overstats-agent.zip
- SHA256 cd554810647d2693c1ad81213570ff1cf4714fadf963977a9228f5a8767af5f8
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
overstats-agent.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
overstats-agent.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
General
- Target overstats-agent.zip
- Size 364KB
- Sample260806-dnghasfe57
- SHA256 cd554810647d2693c1ad81213570ff1cf4714fadf963977a9228f5a8767af5f8
- MD5 ef165363fef103f6f2c98c933934e2da
- SHA1 ced1f98ec5992620723553878a25b7e531c6702e
- SHA512 0e42aa3e718124747641ba2d2c9e2727f63255cf562b4d1669dd8625c47c2afc77f5a2f5dc91c5b7b5a18badbecc296cfe0c30f3a6f1728aa788c1e44334e985
- SSDEEP 6144:2dGvHxhTalqgkrA4VnD4exYm1SNEAZ5PjbX8ilAq1UKU9vSqnNtY:IaHxhTaog0A4VD4JmEEAZJjbXHD1UKYg
- TLSH T1998423046D34FD78DD296778B96FDD6B540084D688940FCA0ABC078A9EE6C388FE67D4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/overstats-agent.exe
File Explorer
-
overstats-agent.zip.zip 364KB
-
PLAYER-README.txt4KB
-
overstats-agent.exe.exe 760KB
PLAYER-README.txt
- SHA256 cd1cf4c180c008b33ff3f95b0ace144b66818968dfafc8a301f33df196e29308
- MD5 5853a3b0a845604871184d7861c9e0e8
- SHA1 3497ad816917aacc6f560ed3df3fbb71f4ab27d3
- SHA512 362b766ec1e3319190f74855952eda8181a0fd032db84d719498db17c760b9857557bf968dfb8384258b11aaef2bd130def440614225299eca3ee7fbe17f21db
- SSDEEP 96:uS+Fma4jEOS+9qOIyaOSkTvlenCDU2gDTTSlbrbSnIMJe305sg:uS9tSVgSqNenYU2KTSlbnS4MN
- TLSH T1E4916C118D5D249F0624F417E908790AFAEB44FF7F6A971335AC3D7E6BE1028C12E61A
- MD5 SHA1 SHA512 SSDEEP TLSH
overstats-agent.exe
- IMPHASH 5579ba7fbfdc076ccb7dbd2a9df4b8ca
- SHA256 e237e23494d04bd21697237036b5c8be2d40a76bf5ef91f924aa503c1cd3bb05
- MD5 b0dc636bf35744274e7d6640473af699
- SHA1 a42389754b6982a9b5584b48e2bac40a7e496678
- SHA512 68a19fec04672ef91fb964df506b50e623e9b0ec5e108c1a5206f38931a0b8c82199502763b9364e063af98fefc64b02171c56f2e9ca17763bc45844dce50a9f
- SSDEEP 12288:tiE1J0ql9iDTtJP4/NyW206P7Y6ceME5UGeK/IJdrGc6:tRRl9iXtel526ebipQ
- TLSH T16FF46E2A66AC01F8E0BBD279CE5B5906F3B6781A03709ADF13D047672E175E45E3E720
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
395820
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
advapi32
RegOpenKeyExW
RegQueryValueExW
RegCloseKey
ws2_32
htons
socket
bind
WSACleanup
InetPtonW
accept
WSAStartup
closesocket
listen
setsockopt
send
recv
shell32
ShellExecuteW
Shell_NotifyIconW
SHGetKnownFolderPath
ole32
CoTaskMemFree
bcrypt
BCryptCreateHash
BCryptDestroyHash
BCryptFinishHash
BCryptCloseAlgorithmProvider
BCryptHashData
BCryptOpenAlgorithmProvider
winhttp
WinHttpSetTimeouts
WinHttpQueryDataAvailable
WinHttpOpenRequest
WinHttpConnect
WinHttpCloseHandle
WinHttpOpen
WinHttpCrackUrl
WinHttpQueryHeaders
WinHttpReceiveResponse
WinHttpSendRequest
WinHttpReadData
kernel32
SetEndOfFile
WriteConsoleW
HeapSize
GetProcessHeap
SetStdHandle
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
GetACP
IsValidCodePage
HeapReAlloc
ReadConsoleW
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
GetFileType
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
VirtualProtect
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
HeapAlloc
GetTimeZoneInformation
HeapFree
GetCommandLineW
GetCommandLineA
GetLastError
Sleep
GetTickCount
SetConsoleCtrlHandler
SetConsoleOutputCP
CloseHandle
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
CreateFileW
GetFileSizeEx
ReadFile
SetFilePointerEx
FreeLibrary
GetProcAddress
LoadLibraryExW
GetModuleHandleW
GetConsoleWindow
GetConsoleProcessList
GlobalAlloc
GlobalUnlock
GlobalLock
GlobalFree
MultiByteToWideChar
WideCharToMultiByte
ExitProcess
GetModuleFileNameW
WriteFile
GetStdHandle
GetModuleHandleExW
FreeLibraryAndExitThread
ExitThread
CreateThread
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
RtlUnwindEx
RaiseException
RtlPcToFileHeader
GetStartupInfoW
IsDebuggerPresent
InitializeSListHead
GetCurrentProcessId
IsProcessorFeaturePresent
QueryPerformanceCounter
QueryPerformanceFrequency
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
TryAcquireSRWLockExclusive
GetCurrentThreadId
LocalFree
FormatMessageA
GetLocaleInfoEx
CreateDirectoryW
FindClose
FindFirstFileW
FindFirstFileExW
FindNextFileW
GetFileAttributesExW
AreFileApisANSI
GetFileInformationByHandleEx
ReleaseSRWLockShared
AcquireSRWLockShared
SetLastError
WaitForSingleObjectEx
GetExitCodeThread
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
GetSystemTimeAsFileTime
EncodePointer
DecodePointer
LCMapStringEx
WakeAllConditionVariable
SleepConditionVariableSRW
CompareStringEx
GetCPInfo
GetStringTypeW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
RtlUnwind
user32
SetWindowLongPtrW
GetWindowLongPtrW
GetCursorPos
SetForegroundWindow
TrackPopupMenu
AppendMenuW
DestroyMenu
CreatePopupMenu
LoadIconW
DestroyWindow
CreateWindowExW
RegisterClassExW
DefWindowProcW
PostMessageW
PeekMessageW
DispatchMessageW
TranslateMessage
OpenClipboard
CloseClipboard
SetClipboardData
EmptyClipboard
ShowWindow
Name
.text
Size
585KB
Virtual Size
584KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
137KB
Virtual Size
137KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
7KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
25KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_RDATA
Size
512B
Virtual Size
500B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=18, id=260, version=33145,
count=6, id=259, version=33145,
count=2, productName=Unmarked objects (old),
count=16, id=260, version=33030,
count=18, id=259, version=33030,
count=99, id=261, version=33030,
count=1, id=262, version=33145,
count=17, id=257, version=33145,
count=223, id=1, productName=Unmarked objects,
count=197, id=261, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,