rebooted.rar
- SHA256 07b5274e08eb30c1db4d84e3eb212e7fb3bbe4be8f91713f646320ebaa81320c
Overview
overview
8Static
static
3LAUNCHER.bat
windows10-2004-x64
8LAUNCHER.bat
windows11-ltsc_2024-x64
8LAUNCHER.ps1
windows10-2004-x64
8LAUNCHER.ps1
windows11-ltsc_2024-x64
8REBOOTEDSPOOFER.exe
windows10-2004-x64
1REBOOTEDSPOOFER.exe
windows11-ltsc_2024-x64
1keyauth_emulator.py
ubuntu-18.04-amd64
1keyauth_emulator.py
debian-9-armhf
1keyauth_emulator.py
debian-9-mips
1keyauth_emulator.py
debian-9-mipsel
1server.key
macos-10.15-amd64
1Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
LAUNCHER.bat
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
LAUNCHER.bat
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
Behavioral task
behavioral3
Sample
LAUNCHER.ps1
Resource
win10v2004-20260513-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral4
Sample
LAUNCHER.ps1
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
7 signatures
150 seconds
Behavioral task
behavioral5
Sample
REBOOTEDSPOOFER.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
REBOOTEDSPOOFER.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral7
Sample
keyauth_emulator.py
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
0 signatures
150 seconds
Behavioral task
behavioral8
Sample
keyauth_emulator.py
Resource
debian9-armhf-20260513-en
debian-9-armhf
0 signatures
150 seconds
Behavioral task
behavioral9
Sample
keyauth_emulator.py
Resource
debian9-mipsbe-20260513-en
debian-9-mips
0 signatures
150 seconds
Behavioral task
behavioral10
Sample
keyauth_emulator.py
Resource
debian9-mipsel-20260513-en
debian-9-mipsel
0 signatures
150 seconds
Behavioral task
behavioral11
Sample
server.key
Resource
macos-20250619-en
macos-10.15-amd64
0 signatures
150 seconds
General
- Target rebooted.rar
- Size 37.2MB
- Sample260814-my5sbasthx
- SHA256 07b5274e08eb30c1db4d84e3eb212e7fb3bbe4be8f91713f646320ebaa81320c
- MD5 313c990df57c96687e41e319cf2ff26e
- SHA1 5f6a067e496a7ef91eb739b0d16ce84c97d68d69
- SHA512 f7a6ab3a9cb1a7a77fe4cc01a24c656334ba11d7643d99a7b66ef6858bea116d9676a1e5c00baed973b81d62f9408d836642ac6aa12121e7be173cdb68315d19
- SSDEEP 786432:2QwbASKIZCQw0zui4LTG4B4jM33d/0cQhfw5KBwJSCFYCKuIAhlWmhng:lwbA8ZC5hRTG4B4jQdaS5YwgCvtIcfW
- TLSH T1D68733FF2AA9B7D6A7F2F6C718B0C4A1524F80F19F043765620D153E14BB613D6268E8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/REBOOTEDSPOOFER.exe
File Explorer
-
rebooted.rar.rar 37.2MB
-
LAUNCHER.bat393B
-
LAUNCHER.ps1.ps1 4KB
-
REBOOTEDSPOOFER.exe.exe 43.0MB
-
keyauth_emulator.py.py .sh 8KB
-
server.crt1KB
-
server.key1KB
-
server.pfx2KB
LAUNCHER.bat
- SHA256 00c0f5856b30a76be23c5af9053280b2025d6ed62e33d3b599733ce6b6d830f1
- MD5 4227591794b4f124d4b9526ffb068515
- SHA1 2a3a865ead848210aff105619c51ed6c6bfa06b6
- SHA512 320a8d32f18e936f045fc3a6cf86fe039ea70b2bc534267671c8906d2d897b809151e9f7f26c232ad43a592ae7bbc31dbce5b98ff9ebbd37879e482c090c5010
- TLSH T1BFE0F10126EA03BF8334E541C15821A5ED5C634B301844DA32A1A1743B05580C7F4CCC
- MD5 SHA1 SHA512 TLSH
LAUNCHER.ps1
- SHA256 c6bc91613bfdcebd8f1b46871a4f3bce0639bfe4a0438f1452e156778c90140a
- MD5 a835b3ea37f73108673ef30fef2ec6c5
- SHA1 531db6db8009af8a3dce954a1a730636daa8e700
- SHA512 4ee80883c61d08dd176148afe323d23936c6bba6d92b2093affd782f6f5a212a1c1c3ec2d39860047ceab09cc18483ea548f8bec16929421c962b7e6068134d4
- SSDEEP 96:aNmi3mPELpcET9NpIxBH8TC38zM2UJ8zr:Pi34EdcWIXH8FUJO
- TLSH T126A12135F105250E85F6169E0502B26CFC96C07752CB09C4B15C82AABBF6BAE4B36DB6
- MD5 SHA1 SHA512 SSDEEP TLSH
REBOOTEDSPOOFER.exe
- IMPHASH 53aa1c42e9e2fc90e2df00eb6fd052f8
