TheOGcups menu.zip
- SHA256 e02d700739c71709267ceb547f522da1d59adb6e43ab93fdb6b1a318d7635abe
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
TheOGcups menu/LIBERTEA.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
TheOGcups menu/LIBERTEA.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
TheOGcups menu/LIBERTEA_Bypass.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral4
Sample
TheOGcups menu/LIBERTEA_Bypass.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
General
- Target TheOGcups menu.zip
- Size 440KB
- Sample260830-2j18xadf87
- SHA256 e02d700739c71709267ceb547f522da1d59adb6e43ab93fdb6b1a318d7635abe
- MD5 f97fa69cfca82d11eac559a83ff964a5
- SHA1 aa8243ab3942eec2bb9a8dbd118e1176730f41b5
- SHA512 0afb313ed00ed4827defa71d59712d6ab3197150c8836e03dea388133a080568e3146b83a1f6171b67c5bea89d5a9ace8c56f1b9dacdb7786af329a40ffa0c23
- SSDEEP 6144:rj9jge6pKuMuyNwRd3lms+nIbe1p+hDarPyTyLAznvgsajcKZunWk8MRsC:39jgHy2JlXlop++PyZzUosWWap
- TLSH T1FFA423885F42DCFFCA314B2AD72965FAEF00FC81707340ACD159E2F6426ADEA6576181
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/TheOGcups menu/LIBERTEA.dll unpack001/TheOGcups menu/LIBERTEA_Bypass.exe
File Explorer
-
TheOGcups menu.zip.zip 440KB
-
TheOGcups menu/LIBERTEA.dll.dll 372KB
-
TheOGcups menu/LIBERTEA_Bypass.exe.exe 143KB
TheOGcups menu/LIBERTEA.dll
- SHA256 deae9a61819ce33443b22e4fec038e7a9e175b6c4679f95d0774c33e3516de5b
- MD5 5d078123c7349f42b64b34c85a95e27d
- SHA1 23034cc6522fff9079afb7e62da7eaf8cb1084b0
- SHA512 3b0046b4f844e0daef66233732208451ab98eeb73877028b44c2f16e35258bc07655523cacb7737aeea6426bec92dfd2b8e385bed47ae8e1b83e28a4f13f8d5c
- SSDEEP 6144:uzf57emMGX6G8p/TFGa6309kpQk9FU5MeetP64LZSjAa2C2p1dz5frnl3Hb6H0:UArhzqQe3m72pDhzlGU
- TLSH T1A78423E64AAC5FCEE6AB0971A11E362D90D3B82FD2B30958B03D6949171DE204DD934E
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
3399680
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
Name
.text
Size
Virtual Size
2.9MB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
369KB
Virtual Size
372KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
TheOGcups menu/LIBERTEA_Bypass.exe
- IMPHASH de89400c39fdf460d9b8944efc6a6550
- SHA256 0e643ce833d8e204ea9344486bf021ad5296bcf883022617bf6370c58cf23791
- MD5 966b923340b045f0d29a3cebeedf79cd
- SHA1 13737707e53e957934b8716442df2ebfd38eee15
- SHA512 e2b54502141dff03445afa402c792955bef2e86b1c041819c44e426938444de86eb29b78de252f5ead31eb12421ced1b97d9ffaecd6ac2cf05091085a1acddcb
- SSDEEP 3072:zJ9+11UrLAKuEA1XsQ15oVqO7mN/Bhp/VZ:ju1UXBWZSVqeu
- TLSH T1D4E35B5B72A530F9E0778239C9611A46F773B83617609BEF03A447B52F236D19C3AB21
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
9752
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
gdi32
TextOutA
CreateFontA
SetBkMode
DeleteObject
SelectObject
SetTextColor
CreateSolidBrush
user32
GetMessageA
DispatchMessageA
PostMessageA
FillRect
GetSystemMetrics
ShowWindow
DrawTextA
MessageBoxA
DefWindowProcA
EndPaint
TranslateMessage
LoadCursorW
GetClientRect
PeekMessageA
PostQuitMessage
RegisterClassExA
UpdateWindow
InvalidateRect
BeginPaint
CreateWindowExA
advapi32
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
kernel32
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
HeapReAlloc
SetFilePointerEx
GetProcessHeap
LCMapStringW
VirtualProtect
InitializeCriticalSectionEx
FlsFree
CreateFileW
WriteConsoleW
HeapSize
WriteProcessMemory
GetCurrentProcess
TerminateProcess
GetModuleFileNameW
CreateMutexA
WaitForSingleObject
GetFileAttributesW
ReleaseMutex
GetModuleHandleA
OpenProcess
CreateToolhelp32Snapshot
Sleep
GetLastError
Process32NextW
Process32FirstW
CloseHandle
FreeConsole
CreateThread
Module32FirstW
VirtualProtectEx
GetProcAddress
VirtualAllocEx
ReadProcessMemory
GetModuleHandleW
FlushInstructionCache
CreateRemoteThread
Module32NextW
VirtualFreeEx
VirtualQueryEx
FlsSetValue
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
RtlUnwindEx
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
EncodePointer
RaiseException
RtlPcToFileHeader
GetStdHandle
WriteFile
ExitProcess
GetModuleHandleExW
HeapFree
HeapAlloc
GetFileType
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetStdHandle
GetStringTypeW
FlsAlloc
FlsGetValue
Name
.text
Size
84KB
Virtual Size
83KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
46KB
Virtual Size
45KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
696B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=142, id=261, version=35215,
count=12, id=260, version=35215,
count=8, id=259, version=35215,
count=9, id=259, version=35207,
count=17, id=260, version=35207,
count=40, id=261, version=35207,
count=9, id=257, version=35215,
count=144, id=1, productName=Unmarked objects,
count=1, id=265, version=35226,
count=1, id=255, version=35226,
count=1, id=151,
count=1, id=258, version=35226,