gafgyt | nuclei_3[.]10[.]0_windows_amd64[.]zip

resource	yara_rule
static1/unpack001/nuclei.exe	family_gafgyt

resource
unpack001/nuclei.exe

nuclei_3.10.0_windows_amd64.zip

SHA256 c4c16fc832ba46b78e1a062966bb38e1793679dbdd79d5a5422b3b8605a606b3
MD5 b5a48d79b4a76a15e6948c3ad2141fad
SHA1 4d4b625356c1030d791e12332dad7b8da7eaf60b
SHA512 daa86337c390fe7161fbb683077baba8092bbb40217a953f3e31223aa310f470f6fa128b674a8c082b4cc08c64677f58bff2b1509ff685a0147792c0870f18a1
SSDEEP 786432:mhbgXVay71zQ/wrCd7fSOfGAI4OAoHZXUd9hnr0kow79GcesM:Ub0Vac10zd2tAI9tJy9V0fSM
TLSH
T1D49733C1E9C0B1BD2BE69F110AEF1246DAE693426CD58013FE8959D2C4E1F36346D5F8
MD5 SHA1 SHA512 SSDEEP TLSH

LICENSE.md

SHA256 5fa6644d2dd1987a79c06f4af210d2cf8cfc4ee799999029d0f9980c9cf95a2c
MD5 3d2454ee6432ed925694532663f32c57
SHA1 e8be6d192a31325529d5762e0712aa76501a01d0
SHA512 87c9335e9155118735748e5f1fd75c8d0d58bc8b99bc4e9765d0e55f415a3460b841e361a1b83371b7012fb24f09b2bca3898cfc4334fa0840653895e31f2140
TLSH
T17D11861E72514772289A13605678ACC5F22B725E7A6F2A84246DF241233A06CC5FF840
MD5 SHA1 SHA512 TLSH

README.md

SHA256 2aea24f0ab1384fd6f43a96ea05e705780f15060227aa82c6ec0760ed221a6b0
MD5 44abcf9f652959bfba3279f3c38068dc
SHA1 4a19e226d2d64eed0f932fb5507ebaefa0007333
SHA512 a83626389689c229991e4e6553012bf743c2c7c94c1a1ede08c078bec080057fd28a1406960de9f8b2925e68409bd7f06ec5c0f0e1332fc3365ff2b15800c47c
SSDEEP 768:65wAS1f3VBGidAVQlFVXegVWfVhD9A8MXaAm+FuODEG:WdWlB5c2VkVXAFjc65
TLSH
T178431FB38642BA0F4F8181C1DE04B56CA376811DCB4268AEF4BD5479B749FA31AF52CD
MD5 SHA1 SHA512 SSDEEP TLSH

README_CN.md

SHA256 f800413e5699582df9b3b4709f8d3a8c6f946784196ac8d9a55590e66c57c13f
MD5 8a78b038a0a214fa1923eb796146ebf8
SHA1 4b110d0b9c61581c0ddc91e9e1ee0b3ccffeb43e
SHA512 99f553d40224443596f27d9fb38889adfd2cff75437581bb2ea164068ea975ab6f3d944be436a31038bb43a8db610037deda6ada39074572c93a021e8318deea
SSDEEP 768:6k349CJOidAVQlFVXegVWfVhD2U1Y6d2XFuODjO:vOCTc2VkV8maXc6C
TLSH
T1E74321B28642FD0F4F8181C0DE04B47CA362911DCB4668AEF8BD9479B749F621AF56CD
MD5 SHA1 SHA512 SSDEEP TLSH

README_ES.md

SHA256 1d412bbd092eb57f9371ce6e039fb8f032a6a4375806b5153009a338a05180fb
MD5 86fe88b6f72b4e22b99f5b0a91a89ff9
SHA1 24f062bafc93e1bb61af408c1b5bec102346fc56
SHA512 c6b707dff18cedc958908c826b28a08c09bf911f17866c6b523c40422888bd2bba7f922b7b0f5a57b32eb4076a7efd7765defe446ecf59eae8e250b29c24843e
SSDEEP 768:6vswuHoVC2idAVQlFVXegVWfVhDUt1m4gpWFuODk:C3FEJc2VkV2XmOc6k
TLSH
T14F4322B34642AE0F4F8181C0DE04B46CA376411DCB46A8ADF4BD9479B789FA31AF56CD
MD5 SHA1 SHA512 SSDEEP TLSH

README_ID.md

SHA256 d73d1f6cd59736da425d60fd4b31abac4f13d68dd47f0a59c175edf29a78bf49
MD5 367c8bc2b27339de36788990cba7d868
SHA1 baab5be09500f9c7882a90d8b4406a89b558249d
SHA512 4cef925d157e225f51a7948bee375beb59095251d61a537b2868723a6a8e1d5d54e79f5c28594f859b1a772a8e52364bb12ff0ca31165a9b8fb0fefe76c11c5e
SSDEEP 768:6b/d4JVidAVQlFVXegVWfVhDrkL0+abFuODT:rUc2VkVpRc6T
TLSH
T1684320B34642FA0F4F8181C0E944B46CA367811DCB4268AEF8BD5579B749FA31AF52CD
MD5 SHA1 SHA512 SSDEEP TLSH

