6617cbf570bd545418a5d25cf5bc3f3823752c5e61230864647e7eb472243e2a
- SHA256 6617cbf570bd545418a5d25cf5bc3f3823752c5e61230864647e7eb472243e2a
Overview
overview
3Static
static
3win64/dnsc...xy.exe
windows10-2004-x64
1win64/dnsc...xy.exe
windows11-ltsc_2024-x64
1win64/serv...ll.bat
windows10-2004-x64
1win64/serv...ll.bat
windows11-ltsc_2024-x64
1win64/serv...rt.bat
windows10-2004-x64
1win64/serv...rt.bat
windows11-ltsc_2024-x64
1win64/serv...ll.bat
windows10-2004-x64
1win64/serv...ll.bat
windows11-ltsc_2024-x64
1Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
win64/dnscrypt-proxy.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
win64/dnscrypt-proxy.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral3
Sample
win64/service-install.bat
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral4
Sample
win64/service-install.bat
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral5
Sample
win64/service-restart.bat
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral6
Sample
win64/service-restart.bat
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral7
Sample
win64/service-uninstall.bat
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral8
Sample
win64/service-uninstall.bat
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
General
- Target 6617cbf570bd545418a5d25cf5bc3f3823752c5e61230864647e7eb472243e2a
- Size 4.5MB
- Sample260714-m8zztabs8l
- SHA256 6617cbf570bd545418a5d25cf5bc3f3823752c5e61230864647e7eb472243e2a
- MD5 7ffc6f7dc96614265b75d8e846eea6c1
- SHA1 c7dadf8413a6799a75bd9b4fd89176464e0076b2
- SHA512 bc26946581cde54a5e18ab597354b6d104e0702b4f18ae2eadd7ff289830ebcb8059a0627ebd3197e73da91a53df0a840a3f51d67d58212dc3de4ab5e85bd943
- SSDEEP 98304:FGOVZxPFzC0jMHRXSA6viug9sQB5jopM/+8NDITEsC:FRZxdRjMx5miug9rB5KM9DVsC
- TLSH T16926336367602E3BE287C7D6C085A01881FFE485AE3CBDC69643A521BF2EEC6357154D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/win64/dnscrypt-proxy.exe
File Explorer
-
6617cbf570bd545418a5d25cf5bc3f3823752c5e61230864647e7eb472243e2a.zip 4.5MB
-
win64/LICENSE787B
-
win64/dnscrypt-proxy.exe.exe 11.5MB
-
win64/example-allowed-ips.txt259B
-
win64/example-allowed-names.txt1KB
-
win64/example-blocked-ips.txt620B
-
win64/example-blocked-names.txt1KB
-
win64/example-captive-portals.txt1KB
-
win64/example-cloaking-rules.txt1KB
-
win64/example-dnscrypt-proxy.toml39KB
-
win64/example-forwarding-rules.txt2KB
-
win64/localhost.pem2KB
-
win64/service-install.bat.bat .vbs 992B
-
win64/service-restart.bat.bat .vbs 1009B
-
win64/service-uninstall.bat.bat .vbs 993B
win64/LICENSE
- SHA256 d0b350342d0373ecbc96207ab0f5b6aa2e07add58daafe401ea74b16f0c26c7a
- MD5 18c2300adaac0dae2fb5c2c33250502e
- SHA1 9c4b2d5655de5de27242a9148bd95ea8ed39d2c2
- SHA512 3c29c794be9d7b037fbec553c638dc9225e92593c6e0bd55f9e9ae516d3f898a3b8a90ec7c8491ab37049bcdfe3d74240c85c4aba27d8a5a3d5582d4b101dbd0
- TLSH T1CE01758FF2E667C015A09F653DA1F88E30DDF037BE43AA1034A5E188CBA705FD86A400
- MD5 SHA1 SHA512 TLSH
win64/dnscrypt-proxy.exe
- IMPHASH ed8b780a3ce7ca4aba78a21f6bc3d4e0
- SHA256 6f9561bda6d7bc9ed36dd3fa9e0a6f01e5b4c7c9d8a890e10578dd64d95dddaf
- MD5 d6161628df1f4ac04ccf0dba52cab4ee
- SHA1 24cf7065f61cd7ebcbe5417f2719a1a83a9a7490
- SHA512 e9bd3baa38a7bc74e35ae7203f71af07b962f691de4fb1200cc07882086f4c0e42eded1f252107ac3925eb0fdc0f471fcb3f3cbe3cfec589451d24cc24d5e016
- SSDEEP 49152:CxG8Jt8ZlkyOn8BMm/A7zKCZnhB9D0XHNDHC8WEqiTqNlaOJkLD114Ry2RMfN8RL:CxxD8XUdpkLDURRG8RVhTAGPB9xmE
