csbot_51.rar
- SHA256 7351cef8962873af2e0cc0696f69dc664824a5f2dac2e74a5bd575c38dc55b1c
Overview
overview
7Static
static
7csxbot.py
windows10-2004-x64
3csxbot.py
windows11-ltsc_2024-x64
3protector.dll
windows10-2004-x64
7protector.dll
windows11-ltsc_2024-x64
7protector.dll
windows10-2004-x64
7protector.dll
windows11-ltsc_2024-x64
7start_csxbot.bat
windows10-2004-x64
3start_csxbot.bat
windows11-ltsc_2024-x64
3Behavioral task
behavioral1
Sample
csxbot.py
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
csxbot.py
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral3
Sample
protector.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral4
Sample
protector.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral5
Sample
protector.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral6
Sample
protector.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral7
Sample
start_csxbot.bat
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral8
Sample
start_csxbot.bat
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
General
- Target csbot_51.rar
- Size 466KB
- Sample260718-pgssjaew4z
- SHA256 7351cef8962873af2e0cc0696f69dc664824a5f2dac2e74a5bd575c38dc55b1c
- MD5 bf58644e2486c6440fe61beeb5ed0983
- SHA1 c6d1e4228726671a05d268f096bb81fbe7a8d8b5
- SHA512 c6a9ce2e0376f1134fdbf3e8faa36f49c3eb1eea29ba428a4a5ab9b06e2f4fa6aa8d200d14469b44fca53318756891d69fbcb97608bb159526f0234e51ce0f3b
- SSDEEP 12288:gI/Heo0bvDzkvtFeG9X4TbPrRf2KrqBkMbEi:g4Heo0bLz0tQGCTLrdVOBk65
- TLSH T187A423F36557A728D2127FF8D0DFB2D022715D059F7B3EA29D4CAE232CAA2B44067512
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
-
resource yara_rule static1/unpack001/protector.dll themida - Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/protector.asi unpack001/protector.dll
File Explorer
-
csbot_51.rar.rar 466KB
-
_logs/prot_2013_08_05__21_53.log589B
-
cstrike/config.cfg4KB
-
cstrike/userconfig.cfg27B
-
cstrike_russian/config.cfg4KB
-
cstrike_russian/userconfig.cfg27B
-
csxbot.cfg143B
-
csxbot.py7KB
-
hlprotfl.log2B
-
protector.asi.dll 3KB
-
protector.dll.dll 439KB
-
protector.ini4KB
-
serverscs.txt415B
-
servlogdata.txt2B
-
start_csxbot.bat16B
_logs/prot_2013_08_05__21_53.log
- SHA256 c50d9f5b9c31f77a5a8c772e1d629661f4edcd5478185f314efd5e9f92477cd4
- MD5 e75923fd3fd6fcc6c46daf10cc502da0
- SHA1 a540c6715a3be42396943058daa82a880b30d207
- SHA512 05bd2df66d6de9ebf21982ca36284f1c8a7cb8c17c88720eaaee762745d16d049d3145a1c2d5a40a6727104a1abcd11d97d962d9ce1664926c091c4bb727aea5
- TLSH T1DFF0C20631763F230B9C43CA998336FE504721DF8346E44023259699F2789B4F6E27F5
- MD5 SHA1 SHA512 TLSH
cstrike/config.cfg
- SHA256 66c58479fa077c01b95d77be8c5bd704fab84fbc9e862632112ba9e9561f04a5
- MD5 b9188936a305b0ff5f1facb6eb3a3985
- SHA1 fb8e08ad65c147a74d9049ce326761507a4612d6
- SHA512 8c4386ab4a3501b2733be354d5b0c2468e5929fc1a2375a22c835a2ebb6da1699bfea276c5515e247e9f2e2672020cb427737371b18ed72282bd88be3ef56574
- SSDEEP 96:lYjL6TSLc1CtYbOPOB90z6hJs9IUd8696ik8biK:nD1gxH5
- TLSH T121812077FE006C2691C75D53F5A3E1023A8E606A45CBB46BA809C8FC54FE16BDB36C11
- MD5 SHA1 SHA512 SSDEEP TLSH
cstrike/userconfig.cfg
