4_1675_bunnyhop.rar
- SHA256 a10c177cdcbc938cdb405662ce4b9aac06a333c4f8876760300c1d94c267d71e
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Clan Spin/GDFwSvc.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
Clan Spin/GDFwSvc.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral3
Sample
Clan Spin/rev0lt/bin/rev0lt.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral4
Sample
Clan Spin/rev0lt/bin/rev0lt.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
General
- Target 4_1675_bunnyhop.rar
- Size 137KB
- Sample260801-ph5hqaae38
- SHA256 a10c177cdcbc938cdb405662ce4b9aac06a333c4f8876760300c1d94c267d71e
- MD5 412e53078003f13d3bb23fc337f3a10a
- SHA1 9e71d8a0cf7cc292eec5ef924b549aa23a7cd01e
- SHA512 aceb870813803d10d1deadce04ff1ac57a593d163b95451e10db0028e6d9641cf366de5465fb07c28b9c7d21f342533e58b62fd472ba1f53efaf6550cd6a80b0
- SSDEEP 3072:M8e4bBCHr5uWHsTxBYTZgeCvO03kHTMJ2Fv:fe4b8Lg9DYTOjO00HIJGv
- TLSH T147D312ADF280C8D7F9861737AAA924D8413C649E25BB5A389587E8F720ED15CF4E40C3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/Clan Spin/GDFwSvc.exe unpack001/Clan Spin/rev0lt/bin/rev0lt.dll
File Explorer
-
4_1675_bunnyhop.rar.rar 137KB
-
Clan Spin/GDFwSvc.exe.exe 156KB
-
Clan Spin/rev0lt/bin/rev0lt.dll.dll 132KB
-
Clan Spin/rev0lt/skin/Main.bmp69KB
-
Clan Spin/rev0lt/skin/Mask.bmp304KB
-
Clan Spin/rev0lt/skin/Thumbs.db10KB
-
Clan Spin/rev0lt/skin/skin.ini188B
Clan Spin/GDFwSvc.exe
- IMPHASH e7075482c29e949390e49ccafcdce0e2
- SHA256 545746b86519a50e751e282556b960ff29f24349f8e4597d118c2ff3390331b0
- MD5 fcee9a352ebb22690c31118380eba9a3
- SHA1 c3ee5333ca9af231ec0336f1fd3962a0a767c808
- SHA512 700f9a62e9d1f1a998b87c474f41822643b64f924b8e47e0ade56f271f4cf760a3ac4e84c40cac143582435ce5dedca67551ce9641ac6380709cd2836d88f59f
- SSDEEP 3072:0qCeoT6FavAP6VC7lztvjdhG+nGBIyhJ:HCeoT6aAPb55RhG+abJ
- TLSH T142F39E2275E0E2F2D09585360865EB45AB39FD715F3986D373983F5E9E701C0AB3B288
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
20288
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
c:\Users\Ex777\Desktop\Rev0lt\Rev0lt Loader\release\Rev0lt Loader.pdb
kernel32
Sleep
CloseHandle
CreateRemoteThread
GetProcAddress
CreateMutexA
VirtualAllocEx
GetLastError
OpenProcess
GlobalFree
GlobalAlloc
GlobalReAlloc
GlobalUnlock
GlobalLock
ReadFile
GetFileSize
CreateFileA
GetPrivateProfileStringA
lstrlenA
ExitProcess
GetCommandLineA
HeapFree
GetVersionExA
HeapAlloc
GetProcessHeap
GetStartupInfoA
RtlUnwind
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
GetTickCount
GetStdHandle
GetModuleFileNameA
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
LoadLibraryA
InitializeCriticalSection
RaiseException
HeapSize
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
GetFileType
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
MultiByteToWideChar
GetLocaleInfoA
VirtualAlloc
HeapReAlloc
SetFilePointer
GetConsoleCP
GetConsoleMode
GetStringTypeA
GetStringTypeW
LCMapStringA
LCMapStringW
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
FlushFileBuffers
CreateThread
GetModuleHandleA
FindFirstFileA
