beetle-cab.cab
- SHA256 bf0a5efb3d84fa52938ccf45d84483386606204b4f6473cb9030b53baf7b1ba4
Overview
overview
8Static
static
3beetle-cab/7za.dll
windows10-2004-x64
3beetle-cab/7za.dll
windows11-ltsc_2024-x64
3beetle-cab/7za.exe
windows10-2004-x64
3beetle-cab/7za.exe
windows11-ltsc_2024-x64
3beetle-cab/7zxa.dll
windows10-2004-x64
3beetle-cab/7zxa.dll
windows11-ltsc_2024-x64
3beetle-cab/start.cmd
windows10-2004-x64
8beetle-cab/start.cmd
windows11-ltsc_2024-x64
8Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
beetle-cab/7za.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
beetle-cab/7za.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral3
Sample
beetle-cab/7za.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral4
Sample
beetle-cab/7za.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral5
Sample
beetle-cab/7zxa.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral6
Sample
beetle-cab/7zxa.dll
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral7
Sample
beetle-cab/start.cmd
Resource
win10v2004-20260513-en
windows10-2004-x64
17 signatures
150 seconds
Behavioral task
behavioral8
Sample
beetle-cab/start.cmd
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
14 signatures
150 seconds
General
- Target beetle-cab.cab
- Size 13.1MB
- Sample260804-pfhk6swvbw
- SHA256 bf0a5efb3d84fa52938ccf45d84483386606204b4f6473cb9030b53baf7b1ba4
- MD5 64d612286675052142ea0f1b764fb461
- SHA1 c1bf827dd9bff1309cdc014f7c008cdf77532562
- SHA512 3ad54f0d68f2e7b4493f307c2031b4f0b37a9bbb61387f3079b4374fc4c9e8ce346bf5f6dbe40612d8af02acb6aa9aaa29490cdeeb90259b4dda536bb766498e
- SSDEEP 393216:ykC5RTCLfUqwxGPPmoDFYJbFFyC1+JdIivLDb15OINzxoNf:yJv6fUqgpJ1+5LDJ5OITef
- TLSH T1DAD63321B7F5D0BBD2022231D61D3BB596F983490B2489C76380DF6EAF355E1CA3A51D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 3 IoCs
Checks for missing Authenticode signature.
resource unpack001/beetle-cab/7za.dll unpack001/beetle-cab/7za.exe unpack001/beetle-cab/7zxa.dll
File Explorer
-
beetle-cab.cab.cab 13.1MB
-
beetle-cab/7za.dll.dll 272KB
-
beetle-cab/7za.exe.exe 796KB
-
beetle-cab/7zxa.dll.dll 161KB
-
beetle-cab/arc.7z.7z 11.9MB
-
beetle-cab/start.cmd86B
beetle-cab/7za.dll
- IMPHASH abef435823a11ce87635e8e72c359aba
- SHA256 d7f1224cc4afb90af3792dadfdf2f14bad4a19329ee0f3c87c111611aa36b7b1
- MD5 b54e2dcd1a3d593ca0ae4cb71910710e
- SHA1 15ab00317b310a7a535684c7221e0eb6cde68ac2
- SHA512 1414fd599095c3afd4faa6cf56e2f00d9db4d80f460457e4e08734ee24ed852f74d5813b4e96091c330ba8dd2f998995233583bbf887eff1c89b924b09a3fcc0
- SSDEEP 6144:Ml7K/bZ3Xb4/e4BQSx65Pz6RjVM/oTO+T7KmdCUOHn:MRK/bi/ecx6gJVMgTOE7KAQ
- TLSH T13244AE21BBF6C0F5D5862235861C7BBA55FDE3894B10C8D3A390DE1EAE329D2D23950D
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
229479
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
oleaut32
SysAllocStringByteLen
SysAllocStringLen
SysAllocString
SysFreeString
SysStringLen
VariantCopy
VariantClear
user32
CharUpperW
msvcrt
_adjust_fdiv
_initterm
_onexit
__dllonexit
?terminate@@YAXXZ
??1type_info@@UAE@XZ
_except_handler3
_beginthreadex
exit
realloc
memset
strlen
memcpy
memmove
free
_CxxThrowException
malloc
memcmp
_purecall
__CxxFrameHandler
kernel32
InitializeCriticalSection
ReleaseSemaphore
CreateSemaphoreW
ResetEvent
SetEvent
CreateEventW
SetThreadAffinityMask
ResumeThread
WaitForSingleObject
InterlockedIncrement
IsProcessorFeaturePresent
VirtualFree
VirtualAlloc
LoadLibraryW
FreeLibrary
QueryPerformanceCounter
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetVersionExW
GlobalMemoryStatus
GetSystemInfo
GetCurrentProcess
GetProcessAffinityMask
GetLastError
CloseHandle
GetProcAddress
GetCurrentProcessId
GetTickCount
GetCurrentThreadId
GetModuleHandleA
CreateDecoder
CreateEncoder
CreateObject
GetHandlerProperty
GetHandlerProperty2
GetHashers
GetIsArc
GetMethodProperty
GetNumberOfFormats
GetNumberOfMethods
