Starlight_Bypass Rebooted Crack.zip
- SHA256 470cae211f82446a0d9d10a5afe19028dee7e9891b6e1a6829a46cf45e0a5f40
Password
6sa6
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Starlight_Bypass Rebooted Crack.zip
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
Starlight_Bypass Rebooted Crack.zip
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
General
- Target Starlight_Bypass Rebooted Crack.zip
- Size 38.0MB
- Sample260820-baqspsxcmb
- SHA256 470cae211f82446a0d9d10a5afe19028dee7e9891b6e1a6829a46cf45e0a5f40
- MD5 fbcb9f2d61aa89a01305fe4f01a08a0c
- SHA1 453de9c02b9a13bc000d8021e4ce814c21f15ecc
- SHA512 16098a37526644fe6cf77248d35b16a986f9f6e9bfbe9f1ccec3d28570646e7824a08580194742442da5534acffc730910d0f4ed9303df18e40ad9ed9876d3f3
- SSDEEP 786432:hIVKPeS2uTTNIjWl6k8zXRY559+F3Rfi1sqADKE0eZ54S3j+vdzSQ:SVgeSjNIj9XXaH9+Fdi1HADJBGS3cdzj
- TLSH T1209733CCA89FEDC844A76353159EE24396BB671379AAD749069FC08708DFE90767C308
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/Starlight_Bypass Rebooted Crack/REBOOTEDSPOOFER.exe unpack001/Starlight_Bypass Rebooted Crack/Starlight_Emulator.exe
File Explorer
-
Starlight_Bypass Rebooted Crack.zip.zip 38.0MB
-
Starlight_Bypass Rebooted Crack/REBOOTEDSPOOFER.exe.exe 43.0MB
-
Starlight_Bypass Rebooted Crack/Starlight_Emulator.exe.exe 82KB
-
Starlight_Bypass Rebooted Crack/server.crt1KB
-
Starlight_Bypass Rebooted Crack/server.pfx2KB
Starlight_Bypass Rebooted Crack/REBOOTEDSPOOFER.exe
- IMPHASH 53aa1c42e9e2fc90e2df00eb6fd052f8
- SHA256 702a9a60b898192ca046399b9ec0a3ff17c3126e5a030c691ffa0bc271b90eee
- MD5 02cb99b7a27d1dd6c44d7402749a723f
- SHA1 7665693b3a690c2c8d215f6adab45bdbe66f1a53
- SHA512 f9a500a1c6431ecfbdf2f1854b5d0338304eb881bb1bdabeb43cbabcb247385360e2fdd5a9a3fdddd3f854f04e25918b785440d7d91269d12f92141fe3ed3115
- SSDEEP 786432:k615BMqw6B5LSzSzYo6FvR8VhFyLXLJej8aCmaoWLVFw0TwL7TuhyJ2u56v:ZMqtLSzpfvmrFyLtejLCma5ZF3MLfuhZ
- TLSH T175A723DB2AEA52ECD4C34B8057CF22DA51C1B53A85AD986D2FCB2C031530DBBD549A37
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
6sa6
Minor OS version
0
Major OS version
6
Entry point
35252198
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
d3d11
D3D11CreateDeviceAndSwapChain
d3dcompiler_43
D3DCompile
advapi32
RegOpenKeyA
winhttp
WinHttpReadData
kernel32
DeleteFileA
GetSystemTimeAsFileTime
HeapAlloc
HeapFree
ExitProcess
GetModuleHandleA
LoadLibraryA
GetProcAddress
user32
SetWindowLongW
gdi32
CreateCompatibleBitmap
shell32
ShellExecuteA
ole32
CoCreateInstance
wininet
InternetOpenA
urlmon
URLDownloadToFileA
crypt32
CryptUnprotectData
dwmapi
DwmExtendFrameIntoClientArea
imm32
ImmReleaseContext
shlwapi
SHDeleteKeyW
dbghelp
ImageDirectoryEntryToData
ntdll
RtlLookupFunctionEntry
Name
.text
Size
Virtual Size
1.4MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
Virtual Size
8.9MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
Virtual Size
37KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
Virtual Size
59KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.!vx
Size
Virtual Size
23.0MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.3hj
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.EUD
Size
42.9MB
Virtual Size
42.9MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
49KB
Virtual Size
48KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
Starlight_Bypass Rebooted Crack/Starlight_Emulator.exe
- IMPHASH 5f5e9b263726d9ec11f3f71e16acc41c
- SHA256 a3adc9318074f79d3eaff1a04b271cbcb06d78670b181812999c63440d9a3222
- MD5 a28e9cdab86641f51b594fcc146f8d18
- SHA1 6236db4738155ed7685c8d20e079bc56eec91fe9
- SHA512 697c8160f87094559d9cf474de5ad2815e11480e60ddff8c569507de6eda17c78545fe4a30f74045a690680f33ebdd843927428604446d716ac0eb9213ac4ac6
- SSDEEP 1536:Z26gyzYxquoSArSEaQZrI73Zf7J52IPFgqFRn6Q+aBD1OfAlRBq:ZxgyzYxqu4zaSc7Rl7F7DQfe/
- TLSH T1CE832A26DE1510AED36A9AF8D9530901DB73BC874371B7CF53815CE60E26AD4AF3EA01
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
6sa6
Minor OS version
0
Major OS version
6
Entry point
45456
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
ws2_32
WSAStartup
socket
send
accept
listen
htons
closesocket
bind
recv
secur32
QueryContextAttributesW
AcquireCredentialsHandleW
FreeCredentialsHandle
AcceptSecurityContext
DeleteSecurityContext
EncryptMessage
FreeContextBuffer
DecryptMessage
crypt32
CertEnumCertificatesInStore
PFXImportCertStore
CertFreeCertificateContext
