255_31_160_QPL-V0.1.rar
- SHA256 c06f058a6b28cd48934ad80deaca8d4e36dc3bd6e028bc46dbbc7de73e599a31
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
cheats.css-ost.ru - бесплатные читы.url
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
cheats.css-ost.ru - бесплатные читы.url
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
csxq.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral4
Sample
csxq.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral5
Sample
csxq.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral6
Sample
csxq.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
General
- Target 255_31_160_QPL-V0.1.rar
- Size 208KB
- Sample260728-w32e5aba82
- SHA256 c06f058a6b28cd48934ad80deaca8d4e36dc3bd6e028bc46dbbc7de73e599a31
- MD5 fc0e887829aefd55918cd7735170ce2a
- SHA1 4634aac356462c8ce1d65966c7de03f4d412dea8
- SHA512 a54bd712970863cf52bd62a2c934f807652d4e0033968d8f77957523b936bb51f9c3363d721bc4fd0de7373df322aa108aa8a1574c7cf435472fee222a00486c
- SSDEEP 6144:T/m/HshQSG61DL0QFf/JDWrbBgU3qRTY9moZ+RUFA6TEffgtd:vfhK/B3qRaFYRUSUE3gz
- TLSH T1CA2413D0DECBCB9CC6351C7E6606B63C1698A75AF37B05CD881C6011A9BA71BC0E6C9D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/csxq.dll unpack001/csxq.exe
File Explorer
-
255_31_160_QPL-V0.1.rar.rar 208KB
-
XQ [H]OO[K] V0.1.cfg4KB
-
athug.txt1KB
-
cheats.css-ost.ru - бесплатные читы.URL124B
-
csxq.dll.dll 139KB
-
csxq.exe.exe 39KB
-
ver.ini93B
-
way/de_aztec.ct39KB
-
way/de_aztec.t39KB
-
way/de_dust.ct39KB
-
way/de_dust.t39KB
-
way/de_dust2.ct39KB
-
way/de_dust2.t39KB
-
way/de_dust2002.ct11KB
-
way/de_dust2002.t11KB
-
版本替换/2834.ini92B
-
版本替换/3147.ini94B
-
版本替换/3213.ini95B
-
版本替换/3248.ini94B
-
版本替换/3266.ini94B
XQ [H]OO[K] V0.1.cfg
- SHA256 6643a3c07070c986f1ea459ca7d94b80a678e64a25fbd8326a53c141fcba81b4
- MD5 f7ada981872174cd1c4c3e139a73aa62
- SHA1 fce5a96f21d5147624cd9307d041fe79ee3ae1ba
- SHA512 42249c1a221980075e2015bd04b07799f88089aae4a9487393744f2bd8fa6ee88ae4fc5bfa73909f286962ef485256279908aec9fd03745f88b35b0fac695e5f
- SSDEEP 96:6zj4iijOH9AZ3Iy7jZvRaNIstN1NSNb7NXNpAyAZAA3335yFBN:IIOdAhj6u6PMhp/AyAZAA333ch
- TLSH T14F918A31A67B3E86D0A6F39BB01B0E554C782329CF4BCD9C316CD3959E420D86B476E6
- MD5 SHA1 SHA512 SSDEEP TLSH
athug.txt
- SHA256 a64d69ef545571dc6297e14d07e2ce5a29a3d1b4fbf40fcf2fc658e643179449
- MD5 1a81cd3c4eecee5f7648eb0f1d58299d
- SHA1 341a8621af0460a4e593214cafe8fd520d1a3b63
- SHA512 f9985761a96aecc8819f99f97a6c40a25e440442b47f603e33af9bf007bdca75963b288b02e6473f9f09c358997bc30c321019da65aa985f082e6a270388fd61
- TLSH T1A421EB17F0C88CE83923930B12F268DF444897B9691C44C5BD6FD97CB79F92041A2995
- MD5 SHA1 SHA512 TLSH
cheats.css-ost.ru - бесплатные читы.URL
- SHA256 2803f3d8b64d21392c978d7f6643485ec1d87a1b0f6fe9279b681f2b4394b3aa
- MD5 b36ce8a39729004f65252bc40801739b
- SHA1 7be407e8513d620e022de9a106589fd0e1c0636a
- SHA512 e1fff7afb50b9a7bdd821cbf192dc10f241e432e995411b12c1d731ced7c1c7b4c34d5397dd0ee4407f16e13761f210b6a38043463db772e8387b6fd34bba817
