f9151b0b2799342ce1017cee1b034cc51179e8271a56c6f967651b596896bd9c
- SHA256 f9151b0b2799342ce1017cee1b034cc51179e8271a56c6f967651b596896bd9c
Overview
overview
8Static
static
5f9151b0b27...9c.zip
windows10-2004-x64
1f9151b0b27...9c.zip
windows11-ltsc_2024-x64
1actions/__init__.py
windows10-2004-x64
3actions/__init__.py
windows11-ltsc_2024-x64
3actions/about.py
windows10-2004-x64
3actions/about.py
windows11-ltsc_2024-x64
3actions/install.py
windows10-2004-x64
3actions/install.py
windows11-ltsc_2024-x64
3actions/ui.py
windows10-2004-x64
3actions/ui.py
windows11-ltsc_2024-x64
3bot_actions.py
windows10-2004-x64
3bot_actions.py
windows11-ltsc_2024-x64
3config.py
windows10-2004-x64
3config.py
windows11-ltsc_2024-x64
3main.py
windows10-2004-x64
3main.py
windows11-ltsc_2024-x64
3run.bat
windows10-2004-x64
8run.bat
windows11-ltsc_2024-x64
8scanner/cipher.py
windows10-2004-x64
3scanner/cipher.py
windows11-ltsc_2024-x64
3scanner/client.py
windows10-2004-x64
3scanner/client.py
windows11-ltsc_2024-x64
3builder.exe
windows10-2004-x64
8builder.exe
windows11-ltsc_2024-x64
8scanner/env.py
windows10-2004-x64
3scanner/env.py
windows11-ltsc_2024-x64
3scanner/worker.py
windows10-2004-x64
3scanner/worker.py
windows11-ltsc_2024-x64
3Behavioral task
behavioral1
Sample
f9151b0b2799342ce1017cee1b034cc51179e8271a56c6f967651b596896bd9c.zip
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
f9151b0b2799342ce1017cee1b034cc51179e8271a56c6f967651b596896bd9c.zip
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
actions/__init__.py
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral4
Sample
actions/__init__.py
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral5
Sample
actions/about.py
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral6
Sample
actions/about.py
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral7
Sample
actions/install.py
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral8
Sample
actions/install.py
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral9
Sample
actions/ui.py
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral10
Sample
actions/ui.py
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral11
Sample
bot_actions.py
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral12
Sample
bot_actions.py
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral13
Sample
config.py
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral14
Sample
config.py
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral15
Sample
main.py
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral16
Sample
main.py
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral17
Sample
run.bat
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral18
Sample
run.bat
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
10 signatures
150 seconds
Behavioral task
behavioral19
Sample
scanner/cipher.py
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral20
Sample
scanner/cipher.py
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral21
Sample
scanner/client.py
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral22
Sample
scanner/client.py
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral23
Sample
builder.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral24
Sample
builder.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
10 signatures
150 seconds
