ToHrohet.rar
- SHA256 2a2831d034efaaecf5dd835f82d6b4428f2711f550c72b8f7498785a6ebb9477
Behavioral task
behavioral1
Sample
ToHrohet.rar
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
21 signatures
900 seconds
General
- Target ToHrohet.rar
- Size 32.5MB
- Sample260724-yzc98ssbpc
- SHA256 2a2831d034efaaecf5dd835f82d6b4428f2711f550c72b8f7498785a6ebb9477
- MD5 49ebef0f0d34691d7521a76e795fc66d
- SHA1 3fae776e4eddf9195e14277952257ce21b117dc7
- SHA512 be96e312450ab4c71d6c49a0f515b7977a65ebf5e42ea0ffce1f15d3356ef60b77db3d904631f6701263b9e03ddfc19d9f35bf5a5efd14f78e2a84d6a415533f
- SSDEEP 786432:+5OGUJgZMJJvMOj1SiMPajF4SmR7DKHcTnN5OA1/J0M:ehsg6Jj1SiFjF4SmR7uHcLjOAj
- TLSH T1DC7733CC222AF163D19FF9664F97140978CB75EEE1EECA437B6482358BE12C31D59824
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Detects Pyinstaller 1 IoCs
resource yara_rule static1/unpack001/ToHrohet/ToHrohet.exe pyinstaller - Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/ToHrohet/ToHrohet.exe
File Explorer
-
ToHrohet.rar.rar 32.5MB
-
ToHrohet/Invto.wav435KB
-
ToHrohet/Pastone.gif.gif 5.7MB
-
ToHrohet/ToHrohet.exe.exe 29.6MB
-
ToHrohet.pyc2KB
ToHrohet/Invto.wav
- SHA256 6d84c1af89c4da56c2cfb1c0d02421f315c5f6e1643cb64049d7b189b958c17a
- MD5 e4f0dc343f304f389ad6127ff23851e6
- SHA1 129bf138be33b3f6743214c785d81c73755ed99f
- SHA512 11d9a144e385e824cdc0d2b7ca986f07e6000a142408d08c49d82d2676ca6d1f3899f5f2495f94de74f803cff1a9b1f8cad80cd5f56648e4ee46cb9a9823df64
- SSDEEP 12288:c3R+2wOiSFTFlfFQRGASmkOM1bNh0rRA+yI:c3UzSFTrNQEmjwbNh0i+d
- TLSH T154942318D991811DB89F26840EE3CB04EF225F876715798B1512F389EBF32AC93E6D49
- MD5 SHA1 SHA512 SSDEEP TLSH
ToHrohet/Pastone.gif
- SHA256 c8e93e5b8a7138bcfdd1ff674e3fb680046c95c53e1c5e3b5c2267bbf74923eb
- MD5 d25b7827274a94467673a2b4903a8598
- SHA1 4ddb13e759ae23efc63d67bc22d1ace75f4878eb
- SHA512 048e58b70430d62077edc97b5e5f5e8edefeeb38ec8d80e38a60c88984050fa2a1d86ad61dff381a0e00be31d7be02bc2b45b503a3a39d685140e034b298fb84
- SSDEEP 49152:7/Z1NKlWmpRLiYpxcDVgpgdX6ldhHWWVanlachNf5C/duv54LeeeeeeeetCZ8ZJn:7/Z1NKlbF/gmEs2umJ8CZgllllll3
- TLSH T1E95623F0DA071389FC7A39409D59366AB93F896DA7E24E7DF8A7210B38051F41EE8171
- MD5 SHA1 SHA512 SSDEEP TLSH
ToHrohet/ToHrohet.exe
- IMPHASH 351592d5ead6df0859b0cc0056827c95
- SHA256 9a1983272bb891a2f81656208ca43da0e7925c9074fb944210b7437827591c61
- MD5 746e65b8e8f97b6e91b276ca12a8870c
- SHA1 922a0c7f3e63d5eecc68b44dfd2decca4b836e77
- SHA512 58511513785cada6e094f4bba222df463f86210cd27570f13f5828d4001f488a7eb05e354a1ced1da8697338e516f7bf89ac40845baeb4e824d1814243e31667
- SSDEEP 786432:S2G4TLcNODcoh1xrxKvuToWAGWrYMc3cgKUnnHFW/:FTIAZ1C0oZ7vc3Pnl6
- TLSH T1FC67339A7F9018A5F99A803A9D90572793E378312FA0958F17EC4BA41E732D8CD7C335
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects Pyinstaller
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
54464
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
user32
TranslateMessage
ShutdownBlockReasonCreate