- SHA256 d73ecc4ece3afa53a243002ae5efa37ee98283059857064c5ccc3f0c35a21bd0
- MD5 dcb564591f5708f5f9a5a0825398bd97
- SHA1 bf1b84056317c5ee643480f825fa289a7794fef2
- SHA512 f0d281d2912b8ebc1cc36423862fcac6c42c5e41b8a4735fb6f8432f9179d07aefc3693de3d596bd3d1435e5469d29942a35735a5610d329072d7541ed55e54e
- MD5 SHA1 SHA512
cstrike_russian/config.cfg
- SHA256 66c58479fa077c01b95d77be8c5bd704fab84fbc9e862632112ba9e9561f04a5
- MD5 b9188936a305b0ff5f1facb6eb3a3985
- SHA1 fb8e08ad65c147a74d9049ce326761507a4612d6
- SHA512 8c4386ab4a3501b2733be354d5b0c2468e5929fc1a2375a22c835a2ebb6da1699bfea276c5515e247e9f2e2672020cb427737371b18ed72282bd88be3ef56574
- SSDEEP 96:lYjL6TSLc1CtYbOPOB90z6hJs9IUd8696ik8biK:nD1gxH5
- TLSH T121812077FE006C2691C75D53F5A3E1023A8E606A45CBB46BA809C8FC54FE16BDB36C11
- MD5 SHA1 SHA512 SSDEEP TLSH
cstrike_russian/userconfig.cfg
- SHA256 d73ecc4ece3afa53a243002ae5efa37ee98283059857064c5ccc3f0c35a21bd0
- MD5 dcb564591f5708f5f9a5a0825398bd97
- SHA1 bf1b84056317c5ee643480f825fa289a7794fef2
- SHA512 f0d281d2912b8ebc1cc36423862fcac6c42c5e41b8a4735fb6f8432f9179d07aefc3693de3d596bd3d1435e5469d29942a35735a5610d329072d7541ed55e54e
- MD5 SHA1 SHA512
csxbot.cfg
- SHA256 f90819665a1e6146996fbe93f7024fed224453e48ff8cf77804b8d62bcadce0f
- MD5 497f005714805731b5107dc45ceb8c58
- SHA1 f04451bbf8465a543f060c18d5189c0c9367dae5
- SHA512 92e9a8bb2c7c1711983e79bfe84dfecdae2afc2cc8c57ed4013e20bc0421ab588584065adcd781e9e58cf246eebe0e997a19813e9dcd167089cd4f3cd7d6075b
- TLSH T1A8C02B075484430F022003F5B304F381E77D864E88A08804B4110C1BEAACAAE57ACDC0
- MD5 SHA1 SHA512 TLSH
csxbot.py
- SHA256 62d68a48aa0f0ba080148e8e1f01ae739eba87ce199471214b86c13402cca2ea
- MD5 551023053270afbd02e51e2d0a19e476
- SHA1 6d04b47f18baa5e798d43c1c2dcc8dc76a28e309
- SHA512 319daf8241c09698beed693cd44d17bcf4ab8df1c23fe2910298fdc09bb705e23b40148dc0ffadb45d870885e48179e743a3ada260a504ffe4a3669a925497b4
- SSDEEP 192:6OPYTGsP+uyEiymDgR+D48Bjoca9TjJK15S0KJ+on1N7j4SP8:rPYTP+uxqgR+BBjoca9Tj415sn1N7j4r
- TLSH T16AF1ED129C0E245662721F9FA9035988F20F65D7293B7C20BB4DE174EF74A3EA3747A4
- MD5 SHA1 SHA512 SSDEEP TLSH
hlprotfl.log
- SHA256 7eb70257593da06f682a3ddda54a9d260d4fc514f645237f5ca74b08f8da61a6
- MD5 81051bcc2cf1bedf378224b0a93e2877
- SHA1 ba8ab5a0280b953aa97435ff8946cbcbb2755a27
- SHA512 1b302a2f1e624a5fb5ad94ddc4e5f8bfd74d26fa37512d0e5face303d8c40eee0d0ffa3649f5da43f439914d128166cb6c4774a7caa3b174d7535451eb697b5d
- MD5 SHA1 SHA512
protector.asi
- IMPHASH e170beb522d6355f5d63a4d404e86f3d
- SHA256 a0f7671970f4fbac0e29e142e217c80e13ed4a50f1a4ed20dfd5176d279d3a12
- MD5 561cd87084d643a4791dcfe1e5a13af5
- SHA1 ece309fbd924e31ad36e53a694c7351304bbf8ce
- SHA512 c0cbcdbc56e5e8ce5d6e66f1a904b3113fa4ee7c05bb958321e5f2aa63c8e11f9879c8e8d3d204eccbd3fe0a6d5c000d43617a2eb38e79eb627be0e8720e5696
- TLSH T174519E2B93B08EFBC44D0374EC59B81D73A851258AD28057AE4D143A7952DC85B31E02
- MD5 SHA1 SHA512 TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
4166
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
FormatMessageA
GetLastError
VirtualAlloc
LoadLibraryA
CreateMutexA
user32
MessageBoxA
Name
PROTLOAD
