botnetc2.rar
- SHA256 2fe9414ac8f5a460243c068cf04bfbbc155eaaaa96c2ca74b50c37d96417c73e
Overview
overview
10Static
static
10botnetc2.rar
windows10-2004-x64
8botnetc2.rar
windows10-ltsc_2021-x64
1botnetc2.rar
windows11-21h2-x64
1botnetc2.rar
windows11-ltsc_2024-x64
1botnetc2.exe
windows10-2004-x64
8botnetc2.exe
windows10-ltsc_2021-x64
10botnetc2.exe
windows11-21h2-x64
8botnetc2.exe
windows11-ltsc_2024-x64
10�q �W�l.pyc
windows10-2004-x64
�q �W�l.pyc
windows10-ltsc_2021-x64
�q �W�l.pyc
windows11-21h2-x64
�q �W�l.pyc
windows11-ltsc_2024-x64
readme.txt
windows10-2004-x64
1readme.txt
windows10-ltsc_2021-x64
1readme.txt
windows11-21h2-x64
3readme.txt
windows11-ltsc_2024-x64
1Behavioral task
behavioral1
Sample
botnetc2.rar
Resource
win10v2004-20260513-en
windows10-2004-x64
34 signatures
150 seconds
Behavioral task
behavioral2
Sample
botnetc2.rar
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
3 signatures
150 seconds
Behavioral task
behavioral3
Sample
botnetc2.rar
Resource
win11-20260513-en
windows11-21h2-x64
3 signatures
150 seconds
Behavioral task
behavioral4
Sample
botnetc2.rar
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral5
Sample
botnetc2.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral6
Sample
botnetc2.exe
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
11 signatures
150 seconds
Behavioral task
behavioral7
Sample
botnetc2.exe
Resource
win11-20260513-en
windows11-21h2-x64
10 signatures
150 seconds
Behavioral task
behavioral8
Sample
botnetc2.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
Behavioral task
behavioral9
Sample
�q �W�l.pyc
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral10
Sample
�q �W�l.pyc
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
0 signatures
150 seconds
Behavioral task
behavioral11
Sample
�q �W�l.pyc
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral12
Sample
�q �W�l.pyc
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral13
Sample
readme.txt
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral14
Sample
readme.txt
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
1 signatures
150 seconds
Behavioral task
behavioral15
Sample
readme.txt
Resource
win11-20260513-en
windows11-21h2-x64
5 signatures
150 seconds
Behavioral task
behavioral16
Sample
readme.txt
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
General
- Target botnetc2.rar
- Size 10.0MB
- Sample260807-cdhf6sem4y
- SHA256 2fe9414ac8f5a460243c068cf04bfbbc155eaaaa96c2ca74b50c37d96417c73e
- MD5 bdc731d3fb13584548ecfda9761f1ba9
- SHA1 b822d12f98e805da7bf387cacb33025d870e4ea4
- SHA512 a34558253f07c95a2a56856380087b7a2edb7cbcc0011261f717a5f28fac2d22a712fd4d398eedc62bb02ed2496f229e739ce3b7cb8712d310923b1bc84fd44f
- SSDEEP 196608:DdnBtgzNxBZjfGUSz5784KjLctEqTwe/OoIaJMV7jL8:JB0P1Gi4BEqc4UaJWjw
- TLSH T171B633125CCF3F6EDE84A17EFA4D94ED40E11130484B9E23AE3BC6ACF6A365141995EC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Family: blankgrabber
Blankgrabber is an infostealer written in Python and packaged with Pyinstaller.