- TLSH T1D5B09B5C5545815DD251940D70F0F455484D75A044C2D48C5250DD565C550C0D55A765
- MD5 SHA1 SHA512 TLSH
csxq.dll
- IMPHASH 99f5b0b723d6fca2813f516623081e1c
- SHA256 fdf6f922a83edafeea3c2d1638bead93336a65bd31284bd91f5b5a4c7455548f
- MD5 90c086347357f1ce11366b9fe57f7d1d
- SHA1 4e24765a434341a7d4745c1bce33194d25fb8767
- SHA512 4f71e3513070718af7bf4f03d5d42b33e09f9b17ae913fbd93604fc8ebd3bdf8d6a64aa1dedf969ddfff7653055530cb50e91d89c246504756559a07564b10ea
- SSDEEP 3072:7lyfSIt458qRgAscIPWoAAMDaUixanLZrLwE:7st458C9QNxP/x+LwE
- TLSH T148E30262577AC736CE5E0334E24AA6F58CB1CA383B14D328B759E7D06873479EF05681
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
562410
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
VirtualFree
VirtualAlloc
ExitProcess
GetProcAddress
LoadLibraryExA
GetModuleHandleA
VirtualProtect
GetModuleFileNameA
FreeLibrary
GetLastError
CreateMutexA
LoadLibraryA
user32
wsprintfA
MessageBoxA
CreateInterface
Name
.data
Size
Virtual Size
412KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
129KB
Virtual Size
129KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.ex_cod
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.ex_rl
Size
364B
Virtual Size
356B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=6, id=12, version=7291,
count=35, id=14, version=7299,
count=140, id=10, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=13, id=11, version=8047,
count=6, id=10, version=8047,
count=9, id=19, version=8034,
count=114, id=1, productName=Unmarked objects,
count=43, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
csxq.exe
- SHA256 b9ef1983351742743a768465b864c544a91a0ff4da22be1bd39c346cc8a867b0
- MD5 51975edee95209f7256520f6284470a9
- SHA1 540b4a98c1c6defd0f4aba6d3bff36c767e4835f
- SHA512 600b9c29b65ae5ccca1834d9ab1b5c1057f7114d8f4c6d0a7eec0475aee36e3eff4baf05f07699692598cfc7e534077c8a510e5758d6b450184c968ff6711914
- SSDEEP 768:Szrn08tcffm0lQURYgQy4hJx2zWvceFWzsRBWMpFTA2A+k5:i08we1N5H2zWv1HRQiU2A+k5
- TLSH T10D03F1616F5A98E2D7ECC931687EE4BADF778B18014384B74ECC9300A93B153412EF29
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
184320
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
.bss
Size
Virtual Size
118KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.packed
Size
20KB
Virtual Size
48KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.edata
Size
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.loader
Size
15KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
ver.ini
- SHA256 6c7578ec307cdac49d7ca89ab11cdd2d3c131d523730e1c691f0e5c85c9e15ea
- MD5 5c27bcbba9e984dbd65a5d01087ccedd
- SHA1 2f15895115895b99a6f916c625bc922f9d44ebb0
- SHA512 aeb83e70c443ea535d052ef4df07df24502e98fe1b43b32241d471e34850b4237bc6655d0c9963216680b87f377df86b508aa919bb221b1a88d755f8d154026c
- TLSH T1DBB012544D203500101C3305E1C710E20EA72948322C4006F0DC03FC40218644418C73
- MD5 SHA1 SHA512 TLSH
way/de_aztec.ct
- SHA256 f657e0be95da4c9e3a45b6b6d0204b733046a246ee856af88f097f99a3b3b7dd
- MD5 004e8c954ffa36b2ef7d685dd09198ae
- SHA1 d264936eea7c4f8a4e07fe059f148298fdea7a98