- TLSH T1FCC65A03ECA504E9C5ADD631C963A122BB71BC491B2123D72B60F6247F37BE46EB9750
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
6
Entry point
559648
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
kernel32
GetProcAddress
LoadLibraryExW
WriteFile
WriteConsoleW
WerSetFlags
WerGetFlags
WaitForMultipleObjects
WaitForSingleObject
VirtualQuery
VirtualFree
VirtualAlloc
TlsAlloc
SwitchToThread
SuspendThread
SetWaitableTimer
SetProcessPriorityBoost
SetEvent
SetErrorMode
SetConsoleCtrlHandler
RtlVirtualUnwind
RtlLookupFunctionEntry
ResumeThread
RaiseFailFastException
QueryPerformanceCounter
PostQueuedCompletionStatus
LoadLibraryExW
SetThreadContext
GetThreadContext
GetSystemInfo
GetSystemDirectoryA
GetStdHandle
GetQueuedCompletionStatusEx
GetProcessAffinityMask
GetProcAddress
GetErrorMode
GetEnvironmentStringsW
GetCurrentThreadId
GetConsoleMode
FreeEnvironmentStringsW
ExitProcess
DuplicateHandle
CreateWaitableTimerExW
CreateThread
CreateIoCompletionPort
CreateEventA
CloseHandle
AddVectoredExceptionHandler
AddVectoredContinueHandler
Name
.text
Size
5.2MB
Virtual Size
5.2MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
5.6MB
Virtual Size
5.6MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
457KB
Virtual Size
32.8MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
125KB
Virtual Size
124KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.xdata
Size
512B
Virtual Size
180B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
113KB
Virtual Size
112KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.symtab
Size
512B
Virtual Size
4B
Characteristics
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
win64/example-allowed-ips.txt
- SHA256 2b6af5d8620f70d4ed5b7e4395f9a75070689c9b5158084f2922932658c273e6
- MD5 a80f1d203b4920337527d044a50e99e0
- SHA1 e170114e98a532ec8e7192d3ddd4d283332101fb
- SHA512 bc9dcc9bc40434794032c115342fd0ba66f68df50d34876b879ad57d96c1b7f821d9ddf2e63b811fbdbd33434f7040b5fa208034cf56f93b148abe40f2f81e45
- TLSH T142D0C055AB5131AE0374B1CC01082770897F60441DE3A09CB31CC2C31F1BF40E21CA03
- MD5 SHA1 SHA512 TLSH
win64/example-allowed-names.txt
- SHA256 ae29b66fae991f2e29112806ae137281fe79595574a08d13018d879e73a3c2d7
- MD5 45f6a9c4329d7b0dd88e7487420c0458
- SHA1 0d0d8decfad151e120e28a3aa8f31bb630143eb2
- SHA512 bc74bc7d66f72898f621c274888912e325379e4ebf716ddc6f064cb17c4d7f221bb9d6e2663efd22bebbf71baccb728d256fd6f35371951eb9898fc52a35935b
- TLSH T14C218C6A0795115903B011A7010D70FDFD6985B99FE3CED0B48E539A6B44F6371F06E9
- MD5 SHA1 SHA512 TLSH
win64/example-blocked-ips.txt
- SHA256 448ebd9a2c3787eb76f559a52b558b96f65f4d118d4c405e820fa74b80fa5cdc
- MD5 99d9d7a56475074300575eba0133c217
- SHA1 3fc110bbc93cb0e4002425bbca6a51b091085e84
- SHA512 60ce198c618caeeba60ea8104e3f2d2da689c7fdb8dc3bd6ba9ddfb999a5ab2d18edc95da89b8730692280d3eaf5f0d66ae1a7417f067db28e5d01f3ffe810fe
- TLSH T137F02BD21A2540F60BA515E7880A37B1DB4AD25DBDF79DDDF15CC1C36744F218015523
- MD5 SHA1 SHA512 TLSH
win64/example-blocked-names.txt
- SHA256 7e114be9f7f5fa0ee686d82738236d24eb1eb0b6091ea48fd52bc71ff1fb086f
- MD5 b42111ae1a4d146e6dd81cfc24234430
- SHA1 575bed0a88efe2965454eed1de54dc6285636afa
- SHA512 4e03081c95d374dea8268bafa87f0300e9e47e672aed0860335c062add494d6d302feecbf5ab9ede86105b6ad289df84feaa90da4eb523dffa92e4aba514c65d
- TLSH T1AA218B2A0F99215917F111E7848A31E8FC6992785DE3DE84748FC3069B08F6771E0BFA
- MD5 SHA1 SHA512 TLSH
win64/example-captive-portals.txt
- SHA256 e1ffe7e4543d7480fefc24043f886ad0f1cb14f450ab981ba1c296be5e1c428d
