staffbesting dih 7.rar
- SHA256 d50fd22220a64e71237cb2f5c92b60fda825c6bdda157c0cc09494c15cd5be64
Password
1
Behavioral task
behavioral1
Sample
staffbesting dih 7.rar
Resource
win10v2004-20260513-en
windows10-2004-x64
14 signatures
600 seconds
Behavioral task
behavioral2
Sample
staffbesting dih 7.rar
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
15 signatures
600 seconds
General
- Target staffbesting dih 7.rar
- Size 48.4MB
- Sample260804-ebenlsvwds
- SHA256 d50fd22220a64e71237cb2f5c92b60fda825c6bdda157c0cc09494c15cd5be64
- MD5 0890f4539807712027d6dbaf4ac023ee
- SHA1 a321c91fde1a7148142585477e4ceed3374f7f2b
- SHA512 be1d4a86c4d2ed8d9f8b728d645fe0cdfcb9ca5e4047e5a1c75029ebd0f137c35ec9889d879ecfe12cf82edbff585330a2a697bd37cb5006cd9bca6766e6abf5
- SSDEEP 786432:IhDU62SLG1fxBPLIMye9bfxgco3pRyHXRD3dy9RoqV3Tw+0bL27cVOFooHZvo:YVdsxBMMye9ewDsNTV0bL2AVOFPZA
- TLSH T1E7B73331E3C5606885EAF24287299C4DAEE38324052DDBE7711DE8D95EFE71A4C23B85
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Detects Pyinstaller 1 IoCs
resource yara_rule static1/unpack001/staffbesting dih 7/SpiritX_tools.exe pyinstaller - Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/staffbesting dih 7/Private Bypass.exe unpack001/staffbesting dih 7/SpiritX_tools.exe
File Explorer
-
staffbesting dih 7.rar.rar 48.4MB
-
staffbesting dih 7/How To Use.txt1KB
-
staffbesting dih 7/Kılavuz.txt455B
-
staffbesting dih 7/Private Bypass.exe.exe 37.7MB
-
staffbesting dih 7/SpiritX_tools.exe.exe 12.6MB
-
spiritx_crack.pyc13KB
-
staffbesting dih 7/hosts305B
-
staffbesting dih 7/server.crt1KB
-
staffbesting dih 7/server.key1KB
-
staffbesting dih 7/steps.txt810B
-
staffbesting dih 7/yonetici calistir sonra loaderi aç.bat636B
staffbesting dih 7/How To Use.txt
- SHA256 97ab190c674175f90ced9b5675522328bb2dee0beec8bd4425993f718e4f5e9c
- MD5 28392848cf9cd31fe09d2f2365030760
- SHA1 3805cc0211312db18369b74bed0261689cddf603
- SHA512 62fd3541c00998a8d0d7f0d9516fffb2cdc0c9d2c9cc12138919a261d18815e6f00e3c664f5ac43a9ffd5ca35dca7eae7ecfd0412414f0839ef2ba339ce6239d
- TLSH T1C22141A5BA0757750132102A322D7BD9FB235079661BFC21707C02B812BC526867CEDA
- MD5 SHA1 SHA512 TLSH
staffbesting dih 7/Kılavuz.txt
- SHA256 8f2457cef073de3c09bc4be2cd6ac812db7b07a7c5840db04464128541cc6ef0
- MD5 48017cd8d9bdaddbea9a8ca359eec56e
- SHA1 248f2349ad1a6fb42ff90bc8f59ddcccb3e72af3
- SHA512 36f8ebd33d150d99bb5b30d3feb7c462d67181b3c7143f6290c8522a8c9995288aadbac42a1c4e280df0cfa37e612acd7710c2cd5a4bac82916df61493f1eb0a
- TLSH T14DF027246B9882200E6B678FE1AEE576135B8A173910F8533C270559A868F1692F4869
- MD5 SHA1 SHA512 TLSH
staffbesting dih 7/Private Bypass.exe
- IMPHASH faed04e0ce2a671893548510a896aa86
- SHA256 4396fe61b146334c7040cf9a7acf329762181c30a0b007e1955e2419f603e70e
- MD5 a3dd81fe6080e9189232383f993552e3
- SHA1 56b2d25351a3036eeaab8609753a4e28016a4bac
- SHA512 18465f5e12085c058f90e5c6c8881b3028f6931df1faa3ce3da870cf5c3156ac914d0fbddadea8436271c45f83cbc6b399f137a4421f7b7e923883599dbeaf90
- SSDEEP 786432:6yMXVYdC6aJS0jlUWAWalFXA4Zu4Ubd1arm/fjYEKC:5wbIMl7xaXwSyn9/btKC
- TLSH T1E68733D778C561B0D0EB8B02B247D3ADA191AD251AD92C0D32D63D431F32EFB9A06D67
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
1
Minor OS version
0
Major OS version
6
Entry point
68733349
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
shell32
SHFileOperationW
kernel32
FlsGetValue
Name
.text
Size
Virtual Size
142KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
Virtual Size
59KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
Virtual Size
161KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.TCD
Size
Virtual Size
32.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.O"u
Size
512B
Virtual Size
88B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.ptq
Size
37.6MB
Virtual Size
37.6MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
23KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
268B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
staffbesting dih 7/SpiritX_tools.exe
- IMPHASH d5b1104f7bf955d6b89a47291d5b603b
- SHA256 086809caa3f9a5d76d68053395bf6cfd725fb26da61c85cbc963337a2a095c88
- MD5 48641b69500502d2c887b4d132f610b6
- SHA1 db42f0b03f6705a55fe2871c5bf911d038952225
- SHA512 65c0523062784feb24b73ded7eb0e2a82f1a794760154a8bd81da46384cd009013c8aefce0fac3d41c2f307e6454baeef30ce26242a99ad3042eddc27611bc68
- SSDEEP 393216:RDMgIfUKOcR1idq1B7/zCQsHsoqybpin:O58KPR1ig1dzGnnbp
- TLSH T1F8D6335C92E109B2F4ABA23D06A64557C1B171145712CEEF07E1836A2E9B3F34E36BF1
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects Pyinstaller
-
Unsigned PE
Checks for missing Authenticode signature.
Password
1
Minor OS version
0
Major OS version
6
Entry point
54976
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
user32
GetCursorPos
ShutdownBlockReasonCreate
GetWindowThreadProcessId
SetWindowLongPtrW
GetWindowLongPtrW
MsgWaitForMultipleObjects
ShowWindow
DestroyWindow
CreateWindowExW
RegisterClassW
DefWindowProcW
PeekMessageW
DispatchMessageW
TranslateMessage
GetMessageW
GetMonitorInfoW
MonitorFromPoint
GetSystemMetrics
kernel32
GetTimeZoneInformation
GetProcessHeap
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
GetStringTypeW
GetFileAttributesExW
SetEnvironmentVariableW
FlushFileBuffers
GetLastError
FreeLibrary
GetProcAddress
LoadLibraryExW
FormatMessageW
GetModuleFileNameW
SetDllDirectoryW
CreateSymbolicLinkW
SetErrorMode
CreateDirectoryW
GetCommandLineW
GetEnvironmentVariableW
ExpandEnvironmentStringsW
HeapSize
FindClose
FindFirstFileW
FindNextFileW
GetDriveTypeW
RemoveDirectoryW
GetTempPathW
CloseHandle
QueryPerformanceCounter
QueryPerformanceFrequency
WaitForSingleObject
Sleep
GetCurrentProcess
GetCurrentProcessId
TerminateProcess
GetExitCodeProcess
CreateProcessW
GetStartupInfoW
LocalFree
SetConsoleCtrlHandler
GetConsoleWindow
K32EnumProcessModules
K32GetModuleFileNameExW
CreateFileW
FindFirstFileExW
GetFinalPathNameByHandleW
MultiByteToWideChar
WideCharToMultiByte
HeapReAlloc
WriteConsoleW
SetEndOfFile
DeleteFileW
RtlUnwindEx
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
SetUnhandledExceptionFilter
GetModuleHandleW
SetLastError
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
RtlLookupFunctionEntry
EncodePointer
RaiseException
RtlPcToFileHeader
GetFileInformationByHandle
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
ReadFile
GetFullPathNameW
SetStdHandle
GetStdHandle
WriteFile
ExitProcess
GetModuleHandleExW
GetCommandLineA
IsProcessorFeaturePresent
HeapFree
RtlCaptureContext
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
GetConsoleMode
ReadConsoleW
SetFilePointerEx
GetConsoleOutputCP
GetFileSizeEx
HeapAlloc
GetCurrentDirectoryW
VirtualProtect
CompareStringW
LCMapStringW
advapi32
ConvertSidToStringSidW
GetTokenInformation
OpenProcessToken
ConvertStringSecurityDescriptorToSecurityDescriptorW