- SHA256 702a9a60b898192ca046399b9ec0a3ff17c3126e5a030c691ffa0bc271b90eee
- MD5 02cb99b7a27d1dd6c44d7402749a723f
- SHA1 7665693b3a690c2c8d215f6adab45bdbe66f1a53
- SHA512 f9a500a1c6431ecfbdf2f1854b5d0338304eb881bb1bdabeb43cbabcb247385360e2fdd5a9a3fdddd3f854f04e25918b785440d7d91269d12f92141fe3ed3115
- SSDEEP 786432:k615BMqw6B5LSzSzYo6FvR8VhFyLXLJej8aCmaoWLVFw0TwL7TuhyJ2u56v:ZMqtLSzpfvmrFyLtejLCma5ZF3MLfuhZ
- TLSH T175A723DB2AEA52ECD4C34B8057CF22DA51C1B53A85AD986D2FCB2C031530DBBD549A37
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
35252198
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
d3d11
D3D11CreateDeviceAndSwapChain
d3dcompiler_43
D3DCompile
advapi32
RegOpenKeyA
winhttp
WinHttpReadData
kernel32
DeleteFileA
GetSystemTimeAsFileTime
HeapAlloc
HeapFree
ExitProcess
GetModuleHandleA
LoadLibraryA
GetProcAddress
user32
SetWindowLongW
gdi32
CreateCompatibleBitmap
shell32
ShellExecuteA
ole32
CoCreateInstance
wininet
InternetOpenA
urlmon
URLDownloadToFileA
crypt32
CryptUnprotectData
dwmapi
DwmExtendFrameIntoClientArea
imm32
ImmReleaseContext
shlwapi
SHDeleteKeyW
dbghelp
ImageDirectoryEntryToData
ntdll
RtlLookupFunctionEntry
Name
.text
Size
Virtual Size
1.4MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
Virtual Size
8.9MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
Virtual Size
37KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
Virtual Size
59KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.!vx
Size
Virtual Size
23.0MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.3hj
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.EUD
Size
42.9MB
Virtual Size
42.9MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
49KB
Virtual Size
48KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
keyauth_emulator.py
- SHA256 59c5c29a5f0ee23f7d8ec335ecaaec39cae50d1f92c91cee0f97e937b627f294
- MD5 f2fa32852f88e3256cea57aae1ea39e0
- SHA1 1b3833350869167a8c1adb4725042ec96b064983
- SHA512 f1ea6dafd29a58b1c2f1c39d38b7cb422f4277b95b95c6091bc5346c124429fc338dfea6c9522e0a0a2ea3e82e3c8fd6e50cb1ad04c7afb000c355a5190f80e9
- SSDEEP 192:a6IcZ10/mLKt0TVOQiy82V2sGS1TDSRgJmFcFBpO/ueh6f568kEVwoxImbUdR:pIA1IIXRo61TDSRgJmFcnfjMmbSR
- TLSH T1890245269D05541701738B9ED41BA882F71E56073368A81B793C8BD81FF8C2295F6FF9
- MD5 SHA1 SHA512 SSDEEP TLSH
server.crt
- SHA256 3a5252e6652f1a379b34d409097352608d1f0737e888a4f450243290ce727e27
- MD5 33d52c49d8cccfedbe8f59dcbbbff941
- SHA1 59db2b186822a7e5180c2817499dac754889e296
- SHA512 5788c8e298fb13d308f81bc4462ff5c10e7601155cb4f987e3b5795462acc3b2cb00f9862b15b482ee9453028c94d17e3d92ef3fbfe9098d54eccb4bbf15d588
- TLSH T17721E75E4EB12A48989AF42B8AEB9250CEFCFCF181AC44C440189503B59D91C32EE846
- MD5 SHA1 SHA512 TLSH
server.key
- SHA256 2b9ff7a06f3667f8690f32831ce4f2fd75c1b3fb98a9b97acd93c4e787d68794
- MD5 7e0851e93ad4dad949c7d3a06d1fa7ac
- SHA1 e325543c61d89ccbf249dcb64ba68b06520da45c
- SHA512 7597efcf3217f1f3ba598219c415e6abd7216b25a0b3d347c7c4aed2dcdf09c684fdff78b5c4f07f9303184561564393f5ee2a793fa3f1d2d2af063562646ca0
- TLSH T19131FA392DF095EDCEECE0738697332E5A79F7380184A4648133B8A2A179F28686D951
- MD5 SHA1 SHA512 TLSH
server.pfx
- SHA256 a86c438032f56d49abd2e3b066b515ae5a67247fb1207a0d2ef0089d8598e10c
- MD5 b34f60fe3a20b7ba0e1fc020850eb6fd
- SHA1 47f3c19591fff5def64df24106b7d315c0def06d
- SHA512 f1db1a616caa2f2e207951fcf550bebebf35d0344d02d655aa53310cc959cf5c078bea5e4649c87e76b4f3c073dc1033d1a0e17695ea22ecac3306c46d3fccc3
- TLSH T1F6513A3B5EF710B9F932CFC65C3D4AC248A2CFE33E348A8F161550E04D46825A4E8927
- MD5 SHA1 SHA512 TLSH