- MD5 d148c79d9c6a219be2363c927eda7641
- SHA1 5311fc4cb21947ad181bbd88eb9b044c8600f5de
- SHA512 b4bb8d8a3693c26d44e509d4eed622a73f53617dbc4d5d544503578fcb238f97c09177efcbbeb2f05287ab4c21a705fa231ea6a6fb902dc392f018253a3b8277
- TLSH T12831C021978607F9E759032E029420B4B36652B54F17C6C9FBDE629CE31035C77B19D3
- MD5 SHA1 SHA512 TLSH
win64/example-cloaking-rules.txt
- SHA256 eaa0845ad8c5f7eb0b09bf422645753fd986d5394c64516e21c711ab83ff3f66
- MD5 a510a3779852490f949bbb6378edbaad
- SHA1 c81586feb9089b011310366dc818dc3e17ad5eaa
- SHA512 a88cae3b6a54da2fa0de7d2f156e3e9c8a1ffb487f2e07de175a677c1e99d68d2830d3406a4028b97a35edb403ed6f3af2b235862d0289c7d356ed08b248400c
- TLSH T1F8310F172916A2AF03F8E6A52118256C7909E12C8EDBCDB0B4CCC10AF368F1776F5C99
- MD5 SHA1 SHA512 TLSH
win64/example-dnscrypt-proxy.toml
- SHA256 5f14ee3b430d622156111b51608c727651d54b14399a92a9f16fd5378cf61e1f
- MD5 0fae8538d3927b4e82df2b30c05d13dd
- SHA1 517a57bfaaca890d5cdee6a1bdf54c676742bc33
- SHA512 ededa4a73b6c260e7d7d44d46638a3f0cec7d4d6ccba215113a1fb6d3b9a3bb5144e71d564c51df88f12e65adcbf7d00d17cc64484aef1f7bb3e413d31d8702d
- SSDEEP 768:OxNwRoyyh77ECq8SEgUzm46SsPlsNaJLKYf:Ah7Vq9nUz3aJLKYf
- TLSH T18203F8068787326B07A20243565EA5F8F728C1DD6E771660719CC24C3392FB9D37A9AF
- MD5 SHA1 SHA512 SSDEEP TLSH
win64/example-forwarding-rules.txt
- SHA256 cd7076074ba90f22ec3268572fc543cbf258cf4cacc5997f3aeea9c2b7029cba
- MD5 26511c898f7a694858ddf2e38e1aae98
- SHA1 12447c0c739dab97531c863bbe0c15c1c0666d68
- SHA512 509fe3993bfa9e4484b4eb0d99c330e1cf40264d323bab2840c93d00ab4ab67b728e51b322eedf5872764dac114903b16527f7b971f1e9b83cac003861b085af
- TLSH T1BE417411574626191B65A583EA0CE0F6F72720EE0E5B4041B2AF4603730F7A4FBE79EC
- MD5 SHA1 SHA512 TLSH
win64/localhost.pem
- SHA256 28eb1ca4726f5a1699e9c0f9730c1f59c9b7ac105ca1da3a0070b9b483f7c62e
- MD5 3063f1bbd28c25692e094cfd2fa9fb23
- SHA1 1800d48be7ff06fe3cfd33178aaa87e9d52a3961
- SHA512 0d633bcaea7fa05960c2a1489513133ce02f3be544981eb4ed6310a3ab23aea9ff7324eb80c210c55c1f46b81150ea983ab5e63fdeb34d78f8313221e27c9155
- TLSH T16E515C118FD23CE1229BD15AEE2E2261D47F6AB0AB315D107B0B58E9870F645B37D548
- MD5 SHA1 SHA512 TLSH
win64/service-install.bat
- SHA256 04c1ac6ed9eea7c56c82bb78013f5f5d8ed1dd84c8b9cab8234fca552402662a
- MD5 ab87d533c77929b32f332fb797d0a1c2
- SHA1 c28e6ef1a1bf2aab4216a277e7dfb87e44021a11
- SHA512 22521a504f1a7248367911faf27a08ace2250ac8b6044c34b95e686670bc841cdee45433fc0e1652d4590a69d94d9a69e522595455b79f8156dda0c74283c3f4
- TLSH T187116148FCD5E791827A91C21CBAC19AB2ADC1163A84EED0B579C56013002DC3FB4CAD
- MD5 SHA1 SHA512 TLSH
win64/service-restart.bat
- SHA256 ce3eb0df48ab86c88d26fc0cb9f953fdef7b3ecd8be07faf402e6635a4ffb6d6
- MD5 48d5d506079190f17336d7965b7f8f64
- SHA1 abfbae588044a7ed5fb86f0fead5a22016a6156c
- SHA512 e3ca33d3d59341fdfdbdfb0756ad6d9cf191df1b422e006d2fc86590d116408a2c57053c9d0632f2ed0cf41a70c33aff5f7a32944b1905c1ecc7516df09c16cc
- TLSH T1D9117E45FCC9E796827A95C20CBAD19AB2ADC1023684EED0B174C6602200ADC3FB0CAC
- MD5 SHA1 SHA512 TLSH
win64/service-uninstall.bat
- SHA256 85da9d303859dafd6a3cac3fee506df24020361b75ab235279a0f4dc91aa2fb5
- MD5 a33a3b2d780b0e1b418a0151fb7defe6
- SHA1 26112ef19b25c2e4a10222ca67f89e5803abf72b
- SHA512 330f98a9f736649d41c8507633f42c01f6920ddde1b6becbeb89a772d6fc75565e1c8804521d9fc669eb609fc8149f09c9e8e756c79f572db894ad3663cfad99
- TLSH T123116149FCD5E3A5827A95C21CBAD19AB2ADC1153684EFD0B579C66013002DC3FB4CAC
- MD5 SHA1 SHA512 TLSH