WriteProcessMemory
WriteFile
GetCurrentDirectoryA
user32
GetWindowLongA
SetWindowLongA
LoadCursorA
RegisterClassExA
GetClassInfoExA
TranslateMessage
DispatchMessageA
GetMessageA
CreateWindowExA
SetRect
GetClientRect
DrawTextA
GetWindowTextA
GetParent
SetWindowTextA
DefWindowProcA
EndPaint
PostQuitMessage
SetWindowPos
SetWindowRgn
InvalidateRect
UnregisterClassA
LoadIconA
UpdateWindow
SendMessageA
MessageBoxA
GetWindowThreadProcessId
FindWindowA
ShowWindow
PostMessageA
LoadImageA
BeginPaint
comctl32
InitCommonControlsEx
_TrackMouseEvent
gdi32
BitBlt
GetObjectA
ExtCreateRegion
CombineRgn
DeleteDC
DeleteObject
SelectObject
CreateDIBSection
CreateCompatibleDC
CreateCompatibleBitmap
GetCurrentObject
SetTextColor
CreateFontA
SetBkMode
ole32
CreateStreamOnHGlobal
oleaut32
OleLoadPicture
Name
.text
Size
60KB
Virtual Size
56KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
16KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
8KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
68KB
Virtual Size
66KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=18, id=125, productName=VS2005 build 50727, version=50727,
count=103, id=109, productName=VS2005 build 50727, version=50727,
count=53, id=110, productName=VS2005 build 50727, version=50727,
count=1, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=13, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=155, id=1, productName=Unmarked objects,
count=2, id=114, version=50727,
count=1, id=124, productName=VS2005 build 50727, version=50727,
count=1, id=120, productName=VS2005 build 50727, version=50727,
Clan Spin/rev0lt/bin/rev0lt.dll
- IMPHASH 60a6a61741598595851e0867d2c79dd2
- SHA256 d148592ea5e9fd9cfd13c3a254fd0ef63ea0dfe94c23ae2dd871a9224993743d
- MD5 ea6ceafc2d46d3f42a416a9b292910c4
- SHA1 ac7e8866991260ee49970dddec925a3b6062565f
- SHA512 ddc36473ba0bac1e28f051641c17215ded68fed8024233fb4d36514bcb5ad18ac7d73316af85a4e04f7a767e02386d3bf48c20c426b2563f026f3d95c6bc42b5
- SSDEEP 3072:8yscZ+njgX9LzGcdtSpsMnzNWgTAg0Fuw0CGrt8il9Q:8XcZ+jW9GcdtWXzEgTAOVv9Q
- TLSH T1CAD37C1671F3C4B3D57A013C448A3B3A6BBE95604BB088F75FF0D98D8E663D09A36652
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
13906
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
c:\Dokumente und Einstellungen\Dieter Detmers\Eigene Dateien\HL²\AldiSkill's Hack\AldiSkill's Hack v1\Bunny 1.2\HL2\Release\HL2.pdb
kernel32
GetProcAddress
GetModuleHandleA
VirtualProtect
Sleep
CreateThread
GetModuleFileNameA
VirtualQuery
HeapAlloc
GetProcessHeap
CloseHandle
GetLocaleInfoW
FlushFileBuffers
GetSystemInfo
VirtualAlloc
SetStdHandle
GetStringTypeW
GetStringTypeA
IsValidCodePage
IsValidLocale
RtlUnwind
GetCurrentThreadId
GetCommandLineA
GetVersionExA
TlsAlloc
SetLastError
GetLastError
TlsFree
TlsSetValue
TlsGetValue
ExitProcess
TerminateProcess
GetCurrentProcess
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
UnhandledExceptionFilter
WriteFile
LeaveCriticalSection
EnterCriticalSection
GetACP
GetOEMCP
GetCPInfo
SetUnhandledExceptionFilter
IsBadReadPtr
IsBadWritePtr
IsBadCodePtr
