Chara.zip
- SHA256 2c4cb6227d7d416b12d56137373d75c4bbb5874d86013ad9dd19ce1dbfb4de83
Password
Chara
Overview
overview
3Static
static
3Chara/Chara.exe
windows10-2004-x64
1Chara/Chara.exe
windows11-ltsc_2024-x64
1Chara/Hack...LL.dll
windows10-2004-x64
1Chara/Hack...LL.dll
windows11-ltsc_2024-x64
1Chara/Hack...pt.dll
windows10-2004-x64
1Chara/Hack...pt.dll
windows11-ltsc_2024-x64
1Chara/Hack...UP.dll
windows10-2004-x64
1Chara/Hack...UP.dll
windows11-ltsc_2024-x64
1Chara/Hack...Sc.dll
windows10-2004-x64
1Chara/Hack...Sc.dll
windows11-ltsc_2024-x64
1Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Chara/Chara.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
Chara/Chara.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral3
Sample
Chara/HackTool/CharaDLL.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral4
Sample
Chara/HackTool/CharaDLL.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral5
Sample
Chara/HackTool/Crypt.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
Chara/HackTool/Crypt.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral7
Sample
Chara/HackTool/InjectPUP.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral8
Sample
Chara/HackTool/InjectPUP.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral9
Sample
Chara/HackTool/SyspnSc.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral10
Sample
Chara/HackTool/SyspnSc.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
General
- Target Chara.zip
- Size 11.0MB
- Sample260807-lnbwtavvhs
- SHA256 2c4cb6227d7d416b12d56137373d75c4bbb5874d86013ad9dd19ce1dbfb4de83
- MD5 6a1b74c701c236aafbab413a3e3f47cb
- SHA1 3ee32055a4e535abe76151e9fe77c3872e730b87
- SHA512 7a31837e87ddd32fb5a82c3ea53c2212f9ac2469bfead456ee61010b5c5eeb4f2342a1d41b39afd40883326cefc23ef77055b8f1d2316ec167132214cca0dae9
- SSDEEP 196608:RiQwaPs1AAhOFvo1QC3/Q2a2p61oq+kcQlnHFLvXpWT2M7Rar:R6Is7OFvo24pxEVHFzXET2jr
- TLSH T194C633FB08B17438C2F7A46B70C7D016F69A75D95C1230439FAF01EBB096A9A1EC61E5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/Chara/Chara.exe unpack001/Chara/HackTool/CharaDLL.dll
File Explorer
-
Chara.zip.zip 11.0MB
-
Chara/Chara.exe.exe .ps1 371KB
-
Chara/HackTool/....txt3B
-
Chara/HackTool/CharaDLL.dll.dll 109KB
-
Chara/HackTool/Crypt.dll976KB
-
Chara/HackTool/InjectPUP.dll2.0MB
-
Chara/HackTool/SyspnSc.dll13.4MB
-
Chara/README.txt1KB
Chara/Chara.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 fc11ec883f6552e69b00dc71b8ece86e888525cd5f13bab3a892523f0637e5d4
- MD5 99f0eb5663d81521e070dbc66052c01f
- SHA1 5745423160bafcaaa4995d563fda42087f4e5296
- SHA512 1bb170c378177ef5187e07f7ef82416c5d92750b834b44d1b1d3975038470cd62f4040f62c30c98fda8de6f31d4f64f0f45a6ce0092e9b1002cc865c546f6f0f
- SSDEEP 3072:m0lY8Q2GzuPBDp5666W6pt7wOowt4T/cd0igNki:TJGzuPBCPti0Sit
- TLSH T10B841B3716077285F80D1F73F66E5CCA8C15D5839E51EEF8EBAA2528A27D24C4ED128C
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
Chara
Minor OS version
0
Major OS version
4
Entry point
382142
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
365KB
Virtual Size
365KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Chara/HackTool/....txt
- SHA256 ab5df625bc76dbd4e163bed2dd888df828f90159bb93556525c31821b6541d46
- MD5 2f43b42fd833d1e77420a8dae7419000
- SHA1 6eae3a5b062c6d0d79f070c26e6d62486b40cb46
- SHA512 3a8fb4b09bfb7b454177b044ed4854f4a2c3c18f5d6ef28be875f58d064ac9607cc8b11dc23e93a7a5f187ac277534e05658add66604b3bc03c6b76f8476925c
- MD5 SHA1 SHA512
Chara/HackTool/CharaDLL.dll
- IMPHASH 4634626f65d1259996bf5fc5d324a3d7
- SHA256 2cde6d3a161a7c7f9943d4928994b2128e797488dbdd705a8a7f72626a54731d
- MD5 a32ed60845dfc48c2731abea7534451d
- SHA1 2a3a18eae58ced30241ab631af944cf71ffb1691
- SHA512 73e7ab1d07b396414312a1a90b0cb140c55e5117a53426ef40268c70d656c3ab691ba42e88968c85ac4b0878302f2c65a0a6d14daca82debc66a985379dea6ca
- SSDEEP 1536:OpSqZfdIz3hyQXtIimshZ5j7oqjP4A7zWCl7MbiRhRxCWelL:yNdepIiroqjP4AxRxChL
- TLSH T152B31989BFA1DC97D915433945E6C335273DF2806B878B173E2695391E27BA0BFC4282
