KlothoFLEX is Discord Kopyalama.rar
- SHA256 7bc9e0861727d0b588052727bab6c6e5b8f361bae2e32f1256b2a3eceb3e8b80
Static task
static1
Behavioral task
behavioral1
Sample
KlothoFLEX is Discord Kopyalama.rar
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
26 signatures
150 seconds
General
- Target KlothoFLEX is Discord Kopyalama.rar
- Size 27.1MB
- Sample260720-wvtejsay6m
- SHA256 7bc9e0861727d0b588052727bab6c6e5b8f361bae2e32f1256b2a3eceb3e8b80
- MD5 3ebb0a2a66a75420342b77146d8600f2
- SHA1 6df17c7e958870ce9e2523326b16447ce8b0577e
- SHA512 a6c7273cfd40abcb773b73d4f24edf9814b7cb605ba6a448aa95e4982eec68db67033988e4b9f19157e1e667c3de8aecb31b25daa22f80fcb72e2c0d99af80bb
- SSDEEP 786432:2UgB8KfGARXeyP38lPgDVoV9VLsqJMr2jXNYOJZcd:2KKVRXeY38iDM7ArOY
- TLSH T1F65733414D1E23FB7C22BD06E9B8B041978B84CA95D6EEC23E76E7C3B569B0314F1685
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
File Explorer
-
KlothoFLEX is Discord Kopyalama.rar.rar 27.1MB
-
KlothoFLEX is Discord Kopyalama/Beni Oku!.txt1KB
-
KlothoFLEX is Discord Kopyalama/PythonInstaller.exe.exe 27.3MB
-
KlothoFLEX is Discord Kopyalama/__pycache__/serverclone.cpython-310.pyc6KB
-
KlothoFLEX is Discord Kopyalama/main.py3KB
-
KlothoFLEX is Discord Kopyalama/serverclone.py9KB
KlothoFLEX is Discord Kopyalama/Beni Oku!.txt
- SHA256 df2423db3b055f5c19820425c62f6e315068652f30ff56b2bd5534b880bf9fd2
- MD5 cf6b03ce80885628a3834a8a564e7fd0
- SHA1 b609c765976573ef6f5939db1a46a13883cbaca9
- SHA512 6e74a5598229b964dbae996372fe52a470c0eecf349603fcbdbbf319bcc95e62a7d350977fd03c5af5333e44e4cb185a12083b573b7b9ed5ddaac1332589fb24
- TLSH T10F211409A2EE283DCD9A428B71370B2DE28DD3912930360672EF05BD320974672A358E
- MD5 SHA1 SHA512 TLSH
KlothoFLEX is Discord Kopyalama/PythonInstaller.exe
- IMPHASH d7e2fd259780271687ffca462b9e69b7
- SHA256 69165821dad57c6d8d29ec8598933db7c4498f8ef9d477fa13c677fd82567b58
- MD5 9a99ae597902b70b1273e88cc8d41abd
- SHA1 058c5319e77a698b185975084c7be7d25ae021b2
- SHA512 ad8e63ab10ad324ffc897346d18ee8a91459bbcb4f433103c94177eefe5aa512a996efac4284e8f9fd5c91c1e86bd7594b58eb9ecc235512bd55e9d5355fdc84
- SSDEEP 786432:xjELvvyFiEpl2+wZu+aDRQq7IozqKNSXSgyjXy:h43Epl2+2uFRQq7Io6JJ
- TLSH T1DE57333391489577D1D601F3BB2492347D7C6A326E11842EF6C4FE1A69BD48A3BB3362
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
85:02:8c:cc:27:1a:b7:c2:28:f5:f0:ae:7d:6c:81:f7:96:f4:d3:bb:95:89:53:77:36:08:70:f3:9c:7c:93:62
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Python Software Foundation,O=Python Software Foundation,L=Beaverton,ST=Oregon,C=US
Chains
Jun 6, 2022
CN=Python Software Foundation,O=Python Software Foundation,L=Beaverton,ST=Oregon,C=US
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Serial Number
08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Apr 29, 2021 - Apr 28, 2036
Subject
CN=Python Software Foundation,O=Python Software Foundation,L=Beaverton,ST=Oregon,C=US
Serial Number
07:1f:14:1b:8b:30:0d:25:f3:14:eb:23:0c:d0:d1:dd
Issuer
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Jan 17, 2022 - Jan 15, 2025
Subject
CN=DigiCert Timestamp 2022 - 2,O=DigiCert\, Inc.,C=US
Serial Number
0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Mar 29, 2022 - Mar 14, 2033
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Mar 23, 2022 - Mar 22, 2037