Name
.text
Size
183KB
Virtual Size
182KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
79KB
Virtual Size
79KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
10KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
43KB
Virtual Size
42KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=182, id=261, version=33145,
count=12, id=260, version=33145,
count=11, id=259, version=33145,
count=3, id=253, version=35721,
count=9, id=259, version=35721,
count=17, id=260, version=35721,
count=39, id=261, version=35721,
count=7, id=257, version=33145,
count=140, id=1, productName=Unmarked objects,
count=29, id=260, version=36246,
count=1, id=258, version=36246,
spiritx_crack.pyc
- SHA256 e4e3493d0817b1ffd17e05ea5ec5fea64d6a79689efcf489e8a12cda2d541a8e
- MD5 835d5424f1ec55eff5f0054386822495
- SHA1 269a74e52251f9e0657c424d81aff3b87342bfcc
- SHA512 979327f4d6a3520d9f872a98759f6e9612466c80050c15e43d6cf827adbb6b174f874a8b90d76aa97d7ebcaf3a679c983c2b94bd46fa0ba924a85d364cd41613
- SSDEEP 192:6+q5l3ldy0eppd+0+xkEqFFUkKBJHT0dGYnrdq8yXIASQdrw2y:fo3JezMNjqF/6No1nrdqNftu2y
- TLSH T1AD52923448907757FEEDE53830F6E9995736A2CAB2368707F1941CF8AFCD20489606AD
- MD5 SHA1 SHA512 SSDEEP TLSH
staffbesting dih 7/hosts
- SHA256 041daa803a6e510e6b2f757b97a2294f4147dc0c4ed0db01ab0e92fd798a3ade
- MD5 a12601934ac21051d2d8b01d59afae10
- SHA1 4f073a396c2e46de3f4801fff8c526fb845ef4d4
- SHA512 1fc4b9fb6b64a5092189720b5e252edbc21317c60f1fa542ce0634261a1550ded3ea06ef34b7360b69f38cb023191c47caf9cc1048e579b616ab456fd414869b
- TLSH T1A6E04224811F849E9CF2B592182FA32BD003D9620C877A467A6CD56D337D95E146005C
- MD5 SHA1 SHA512 TLSH
staffbesting dih 7/server.crt
- SHA256 c85df6007a9b65adec92e9319ca285f6bbe2373cc4e1b8bc7c1665bf4c4171bf
- MD5 48cd7546ca25b4b2e681cec0f16f008f
- SHA1 f00ad5a94a34619991b4f60529eb814cb1e49c02
- SHA512 c89f0ffa37759f2e6093c59a97fa03e2c7a1dea8caeb0d5f55105dbdfd8d365042821a05c9ff61b60a34c5e72267a9dd072de4e530ecf28efb5ee0b409cc5646
- TLSH T1CE2195618F38E683F043DA8AD5F3A86B427D1154DC92E3A320636CF55A803345C5E97B
- MD5 SHA1 SHA512 TLSH
staffbesting dih 7/server.key
- SHA256 a30d3451740e43c400ffb8fcfa2399649a401a6767b3ca2bfe7e71bb2813d30a
- MD5 82e3a2a1b612b91368b6369a137f0306
- SHA1 f44bff0dc8a5eb1907760d4f92467f30a466905d
- SHA512 fe651c269e7824f1195343d434fdbbf2d206dbc51d213a08ae5129b175910c1fbc695360c26af52b6e64210f000acb6967922efa17f54163d2df3e08ad9ba669
- TLSH T17531F84A3D8D0FE18057D964F79389B6E0BCC02A1382D2AA3B194003EA5C6CB161AB70
- MD5 SHA1 SHA512 TLSH
staffbesting dih 7/steps.txt
- SHA256 7dc59199612e5417f62f17eff329ab036f9d68dedea137d1b97e6f4f558a5ea1
- MD5 55603516d9769fa7bab7b467a94d6c8f
- SHA1 688b15cfc65d54b042cbcdde092b601be5dbd25f
- SHA512 0eca2d249a9ca8c29d4c10d052d3586ccb56e5ef7f9c8d6c562307c98647d96c8aa5fa3050f158ed9bcc2b09be0c0251c68f3b572a68498c80b10f3d7141c575
- TLSH T17D01F1B3A2E7233917134150501E46D12F925069C2A6E450346A14F8839BEB3A8BE7FE
- MD5 SHA1 SHA512 TLSH
staffbesting dih 7/yonetici calistir sonra loaderi aç.bat
- SHA256 17e98d92ccfdb23c3e14aa1e5aa55e8ffd71e31a395ac8f3c122c7436303bab5
- MD5 6de192f8e7f86649535e833623974a6b
- SHA1 4e2cdb3c243fe656884fe199e21e9e45c4ec567a
- SHA512 35e50867a9628d84cf43ed2ea79ecec38734dc1eac3011a13ac442fb998e31d31a965864bf6edee0d5bf9854725a312880582f39296737b303df9456c3ba69cc
- TLSH T198F0810A84EC85CF38D2FB3437D3A722471E75ADB963A2E91F91901D008828326ED48F
- MD5 SHA1 SHA512 TLSH