CertDuplicateCertificateContext
CertCloseStore
user32
RegisterClassExW
GetMessageW
TranslateMessage
DispatchMessageW
DefWindowProcW
PostQuitMessage
LoadCursorA
MessageBoxW
CreateWindowExW
GetClientRect
InvalidateRect
EndPaint
BeginPaint
UpdateWindow
ShowWindow
gdi32
BitBlt
CreateCompatibleBitmap
CreateCompatibleDC
DeleteDC
DeleteObject
SelectObject
gdiplus
GdipFillPolygon
GdipDeleteFontFamily
GdipCreateFontFamilyFromName
GdipDeleteFont
GdipFillPath
GdipAlloc
GdipFree
GdiplusStartup
GdiplusShutdown
GdipCreatePath
GdipDeletePath
GdipCreateFont
GdipClosePathFigure
GdipAddPathArc
GdipCloneBrush
GdipDeleteBrush
GdipCreateSolidFill
GdipCreatePen1
GdipDeletePen
GdipCreateFromHDC
GdipDeleteGraphics
GdipSetSmoothingMode
GdipDeleteStringFormat
GdipSetStringFormatAlign
GdipSetTextRenderingHint
GdipCreateStringFormat
GdipDrawPath
GdipFillRectangleI
GdipSetStringFormatLineAlign
GdipDrawString
msvcp140
?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD0@Z
?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z
?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z
?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADXZ
?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?getloc@ios_base@std@@QEBA?AVlocale@2@XZ
?width@ios_base@std@@QEAA_J_J@Z
?width@ios_base@std@@QEBA_JXZ
?flags@ios_base@std@@QEBAHXZ
?good@ios_base@std@@QEBA_NXZ
?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?_Throw_Cpp_error@std@@YAXH@Z
_Cnd_do_broadcast_at_thread_exit
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Id_cnt@id@locale@std@@0HA
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
_Mtx_unlock
??0_Lockit@std@@QEAA@H@Z
??1_Lockit@std@@QEAA@XZ
?_Xbad_alloc@std@@YAXXZ
?_Xlength_error@std@@YAXPEBD@Z
?_Xout_of_range@std@@YAXPEBD@Z
?uncaught_exception@std@@YA_NXZ
_Thrd_detach
_Mtx_lock
?id@?$ctype@D@std@@2V0locale@2@A
kernel32
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
GetStartupInfoW
SetUnhandledExceptionFilter
MultiByteToWideChar
GetModuleFileNameW
CloseHandle
ReadFile
GetFileSize
GetModuleHandleW
CreateFileW
vcruntime140
__std_exception_destroy
__std_terminate
_CxxThrowException
__current_exception_context
__current_exception
__C_specific_handler
memset
memmove
memcpy
memcmp
__std_exception_copy
vcruntime140_1
__CxxFrameHandler4
api-ms-win-crt-string-l1-1-0
strlen
tolower
wcslen
api-ms-win-crt-runtime-l1-1-0
_beginthreadex
_register_thread_local_exe_atexit_callback
_c_exit
terminate
_exit
exit
_initterm_e
_initterm
_get_wide_winmain_command_line
_initialize_wide_environment
_configure_wide_argv
_set_app_type
_seh_filter_exe
_cexit
_crt_atexit
_register_onexit_function
_initialize_onexit_table
api-ms-win-crt-math-l1-1-0
cosf
sinf
__setusermatherr
api-ms-win-crt-heap-l1-1-0
free
_set_new_mode
malloc
_callnewh
api-ms-win-crt-stdio-l1-1-0
__p__commode
_set_fmode
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
Name
.text
Size
44KB
Virtual Size
44KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
31KB
Virtual Size
30KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
640B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
192B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=12, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=259, version=35721,
count=10, id=260, version=35721,
count=28, id=261, version=35721,
count=6, id=257, version=35721,
count=196, id=1, productName=Unmarked objects,
count=15, id=257, version=33145,
count=1, id=261, version=36252,
count=1, id=258, version=36252,
Starlight_Bypass Rebooted Crack/server.crt
- SHA256 3a5252e6652f1a379b34d409097352608d1f0737e888a4f450243290ce727e27
- MD5 33d52c49d8cccfedbe8f59dcbbbff941
- SHA1 59db2b186822a7e5180c2817499dac754889e296
- SHA512 5788c8e298fb13d308f81bc4462ff5c10e7601155cb4f987e3b5795462acc3b2cb00f9862b15b482ee9453028c94d17e3d92ef3fbfe9098d54eccb4bbf15d588
- TLSH T17721E75E4EB12A48989AF42B8AEB9250CEFCFCF181AC44C440189503B59D91C32EE846
- MD5 SHA1 SHA512 TLSH
Starlight_Bypass Rebooted Crack/server.pfx
- SHA256 a86c438032f56d49abd2e3b066b515ae5a67247fb1207a0d2ef0089d8598e10c
- MD5 b34f60fe3a20b7ba0e1fc020850eb6fd
- SHA1 47f3c19591fff5def64df24106b7d315c0def06d
- SHA512 f1db1a616caa2f2e207951fcf550bebebf35d0344d02d655aa53310cc959cf5c078bea5e4649c87e76b4f3c073dc1033d1a0e17695ea22ecac3306c46d3fccc3
- TLSH T1F6513A3B5EF710B9F932CFC65C3D4AC248A2CFE33E348A8F161550E04D46825A4E8927
- MD5 SHA1 SHA512 TLSH