Dgen.rar
- SHA256 61b40930ef591a4db4b3578b8c632e793d20a2f5fea812d70c6f260c40789330
Behavioral task
behavioral1
Sample
DGen_121_Rus.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
DGen_121_Rus.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral3
Sample
dgen.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral4
Sample
dgen.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
General
- Target Dgen.rar
- Size 282KB
- Sample260720-gy4blabs5v
- SHA256 61b40930ef591a4db4b3578b8c632e793d20a2f5fea812d70c6f260c40789330
- MD5 5286d49154339da64669c9d2ff62e624
- SHA1 d284138ae5517721c7821d325d64d78312484faa
- SHA512 0c4f1936f84ad0509ee9967122bfc772b6ce6f024d084649065e77e7430e3af312cb37df47984f3f6dfe364b9e51e12c9612a585fdfaae9a38b66108ce85cfd6
- SSDEEP 6144:lbSZpuAjSP95qyTlSI997LagA+Z43qlTmUCt60hZ+xMUmHuYDJ:lspuPqs7nTmUCt6IZ+xmHuYDJ
- TLSH T1DB542306126236E45CF23B2FA6BE7589849B2D7F54F561A4490FBF41309C63EB38CB15
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
-
resource yara_rule static1/unpack002/DGen_121_Rus.exe upx - Unsigned PE 3 IoCs
Checks for missing Authenticode signature.
resource unpack002/DGen_121_Rus.exe unpack003/out.upx unpack004/dgen.exe
File Explorer
-
Dgen.rar.rar 282KB
-
Dgen/DGen_121_Rus.zip.zip 32KB
-
DGen_121_Rus.exe.exe 47KB
-
out.upx.exe 41KB
-
Dgen/Dgen.zip.zip 250KB
-
dgen.exe.exe 1.0MB
-
dgen.txt7KB
Dgen/DGen_121_Rus.zip
- SHA256 22871d6ce6784c93ccc43f622ebfa28281bc01d7429b1d9c44a83f51b750c4b2
- MD5 17818e5f9cf382456ded616e213e8a8b
- SHA1 d229d5362008ea35a58cdaed1b379e99a0d85700
- SHA512 aed7438bff1431a993e6513480753bca3b4beeeec389d956469721065f14baeb2050490c2a345d9ad24dcb0e5b918067e11ef130511aa72b50b4f9a73fe667f0
- SSDEEP 768:ZVuBx9aGnmPWC0p89JfBZAWtFX/CbwPz6MjSStfZ8erKZuBkclz9S4s7D:+xRmeC0p89JfDAM9/Cg6HSz8e2ZhSo46
- TLSH T10CE2F15AFA9155503C8673A54788E505F0A8FE707EEECA4D303B2AA4476E1FB3750832
- MD5 SHA1 SHA512 SSDEEP TLSH
DGen_121_Rus.exe
- SHA256 0f4a2938afed62aec40ac5a3262687f88688888d2858613cd0dd81982d5d6602
- MD5 9a83e9c0361d85d69668a9a2c0fef97e
- SHA1 98c62856a58c2d9d5e2830a1e254c1885d0c8c00
- SHA512 d00467ff49100f5390948483a243f7d3c5aeba2ff83f2f8293bd6e3c7ca60bd930c01b27a8dbd75c926cce6db08d5e7dcb679b279e19f07f98b9bba5d7849649
- SSDEEP 768:EHRTA6pY4BuSrmVaDs8naXsq8JG5MWtQ6aUlBjf5LRNtL9xKRB+vZFT:EhxPrmVCsmagGOeQ6aUlBD5dL9/t
- TLSH T1D7238DA366D4F7E4C1A272F521BD14EA35BF2C550B600EC78A4BFDBD9E7A32420D0948
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
141136
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
UPX0
Size
Virtual Size
112KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
22KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=136, id=19, version=8078,
count=1, id=64, productName=VS2002 (.NET) build 9466, version=9466,
count=1, id=69, productName=VS2002 (.NET) build 9466, version=9466,
out.upx
- SHA256 b912a2822e2ddcbff5b90f6a2150f03013527d2d4aede6a16df9eaa25cdede6d
- MD5 08b67fa33c7f044ba04aaa2094da33db
- SHA1 2c5d0e11dd9fa0d4ef6a5e23f47fcdc6efee50ba
