7tsp_gui_2019_edition_by_devillnside_ddb5026.zip
- SHA256 009cbb93af1005326314a62a623cf2b9b88255c758953a6b8ac055453de01a1c
Behavioral task
behavioral1
Sample
7tsp GUI v0.6(2019).exe
Resource
win10v2004-20260513-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
7tsp GUI v0.6(2019).exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target 7tsp_gui_2019_edition_by_devillnside_ddb5026.zip
- Size 3.9MB
- Sample260718-smm11set4j
- SHA256 009cbb93af1005326314a62a623cf2b9b88255c758953a6b8ac055453de01a1c
- MD5 03ec95aa8b6b9b0c93267d50530e4d73
- SHA1 1873bcad50774b6d1c2663c0aae61224f4774210
- SHA512 41a89845280027ce40334ab3a92b59d067ebdda71db5830ac3b0ad0b0511e5c76af3e694dbc2eb5fd98a452898f0dd58d91f85f29a388513539824dea8da9576
- SSDEEP 98304:DKeDBgMNTwmVKhf79kBoHKVa8emhb8C3W8T4aBFvP7Y5IkH:DKurwJxncFz3BX7Y5v
- TLSH T101163306F051C05AE9752378D06AF332872F7D5A3E164142A6FABE3F7C7629E9A45303
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule static1/unpack002/out.upx autoit_exe -
resource yara_rule static1/unpack001/7tsp GUI v0.6(2019).ee upx - Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/7tsp GUI v0.6(2019).ee unpack002/out.upx
File Explorer
-
7tsp_gui_2019_edition_by_devillnside_ddb5026.zip.zip 3.9MB
-
7tsp GUI v0.6(2019).ee.exe 3.9MB
-
out.upx.exe 746KB
-
How To.txt804B
-
Renam .ee to .exe.txt97B
7tsp GUI v0.6(2019).ee
- SHA256 090c9e214599150f6ed241171bb2107e04d13bfa5e74927b094b139eae280b65
- MD5 0fc4b5592e3b58f1fc87d5ef81de981a
- SHA1 f9408f54be6540ccaf7ce0b9dbb80b81afd83ca8
- SHA512 648228bc4c599804a573ca7b108727bfd2504c221325d2b3d92d0655663bde863ad9720facc9a54ae7ca99f4d0f65967e7aa445c63b6567a399e081118dcfa13
- SSDEEP 98304:+KeDBgMNTwmVKhf79kBoHKVa8emhb8C3W8T4aBFvP7Y5Iks:+KurwJxncFz3BX7Y5k
- TLSH T1FF163306B051C05AE9752378D06AF332872F7D5A3E164143A6FABE3F7C7629E9A45303
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
875456
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
UPX0
Size
Virtual Size
588KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
263KB
Virtual Size
264KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
145KB
Virtual Size
148KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=2, id=150, version=20413,
count=30, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=178, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=57, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=10, id=109, productName=VS2005 build 50727, version=50727,
count=33, id=123, productName=VS2005 build 50727, version=50727,
count=525, id=1, productName=Unmarked objects,
count=70, id=143, version=30729,
count=2, id=149, productName=VS2008 build 21022, version=21022,
count=1, id=148, productName=VS2008 build 21022, version=21022,
count=1, id=151,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
out.upx
- SHA256 88328d964eaff86faf1149bbe38a1b749270016bdbbacb8d9ad38de59262dff9
- MD5 7d798c699c708eed93886cfc5c786629
- SHA1 447c76b6fff55a6a2e05402f629e8b1804ef6100
- SHA512 b0ca4c16b7e6ab174cd27626e3decf21ceb773ec96b32eeb8e701694202cf9a4b341876a202807fb3d29301c75d7e4fb16305fe33eb3fbf5f917805c65aa552c
- SSDEEP 12288:5Lkcoxg7v3qnC11ErwIhh0F4qwUgUnyTIjL:9fmMv6Ckr7MnyMjL
- TLSH T104F49E12B7C6C0B6DAA239B4197BE33ADB347E194727C587A7E03D77BE212005936361
- MD5 SHA1 SHA512 SSDEEP TLSH
-
AutoIT Executable
AutoIT scripts compiled to PE executables.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
90896
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
.text
Size
512KB
Virtual Size
512KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
54KB
Virtual Size
54KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
26KB
Virtual Size
105KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
152KB
Virtual Size
152KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=150, version=20413,
count=30, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=178, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=57, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=10, id=109, productName=VS2005 build 50727, version=50727,
count=33, id=123, productName=VS2005 build 50727, version=50727,
count=525, id=1, productName=Unmarked objects,
count=70, id=143, version=30729,
count=2, id=149, productName=VS2008 build 21022, version=21022,
count=1, id=148, productName=VS2008 build 21022, version=21022,
count=1, id=151,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
How To.txt
- SHA256 4ff7d8c3ee68bb32f49271eaa996cd599fda1825102df02fe7c1910d147600e6
- MD5 29578b16791787b0b8e971d42b096071
- SHA1 3bcae894e27fae741a3b1f4063293fa9e0c1d581
- SHA512 7090693d44265b399634534a98696d9ea339d123efe473595edc3b3ac59639c64fb3ec46d1d37039f2be6f6e8904dd10e751895b1b32a8375c32df7857f57c49
- TLSH T10A01F194E21657326B710267612F39C7CF5E517D679B012C649B000D0FA7F528B7B6C7
- MD5 SHA1 SHA512 TLSH
Renam .ee to .exe.txt
- SHA256 01d3e9ebc0160f8e3b71727f57a1d87aa941bbda7c713b9fa82858f0a574c1fd
- MD5 c6a976ca9bfd9e50e972284c5e40370a
- SHA1 bfed1144692f9db584b47e2ea27ae40bd08790d8
- SHA512 5155032c8bd70f0f4089fb654930a2f2e58a6741bffe1943096320915d317144ddc81993e546acdc445542f8bbea596e6972d337a8fd7467047fb56faff822d9
- TLSH T1B1B01254C7713D5810000A0741AE0010E333D0D484CA001D6DF411AC008B4580E0E750
- MD5 SHA1 SHA512 TLSH