Behavioral task
behavioral25
Sample
scanner/env.py
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral26
Sample
scanner/env.py
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral27
Sample
scanner/worker.py
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral28
Sample
scanner/worker.py
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
General
- Target f9151b0b2799342ce1017cee1b034cc51179e8271a56c6f967651b596896bd9c
- Size 11.3MB
- Sample260810-caeacahj5x
- SHA256 f9151b0b2799342ce1017cee1b034cc51179e8271a56c6f967651b596896bd9c
- MD5 52300c8d335f26bbbb4b0d60f89c021b
- SHA1 219728756dff35d62dac58bdf5878578f07e1dbe
- SHA512 b8114c24f25f92ee5104bbef83b2caab4e3849dfd9e7db1e3b22b19ca87b66ae9050fbc2b0213f4e846d082505fcead1b3bd6948a09cf9e8c6a3466fb755acb8
- SSDEEP 196608:FY9/ini6U74pjhCtosK7EI/zaBpJrLoa59/fPeET22Nr+pA1Iflx9bi08At:F46UUBhMPkZ7UPHoa5lfPeEl+pAv08At
- TLSH T118C633484FFB691A299A89F431BA31129613B7C70C686376A4EDF40B7017BC4C85EF5B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
-
resource yara_rule static1/unpack002/builder.exe upx - Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack002/builder.exe
File Explorer
-
f9151b0b2799342ce1017cee1b034cc51179e8271a56c6f967651b596896bd9c.zip .ps1 11.3MB
-
LICENSE1KB
-
README.md17KB
-
actions/__init__.py63B
-
actions/about.py63B
-
actions/install.py1KB
-
actions/ui.py7KB
-
bot_actions.py10KB
-
config.json942B
-
config.py3KB
-
main.py3KB
-
requirements.txt136B
-
run.bat.bat .vbs 373B
-
scanner/cipher.py2KB
-
scanner/client.py2KB
-
scanner/data/builder.dat.zip .ps1 11.3MB
-
builder.exe.exe .ps1 11.3MB
-
scanner/env.py1KB
-
scanner/worker.py5KB
LICENSE
- SHA256 35cf1518393cf2355c2acc4879588f9b1359777dde3c6454db1b31a17cac6487
- MD5 6691d066b2e6d5c5e9e03549cab4a405
- SHA1 38595279e5fdd0a1a8f83b1a7b1ab87b76485af9
- SHA512 cfc97bc095c95ddd14fdee113114c706a7f5ada92c14522a2377e6a1a622ad3a4080afcc711da79e3b2db16d632c4dfeb89e249a5893b644bc122757693544b2
- TLSH T14011861E729503631C9257605579ECC5F12BB18A7FAB1981346DF209132A45CCAFFC64
- MD5 SHA1 SHA512 TLSH
README.md
- SHA256 b2b8ed52876015cb17b1a5c3b5556ca33f4c497e99bea6ec91f9edd38f351eaf
- MD5 97d33112d90980782c5ad230e10c85d2
- SHA1 3ae6189d16f3d2712a1e8bcfd5c6d6c668701a0a
- SHA512 0dae62ffb4c9557e90dcce6eb76cf4004a74e52353d35a5bcd9939d8bccd5880c8a5153b4837b4f71fd2612ad69d758ddd967ee8f7d276182d3e5b06c9f91ca5
- SSDEEP 384:F+h+tlnMeBUkPGAMMly1djZoWDyEnNOLHBtHa:e+DnMeBPBOdj+JO+htHa
- TLSH T12C82E4729A2029993BE6CD5EA0712E83DA167447F7041934B28DB1D84FFC529CDBF4B4
- MD5 SHA1 SHA512 SSDEEP TLSH
actions/__init__.py
- SHA256 909e6ff461d0fb1e971f4ccc7fd754d1555fffcadb30f67432f41863947df845
- MD5 3a91f7f1ef3357f4f1522137e8ebb935
- SHA1 2984d10bab5ae33441ef9863e8db0af7fc21070a
- SHA512 b505cfa37b44f41aa9157e3e82e278ea1961399c89ae287d1adb25ec14e4c78e52a2a6e95f9411909fa00de3c661bc4775c96064c2c9fb0e9874da280fa28863
- TLSH T1D0A00224B2D06A6157A289152653452428FEB07CE1905EE51812806E566D94649B2546
- MD5 SHA1 SHA512 TLSH
actions/about.py
- SHA256 414e19388a97ce181d2cb6b359b4db2cf78bd3bd8b5b90fc63bfb3ce9f04ffa3
- MD5 7884c7becb618eb9165a411af3738072
- SHA1 41460183e4b123a0ec426ef77da3ee711d59d338
- SHA512 a0bd059a5463679936c00680dd77ba855e177363daaa691b88b82ca5b2943514be8e9b2e3628bbb3099c13f3cb07a527e31e2ea56d6176d81337d3e74dc70769
- TLSH T10EA02230B3C0082002A208282222000028EE303CC0888EF20800802C002CC0208B0202