SetCaseSensitive
SetCodecs
SetLargePageMode
Name
.text
Size
231KB
Virtual Size
230KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
23KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.sxdata
Size
512B
Virtual Size
4B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
10KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=3, id=11, version=8047,
count=8, id=14, version=7299,
count=4, id=10, version=8047,
count=2, id=4, version=8047,
count=1, id=95, version=2190,
count=94, id=1, productName=Unmarked objects,
count=7, id=93, version=2179,
count=90, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=2, id=10, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=26, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=3, id=259, productName=VS2019 v16.8.4 build 29336, version=29336,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
beetle-cab/7za.exe
- IMPHASH abae283b9febd6b6c99aae6c6b3d9202
- SHA256 ba7f3627715614d113c1e1cd7dd9d47e3402a1e8a7404043e08bc14939364549
- MD5 90aac6489f6b226bf7dc1adabfdb1259
- SHA1 c90c47b717b776922cdd09758d2b4212d9ae4911
- SHA512 befaa9b27dc11e226b00a651aa91cbfe1ec36127084d87d44b6cd8a5076e0a092a162059295d3fcd17abb6ea9adb3b703f3652ae558c2eef4e8932131397c12d
- SSDEEP 24576:HWdp+y7/ya3yc7tfBA6rDUzfKrBxEATB:up+fa3rLA6s+/
- TLSH T177059F227BF5D077C25211328A1C7BB691F9936C0B2448C763848F2DBB719D5DE3A92E
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
656756
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
oleaut32
VariantCopy
SysAllocStringLen
SysAllocString
SysFreeString
SysStringLen
VariantClear
user32
CharPrevExA
CharUpperW
advapi32
OpenProcessToken
GetFileSecurityW
SetFileSecurityW
RegQueryValueExW
RegCloseKey
RegOpenKeyExW
AdjustTokenPrivileges
LookupPrivilegeValueW
msvcrt
_controlfp
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
__p___initenv
_XcptFilter
_exit
_onexit
__dllonexit
??1type_info@@UAE@XZ
?terminate@@YAXXZ
_except_handler3
_beginthreadex
exit
_ftol
realloc
memset
strlen
wcscmp
wcsstr
strcmp
memmove
fputs
fputc
fflush
fgetc
fclose
_iob
free
malloc
memcmp
_purecall
memcpy
_CxxThrowException
__CxxFrameHandler
_isatty
_fileno
kernel32
CreateEventW
SetEvent
ResetEvent
CreateSemaphoreW
ReleaseSemaphore
InitializeCriticalSection
ResumeThread
SetFileAttributesW
WaitForSingleObject
InterlockedIncrement
VirtualFree
VirtualAlloc
GetOEMCP
LocalFileTimeToFileTime
SetConsoleMode
GetConsoleMode
GetVersionExW
SetFileApisToOEM
GetCommandLineW
GetConsoleScreenBufferInfo
SetConsoleCtrlHandler
DeleteCriticalSection
QueryPerformanceFrequency
QueryPerformanceCounter
GetProcessTimes
OpenEventW
OpenFileMappingW
MapViewOfFile
UnmapViewOfFile
SetProcessAffinityMask
WaitForMultipleObjects
EnterCriticalSection
LeaveCriticalSection
GetStdHandle
GetSystemTimeAsFileTime
FileTimeToDosDateTime
DosDateTimeToFileTime
IsProcessorFeaturePresent
GlobalMemoryStatus
GetSystemInfo
GetProcessAffinityMask
FileTimeToLocalFileTime
FileTimeToSystemTime
CompareFileTime
GetCurrentProcess
GetDiskFreeSpaceW
SetEndOfFile
WriteFile
GetLastError
MultiByteToWideChar
WideCharToMultiByte
FreeLibrary
LoadLibraryW
GetModuleFileNameW
LocalFree
FormatMessageW
CloseHandle
SetFileTime
CreateFileW
ReadFile
RemoveDirectoryW
MoveFileW
GetProcAddress
GetModuleHandleW
CreateDirectoryW
DeleteFileW
SetLastError
SetCurrentDirectoryW
GetCurrentDirectoryW
GetTempPathW
GetCurrentProcessId
GetTickCount
GetCurrentThreadId
FindClose
FindFirstFileW
FindNextFileW
GetModuleHandleA
GetFileAttributesW
GetFileInformationByHandle
GetLogicalDriveStringsW
GetFileSize
SetFilePointer
DeviceIoControl
SetThreadAffinityMask
Name
.text
Size
672KB
Virtual Size
672KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
88KB
Virtual Size
88KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.sxdata
Size
512B
Virtual Size
4B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
29KB
Virtual Size
29KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=12, version=7291,
count=3, id=11, version=8047,
count=9, id=14, version=7299,
count=11, id=10, version=8047,
count=2, id=4, version=8047,
count=1, id=95, version=2190,
count=158, id=1, productName=Unmarked objects,
count=9, id=93, version=2179,
count=188, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=3, id=10, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=36, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=5, id=259, productName=VS2019 v16.8.4 build 29336, version=29336,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
beetle-cab/7zxa.dll
- IMPHASH 72325093dd826f0b5d93d82d3606361c
- SHA256 6b4888207c46c23d2d4e4eace8a2db01711692bc7d4bb93f3750bc41e91bb73c
- MD5 72dcc77ba25ebc4984d959a78c8646d5
- SHA1 50347fcdb44426918d2eeafd5ff8ca9385fbbb0b
- SHA512 1ff7c0027802e65d5d668f2c7d90b71d720c964e7da03c2a8dc8e0b8456bfa8658ca57de17e66a1ebaaef5bf0be1806188813e1da608b6861bc4d8b6a48f8876
- SSDEEP 3072:ifGI+bVn1rLT8VxY9ZcHwDLULRpqnhlGZcQU6aRg+NmVRmCHOtGgYckP:3eK7QwUqnT6aRfmVR5SYz
- TLSH T16FF3BD20B7BAC0F9C70A3231991E7B7752BAE38D4B0059D76350EE9A2E355D5E33C129
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
130359
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
oleaut32
SysAllocStringByteLen
SysAllocStringLen
SysFreeString
SysStringLen
VariantClear
msvcrt
??1type_info@@UAE@XZ
?terminate@@YAXXZ
__dllonexit
_onexit
_initterm
_adjust_fdiv
_except_handler3
memset
strlen
free
malloc
_CxxThrowException
memcpy
memmove
memcmp
_purecall
__CxxFrameHandler
_beginthreadex
kernel32
InitializeCriticalSection
ReleaseSemaphore
CreateSemaphoreW
ResetEvent
SetEvent
CreateEventW
WaitForSingleObject
CloseHandle
VirtualFree
VirtualAlloc
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetVersionExW
GetModuleHandleA
GetProcAddress
GlobalMemoryStatus
GetSystemInfo
GetCurrentProcess
GetProcessAffinityMask
IsProcessorFeaturePresent
GetLastError
CreateDecoder
CreateEncoder
CreateObject
GetHandlerProperty
GetHandlerProperty2
GetHashers
GetIsArc
GetMethodProperty
GetNumberOfFormats
GetNumberOfMethods
SetCaseSensitive
SetCodecs
SetLargePageMode
Name
.text
Size
130KB
Virtual Size
130KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
15KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.sxdata
Size
512B
Virtual Size
4B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=3, id=11, version=8047,
count=8, id=14, version=7299,
count=4, id=10, version=8047,
count=2, id=4, version=8047,
count=1, id=95, version=2190,
count=59, id=1, productName=Unmarked objects,
count=7, id=93, version=2179,
count=72, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=1, id=10, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=16, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=3, id=259, productName=VS2019 v16.8.4 build 29336, version=29336,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
beetle-cab/arc.7z
- SHA256 48435dcd68f7eaedb6bab82de79a35888aaeeb1b742e3ca71180028079319cc1
- MD5 abd05882a7125de640b189716a37e913
- SHA1 1309933bdab3153abdd7e1269f4ff409f45331dd
- SHA512 24ce66ca3531d1d4315831b3cc01ff294743f0ea0c5ea857e41d2213c936373e2f869dba8413966896b9c33cc8c8d83b313858d10e5a70fc803c503645a353c2
- SSDEEP 196608:/OZYSmderuHCLPmuMqqxnmjaxp3P4CQKrKYtcb34Iv8XYkohvqDH1mps8uVaed8f:/OZYSgyuiLPmzqqxnmIP4CttjIqYkoh7
- TLSH T184C633DEC159385BF609B6CCF71E1B0C9B76454B181C6F4A1082BD9A8FBD631C6B81A8
- MD5 SHA1 SHA512 SSDEEP TLSH
beetle-cab/start.cmd
- SHA256 030ee398e53caf0928e757162f3c7be7d593a59dde2795991ec7e4fd8e71f2e3
- MD5 232ebf167ea35163ea69a1570be7b03e
- SHA1 b8bc8c8b3f9ebf83ec43244a934389bd98849a0a
- SHA512 efe7d716b4c2553b1dc295271b1bb32fccf12e2b64e6de7adbf5f8284bdee1c3a92b5a227c46a6bff6c1298d2e7319b73b7a75651710cad84564f0c4ec4c917f
- TLSH T127A01210003B9930B8650418835A079D080B44611522184C381209520004851C0301C2
- MD5 SHA1 SHA512 TLSH