- SHA512 59cb4291eb6055d70d84fc9558342a12d65cdb4b54fe9b61a895e94dd3cb7b3a4f91a62ef69be6a2a1a2e5814eb89ead9e0a8fda254ce180725fa3a40d884637
- SSDEEP 192:a31hEhe7d+6gxSy7DP9lh9phdFTkzvl9psx7UDMsvzKTwf:a3sM+9x99Xbdkrl9psx7G
- TLSH T1B603A2209E534795C55C3C733842B199ED220B84326669673BFF0AF7A83EC9228E5DC7
- MD5 SHA1 SHA512 SSDEEP TLSH
way/de_aztec.t
- SHA256 f657e0be95da4c9e3a45b6b6d0204b733046a246ee856af88f097f99a3b3b7dd
- MD5 004e8c954ffa36b2ef7d685dd09198ae
- SHA1 d264936eea7c4f8a4e07fe059f148298fdea7a98
- SHA512 59cb4291eb6055d70d84fc9558342a12d65cdb4b54fe9b61a895e94dd3cb7b3a4f91a62ef69be6a2a1a2e5814eb89ead9e0a8fda254ce180725fa3a40d884637
- SSDEEP 192:a31hEhe7d+6gxSy7DP9lh9phdFTkzvl9psx7UDMsvzKTwf:a3sM+9x99Xbdkrl9psx7G
- TLSH T1B603A2209E534795C55C3C733842B199ED220B84326669673BFF0AF7A83EC9228E5DC7
- MD5 SHA1 SHA512 SSDEEP TLSH
way/de_dust.ct
- SHA256 42a079dced12dbe606a8b213944974fb6de585f4636c40fcef01506011231184
- MD5 19d8236759f7749158db043c8209a3ce
- SHA1 3456f91d2f891e24960a6afb12312b01e91bf643
- SHA512 b8a48851fc9b053f20f326acb8ebad15cf0df3b298c77c6cdac6279d5d92d0c1636d763326ffa3313453b6ac79c334cbb35787741fce384335c4fab97f04f929
- SSDEEP 96:oNZPVcavzYm60NLlzDEcHFGQ1skA83FVGO4tf/n1YXh2h8IYRhe3QrO/t:oviAzOqLmcHnskZ3FV81Qh2hRQe3f/
- TLSH T10A037EE500170AAFE74F4EB7ADE0423743B4D52025F9AA50F5B0EF37940B5A06CD0B19
- MD5 SHA1 SHA512 SSDEEP TLSH
way/de_dust.t
- SHA256 42a079dced12dbe606a8b213944974fb6de585f4636c40fcef01506011231184
- MD5 19d8236759f7749158db043c8209a3ce
- SHA1 3456f91d2f891e24960a6afb12312b01e91bf643
- SHA512 b8a48851fc9b053f20f326acb8ebad15cf0df3b298c77c6cdac6279d5d92d0c1636d763326ffa3313453b6ac79c334cbb35787741fce384335c4fab97f04f929
- SSDEEP 96:oNZPVcavzYm60NLlzDEcHFGQ1skA83FVGO4tf/n1YXh2h8IYRhe3QrO/t:oviAzOqLmcHnskZ3FV81Qh2hRQe3f/
- TLSH T10A037EE500170AAFE74F4EB7ADE0423743B4D52025F9AA50F5B0EF37940B5A06CD0B19
- MD5 SHA1 SHA512 SSDEEP TLSH
way/de_dust2.ct
- SHA256 e0dfea4778c88b27239d268f2fccfd22c5c7bba75defc1257c93f3549f496f6e
- MD5 5a3fcc28fccbf20c55e559dff984b8f6
- SHA1 97d3526e7ecc6035f937f56a706612f4379ccee5
- SHA512 0017d7a948badcc26e295b1de6673751a65e295c477e34f2449fadab9fc0bbf750043933cd24468b1cd364fb27a1af3e173cdd7cb9076aee0ad12e58d075cf14
- SSDEEP 96:oUThnkY4Pzp+aNtYdL5Vb3Ij3YR4NcpPxHFX9etWCh6iC1ar1t7:qdVdy5VT2NOPxHetiV1arb
- TLSH T15E033CF06413550BD48A58BF50D92A3B43ADE8E99DB11E2CD538EF0AE794013ADB0FE1
- MD5 SHA1 SHA512 SSDEEP TLSH
way/de_dust2.t
- SHA256 ef01dafdd665a7a414e7c47eeee10575df871c4772b051f1d8c110fb4fc55fbd
- MD5 0c4ba202704bf024347ef38a55d6ac92
- SHA1 0f1413c4bb20363d4c9b25fe1218e606bb55d842
- SHA512 efae08ecf5001cded064db0514c051fea22e96bcd0a909f37bb0f4090abcb482de5f70b8250b2be329cd07b4356388885bff178fed516d88071261d82b0754c3
- SSDEEP 192:uoN7h2ZLvq/HfjsJEw4VbUDt9hd05fGj2PpVl:uo/WA/IWrGt9hdgfyy
- TLSH T1F2031AF03163168BD98A157B85C5283787ADD09889B48B6CE135EF8ED7D20432DA0FE5
- MD5 SHA1 SHA512 SSDEEP TLSH
way/de_dust2002.ct
- SHA256 cb184c1f9045c67ef07b81275d1c6699712723783762db067abdb1773da564c9