- A stealer written in Python and packaged with Pyinstaller 1 IoCs
resource yara_rule static1/unpack002/�q �W�l.pyc blankgrabber_exe - Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/botnetc2.exe
File Explorer
-
botnetc2.rar.rar 10.0MB
-
botnetc2.exe.exe 20.0MB
-
�q �W�l.pyc1KB
-
readme.txt628B
botnetc2.exe
- IMPHASH c990338f8145dc29c6f38fb73cf05c77
- SHA256 4f4ca7a9fd78b4405e0e53b517ba381d21b9da5b6f21409b0222806cf593d13d
- MD5 a97a4ff9e1a47eaf6bfc23c4739e8e08
- SHA1 6cbd259c23c41badf4ada3103df2594cfbfc8258
- SHA512 3ae1cabcd78b517de1b3f15c9b61cfef4a05162294cac59587838dbb469ae61de8396ad04b36ca5edf5ed33b6e0782a457c3a08c222f4c141328e9b10c19b852
- SSDEEP 196608:aFpNcvdtlj9fZwQRCgjmpXHIEGn7jdfPjRMsqeXL2yrjAnDkyZ:Ypgjw8ERIEgfPjSDNWCkyZ
- TLSH T1502733086FDA15F6F5E6453D8C62C83A93B2BEA12F34C2CF026502781E57AD1597F362
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
53456
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
user32
CreateWindowExW
ShutdownBlockReasonCreate
MsgWaitForMultipleObjects
ShowWindow
DestroyWindow
RegisterClassW
DefWindowProcW
PeekMessageW
DispatchMessageW
TranslateMessage
PostMessageW
GetMessageW
MessageBoxW
MessageBoxA
SystemParametersInfoW
DestroyIcon
SetWindowLongPtrW
GetWindowLongPtrW
GetClientRect
InvalidateRect
ReleaseDC
GetDC
DrawTextW
GetDialogBaseUnits
EndDialog
DialogBoxIndirectParamW
MoveWindow
SendMessageW
comctl32
ord380
kernel32
GetACP
IsValidCodePage
GetStringTypeW
GetFileAttributesExW
SetEnvironmentVariableW
FlushFileBuffers
LCMapStringW
CompareStringW
VirtualProtect
InitializeCriticalSectionEx
GetOEMCP
GetCPInfo
GetLastError
FreeLibrary
GetProcAddress
LoadLibraryExW
GetModuleHandleW
MulDiv
FormatMessageW
GetModuleFileNameW
SetDllDirectoryW
GetEnvironmentStringsW
CreateDirectoryW
GetCommandLineW
GetEnvironmentVariableW
ExpandEnvironmentStringsW
DeleteFileW
FindClose
FindFirstFileW
FindNextFileW
GetDriveTypeW
RemoveDirectoryW
GetTempPathW
CloseHandle
QueryPerformanceCounter
QueryPerformanceFrequency
WaitForSingleObject
Sleep
GetCurrentProcess
TerminateProcess
GetExitCodeProcess
CreateProcessW
GetStartupInfoW
LocalFree
SetConsoleCtrlHandler
K32EnumProcessModules
K32GetModuleFileNameExW
CreateFileW
FindFirstFileExW
GetFinalPathNameByHandleW
MultiByteToWideChar
WideCharToMultiByte
FlsFree
FreeEnvironmentStringsW
GetProcessHeap
GetTimeZoneInformation
HeapSize
HeapReAlloc
WriteConsoleW
SetEndOfFile
CreateSymbolicLinkW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
RtlUnwindEx
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
EncodePointer
RaiseException
RtlPcToFileHeader
GetCommandLineA
GetFileInformationByHandle
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
ReadFile
GetFullPathNameW
SetStdHandle
GetStdHandle
WriteFile
ExitProcess
GetModuleHandleExW
HeapFree
GetConsoleMode
ReadConsoleW
SetFilePointerEx
GetConsoleOutputCP
GetFileSizeEx
HeapAlloc
GetCurrentDirectoryW
FlsAlloc
FlsGetValue
FlsSetValue
advapi32
OpenProcessToken
GetTokenInformation
ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertSidToStringSidW
gdi32
SelectObject
DeleteObject
CreateFontIndirectW
Name
.text
Size
170KB
Virtual Size
170KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
77KB
Virtual Size
76KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=183, id=261, version=33140,
count=12, id=260, version=33140,
count=8, id=259, version=33140,
count=3, id=253, version=34321,
count=9, id=259, version=34321,
count=17, id=260, version=34321,
count=40, id=261, version=34321,
count=11, id=257, version=33140,
count=158, id=1, productName=Unmarked objects,
count=25, id=260, version=34808,
count=1, id=258, version=34808,
�q �W�l.pyc
- SHA256 92b5550576e8b47d232123f907537a8cc6f13676e6438dfbf9224021e29e1821
- MD5 31dcb901f61b1092292462263b08198c
- SHA1 365a232c315a0602998c5296434584351f490aea
- SHA512 737c4452e0367455cf3dd73a804119de001b47456ffc36b977fa458764f07b40846ada811e3e20451faa39897ca017930bfc3f859dd8d268537e28183ad4e9e2
- TLSH T1D83121F04E183A53DBCCE2B5C9275C18E26E8932B01A2743631E72F99CCF76DC968520
- MD5 SHA1 SHA512 TLSH
-
A stealer written in Python and packaged with Pyinstaller
readme.txt
- SHA256 037ad67f75655e0c681f706968692ed4dca28fc6999c50cda8d6d2f66c442e4d
- MD5 6d039a198f7d0fa87823d953e8ab2baf
- SHA1 53627cf8f52294c35895afb5d25e9740d6d1562b
- SHA512 8d84d06b361afc15c0354de690ad2b345fa0e659e973e8beaea5d61a623a124aae3b606bc8751ec71dc16ce8c8f42430bb123e6e641f5c120b439074f193fae9
- TLSH T11AF0ACB8D4D8C28E1F246807C38ADCA5A3D8D0690F609D9412B5969850BDCAA72AC3B3
- MD5 SHA1 SHA512 TLSH