RemoteAccess.zip
- SHA256 17b48fe37c4573aa78676a11fde9bd7258cde598c133db23582a60934c3a471a
Overview
overview
7Static
static
3INICIAR_CLIENTE.bat
windows10-2004-x64
7INICIAR_CLIENTE.bat
windows11-ltsc_2024-x64
7INICIAR_SERVIDOR.bat
windows10-2004-x64
7INICIAR_SERVIDOR.bat
windows11-ltsc_2024-x64
7RemoteClientMQTT.exe
windows10-2004-x64
7RemoteClientMQTT.exe
windows11-ltsc_2024-x64
7RemoteServerMQTT.exe
windows10-2004-x64
7RemoteServerMQTT.exe
windows11-ltsc_2024-x64
7Behavioral task
behavioral1
Sample
INICIAR_CLIENTE.bat
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
INICIAR_CLIENTE.bat
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral3
Sample
INICIAR_SERVIDOR.bat
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral4
Sample
INICIAR_SERVIDOR.bat
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral5
Sample
RemoteClientMQTT.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral6
Sample
RemoteClientMQTT.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
Behavioral task
behavioral7
Sample
RemoteServerMQTT.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral8
Sample
RemoteServerMQTT.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
General
- Target RemoteAccess.zip
- Size 57.0MB
- Sample260813-e9dtzazycz
- SHA256 17b48fe37c4573aa78676a11fde9bd7258cde598c133db23582a60934c3a471a
- MD5 6710ed7831fa4ea6e5f319be8361bc6d
- SHA1 664b3b9d677be69c2aa583f7ed903785d6f719d7
- SHA512 e21151f059e4236deee7bb81767347375f4e6d6077a3411dd7d1986d7a8a30d55be9eaa77f4627febfca9325bb0b52ec2731d08d2c04c3dee58456d47413e4c1
- SSDEEP 1572864:PnGVHxhi9kBF1lDFgkkQinhP57q6tbxXhlKAM9UZ:PGVRhLB7dihBOyxXBZ
- TLSH T1FCD733EA649678361864CAAA6FED875D62C548DF9721D374A3AD3F3D003F3098F70921
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Detects Pyinstaller 2 IoCs
resource yara_rule static1/unpack001/RemoteClientMQTT.exe pyinstaller static1/unpack001/RemoteServerMQTT.exe pyinstaller - Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/RemoteClientMQTT.exe unpack001/RemoteServerMQTT.exe
File Explorer
-
RemoteAccess.zip.zip 57.0MB
-
INICIAR_CLIENTE.bat598B
-
INICIAR_SERVIDOR.bat601B
-
RemoteClientMQTT.exe.exe 30.2MB
-
remote_client_mqtt.pyc16KB
-
RemoteServerMQTT.exe.exe 27.3MB
-
remote_server_mqtt.pyc10KB
INICIAR_CLIENTE.bat
- SHA256 b4c3de81c096e43ebd55ee2f3ffebf170bdc1f205ada6dacf03ca4152434113d
- MD5 2cb544fc67b080474d88e798cddabc4c
- SHA1 61f3abd1cefaae8deb4a44eb0d0595d2e5b9b3b0
- SHA512 f54d49cb8ce94a8dcf0fbc79914d811200c4b142d5eef1e5a5bd6d79c1bd5de0e6488b2759eaf538792ca0fe85c33cfc616a55d92f0d2b4cc3c049c6756cf3f7
- TLSH T175F0F0D2B3D2362868DE4296CC02D0A1740B715781409E6EF88F527C8F4D7E9E5AC1C0
- MD5 SHA1 SHA512 TLSH
INICIAR_SERVIDOR.bat
- SHA256 f6eaaceb9788a56fbf381047862999255d61746c80c4a695536f8c5a9e05d089
- MD5 151e9009415a86fa565b76e281e22dc1
- SHA1 d4abf338b8ef2427ce484adf98c5d414e6f83fdc
- SHA512 3b249c43b9819cd2326749e70fb84ddf2ec79d63a6d31275c1c8089ba605291dc64a41f39f532ddcc4ae3767f9bac296c153b069d78f32e90fdfc7e33a4e2d90
- TLSH T104F05996B29235D458D651998C4710A6710B905B81506E8DBD6FC27E4F8EFE5F6AC0C0
- MD5 SHA1 SHA512 TLSH
RemoteClientMQTT.exe
- IMPHASH cf72283be50852e418ce6bbb6b645835
- SHA256 5cedd55c7984075af7ae2e89477c14d0f4bb81430bf3541d309be17d6b8829ca
- MD5 15219590a6f0b8a79e5b762f5797ce29
- SHA1 6be88d3e0e7776cf795bc3854895ead6682a3eb6
- SHA512 672607c7c7ead9863b21ea0ec9bfde748ae9f16a62e2e86a78e9b22aba3d12c4f1ba7f0a6e94ab40c3a4ee9f90e34fb048014d8cbdc3e853e6d1b192c050a504
- SSDEEP 786432:wbS4ce2s7KXsmbRphfXahpHJXduJT+0to+xat+1Nvl7ewq:D4f/7wPhfXahkJmSew
- TLSH T18B6733C973641C7AF8A5413D6DDA865B92A1786147B1C3AB1BF91F380C7B2C8EE30B51
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects Pyinstaller
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
57632
