K.zip
- SHA256 1456b586637bb881cdd7ff3ad32620fd4ca4fb74ee048dc0ceec7b2265908550
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Release/BeDaisy.sys
Resource
win11-20260513-en
windows11-21h2-x64
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
Release/PasterSix RainbowSix made by Overhead.exe
Resource
win11-20260513-en
windows11-21h2-x64
2 signatures
150 seconds
General
- Target K.zip
- Size 405KB
- Sample260804-yt533axtcv
- SHA256 1456b586637bb881cdd7ff3ad32620fd4ca4fb74ee048dc0ceec7b2265908550
- MD5 871af6884f310bc2400956bd936d614b
- SHA1 385c59709b3337850f880e8074fb1cbddbe13fc7
- SHA512 287a215bd56e412c7d94d5f53ed54b617389b55e0ac7e5b6e4d27a192d6f4d6ed7f7ed281a962ecb29efa5eb3267ee1f0eb2538181cd9aec8a4227d8a3626b51
- SSDEEP 12288:pj/QaQCbk3dhKzXf1AlPnXzGWUs4ijriD:pn+dG1APDbUsxjeD
- TLSH T1029423AC7B7449ACCFC7B5B754DF85C1885AB9A4CBF84C23604D52A3B164989CCE4B2C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/Release/BeDaisy.sys unpack001/Release/PasterSix RainbowSix made by Overhead.exe
File Explorer
-
K.zip.zip 405KB
-
Release/BeDaisy.sys.sys 18KB
-
Release/PasterSix RainbowSix made by Overhead.exe.exe 1.1MB
Release/BeDaisy.sys
- IMPHASH 3803ac984b44d93e5b67a787365cd79f
- SHA256 35b0d79631b6c0e13569b35fea3371e540e1e24a1ad240aa4095bc003312463b
- MD5 4c0c465499d6ee54352570d2807d12d8
- SHA1 332a6b3bf722e97780d09328d420fc8815f8e514
- SHA512 53124eadac016c0ad5c2937d09a8a37a4fabda32b56bb3fb90defdab9fa2ba149841056f992e0fb7154308aa71b4f5352a5dcbb5d7ddecf0b5aa036f1899c5ce
- SSDEEP 384:e2regI48Iq1qhvYoP6MUMv5g5M/b0475a:eaUi/UMvTJa
- TLSH T15C822CC3A39C58E5E31DC1BB46661A27D1B2BC25272377DF0251C13A2757AE8753AB40
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
5216
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\User\Desktop\driver and inj\bin\Release\KernelDriver.pdb
ntoskrnl.exe
RtlInitUnicodeString
IofCompleteRequest
IoCreateDevice
IoCreateSymbolicLink
IoDeleteDevice
MmIsAddressValid
KeGetCurrentIrql
ExAllocatePoolWithTag
MmGetSystemRoutineAddress
RtlEqualUnicodeString
ExFreePoolWithTag
ProbeForRead
ProbeForWrite
MmMapIoSpace
MmUnmapIoSpace
IoGetCurrentProcess
ObfDereferenceObject
ZwClose
KeStackAttachProcess
KeUnstackDetachProcess
PsLookupProcessByProcessId
ObOpenObjectByPointer
ZwAllocateVirtualMemory
ZwFreeVirtualMemory
PsGetProcessPeb
PsGetProcessWow64Process
ZwProtectVirtualMemory
__C_specific_handler
PsProcessType
MmBuildMdlForNonPagedPool
MmProtectMdlSystemAddress
MmMapLockedPagesSpecifyCache
MmUnmapLockedPages
IoAllocateMdl
IoDeleteSymbolicLink
IoFreeMdl
KeInitializeEvent
KeSetEvent
KeWaitForSingleObject
MmProbeAndLockPages
MmUnlockPages
PsCreateSystemThread
PsTerminateSystemThread
ObReferenceObjectByHandle
PsGetThreadId
PsGetThreadProcessId
PsIsThreadTerminating
PsLookupThreadByThreadId
PsGetContextThread
PsSetContextThread
PsThreadType
Name
.text
Size
13KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
272B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
1024B
Virtual Size
816B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.idata
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=259, version=33145,
count=1, id=260, version=33145,
count=3, id=257, version=33145,
count=51, id=1, productName=Unmarked objects,
count=6, id=260, version=34810,
count=1, id=258, version=34810,
Release/PasterSix RainbowSix made by Overhead.exe
- IMPHASH 13fc67a215597b2f476443012d81e321
- SHA256 e28ca9a07aa706f04f0fbee73a8e6cfc6df3b28c46d4e47d3676e73dfb8ed783
- MD5 cb514364aa967a88c4b423bdef76a0fb
- SHA1 d0aeca382ba0300a7b0ae0767b7ec090db415ef9
- SHA512 42f20da1ed8bf89a7c6befcf19db322d097af0c39b2c75a2c9a24d4676f5118118e065fe98c7964fb8d72b96eea847e942d2490a89786ea0df6be3bcc1ba69d6
