BOTS CS1[.]6 STEAM [BY N1TR0] (2) (1)[.]rar

General

Target
BOTS CS1.6 STEAM [BY N1TR0] (2) (1).rar
Size 13.8MB
Sample260810-v2q3bsdr4x
SHA256 8a40283b8c9200872afe92a56dd1a09a366a4afdab3e2343e00c64241555bb1a
MD5 b303ee2431cc65b3b46eb31b2755750f
SHA1 aeba633badace0a06c8e64e9fd09e53bc0c9bb40
SHA512 911eadf56be7a5952fd92d27939fbcfce63605c1d366f30811bfb43f5e6fd03a152140aabbe0d6ab9fdcf214cc316548de3cc81d05f76795638aa8daa57b30fc
SSDEEP 196608:Dpn54rYHQFHUxICpFNGu7KuMtNQ/712B08PhKwgVTSkPzkgQT5KHM8VR2pN0:x5D1x9pFKuMNu1v8KwgxfBVMc
TLSH
T1F0E6337F7C5AC71EE3188AD1E980E30A671CFECD79226081D7CDD652CE563AE0972825
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/BOTS BY N1TR0'/bots.exe

File Explorer

BOTS CS1.6 STEAM [BY N1TR0] (2) (1).rar

.rar 13.8MB
BOTS BY N1TR0'/bots.exe

.exe 14.4MB

BOTS CS1.6 STEAM [BY N1TR0] (2) (1).rar

SHA256 8a40283b8c9200872afe92a56dd1a09a366a4afdab3e2343e00c64241555bb1a
MD5 b303ee2431cc65b3b46eb31b2755750f
SHA1 aeba633badace0a06c8e64e9fd09e53bc0c9bb40
SHA512 911eadf56be7a5952fd92d27939fbcfce63605c1d366f30811bfb43f5e6fd03a152140aabbe0d6ab9fdcf214cc316548de3cc81d05f76795638aa8daa57b30fc
SSDEEP 196608:Dpn54rYHQFHUxICpFNGu7KuMtNQ/712B08PhKwgVTSkPzkgQT5KHM8VR2pN0:x5D1x9pFKuMNu1v8KwgxfBVMc
TLSH
T1F0E6337F7C5AC71EE3188AD1E980E30A671CFECD79226081D7CDD652CE563AE0972825
MD5 SHA1 SHA512 SSDEEP TLSH

BOTS BY N1TR0'/bots.exe

IMPHASH a24e57cfb1e35030a9b4252bf1fa8b4b
SHA256 311469a1755fc2bf87956df15f3c8b8f4759a7409efcab8078bb7a0e3eab696e
MD5 8ba5a05ce1d467d4a58d319c863877cf
SHA1 73c4227ee4ae46410916c488d1e2859f63df47b9
SHA512 f2840d07b6a4bf33fece0f4067db18a29ae5c9c3835cc6bb383eaf938219955daef226dcb177ad1ddbf7554549983a5a839a42437ba6d57d09e2a9ab5b25d8fd
SSDEEP 196608:YKeTIy+BouA/jLlmNbuKKbYppppppppppmadPzcQokavLRRGbWWsXTPHQT6Gu35c:YKjyUBglm4vCFzcjRTIlsMf2L1xqFB
TLSH
T159E633E02589ED69D07CE134CEAD9A181F8CDCEFAC66515985C07E83143AB54CE3ACB7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

7581

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

lstrcmpiA lstrcpyA lstrlenA _lclose RemoveDirectoryA DeleteFileA GetModuleFileNameA _lread _llseek _lopen GetDiskFreeSpaceA SetCurrentDirectoryA CreateDirectoryA GetFileAttributesA lstrcatA GetTempPathA GetCurrentDirectoryA _lwrite _lcreat CloseHandle GetExitCodeProcess CreateProcessA ExitProcess TerminateProcess GetCurrentProcess HeapFree HeapAlloc GetModuleHandleA GetStartupInfoA GetCommandLineA GetVersion InitializeCriticalSection EnterCriticalSection LeaveCriticalSection GetEnvironmentVariableA GetVersionExA HeapDestroy HeapCreate VirtualFree VirtualAlloc HeapReAlloc RtlUnwind UnhandledExceptionFilter FreeEnvironmentStringsA FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStrings GetEnvironmentStringsW SetHandleCount GetStdHandle GetFileType GetCurrentThreadId TlsSetValue TlsAlloc SetLastError TlsGetValue GetLastError WriteFile GetCPInfo GetACP GetOEMCP GetProcAddress LoadLibraryA InterlockedDecrement InterlockedIncrement MultiByteToWideChar LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW

user32

TranslateMessage DispatchMessageA PeekMessageA MsgWaitForMultipleObjects wsprintfA LoadCursorA SetCursor MessageBoxA

Sharing