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
user32
CreateWindowExW
ShutdownBlockReasonCreate
MsgWaitForMultipleObjects
ShowWindow
DestroyWindow
RegisterClassW
DefWindowProcW
PeekMessageW
DispatchMessageW
TranslateMessage
GetMonitorInfoW
MonitorFromPoint
GetCursorPos
GetSystemMetrics
PostMessageW
GetMessageW
MessageBoxW
MessageBoxA
SystemParametersInfoW
DestroyIcon
SetWindowLongPtrW
GetWindowLongPtrW
GetClientRect
InvalidateRect
ReleaseDC
GetDC
DrawTextW
GetDialogBaseUnits
EndDialog
DialogBoxIndirectParamW
MoveWindow
SendMessageW
comctl32
ord380
kernel32
GetACP
IsValidCodePage
GetStringTypeW
GetFileAttributesExW
SetEnvironmentVariableW
FlushFileBuffers
LCMapStringW
CompareStringW
VirtualProtect
GetCurrentDirectoryW
HeapAlloc
GetFileSizeEx
GetConsoleOutputCP
GetOEMCP
GetCPInfo
GetLastError
FreeLibrary
GetProcAddress
LoadLibraryExW
GetModuleHandleW
MulDiv
FormatMessageW
GetModuleFileNameW
GetEnvironmentStringsW
CreateSymbolicLinkW
SetErrorMode
CreateDirectoryW
GetCommandLineW
GetEnvironmentVariableW
ExpandEnvironmentStringsW
DeleteFileW
FindClose
FindFirstFileW
FindNextFileW
GetDriveTypeW
RemoveDirectoryW
GetTempPathW
CloseHandle
QueryPerformanceCounter
QueryPerformanceFrequency
WaitForSingleObject
Sleep
GetCurrentProcess
TerminateProcess
GetExitCodeProcess
CreateProcessW
GetStartupInfoW
LocalFree
SetConsoleCtrlHandler
K32EnumProcessModules
K32GetModuleFileNameExW
CreateFileW
FindFirstFileExW
GetFinalPathNameByHandleW
MultiByteToWideChar
WideCharToMultiByte
SetFilePointerEx
FreeEnvironmentStringsW
GetProcessHeap
GetTimeZoneInformation
HeapSize
HeapReAlloc
WriteConsoleW
SetEndOfFile
SetDllDirectoryW
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
SetUnhandledExceptionFilter
RtlUnwindEx
SetLastError
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
RtlLookupFunctionEntry
EncodePointer
RaiseException
RtlPcToFileHeader
GetCommandLineA
GetFileInformationByHandle
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
ReadFile
GetFullPathNameW
SetStdHandle
GetStdHandle
WriteFile
ExitProcess
GetModuleHandleExW
IsProcessorFeaturePresent
RtlCaptureContext
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
HeapFree
GetConsoleMode
ReadConsoleW
advapi32
OpenProcessToken
GetTokenInformation
ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertSidToStringSidW
gdi32
SelectObject
DeleteObject
CreateFontIndirectW
Name
.text
Size
178KB
Virtual Size
177KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
79KB
Virtual Size
79KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
9KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
61KB
Virtual Size
61KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=183, id=261, version=33145,
count=12, id=260, version=33145,
count=11, id=259, version=33145,
count=3, id=253, version=35721,
count=9, id=259, version=35721,
count=17, id=260, version=35721,
count=39, id=261, version=35721,
count=11, id=257, version=33145,
count=158, id=1, productName=Unmarked objects,
count=29, id=260, version=36246,
count=1, id=258, version=36246,
remote_client_mqtt.pyc
- SHA256 5c2282446a48c94243d2d40292d30e3624cb3d69a1971bf2c58ebf2cb0d61175
- MD5 f3cd5efa6377c6cc9473b9e23abb5116
- SHA1 a9e08e617bc7978a0dbdb0ea34de1be524f0cbdc
- SHA512 2fd55a446da9f83e310b5f5d95bf208eebde17af6f962980fdb48cadc1f92ec0e0e7c2ec183345dac250eb037e59fd89d4f4ccc653ead1a5d24a2f6af798dd09
- SSDEEP 192:/axCmdHVVql1ywiig4RNaWdr5+LG4js26+l53Y7RqGwzKuPQe/888y4:MCmLVO1D7taW55+aL253w7uD/8P
- TLSH T10272D7745990A87BF99CF27A71C3DAA0B7319741B215E307E0B448BE6CCE391C95938E
- MD5 SHA1 SHA512 SSDEEP TLSH
RemoteServerMQTT.exe
- IMPHASH d5b1104f7bf955d6b89a47291d5b603b
- SHA256 29d45716c6e82bf010cf5e849e040a5b4da4c54bf6f63cfbc7fc8d7ed88ff655
- MD5 9a60da33ee0657625cbcb4a5f9df057a
