Private Bypass.zip
- SHA256 c2161cbfe24c6f4f60b77ce48d39f5e776fc4610302e620c73302fd4aef80eb8
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Private Bypass/Private Bypass.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
16 signatures
150 seconds
Behavioral task
behavioral2
Sample
Private Bypass/Private Bypass.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
Behavioral task
behavioral3
Sample
Private Bypass/yonetici calistir sonra loaderi aç.bat
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral4
Sample
Private Bypass/yonetici calistir sonra loaderi aç.bat
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
General
- Target Private Bypass.zip
- Size 24.1MB
- Sample260718-2jnmtahs6t
- SHA256 c2161cbfe24c6f4f60b77ce48d39f5e776fc4610302e620c73302fd4aef80eb8
- MD5 0696f625b5e9115dd443a3f6c2ba195c
- SHA1 dcc1b093cd593d862a1f1628644a36446c31cd79
- SHA512 0e046f051a4f780882c3a09b88ef0ee7b18c63b47e68873c3f6687a4fb3f66941f5713a80c5af693807be598a8e082e82af90617284ca7b2cdd0390c52c0487d
- SSDEEP 393216:2yiW23J+KX61cPTSZ8DRRztQRW0G7EtdvHtEEov0zbYVV976T6rmRmNn+v:Nn2VOZa3z0pN2vp9ZhNS
- TLSH T15B47331F802395A56E50DE3A0726C7C126F9FB443720E21CE7E0E8FDEC8E5EC9996855
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Private Bypass/Private Bypass.exe
File Explorer
-
Private Bypass.zip.zip 24.1MB
-
Private Bypass/How To Use.txt1KB
-
Private Bypass/Kılavuz.txt455B
-
Private Bypass/Private Bypass.exe.exe 24.2MB
-
Private Bypass/steps.txt810B
-
Private Bypass/yonetici calistir sonra loaderi aç.bat636B
Private Bypass/How To Use.txt
- SHA256 97ab190c674175f90ced9b5675522328bb2dee0beec8bd4425993f718e4f5e9c
- MD5 28392848cf9cd31fe09d2f2365030760
- SHA1 3805cc0211312db18369b74bed0261689cddf603
- SHA512 62fd3541c00998a8d0d7f0d9516fffb2cdc0c9d2c9cc12138919a261d18815e6f00e3c664f5ac43a9ffd5ca35dca7eae7ecfd0412414f0839ef2ba339ce6239d
- TLSH T1C22141A5BA0757750132102A322D7BD9FB235079661BFC21707C02B812BC526867CEDA
- MD5 SHA1 SHA512 TLSH
Private Bypass/Kılavuz.txt
- SHA256 8f2457cef073de3c09bc4be2cd6ac812db7b07a7c5840db04464128541cc6ef0
- MD5 48017cd8d9bdaddbea9a8ca359eec56e
- SHA1 248f2349ad1a6fb42ff90bc8f59ddcccb3e72af3
- SHA512 36f8ebd33d150d99bb5b30d3feb7c462d67181b3c7143f6290c8522a8c9995288aadbac42a1c4e280df0cfa37e612acd7710c2cd5a4bac82916df61493f1eb0a
- TLSH T14DF027246B9882200E6B678FE1AEE576135B8A173910F8533C270559A868F1692F4869
- MD5 SHA1 SHA512 TLSH
Private Bypass/Private Bypass.exe
- IMPHASH 9e0884702594ebf6896e707f1852362e
- SHA256 c70516aca90144907e8ddc7bdd7fc79d3f1e65024d74313ee4609b96fd479903
- MD5 4cdac4b5686a496de61f0f84f78461cd
- SHA1 daad7682e14c4687bd578b098fa91bf3d377b1d8
- SHA512 63bccca8cc7c1f3036645bd7e0c62c305fdd5bf7a182e275276aa7d8c33cca34fb540d90cec0e4667515e9fa47dafe6d7bdc8be7deffb8d283cb6b8fcbbf981b
- SSDEEP 393216:HeiYbNTRks3wNEDIGhSa7Yhhbd6rwvguGlc2n3dwrtFqyG7LFuklE5m5uk:+/bvjhSaYzbOgkoFaFap
- TLSH T15B47331AA01295E4EE51DD3A0712C7B5A2B5BE102710D29FA7E0FCBBFE3F5E44D25920
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
52736
