SvinBuilder.rar
- SHA256 e2f59b37b61186fbeeb0ba3377512ee06d9ce5887d9e01ba4acb1521e68947b5
Password
PurpleRat
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
SvinBuilder/Stub/stub.exe
Resource
win10v2004-20260513-uk
windows10-2004-x64
17 signatures
150 seconds
Behavioral task
behavioral2
Sample
SvinBuilder/SvinoLockBuilder.exe
Resource
win10v2004-20260513-uk
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral3
Sample
SvinBuilder/dnlib.dll
Resource
win10v2004-20260513-uk
windows10-2004-x64
0 signatures
150 seconds
General
- Target SvinBuilder.rar
- Size 5.6MB
- Sample260818-1fs8fsbf39
- SHA256 e2f59b37b61186fbeeb0ba3377512ee06d9ce5887d9e01ba4acb1521e68947b5
- MD5 cd005a70a55a3f0c5e01250f69d27680
- SHA1 1b3ff292a16ec0a55806987f9fa1dfa54b655f00
- SHA512 53d1df2d8131068962f8d9feff88ed2eaf0a99a80abe045890d205e462d8b350f40afb07cfac58c5fc7a83c666c3b12a996ee418f34495be6bd066562d991332
- SSDEEP 98304:oVyFQD81oAh/5ex07RK0BV4H7Fhp88Y5nb29k97ys+QlSDHum4ZAd:oaQD81N/++RKOV4bFhC5n0k99lvm4ZAd
- TLSH T1E6563372C76AD9AF30006B057790B6AAE4A056D41990ED7BF4B30FDA0713ACF791C9E4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 3 IoCs
Checks for missing Authenticode signature.
resource unpack001/SvinBuilder/Stub/stub.exe unpack001/SvinBuilder/SvinoLockBuilder.exe unpack001/SvinBuilder/dnlib.dll
File Explorer
-
SvinBuilder.rar.rar 5.6MB
-
SvinBuilder/Stub/stub.exe.exe 5.7MB
-
SvinBuilder/SvinoLockBuilder.exe.exe 10KB
-
SvinBuilder/dnlib.dll.dll 1.1MB
-
SvinBuilder/dnlib.xml.xml 1.8MB
SvinBuilder/Stub/stub.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 0831f3d90eefd65a02ead758f1713d2ce2bc51a55e8111bc87a12b924c6ef099
- MD5 c6325c7e5b3d3fa58e7006dce6d73e2a
- SHA1 69ebe5ce495a0a2a279a88093819b1e7c0ffcf13
- SHA512 7bf370d2a088fd07e5171dec65f44095574d9baba338ac4b46a5efedad80afb987df28c4fdfd8e204f822287c4e247f84066e6fc871ab7271c84eccc7118b8fa
- SSDEEP 98304:9vqmGvGWyDQJ563ouCv25J0UHKacMSLLeay6bjjqy6bjjyy6bjj:QBnPJ564zaJ0UhvGia5O525
- TLSH T16C563308828A4959F07DB1B628955490CBF77E58D3628BCF28CA5BF33A07364FD257B1
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
PurpleRat
Minor OS version
0
Major OS version
4
Entry point
5984258
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\nocki\Desktop\worm\SvinoLock\obj\Release\SvinoLock.pdb
mscoree
_CorExeMain
Name
.text
Size
5.7MB
Virtual Size
5.7MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
SvinBuilder/SvinoLockBuilder.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 07724286e3b5bea579a3bea20a912155737010cf7c9baabb180da22c60e63f1b
- MD5 10031ab2539201f5dc9f4788184da1ae
- SHA1 dece15c814dbc6c75ea52331bbf09e64f62c5b7e
- SHA512 95f84d81bbe64c00b415c4ed9f0ee7849436e4575a359ebdd7779d91927d4478a2bb25191dda6d3b4bc8e1ab1c6f9da7e05985fb7b6dea900cf892fd306beb8f
- SSDEEP 96:EHkFcK+B7KB+KlBupfXiOsXT01fm1KpBN65EiDnV5MQlbGB58F/OvzplLx9rBXg0:qpVLfm8pGqizr8WBSplLx9y8pBVycb
- TLSH T1B322EA62B3B4C63BCA798AB25DB3115007B6F215A921E6ED5CCF544E99A37000392F53
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
PurpleRat
Minor OS version
0
Major OS version
4
Entry point
15982
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\XYECOC\Downloads\book\my new game about cars\net472\hj\SvinoLockBuilder.pdb
mscoree
_CorExeMain
Name
.text
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
SvinBuilder/dnlib.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 97ef5328d1d1703924c48d9cd1d45b7227fe3836e116dcded623b6a0dbd52c23
- MD5 c087c70deb98db9d0b046d0a3d0e582a
- SHA1 f195b25b9c2d85006e15dce3b0b22eab6a4d16a9
- SHA512 9a1c40ef39ea5cb28ace6ba069b1afbf55ca47e4189b06d3cd033cbf7d01a838e7b5edb0e8578547a219a312446a5c2daa68e784ba2fb5c1c799dcc4500ab24c
- SSDEEP 24576:ct140a1plV+Th8rQ7F/qy0EFXnh8MviJa319Iv7f1NGgV:LIwy
- TLSH T12B456C1137FD9B77E06F873AE835061903F1D406A697EF4F6A54ABAA6C833685C00397
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
PurpleRat
Minor OS version
0
Major OS version
4
Entry point
1183806
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
/_/src/obj/Release/net45/dnlib.pdb
mscoree
_CorDllMain
Name
.text
Size
1.1MB
Virtual Size
1.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
SvinBuilder/dnlib.xml
- SHA256 2c4e2806188d354cbf7bf81bbc3963eb465d10dcbac8a75690b219886d164416
- MD5 d5bc999b9d5cbc01e803f406952c21ff
- SHA1 645a318570c531c5470b3e114b53d74f21d783aa
- SHA512 5245c5e5e098ae915209c97a41724fbc9c849e2ec339f3517190edf4556660534a081c249b57ad145c164526c59b381a1cc69b7a95a0b529acf2d3c03c9713f7
- SSDEEP 6144:VTA+HpSCIPAqPFgrOLkOXhR+y+cNUaOtCW5n:dpSCIPAqPFgrO7XhR+y+cNUaOtCW5n
- TLSH T150857714B6C2AD121C36525B9E64FCC4FE550C33604A2E19B68D2F535F7ADCBE2AF920
- MD5 SHA1 SHA512 SSDEEP TLSH