- SHA1 d03da55cc9b4996de5baee04ef00df8299ab1987
- SHA512 4d7457f66130c87d8cf272b0442b47e023e7ad99034ecc80beb2313f4de800ecd9d3d2752946db3504e396d501be0a32540d2d579cd983222d44535abed4ac23
- SSDEEP 786432:SbS4ce2s7Ko0RphfXahpHJXduJT+0to+rP1Nvl7ewq:Z4f/J0PhfXahkzVew
- TLSH T1C7573399726128BFECE185399EAAD1A6E2216C915761D3BF07EC1F3A0C7F3044E34B54
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects Pyinstaller
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
54976
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
user32
GetCursorPos
ShutdownBlockReasonCreate
GetWindowThreadProcessId
SetWindowLongPtrW
GetWindowLongPtrW
MsgWaitForMultipleObjects
ShowWindow
DestroyWindow
CreateWindowExW
RegisterClassW
DefWindowProcW
PeekMessageW
DispatchMessageW
TranslateMessage
GetMessageW
GetMonitorInfoW
MonitorFromPoint
GetSystemMetrics
kernel32
GetTimeZoneInformation
GetProcessHeap
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
GetStringTypeW
GetFileAttributesExW
SetEnvironmentVariableW
FlushFileBuffers
GetLastError
FreeLibrary
GetProcAddress
LoadLibraryExW
FormatMessageW
GetModuleFileNameW
SetDllDirectoryW
CreateSymbolicLinkW
SetErrorMode
CreateDirectoryW
GetCommandLineW
GetEnvironmentVariableW
ExpandEnvironmentStringsW
HeapSize
FindClose
FindFirstFileW
FindNextFileW
GetDriveTypeW
RemoveDirectoryW
GetTempPathW
CloseHandle
QueryPerformanceCounter
QueryPerformanceFrequency
WaitForSingleObject
Sleep
GetCurrentProcess
GetCurrentProcessId
TerminateProcess
GetExitCodeProcess
CreateProcessW
GetStartupInfoW
LocalFree
SetConsoleCtrlHandler
GetConsoleWindow
K32EnumProcessModules
K32GetModuleFileNameExW
CreateFileW
FindFirstFileExW
GetFinalPathNameByHandleW
MultiByteToWideChar
WideCharToMultiByte
HeapReAlloc
WriteConsoleW
SetEndOfFile
DeleteFileW
RtlUnwindEx
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
SetUnhandledExceptionFilter
GetModuleHandleW
SetLastError
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
RtlLookupFunctionEntry
EncodePointer
RaiseException
RtlPcToFileHeader
GetFileInformationByHandle
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
ReadFile
GetFullPathNameW
SetStdHandle
GetStdHandle
WriteFile
ExitProcess
GetModuleHandleExW
GetCommandLineA
IsProcessorFeaturePresent
HeapFree
RtlCaptureContext
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
GetConsoleMode
ReadConsoleW
SetFilePointerEx
GetConsoleOutputCP
GetFileSizeEx
HeapAlloc
GetCurrentDirectoryW
VirtualProtect
CompareStringW
LCMapStringW
advapi32
ConvertSidToStringSidW
GetTokenInformation
OpenProcessToken
ConvertStringSecurityDescriptorToSecurityDescriptorW
Name
.text
Size
183KB
Virtual Size
182KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
79KB
Virtual Size
79KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
10KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
60KB
Virtual Size
59KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=182, id=261, version=33145,
count=12, id=260, version=33145,
count=11, id=259, version=33145,
count=3, id=253, version=35721,
count=9, id=259, version=35721,
count=17, id=260, version=35721,
count=39, id=261, version=35721,
count=7, id=257, version=33145,
count=140, id=1, productName=Unmarked objects,
count=29, id=260, version=36246,
count=1, id=258, version=36246,
remote_server_mqtt.pyc
- SHA256 150b5492042c14997684c815a44b812eab0d23e54928f40239872e85b57c48af
- MD5 dac4d9f0a2eabb57f7831531d5d7abc4
- SHA1 0d09d8471d3550c89b4dfee02babba921f8062f3
- SHA512 26e0f540baf7693800ab3e6002c4fbd63937561c97dc70ecf9f573c5be45035382588ca10abb2c477b28f9eb276ce10ed5bfdb8ad48329b3058ab9fde87e673e
- SSDEEP 192:+lvLci3kMKgY+mw6SXs7sMl2IQMSOypUMFS5kZ6yIsFnR:2H3egY46SXs7sHMS4ASqZ6nsz
- TLSH T1E52208BAC568A827FCEEE17530C7C9C05361C2866121A347F5489DBE1EED725E65430F
- MD5 SHA1 SHA512 SSDEEP TLSH