Minor OS version
1
Major OS version
5
Entry point
189094
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP
PDB paths
C:\agent\_work\8\s\build\ship\x86\burn.pdb
advapi32
RegCloseKey
RegOpenKeyExW
OpenProcessToken
AdjustTokenPrivileges
LookupPrivilegeValueW
InitiateSystemShutdownExW
GetUserNameW
RegQueryValueExW
RegDeleteValueW
CloseEventLog
OpenEventLogW
ReportEventW
ConvertStringSecurityDescriptorToSecurityDescriptorW
DecryptFileW
CreateWellKnownSid
InitializeAcl
SetEntriesInAclW
ChangeServiceConfigW
CloseServiceHandle
ControlService
OpenSCManagerW
OpenServiceW
QueryServiceStatus
SetNamedSecurityInfoW
CheckTokenMembership
AllocateAndInitializeSid
SetEntriesInAclA
SetSecurityDescriptorGroup
SetSecurityDescriptorOwner
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
RegSetValueExW
RegQueryInfoKeyW
RegEnumValueW
RegEnumKeyExW
RegDeleteKeyW
RegCreateKeyExW
GetTokenInformation
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptGetHashParam
CryptReleaseContext
CryptAcquireContextW
QueryServiceConfigW
user32
PeekMessageW
PostMessageW
IsWindow
WaitForInputIdle
PostQuitMessage
GetMessageW
TranslateMessage
MsgWaitForMultipleObjects
PostThreadMessageW
GetMonitorInfoW
MonitorFromPoint
IsDialogMessageW
LoadCursorW
LoadBitmapW
SetWindowLongW
GetWindowLongW
GetCursorPos
MessageBoxW
CreateWindowExW
UnregisterClassW
RegisterClassW
DefWindowProcW
DispatchMessageW
oleaut32
VariantInit
SysAllocString
VariantClear
SysFreeString
gdi32
DeleteDC
DeleteObject
SelectObject
StretchBlt
GetObjectW
CreateCompatibleDC
shell32
CommandLineToArgvW
SHGetFolderPathW
ShellExecuteExW
ole32
CoUninitialize
CoInitializeEx
CoInitialize
StringFromGUID2
CoCreateInstance
CoTaskMemFree
CLSIDFromProgID
CoInitializeSecurity
kernel32
GetCommandLineA
GetCPInfo
GetOEMCP
CloseHandle
CreateFileW
GetProcAddress
LocalFree
HeapSetInformation
GetLastError
GetModuleHandleW
FormatMessageW
lstrlenA
lstrlenW
MultiByteToWideChar
WideCharToMultiByte
LCMapStringW
Sleep
GetLocalTime
GetModuleFileNameW
ExpandEnvironmentStringsW
GetTempPathW
GetTempFileNameW
CreateDirectoryW
GetFullPathNameW
CompareStringW
GetCurrentProcessId
WriteFile
SetFilePointer
LoadLibraryW
GetSystemDirectoryW
CreateFileA
HeapAlloc
HeapReAlloc
HeapFree
HeapSize
GetProcessHeap
FindClose
GetCommandLineW
GetCurrentDirectoryW
RemoveDirectoryW
SetFileAttributesW
GetFileAttributesW
DeleteFileW
FindFirstFileW
FindNextFileW
MoveFileExW
GetCurrentProcess
GetCurrentThreadId
InitializeCriticalSection
DeleteCriticalSection
ReleaseMutex
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
CreateProcessW
GetVersionExW
VerSetConditionMask
FreeLibrary
EnterCriticalSection
LeaveCriticalSection
GetSystemTime
GetNativeSystemInfo
GetModuleHandleExW
GetWindowsDirectoryW
GetSystemWow64DirectoryW
GetEnvironmentStringsW
VerifyVersionInfoW
GetVolumePathNameW
GetDateFormatW
GetUserDefaultUILanguage
GetSystemDefaultLangID
GetUserDefaultLangID
GetStringTypeW
ReadFile
SetFilePointerEx
DuplicateHandle
InterlockedExchange
InterlockedCompareExchange
LoadLibraryExW
CreateEventW
ProcessIdToSessionId
OpenProcess
GetProcessId
WaitForSingleObject
ConnectNamedPipe
SetNamedPipeHandleState
CreateNamedPipeW
CreateThread
GetExitCodeThread
SetEvent
WaitForMultipleObjects