README_JP.md

SHA256 9353ae03cdea1af4e51c4b69c7bf97fdaa1ee4c857a1b6b962a9d5b751239e7f
MD5 3cf36591de46181e8c8276b637ffb89b
SHA1 52bdaeaa43fb76b8afdf247fd3bdddf3ac131eb5
SHA512 9cf39a5cedb92b9695f1ac528f2b97ccdc122ed1c726ac9c164a9323704092a21fb21445679819510aaba0a9ac24d0654a6a06ff331a74d62af249c7aa45e3e5
SSDEEP 768:6B7YAIidAVQlFVXegVWfVhDhjVaxySZ8otUFuODm6:Kxc2VkV3+yEPUc6n
TLSH
T1415322BA8342B90E4F818180DD04B4ACA326855DCB4278ADF47DD439B748FA75AF52FD
MD5 SHA1 SHA512 SSDEEP TLSH

README_KR.md

SHA256 0388fae84751cbad84742f7fc614e35d1d417b5f3a052cb878b2f8ad1d232934
MD5 8d95216031c78eaa2950518a38d20388
SHA1 4a17b7ef32f330c8595642ee2eda9cd7410f54c1
SHA512 5d6d3835ecb1816e036389abec3affecca2c3ae00b67fa71f138c13f78c5259d0ba11b23e9a4ef87ec07bc24a9d2e85c7336f7dc8e4f695f3ea03553fef7bb8b
SSDEEP 768:6tvmjLkHSAqidAVQlFVXegVWfVhD9R1GDf0YbFuODYpa:6vrNc2VkVvR0sYc6j
TLSH
T13F5322B34643FA0E4F9181C0DD44B56CA362911DCB4268ADF8BD9439B788FA31AF52DD
MD5 SHA1 SHA512 SSDEEP TLSH

README_PT-BR.md

SHA256 7f2ac97104feb8503dbba8e188aedef94119be3ceb5d9a19fb650347f2525521
MD5 45b8ce54be8fd3a9a608dfd6affc3428
SHA1 c0b3456d175206b3f00fbd1d5384dea6d5ebfcc3
SHA512 7dfad4ba38922e086a8a7f02da3e4db4771228bfe230aecccedc172052a29f824959204f315e4a7f5342c1982841de1b380542034d78271b81bf9d9fda861521
SSDEEP 768:6Vgzen4ADk6xXvslhZidAVQlFVXegVWfVhDiAhwdEa+eOeFuODX:am3AD3xXvWhYc2VkVwgwdqec6X
TLSH
T1AF4332B34642EA0F4F8181C0DE04B56CA376911DCB42A8AEF4BD5539B788F631AF56CD
MD5 SHA1 SHA512 SSDEEP TLSH

README_TR.md

SHA256 20aded11d4fad7aa2850c8d6ed25239a6658840aabdf2a27d5e3c9f8090fee7c
MD5 aaacf51caad3792a099a743ba6aa8d77
SHA1 078f15f07c29a71e7ffeec35fb84e399fcbc3d0d
SHA512 82ab559b3e4499bf8a9ad669eebee951bbe59e756e89e815ab482104f9f8b4cbcff1d62861614ae35568360f3da8f06cb8ba06f174398951e5031115d85d0266
SSDEEP 768:6WansE5HidAVQlFVXegVWfVhDq38mtLgC1vMWFuOD1o:Lbc2VkVsMULgChfc6G
TLSH
T15D532FA28642FD0E4F8181C1DD04B47CA367811DDB42A8AEF8BD9439B749F631AF56CD
MD5 SHA1 SHA512 SSDEEP TLSH

nuclei.exe

IMPHASH 70df50797f7a85a271c38135c5679c40
SHA256 2079d913d3d7b8c5e5c77dd93c4cf2bebac3f3bbd8121564bff495c9354e5110
MD5 a417c7aa94436b1e161607ebfb352593
SHA1 f615b606bc3981941240341677a0c08713c73d31
SHA512 4ef4b430bfc5d2625c6173e63d283a82e44783b0b163644f3c61648c41231303f44e389f8655eddebc4a444a1217977330ce4b82fed2a1dba0658097b57fe32d
SSDEEP 786432:y7ArbKiC+bzawk0hO+bKosRGdE452wZmZjKRj7rLdHDBMZSvpR:eArbKiNbzawk0jeosRGdE/KRj7l
TLSH
T15B684867F96590A0C5ADC4368662C9A37B707D4A872023D73ADCBF1D2F36BD056BA340
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detected Gafgyt variant
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

6

Entry point

728416

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

.text

Size

47.5MB

Virtual Size

47.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

75.4MB

Virtual Size

75.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5.9MB

Virtual Size

38.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

1.1MB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

512B

Virtual Size

192B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

1.2MB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.symtab

Size

512B

Virtual Size

4B

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

nuclei_3.10.0_windows_amd64.zip

LICENSE.md

README.md

README_CN.md

README_ES.md

README_ID.md

README_JP.md

README_KR.md

README_PT-BR.md

README_TR.md

nuclei.exe

kernel32

generic

Sharing

General

Malware Config

Extracted

Signatures

File Explorer

nuclei_3.10.0_windows_amd64.zip

LICENSE.md

README.md

README_CN.md

README_ES.md

README_ID.md

README_JP.md

README_KR.md

README_PT-BR.md

README_TR.md

nuclei.exe

kernel32

generic