GetWindowThreadProcessId
SetWindowLongPtrW
GetWindowLongPtrW
MsgWaitForMultipleObjects
ShowWindow
DestroyWindow
CreateWindowExW
RegisterClassW
DefWindowProcW
PeekMessageW
DispatchMessageW
GetMessageW
kernel32
GetTimeZoneInformation
GetProcessHeap
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
GetStringTypeW
GetLastError
FreeLibrary
GetProcAddress
LoadLibraryExW
FormatMessageW
GetModuleFileNameW
SetDllDirectoryW
CreateSymbolicLinkW
SetErrorMode
CreateDirectoryW
GetCommandLineW
GetEnvironmentVariableW
ExpandEnvironmentStringsW
DeleteFileW
FindClose
HeapSize
FindNextFileW
GetDriveTypeW
RemoveDirectoryW
GetTempPathW
CloseHandle
QueryPerformanceCounter
QueryPerformanceFrequency
WaitForSingleObject
Sleep
GetCurrentProcess
GetCurrentProcessId
TerminateProcess
GetExitCodeProcess
CreateProcessW
GetStartupInfoW
LocalFree
SetConsoleCtrlHandler
GetConsoleWindow
K32EnumProcessModules
K32GetModuleFileNameExW
CreateFileW
FindFirstFileExW
GetFinalPathNameByHandleW
MultiByteToWideChar
WideCharToMultiByte
GetFileAttributesExW
HeapReAlloc
WriteConsoleW
SetEndOfFile
FindFirstFileW
GetModuleHandleW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
RtlUnwindEx
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
EncodePointer
RaiseException
RtlPcToFileHeader
GetFileInformationByHandle
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
ReadFile
GetFullPathNameW
SetStdHandle
GetStdHandle
WriteFile
ExitProcess
GetModuleHandleExW
GetCommandLineA
HeapFree
GetConsoleMode
ReadConsoleW
SetFilePointerEx
GetConsoleOutputCP
GetFileSizeEx
HeapAlloc
GetCurrentDirectoryW
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
InitializeCriticalSectionEx
VirtualProtect
CompareStringW
LCMapStringW
FlushFileBuffers
SetEnvironmentVariableW
advapi32
ConvertSidToStringSidW
GetTokenInformation
OpenProcessToken
ConvertStringSecurityDescriptorToSecurityDescriptorW
Name
.text
Size
182KB
Virtual Size
182KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
78KB
Virtual Size
78KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
9KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
81KB
Virtual Size
81KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=182, id=261, version=33145,
count=12, id=260, version=33145,
count=11, id=259, version=33145,
count=3, id=253, version=35207,
count=9, id=259, version=35207,
count=17, id=260, version=35207,
count=40, id=261, version=35207,
count=7, id=257, version=33145,
count=141, id=1, productName=Unmarked objects,
count=27, id=260, version=35225,
count=1, id=258, version=35225,
ToHrohet.pyc
- SHA256 0e47546cc80acc9d929893b133cb1d709eba53116b6ae3058476108ca4d538c9
- MD5 fdf009c92e2357f1230ab3d608df308c
- SHA1 b5429dfa63a7ca9bf9556443d9f0ac26ae3265c8
- SHA512 8136d6235c8d262c318069c54e4a4974fa8f7f07e5a6f041c616a4d732313914340072e6a42ab0ae363dc4c1d29288611c1e0850b54f810430a80dc6eb883b9d
- TLSH T1F351C7F25610B443EBEC9038F0D6A4442367C99B9492D3CBD91448BB5E9C25699A431E
- MD5 SHA1 SHA512 TLSH