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
512B
Virtual Size
116B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=4, id=170, productName=VS2010 build 30319, version=30319,
count=5, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=11, id=1, productName=Unmarked objects,
count=1, id=175, version=30319,
count=1, id=157, productName=VS2010 build 30319, version=30319,
protector.dll
- SHA256 99305a76ce403b2d50052a349ac6a3c5e43e980786ce3005e1f8ffe4c194d529
- MD5 62625c7fc8bd610b1d848bcdf02830e3
- SHA1 519c0d92864e04b08b5129c2b97f899653697eed
- SHA512 e87ea9f49bb66b7c98d8776eb3f06f0ec99b91de03ed0b059bc2801890006ec1e99e0c8bfadbce95378e2c642b88a564ea97d9ad30e6d605e7e00b8ad5360b2c
- SSDEEP 12288:CGoShVg5QjJnMBf07u/uEyRrXoUvXabONBJrGcX9UTJH:0wgqjJMBf0KX+rXomabOL9Gma
- TLSH T158A4230EB61F8D01DD553FB15A3A37AA12BE6C4D59F0FE3860F0F446B60085E251A8DA
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
290836
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
Size
58KB
Virtual Size
272KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
Themida
Size
376KB
Virtual Size
912KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=20, id=158, productName=VS2010 build 30319, version=30319,
count=118, id=170, productName=VS2010 build 30319, version=30319,
count=41, id=171, productName=VS2010 build 30319, version=30319,
count=5, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=98, id=1, productName=Unmarked objects,
count=6, id=175, version=30319,
count=1, id=157, productName=VS2010 build 30319, version=30319,
protector.ini
- SHA256 57f9d65b6014895dd1d883404ef974cd6b66a9d3708680fe66b8b3a82b72d351
- MD5 61a5795c5ea6c441756feb00658b30e1
- SHA1 03c6f89bc5c7c3616d3f4b82e2ddc95ef4597f34
- SHA512 b07459ae9bf638f436e726cd6486583ed15b6d910ec9cbe794518b98e6094d09d4d565e1eb3c331f4c086f483279f041c08124d539b5d367bb1c475c365c3127
- SSDEEP 96:6LY5mDO5ZILRATgnojKRMtuPozl+GofUWKd:6E5mOZ4eTNKyt3+Lf7Y
- TLSH T13FB15EE1199369390A851369E1CE7601B2D0EF25D93EC6A2F006C6A833757B9FF5F40E
- MD5 SHA1 SHA512 SSDEEP TLSH
serverscs.txt
- SHA256 16f58add33689a7fea5279fb173f90f8e3d104c4125502523d6b203444092f92
- MD5 32fd70ebfa1240a6f904036498042637
- SHA1 af85abaa07342639286f6e2be823bef5223de6d1
- SHA512 48859f4b6b403e7f23a69fca118142a1668a7fb055fa4080fb27a358c3e7df1da3a059bac3a9ac82b55902f371f72e7a0f36319a1c742d54a034e99704daa2b5
- TLSH T109E0ED49307D6B739A9820FE53736CCB50D42B811517F0E57BA01FCCA462541FCC168D
- MD5 SHA1 SHA512 TLSH
servlogdata.txt
- SHA256 7eb70257593da06f682a3ddda54a9d260d4fc514f645237f5ca74b08f8da61a6
- MD5 81051bcc2cf1bedf378224b0a93e2877
- SHA1 ba8ab5a0280b953aa97435ff8946cbcbb2755a27
- SHA512 1b302a2f1e624a5fb5ad94ddc4e5f8bfd74d26fa37512d0e5face303d8c40eee0d0ffa3649f5da43f439914d128166cb6c4774a7caa3b174d7535451eb697b5d
- MD5 SHA1 SHA512
start_csxbot.bat
- SHA256 2c1f0dabe381e82541917513c276e84309824710b3cd2213e548ab9a9804a135
- MD5 8ac9e98237a883631f82fe9e63547056
- SHA1 5c0a46faf4a235207e71a5ce0a92f2f831d0cbd4
- SHA512 806de6be76954d05f34b286773e229f415be4346011adc7846786b61069fd88044ac62f83f87571f137d27204f299f0d0680e2fc7c287a6107bd62f79f27da9f
- MD5 SHA1 SHA512