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
Chara
Minor OS version
0
Major OS version
4
Entry point
5088
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
kernel32
DeleteCriticalSection
EnterCriticalSection
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetLastError
GetSystemTimeAsFileTime
GetTickCount
InitializeCriticalSection
LeaveCriticalSection
QueryPerformanceCounter
RtlAddFunctionTable
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
SetUnhandledExceptionFilter
Sleep
TerminateProcess
TlsGetValue
UnhandledExceptionFilter
VirtualProtect
VirtualQuery
msvcrt
__dllonexit
__iob_func
_amsg_exit
_initterm
_lock
_onexit
_unlock
abort
calloc
free
fwrite
malloc
memcpy
signal
strlen
strncmp
vfprintf
user32
CallNextHookEx
SetWindowsHookExA
UnhookWindowsHookEx
EnableStartButton
KeyboardProc
UnhookKeyboard
keyboardHook
startButtonDisabled
Name
.text
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
96B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.pdata
Size
512B
Virtual Size
504B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.xdata
Size
512B
Virtual Size
436B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.edata
Size
512B
Virtual Size
182B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.CRT
Size
512B
Virtual Size
88B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
104B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
512B
Virtual Size
92B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/4
Size
1024B
Virtual Size
784B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/19
Size
39KB
Virtual Size
38KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/31
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/45
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/57
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/70
Size
512B
Virtual Size
302B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/81
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/92
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
Chara/HackTool/Crypt.dll
- SHA256 582c9b1468cecf1971b5250df3e8654967bb2974f7fb84dbc68f43feb20d8a9e
- MD5 b0d2c8afc81cb5881867137a06cb047b
- SHA1 f19a8591a2413042cd06bdc2a6375489cdfc113b
- SHA512 8ff283dc22da04f3bc798159dc90132c2b86bac6c16653861b32e36ef9925cab6fc492b695b23c07390b0f2a5efd1959afc4b1d9c5da2d46d61df19c8f94542a
- SSDEEP 24576:Dy5KMjWcsmCl3NCIo7KeD0afJKyLsZgrqz9v+Bu0A8:6K4o0fPOK28
- TLSH T1EF2523F3AADDAE694470E725441BF04D34974BE7032AF8E79BC5F0CB0A9C743652294A
- MD5 SHA1 SHA512 SSDEEP TLSH
Chara/HackTool/InjectPUP.dll
- SHA256 db54ee1bb3e5b66b4a222af087266f741f4e46a298aa263463ce9e0efb359ec4
- MD5 e6524f620e8d894b692ea08e67a62486
- SHA1 54fca1dc7b50dbba3ea809547226014135abc410
- SHA512 ed60ab10e62a4423ca8c8b123042724c2a42968040338cdc78be7034ab3e653bc40455eb50f69280aeb1d5274ba80cabb86e1817431c1c28da68e6d92fac95d0
- SSDEEP 24576:C026GYtnM/VAsO1upvM5pJzmLzT85r880aWu6mII02c2ui7GeHpTlqVbzc3OuXWV:CqttIIpJIvsIo6AQ2u8iVbAsp/Vx
- TLSH T1E6A50251DF2B2FDE2D281E8C456F6E554C8D6E323D22C8F1DA9F140B4238AD616B2D1B
- MD5 SHA1 SHA512 SSDEEP TLSH
Chara/HackTool/SyspnSc.dll
- SHA256 31c8769f23e435dbaaa818e1b6f8368bad2c3837f53d394850809e3daa217882
- MD5 0b6dac156864e81c209a5e495ada49d6
- SHA1 80cf770740aa1269dd3ba4987feb2e44dcedb32e
- SHA512 a18b7ebf612d8b101de23cd91569b3edb994514b1f2cf9ece6804cacf3838b00b4ccb16ee9458f965b8f89bcd11ffbf520ef4e4f8aeca3af1735707d31e0ec03
- SSDEEP 49152:djbtMO5c6O0LIs7GNeQ1tXIFR3Ov3U7ptcKK+UN5a9C5LOIX72fUA6iTWTaiHcQn:8
- TLSH T18FE61251DB6F2FCE7D2C0D8D446F2E4A4C8D5E323C22C8F5DADF150B4229AD616A291B
- MD5 SHA1 SHA512 SSDEEP TLSH
Chara/README.txt
- SHA256 67b327c379da5d222cba2845d2d4f63abf87b54bfec26f114b535fa94e7953eb
- MD5 9cd4050d81493ad68c00c88d852b1e76
- SHA1 d900db11ac778ca6419cc35c4e1439daebfda39f
- SHA512 3daf340d2cf3225a9957df10da1e7e745b444867bfb8c6433166685b41f1ca464598eed1e125cc526b9d06117e0485d9e4de6b31fba87261d4d9614bfdb86b5f
- TLSH T180212B1F74E30025137D5043E1C19D03830318FFDC08110ABC00EBAFB91278C721400C
- MD5 SHA1 SHA512 TLSH