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
shell32
SHFileOperationW
SHGetFolderPathW
CommandLineToArgvW
kernel32
FlsGetValue
WriteConsoleW
HeapReAlloc
CreateDirectoryW
SizeofResource
SetConsoleCtrlHandler
AddDllDirectory
GetCommandLineW
GetStdHandle
WriteFile
GetShortPathNameW
TerminateProcess
GetModuleFileNameW
SetEnvironmentVariableW
K32GetModuleFileNameExW
GetEnvironmentVariableW
GetTempPathW
FindResourceA
WaitForSingleObject
CreateFileW
GetFileAttributesW
GetModuleHandleA
OpenProcess
Sleep
GetLastError
LockResource
CloseHandle
LoadResource
GetProcAddress
GetCurrentProcessId
CreateProcessW
WideCharToMultiByte
GetSystemTimeAsFileTime
FormatMessageA
SetDllDirectoryW
LoadLibraryExW
GetExitCodeProcess
QueryPerformanceCounter
GetCurrentThreadId
InitializeSListHead
SetUnhandledExceptionFilter
GetStartupInfoW
GetModuleHandleW
HeapSize
RtlUnwindEx
SetLastError
FlsAlloc
FlsSetValue
FlsFree
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
RtlLookupFunctionEntry
EncodePointer
RaiseException
RtlPcToFileHeader
GetCurrentProcess
ExitProcess
FreeLibrary
GetModuleHandleExW
IsProcessorFeaturePresent
GetCommandLineA
RtlCaptureContext
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
HeapAlloc
MultiByteToWideChar
HeapFree
VirtualProtect
CompareStringW
LCMapStringW
GetFileType
GetStringTypeW
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetStdHandle
GetProcessHeap
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
GetFileSizeEx
SetFilePointerEx
Name
.text
Size
143KB
Virtual Size
142KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
60KB
Virtual Size
59KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
161KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
24.0MB
Virtual Size
24.0MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=147, id=261, version=33145,
count=12, id=260, version=33145,
count=6, id=259, version=33145,
count=2, id=253, version=35721,
count=9, id=259, version=35721,
count=16, id=260, version=35721,
count=39, id=261, version=35721,
count=5, id=257, version=33145,
count=118, id=1, productName=Unmarked objects,
count=1, id=264, version=36248,
count=1, id=258, version=36248,
Private Bypass/steps.txt
- SHA256 7dc59199612e5417f62f17eff329ab036f9d68dedea137d1b97e6f4f558a5ea1
- MD5 55603516d9769fa7bab7b467a94d6c8f
- SHA1 688b15cfc65d54b042cbcdde092b601be5dbd25f
- SHA512 0eca2d249a9ca8c29d4c10d052d3586ccb56e5ef7f9c8d6c562307c98647d96c8aa5fa3050f158ed9bcc2b09be0c0251c68f3b572a68498c80b10f3d7141c575
- TLSH T17D01F1B3A2E7233917134150501E46D12F925069C2A6E450346A14F8839BEB3A8BE7FE
- MD5 SHA1 SHA512 TLSH
Private Bypass/yonetici calistir sonra loaderi aç.bat
- SHA256 17e98d92ccfdb23c3e14aa1e5aa55e8ffd71e31a395ac8f3c122c7436303bab5
- MD5 6de192f8e7f86649535e833623974a6b
- SHA1 4e2cdb3c243fe656884fe199e21e9e45c4ec567a
- SHA512 35e50867a9628d84cf43ed2ea79ecec38734dc1eac3011a13ac442fb998e31d31a965864bf6edee0d5bf9854725a312880582f39296737b303df9456c3ba69cc
- TLSH T198F0810A84EC85CF38D2FB3437D3A722471E75ADB963A2E91F91901D008828326ED48F
- MD5 SHA1 SHA512 TLSH