InterlockedIncrement
InterlockedDecrement
ResetEvent
SetEndOfFile
SetFileTime
LocalFileTimeToFileTime
DosDateTimeToFileTime
CompareStringA
GetExitCodeProcess
SetThreadExecutionState
CopyFileExW
MapViewOfFile
UnmapViewOfFile
CreateMutexW
CreateFileMappingW
GetThreadLocale
IsValidCodePage
FindFirstFileExW
FreeEnvironmentStringsW
SetStdHandle
GetConsoleCP
GetConsoleMode
FlushFileBuffers
DecodePointer
WriteConsoleW
GetModuleHandleA
GlobalAlloc
GlobalFree
GetFileSizeEx
CopyFileW
VirtualAlloc
VirtualFree
SystemTimeToTzSpecificLocalTime
GetTimeZoneInformation
SystemTimeToFileTime
GetSystemInfo
VirtualProtect
VirtualQuery
GetComputerNameW
SetCurrentDirectoryW
GetFileType
GetACP
ExitProcess
GetStdHandle
InitializeCriticalSectionAndSpinCount
SetLastError
RtlUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
RaiseException
LoadLibraryExA
rpcrt4
UuidCreate
Name
.text
Size
294KB
Virtual Size
294KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
123KB
Virtual Size
123KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.wixburn
Size
512B
Virtual Size
56B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
89KB
Virtual Size
89KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
15KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=9, id=241, version=40116,
count=124, id=243, version=40116,
count=24, id=242, version=40116,
count=19, id=259, version=25305,
count=19, id=260, version=25305,
count=38, id=261, version=25305,
count=5, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=17, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=341, id=1, productName=Unmarked objects,
count=75, id=261, version=25508,
count=1, id=255, version=25508,
count=2, id=151,
count=1, id=258, version=25508,
KlothoFLEX is Discord Kopyalama/__pycache__/serverclone.cpython-310.pyc
- SHA256 13a05a1e3217abe8e5649d0f2a2f2b45050a0af31f53424bef04b355cd5b6f9a
- MD5 bb66af22018a524734436bc216035041
- SHA1 14fd2d0c42b8856f51141bb2d3044d603e3248c6
- SHA512 de28317b25d0e3de1597cfef4ec2ab28c822490fd8e1c14f96e61e3cd09d7c04e96dd2ead046a57b35d1b6fcf6011b821daad6944c97e638638beff6829e26e0
- SSDEEP 96:35Iobmm/fbQRFaQgHa3MrBSi+THc/1XIYhMWBGaO/iBip3ll:3aoSm/f8vaLHFJ/dIQMZ/iBK3ll
- TLSH T1BCD1744B310C965EFC82F3BA50B0074B7FEE7321875548A5459A93836C327D2993F6CA
- MD5 SHA1 SHA512 SSDEEP TLSH
KlothoFLEX is Discord Kopyalama/main.py
- SHA256 96d065ee70bc724ad11120dc6be40aef37a28e43c133a3ae8975eaef3fa06c10
- MD5 7fd2136c8d300cdf14d78f8d9bfe9d4f
- SHA1 864f831cc6a1ba21b8d739da70bed9e7358f654a
- SHA512 2d82596c1d4681960b5cb485e49ce3a515ecf0536ac5311d2b449813fc89a92e6c27428548191263fc8d5a681884482c738f5a7900511d8e4a7b25c57dd1c2d5
- TLSH T16351133684553724422E0D8658F1FEACE37118E2CF3A1480F5DEA9E96F36D108E2ACE5
- MD5 SHA1 SHA512 TLSH
KlothoFLEX is Discord Kopyalama/serverclone.py
- SHA256 8d9fad17ca9d749e4ab1a9e2bea20d00fe9d65c6fe7410f913c72d5d2744b797
- MD5 4a5b1da4d84e9ccf3cb3f8d488597da6
- SHA1 a0d1fe0988234fd875da336b386631c3e8afe46b
- SHA512 d0636f40884bece7e0ab4a15cc2297138a6b0a335303e828146f46875d6b1a89f2e05a669b44a3e15e18236927bf7b82f102de651d809a4e93a35850daea37f1
- SSDEEP 192:9B5PQGLqG4x/JqGKV8qkM86EqG20i2E72:/5PQbx0f8452
- TLSH T15612EF3FDC1818135273A19D8CB1AA54F30AA327887D3CA779DDDA149F34622D96CDA2
- MD5 SHA1 SHA512 SSDEEP TLSH