- SHA512 6d0813e4cd8c83a2477809283d0fae211d9f521a8eced764fca06894b13baf3683e830f33cc83c569f64f144826b10cfce57f961913d8988060134822a8b3a3a
- SSDEEP 768:efM0DxpQLnY0Lr2HafMOvznIZSiSEHCDwBLpZTPCUvQ:T0DxpQLnf2HaTrShe8t9zQ
- TLSH T108136C83A492D0F1C261A7F26F1C3661FFBD2979A6A4EB105F683C496D76403BB0741E
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
11227
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
.text
Size
17KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
86KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
16KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=136, id=19, version=8078,
count=1, id=64, productName=VS2002 (.NET) build 9466, version=9466,
count=1, id=69, productName=VS2002 (.NET) build 9466, version=9466,
Dgen/Dgen.zip
- SHA256 51ad059b9a770643e2c752bfed9774027bad10c4d89573d2aaeac412d5fb7b3e
- MD5 405685765393cd73edbf0c0e2dd956db
- SHA1 bca9fb64809e87d9812452d72520f1036225abf6
- SHA512 4527dd615661fd291f57932fc8d42bb55670fb3a25ddc8143f9022c84ea608e824c61a2f60ef1a53917eb1eb71d2174738f7192e84ff0ce9824437f507624fb6
- SSDEEP 6144:4b33xxe/brAz3TbYWoSvZ+amRG3FgLsuV0CFSrAB/5k3:aiA/bY1SR+fRAwpV08SrArC
- TLSH T162442370B6436F7FA62DCFF0CF5E26904CA4FE2169AFED4E45B919034813962186B258
- MD5 SHA1 SHA512 SSDEEP TLSH
dgen.exe
- SHA256 e660b65a581008f16f19b0822e16292457fe9be42a186fb150e4d613c04259f1
- MD5 16f0a1438635cd80ed3d650aa51b7fd5
- SHA1 037a9bc1acc787a5bee0b3792638daf122f7e15a
- SHA512 daff39d423734731c410681d7ba99a5f990cacb6bc9017b7d87cbe6fab30d22c5980804b7947fc0a9b1a111a0f1a7cb970a1dfb527436d364d311f536b78873d
- SSDEEP 24576:MiEe8L37TPPi3fxMCIn0Es3Wu2pEWmuhj4dgVXduP3xh:Mhj46V+
- TLSH T1D735FA8836D3ECFFC32556BB38C7793CE6F999629815A0A11FFECA7B1C55419221A00D
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
922065
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
.text
Size
932KB
Virtual Size
930KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
8KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
80KB
Virtual Size
724KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
12KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=12, version=7291,
count=23, id=14, version=7299,
count=91, id=1, productName=Unmarked objects,
count=17, id=19, version=8034,
count=105, id=10, productName=VS98 (6.0) build 8168, version=8168,
count=25, productName=Unmarked objects (old),
count=24, id=11, productName=VS98 (6.0) build 8168, version=8168,
count=1, id=6, productName=VS98 (6.0) cvtres build 1720, version=1720,
dgen.txt
- SHA256 2c259d78eb97ac724b2f00ece6bc8bf420bf0b6cd90e025d03b597eafeb81bfc
- MD5 126f7d3f821eda5099bc9b1f96664483
- SHA1 29ab26c44459031f66d8505c7797fdad43c4efe5
- SHA512 387506fe93877672876b485596a35d44c40a0d7194580bade0f2bc0b9a8d81c2b45a568d12f970fb4cec00a2528423bed3edebbc47a73b4ba6b333a64cb36591
- SSDEEP 96:oFV3Ob4xBULpYpeMQiFPEojMuhxXfkrWXcmHWxoOi1C3xkn9hOB55WIcskIsHqCI:oFNQ4xBOpRCMuhxPqxoOgOzjGh9rnVG
- TLSH T1F2F1E8A7AC55BA3B0531D116670E2AC6E718513617E3E62D305DF20C2728BA1C77EE9C
- MD5 SHA1 SHA512 SSDEEP TLSH