- MD5 4577cd94a635f065387039906baef495
- SHA1 89eaec4787624efa99e766c53adc707deae2d63a
- SHA512 fdff0256312e96c5471475e72746976b8df66c2c8f417b35e2dfdae558a192d8dd3772a8176811532c68ac6ef22e91c1bf3a7bac1f49223f5dfb5d0a97fc5671
- SSDEEP 192:CAqL+PZn0jZ6B4OqNbvR52tGF0mgbR8HIsF8jy+S34:/ZnOAEDbZKmgb4v2jy+S34
- TLSH T168420079938C87EC8FCB4A6544A849A73BE328613F0C3C256F4CA6581CFD251498DFA7
- MD5 SHA1 SHA512 SSDEEP TLSH
way/de_dust2002.t
- SHA256 cb184c1f9045c67ef07b81275d1c6699712723783762db067abdb1773da564c9
- MD5 4577cd94a635f065387039906baef495
- SHA1 89eaec4787624efa99e766c53adc707deae2d63a
- SHA512 fdff0256312e96c5471475e72746976b8df66c2c8f417b35e2dfdae558a192d8dd3772a8176811532c68ac6ef22e91c1bf3a7bac1f49223f5dfb5d0a97fc5671
- SSDEEP 192:CAqL+PZn0jZ6B4OqNbvR52tGF0mgbR8HIsF8jy+S34:/ZnOAEDbZKmgb4v2jy+S34
- TLSH T168420079938C87EC8FCB4A6544A849A73BE328613F0C3C256F4CA6581CFD251498DFA7
- MD5 SHA1 SHA512 SSDEEP TLSH
版本替换/2834.ini
- SHA256 0ce6f9578728cecb789f43f3df75b313a26fb367289002a02a57520714fc9d44
- MD5 b33a4fbf5715f410e228c9094c3953f8
- SHA1 c5f2504a4b8a7cc904ebe13cbbced7bd40fa9c99
- SHA512 38fea9cf0ffd6766ca8a63adc6c632945a38126156bcffae4ff3f6881070d776ba4bf5944b8bebc9b9fd5bc50372205cecaefa9d3c054be071b46a435574438d
- TLSH T100B0122409183D0411143420E08B01810DC31148201C4807B04D1B741523F784808CDB
- MD5 SHA1 SHA512 TLSH
版本替换/3147.ini
- SHA256 e78545f7b8224e25774002c59173ccff54b5760cb6a9232588113a60d7908798
- MD5 478df95c1e308e30f044624be7e31263
- SHA1 807608c0c982ad45e7f749ab63a210b0a8249eac
- SHA512 cc26ec362b24585443cbe74b07c6fb9ce48768ce125a0ef5b4e171a318d47029545955c33214f606e022afd875b6de04199c20d3e8ef2775c8c7ba543da9532f
- TLSH T159B012101C20790501703201D08B00D00F73B18820684446F0CC57F004128758C04CB3
- MD5 SHA1 SHA512 TLSH
版本替换/3213.ini
- SHA256 035172316fb60b9c178d026611a132602d2e9200a6d1914a25ca9f453688d425
- MD5 5412caaf79ddfb42a368436e3dc4dd3b
- SHA1 2b9b5a937a5df4c9b4fac65d86cd8d93501fbc32
- SHA512 7e9a6757bdcac66d470e4bf6d8bdcbffb1d3b4d481030ef4a92adb033719b1a177ae0d9f593cf3eb870bd8c3eb58f114679336ee124ecdec982eaa931b391f88
- TLSH T15CB012945D10390010043304F0CB00E20EB3355872384106F0CC07FC40128B58C14C77
- MD5 SHA1 SHA512 TLSH
版本替换/3248.ini
- SHA256 a20a63af0f6c2c8839aaeec8ddf608d751ee8975b4106d79f72e1e50dc0ab96b
- MD5 ce68cb2a454f01291512f3d1f65a43df
- SHA1 9eb3c8d3b516c7f921d5a06f6889360782e46267
- SHA512 185f646eaa99b45afe53ef2faa625be385a6eafffdd48047fe3137d5eb0feb4252e54c1d6aef1e2f7ffbdfb5e1020d9e96cbf09aa6982288041505589fae787f
- TLSH T13FB012544D20390010243305E1C710E20EA33548322C4006F0DC07FC40218754814CB3
- MD5 SHA1 SHA512 TLSH
版本替换/3266.ini
- SHA256 ab55ed34e5dd34509530816e1dbf676b9ca553399908cbbdba62fdae412d56b4
- MD5 854d59f32bcbe1e2c2af920bf7b68415
- SHA1 4811ea645d62c89125d1f211ad88185c7dd4b060
- SHA512 c45b68616c2ba4c8401f35f50246df2cb963577051d78081a4d9e2dba33f770f8c4ffa6d41c24c0cc23f2782d01eba4122a9e2a1429baf324ce8f5377bc07065
- TLSH T12DB012541C30390000203349D18700D30DA33148202C4006F09C2FF840218744844CB7
- MD5 SHA1 SHA512 TLSH