- SSDEEP 6144:Qv3bzZvcYHpkqFTuik4npuU0XJuFO3ACQpn9QLggggggg8nMY+FvSlDzLUvPaJ+V:QxvcMvFbpuUaYOspn9ZFvPvPh0YuuIe
- TLSH T1B3352756A55149A6C47A523454E2E23AFB7A3CB4063283071AEE7D333FF2EE1BC55342
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
319772
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
dwmapi
DwmExtendFrameIntoClientArea
kernel32
QueryPerformanceCounter
QueryPerformanceFrequency
GetStdHandle
CreateFileW
CloseHandle
GetLastError
Sleep
CreateThread
OpenProcess
GetTickCount
VirtualAlloc
VirtualFree
VirtualQueryEx
GetModuleHandleA
GetModuleHandleW
GetProcAddress
GetConsoleWindow
CreateToolhelp32Snapshot
Process32First
Process32Next
AcquireSRWLockExclusive
WakeAllConditionVariable
SleepConditionVariableSRW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GlobalFree
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
GlobalLock
GlobalUnlock
GlobalAlloc
GetCurrentProcess
ReleaseSRWLockExclusive
user32
OpenClipboard
CloseClipboard
SetClipboardData
GetClipboardData
EmptyClipboard
GetActiveWindow
GetKeyState
GetCapture
SetCapture
ReleaseCapture
GetClientRect
SetCursorPos
SetCursor
GetCursorPos
GetWindow
FindWindowA
SetWindowLongA
GetWindowLongA
GetWindowRect
GetWindowTextA
GetForegroundWindow
UpdateWindow
GetSystemMetrics
GetAsyncKeyState
SetWindowPos
MoveWindow
ShowWindow
DestroyWindow
CreateWindowExA
UnregisterClassA
RegisterClassA
PostQuitMessage
DefWindowProcA
PeekMessageA
DispatchMessageA
TranslateMessage
LoadCursorA
ScreenToClient
ClientToScreen
gdi32
GetStockObject
imm32
ImmGetContext
ImmReleaseContext
ImmSetCompositionWindow
msvcp140
_Query_perf_counter
_Query_perf_frequency
_Mtx_lock
_Mtx_unlock
?_Throw_Cpp_error@std@@YAXH@Z
?_Xlength_error@std@@YAXPEBD@Z
d3d9
Direct3DCreate9Ex
vcruntime140
__current_exception_context
__current_exception
__C_specific_handler
memcmp
_CxxThrowException
__std_exception_destroy
__std_exception_copy
memset
memmove
memcpy
memchr
__std_terminate
strstr
vcruntime140_1
__CxxFrameHandler4
api-ms-win-crt-string-l1-1-0
strcmp
strncpy
isprint
strncmp
_stricmp
wcsncpy_s
api-ms-win-crt-stdio-l1-1-0
fclose
fflush
fread
fseek
_wfopen
ftell
__p__commode
_set_fmode
fwrite
__stdio_common_vfprintf
__stdio_common_vsprintf
__stdio_common_vsscanf
__acrt_iob_func
api-ms-win-crt-heap-l1-1-0
_callnewh
_set_new_mode
free
malloc
api-ms-win-crt-utility-l1-1-0
rand
qsort
api-ms-win-crt-math-l1-1-0
pow
atan2f
fminf
fmodf
fmaxf
fabs
_fdtest
sqrtf
sinf
floorf
__setusermatherr
powf
ceilf
cosf
api-ms-win-crt-runtime-l1-1-0
_initterm_e
__p___argc
__p___argv
_c_exit
_register_thread_local_exe_atexit_callback
_initterm
_get_initial_narrow_environment
_set_app_type
_seh_filter_exe
_crt_atexit
exit
_invalid_parameter_noinfo_noreturn
_exit
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
terminate
system
_cexit
api-ms-win-crt-convert-l1-1-0
strtoul
atof
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
Name
.text
Size
312KB
Virtual Size
312KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
781KB
Virtual Size
781KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
6KB
Virtual Size
118KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rcal
Size
512B
Virtual Size
75B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
488B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=18, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=6, id=257, version=34321,
count=4, id=259, version=34321,
count=10, id=260, version=34321,
count=35, id=261, version=34321,
count=13, id=257, version=33145,
count=287, id=1, productName=Unmarked objects,
count=6, id=261, version=34810,
count=1, id=255, version=34810,
count=1, id=258, version=34810,