RaiseException
SetFilePointer
InitializeCriticalSection
InterlockedExchange
LoadLibraryA
LCMapStringA
MultiByteToWideChar
LCMapStringW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
ReadFile
tier0
Error
g_pMemAlloc
GetCPUInformation
vstdlib
Q_snprintf
KeyValuesSystem
Name
.text
Size
72KB
Virtual Size
69KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
32KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
8KB
Virtual Size
54KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
16KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=19, id=49, version=9044,
count=4, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
count=5, id=105, version=2067,
count=38, id=15, productName=VS2003 (.NET) SP1 build 6030, version=6030,
count=134, id=95, productName=VS2003 (.NET) SP1 build 6030, version=6030,
count=3, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=98, id=1, productName=Unmarked objects,
count=19, id=96, productName=VS2003 (.NET) SP1 build 6030, version=6030,
count=1, id=90, productName=VS2003 (.NET) SP1 build 6030, version=6030,
Clan Spin/rev0lt/skin/Main.bmp
- SHA256 c84679c3e70d2fdfbf0c407c75e30d140d9236e980b72457276f224bfad41e39
- MD5 73507d592549565b3baf1f3abb05358d
- SHA1 988ad04a745f3132cb11a75b478ef6bb775f1d76
- SHA512 1d7b0c3395a92828b419c88b5cbfe0a425912ea86a8af286648dcef2108e591e9076d1f62b9e6c4b8b97cacf8855ed9981026ea9efa8c924ae6fc253f0417a4b
- SSDEEP 768:An079dPsNbSUsbk+9NyaCJowG9pMbYVzmS13zZysYaaUZh:a079dPsNbSUsgqCJQH1jZyD8H
- TLSH T11263A592944C8691DCA29F3421BEA9281137DEC77E38F62CAD19B9A7CF3B1C3D471251
- MD5 SHA1 SHA512 SSDEEP TLSH
Clan Spin/rev0lt/skin/Mask.bmp
- SHA256 f469a211508359ce07c1f5f00c4357f3623cdb32cfcb17638d9a19e7d2d706bf
- MD5 20df11c70a9359017c397b0347b7be45
- SHA1 6079c9d784d7ff9308b66f684511ad9cf3c16c35
- SHA512 7a16f9b5d72669f84e906e405017b1134e22f05d028c46a935465cf79eb7cb11cec871952174357c5f8d4c18df6c9cc2397690dd17752091ee741816a057494c
- SSDEEP 3:+W/l/TVlyVlMl:+9PM
- TLSH T12864040357411704D04410F4007D37041101C73D304043330005D005754354D7DDC451
- MD5 SHA1 SHA512 SSDEEP TLSH
Clan Spin/rev0lt/skin/Thumbs.db
- SHA256 bad8bab29928fcaa522cc3b26ac347ad505516c4dfbaf21586b6baef78f35126
- MD5 0acf89f2fd09da0257e19470d0138c66
- SHA1 ffce03da6fde9d01d3acc35792a45fdbaebeca6d
- SHA512 2c9b5a511385468d8dea2a1a97874682446308878d94dc9926b547d2f6b151352f0348fc96d0d1c635db185dfc3e7654a242b550fe4adca9459d209494af9e20
- SSDEEP 96:UE1yEqB6GTUK22nIWzBTELWz7sQ67oVVvYHL8adwKBZZioF+Wmv/BDDqyN9wdZ6:UX14K2DWBHy7sFaaKjZiomxDOyQdZ
- TLSH T17B222B4B6E048BD2FD79C7759E11AD99D3F86E01B9A03B0339E4339A9771CD0944C918
- MD5 SHA1 SHA512 SSDEEP TLSH
Clan Spin/rev0lt/skin/skin.ini
- SHA256 0e6be7119899711f94e0c37799b0b5b30b4a29bf1e47f4bda65a74b495f16f1c
- MD5 b51affbfc602a8bf8404089f5c111d1b
- SHA1 d6f2bf0319a8a8b63d3720a99140419bd46b9530
- SHA512 0710e25db84073474b6f635ece93d71cc6248e12a719b7b991eeed3d3b5082558789d7357a0dfc39815909f8ac8f8a7dac1259cfee2e951b334fd1b5645d8d15
- TLSH T15AC0C947B38E63A58741B5CA69B081B662490B54C83A6089651A14434C3AB7002B967E
- MD5 SHA1 SHA512 TLSH