- MD5 SHA1 SHA512 TLSH
actions/install.py
- SHA256 c6121cfed6ba4ec535d79cd7e0be44354f3f0f241c39e3e6887a6f3552813c73
- MD5 7ba3ef94e3efb8f4efa94c6645a86ab2
- SHA1 8eb5b921ed20f32d3ca2a6bf50bb87c159cfdf17
- SHA512 10f35fcd0de4551abccf9ab83bd028bb3cf5648dd639633534693f0b81e4ad0d49d2e4dc853cde79fd72593e45a61af99798fc2d25125bfe6933e73992bad7fc
- TLSH T18A4121145D1335A0B036C598D4274423E39B69130EB825B3F9FCC1289FB5963D9F6DA6
- MD5 SHA1 SHA512 TLSH
actions/ui.py
- SHA256 53f4df2ad4592cc5ef52c2a94262a755c14c6cb8d6ff7fe8e20413e60fd71ba8
- MD5 8401d1ee895c4426dae18e313da20e76
- SHA1 27ceb3b178d5f3a86538587bac02e9117339de99
- SHA512 7c1cb2489ddd69a666c746b877f13186263b4edc11e09d3334478f088f7ea2a71891dc6d66c690accea4d5b143009ef68040b418be266b98c2d8b3ca6d63d8c1
- SSDEEP 192:XSpF9/QYIPQD07Q8irZ4QgIlFwQykQj9EQZIVuyA6i0I:1QCQ14QgIlFwQykQj9EQZIVupL0I
- TLSH T157F1AA3299617720927E8C18C477EC3AE7121AC38B756526F2FCC6A92F75872C8598DC
- MD5 SHA1 SHA512 SSDEEP TLSH
bot_actions.py
- SHA256 ac5cbced981c3866c3b63edb9ff5fc114377d9e828d689127cf4471aa3e62f10
- MD5 ca7b7045e8c8b49eb25bee467e993bce
- SHA1 1aaf764bdb0fd66fdb12f5878de4d7e8af018121
- SHA512 ab3ff3c2225833f09570838995447ad92e7609c75b64425b70f5a2a236e9c8454153f53108798fc8d5da1237f401d9f7fd03771e2611f61674d233e736d70443
- SSDEEP 192:YOPr2s5GpMTPGo3+SDIGSclpVWn6315RKVzRC36QQamCdxNdRxWQlrr54Kr1oUrK:rTGph7lGS1ns2zQNmCdHx1lps
- TLSH T158327821DC9A1C52C2BA881CD897C116F71A679305797922BABC835C4F748A4DEE6CF8
- MD5 SHA1 SHA512 SSDEEP TLSH
config.json
- SHA256 a8fed5a657f343443bd6f5e32d93aca3e30477603c9a5d2712c3077e457598dc
- MD5 ed858f80f431e3e39b67afc71f653860
- SHA1 57cdeeb1ccc0ce5d0ba8a3b02b99227b93e603e9
- SHA512 77bea407d633c1c658a7e12c10c2c54bf9969903e205c0a359def1d133776c48af7fcb3220906809e1d761a516527a3011b7fc3a3c67c7823c63340583a8b70a
- TLSH T108116D16CDA94C7B15F5E16AA4707703F1657B5B01084E2F76FC4AAC0F76E125183E1A
- MD5 SHA1 SHA512 TLSH
config.py
- SHA256 f7c5e87d6b861600e92d440a9546f344625d87a4bacebdc08c52c2d9eaa7129d
- MD5 2968bb2a85fccba7fe9fbe3ec7983e60
- SHA1 5a50e000ba136f6009f4c310a17a1ae662f3a324
- SHA512 ebfef4d48d442f843bc5d6dd7f6c6f7ea0f67c2d74a7c24b17ae92257bec4072961b1b66a6cc1c7a5feb5574638ef78e5d54194091d8231b9f35aae5c6bc906b
- TLSH T1FD81BD07DC8E6D6343F9893AE026E617F80DAFC702006825B9BCB26C2F7945389E751D
- MD5 SHA1 SHA512 TLSH
main.py
- SHA256 a931fe4892bd013645cfd877ebd7f2263d426e3d5e03f4233e0d21c2dc1b35f8
- MD5 21983d0d1605b4e5f9bb2c1f1d3cc179
- SHA1 26b8858e1e34b3701deea5abd9bf082c449f5dd7
- SHA512 5028c5552afb3bd877e779e2663cb63f37daeb444acac51cb0fdc255b2b5ae044eab29dfdab13adc5392559de8eecf225ea5e427840bf57681d14fbe6ebb7eb3
- TLSH T1A08120276E0E29224677446DC697C890CE6753039B31687B70FD861C0FB58E0C9B7E76
- MD5 SHA1 SHA512 TLSH
requirements.txt
- SHA256 7d3b6c3442c606c88a7b48d7e318c558c4a3424f07a6f7c9472f28eca330e919
- MD5 6078e9e13775508e134105f89f0559d1
- SHA1 c79fce6766b94bbc63a3842137d5775786ccedd1
- SHA512 31ab719dbe5e4609b60833b39c0486ec610b4f1668cac78a55a2fe34ed36632ffd110df5e22b256b6bc01cde9ab88b1b3de0fc27ae55e01199f82b26f4e14d75
- TLSH T166C02B400B3484C096E0C409203EC111488DB7DC71713EC8927ED50B480E0C30411308
- MD5 SHA1 SHA512 TLSH
run.bat
- SHA256 81992f29c2c5ba5a792961eda49d6cb7175a588305c811fa1e047f7414a845d6
- MD5 4c9bb5a86fe1531798960cde0c7fd904
- SHA1 3f2cde175bf4d839c06c8251333023776e7fb6cf
- SHA512 6e20c94626c4a50eae37213af244ac6381e35b3551f3102d483cd58068052fa1877e05b67906e96890d092c5e19efea4b0b897930025eed3b5b37d44a74f3dbd
- TLSH T1F8E0D89A15042625C1B207DC08F42598FA0ED1B34AE8A9CCB75485A96F7F283A566ED8
- MD5 SHA1 SHA512 TLSH
scanner/cipher.py
- SHA256 5c45eac21d78492a7e3edd678e530a7057e5bc55b2b06ce76eb18642ab5d6926
- MD5 8c2e8bb0913278d59b96904c902333f3
- SHA1 71d8d9e7d4e24b3a00decdb9bf23519a7a7709f7
- SHA512 b7b31c70767fe4868a847306e29369c6629f6a0673d7c6d4a40d55dbe0ebdddc3993d1c7802c1bbba9fe0f6e86720b40429ff3c0839de3fab94278751e989c2f
- TLSH T19941F2A6BC27C4C543F1E12ED966C421F419F7178121A129761C9BA42FBB83CE1B109D
- MD5 SHA1 SHA512 TLSH
scanner/client.py
- SHA256 4f5fe884349f2032e47ec90b3a18741bd80edf90789169eb5aaeab75e10c5427
- MD5 d531a7b51d5b6bfa64be0ff639868ecd
- SHA1 bf0821990fb0dea07cc7dc21f53af9e586022939
- SHA512 3fab1674f0714141b98224c2e9aaa27a6db2ea18f02b3896514717d96d6c0b4d2adccf2452314877d145e30d0231eba8e0588a2a802dade5cb4a845c4dd63ad2
- TLSH T12D51CEB06947B000C6F655AD557AA213F36FE6C76229012338BC94605FBB032DDF8D8D
- MD5 SHA1 SHA512 TLSH
scanner/data/builder.dat
- SHA256 a6f31046d3f4dadeacded37236d6ec8eccb1664f427dc06351510ab9978fdfe7
- MD5 21fa8e33cb4d4ce936e5a17bc582e547
- SHA1 f057b65c8ec3ec128f71a6a0989b044023e511bd
- SHA512 8a0529ed31b1bb0893ebc3b99a2807097267703947829abd305e08a0c552f9c28118bf8a9f7252897498a44c3d353052ba7b17ae41b0000706f81b3844172dbb
- SSDEEP 196608:b4r9KZGy0FEpjhC1S6m72W9pU9LNVf0gJj/pT+8To+L3CXEhIXJb7t8MYsb:boy0GBhYZgN/6RR0gJzpT+8FCXEBMYsb
- TLSH T13FC633484FFB691A299688F432BA71169603A7C70C686376B4EDF40B7017BC4C85EF97
- MD5 SHA1 SHA512 SSDEEP TLSH
builder.exe
- SHA256 b3d7eeb00379d8672182923a162612bbef85243b8dd60a8a81a8a8edb4245785
- MD5 4d880030fafaaa53603a6e784aa6ed42
- SHA1 b564a078751fe81595a3881c3ea6bce9eaa72622
- SHA512 07088c9a1c14dd4dcadc5bc251b5acb85b5abcff883395670836b5956d77456b2df30121d88e6a001c94e4c0c8b0cfef2ab37fd93d562e214fcb455d52f4e1d4
- SSDEEP 196608:0ZkLDU1OkQDe/jhCZG+S72EtfYLdb71EOlb/h3mgTauJZWhWBcR11df+emi:CukQirhgvc71YVZEOlLh3mgLWhW1emi
- TLSH T176C633484FBB6919E99688F432BA71169203B7C70C696336B4EDF40B6017BC4C85EF97
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
15310992
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
Name
UPX0
Size
Virtual Size
3.3MB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
11.3MB
Virtual Size
11.3MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
scanner/env.py
- SHA256 f3da7c746fda2548c001e5100c6bf8e74bc502bcf518d5c1cfc6476e517ca159
- MD5 b16b819e209aa17f50da68df8d36bdf9
- SHA1 835a179e8f918c45fe751c05c7143ba269ab99f9
- SHA512 71a0b82c7a70ba699357f126ab413482ee6706369d4bf7b983d3831d4a33290967897c7a543d42e3bb7d3293f50eb07421ae7c50a0d445bca3bbe66a88c812f3
- TLSH T1423158A7EE5BDD1A637C1B0DC58AF24CE65642173D52860B7AFC6A7C2F344A040E1239
- MD5 SHA1 SHA512 TLSH
scanner/worker.py
- SHA256 8587e10715679b8f1812c7e94e2b60f8c495f23646df9a9ddd0c056b2ec03c8a
- MD5 19236ecfbb2276fe7acc0e7241495b92
- SHA1 26dd4fe1ab05b4e07acd10c175dfe154ae02e9b7
- SHA512 3b7f85838509e48438be6cb2841dfa42494838c1761348bc32ecb7eb7333851ba093720d8f985cfe7fc08c5976cd307a76391279067278f29fa5aed32e368046
- SSDEEP 96:fytY34t5cedrcr1rZgNYrZT9/H4k+iWTa/lj1RrqrXnztNYr0bo1c2k2gkF:rkrcr1rZgNYrZJ/H4k+K/l7rqztNYrSk
- TLSH T1CBB1FE95CD27B100C7BA886EA411A743E32B9387161E1572B6FCC3680FB4425DAECDDC
- MD5 SHA1 SHA512 SSDEEP TLSH