Kaiju.REPACK-KaOs.rar
- SHA256 9ac359873b973fe149a79675de442a3bba2f2c9288bee3d6a3afde5c8affbdad
Behavioral task
behavioral1
Sample
Setup.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
16 signatures
300 seconds
Behavioral task
behavioral2
Sample
Setup.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
15 signatures
300 seconds
Behavioral task
behavioral3
Sample
Verify.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
300 seconds
Behavioral task
behavioral4
Sample
Verify.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
300 seconds
General
- Target Kaiju.REPACK-KaOs.rar
- Size 173.7MB
- Sample260907-2tdklahn21
- SHA256 9ac359873b973fe149a79675de442a3bba2f2c9288bee3d6a3afde5c8affbdad
- MD5 0617356d707290dd5e525ff19c0bd9cb
- SHA1 add866146982cb7bd9b50a045759a2fb9697b488
- SHA512 6d4e4ed48bd616412be58adc4ab7de55521149c4ec13ab3ecce6c40ebd8e751a0c52d1c2b92a56a313dff80b18c2a35e0fc163684d959dc55db810e9c4fd093a
- SSDEEP 3145728:LEOhDpa0PNb3fKdFlBgc3OD9tX+HdgnkKImNmbYoVkRxe9XZXveQMu/1+jI3R:4OhT1jfKdbBgc3OB1+Ck1ojlxe9JfeQ/
- TLSH T11198337AB354B53EE0570D35023F931194B3B67A689E8C0B23F88D9ECBB1551493F26A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/Setup.exe unpack001/Verify.exe - Inno Setup is an open-source installation builder for Windows applications. 1 IoCs
Inno Setup installer
resource yara_rule static1/unpack001/Setup.exe innosetup
File Explorer
-
Kaiju.REPACK-KaOs.rar.rar 173.7MB
-
KAOS-Data_00.KK129.7MB
-
KAOS-Data_01.KK40.3MB
-
KaOs Krew Releases.url.url 111B
-
Masquerade's Discord Server.url.url 116B
-
Setup.exe.exe 3.5MB
-
Verify.exe.exe 93KB
KAOS-Data_00.KK
- SHA256 e8eeec269dd6571c617a23e3e3cc40cafb53b06f12bff6403afe9fed5ae79fc7
- MD5 831bfe44757f5ce0f92365fd31f4bba0
- SHA1 3859a2def6251f7baf9faa185c1633a785dba10b
- SHA512 55a2564b9a535000504ab1ee85b0853fd8e7000670783a3d99e439ed343de26f11c0595861817da1ce08875bda6cfc9c94dea8d4373e53618233b038c8ca65f1
- SSDEEP 3145728:d9tX+HdgnkKImNmbYoVkRxe9XZXveQMu/1+jI34:z1+Ck1ojlxe9JfeQZAjI34
- TLSH T1205833AD5A80B93530432C59637B1B5FD48052B7DCC61603746F9FAAC2F5AC6C1BF2A8
- MD5 SHA1 SHA512 SSDEEP TLSH
KAOS-Data_01.KK
- SHA256 3420d306e59d2f963d30546f7407c72d444a1f270776925d6a63fb30789e5c3b
- MD5 ee020c86304dd56e8ed78e9c37315a86
- SHA1 85f983afe20eabefb1dd87e17c34ca7a91b3a850
- SHA512 57a178ea3ea2c6871194138ccd384b08d4d0e7f2bc9f4afe1de973d8266e69e2356a4292304d5886f6a861b5a585fc54ecdb156c6e787418c47a395363eef74f
- SSDEEP 786432:n8G27ON2gDpPC0Pr/NTJboTCJkKfrL6ZJGF/oXF427obHCnJWc3P6jFZgqWqf:n727OhDpPC0PNJbo2J3fKZ3Floungc3a
- TLSH T1F19733E0B749E49FE8E7CCFE102CF15720CDE0682BF4A90E66F7C662A061251A4555BF
- MD5 SHA1 SHA512 SSDEEP TLSH
KaOs Krew Releases.url
- SHA256 1b7172834941dfa51b1a6c84498acc4a41faee00e6ac1135f1cbf37c0dfd2cb1
- MD5 02cec58f528f16edf26e0f0bb44863dc
- SHA1 79e38d2159c892a1db8acb973f5853295ca0ca9f
- SHA512 8f52de12b559e11760abc691f2225ddbbbf4e866abe566d5846bb73b8aa54318f1708cc31ab36284aef266c2b5306a1f8b19fcb6d73820f032d5b1b89ccbb0b1
- TLSH T196B012AE4455868DD241440AA0B1F80CD80F79A14CE3D09CA548DEDB0E080D1C848B36
- MD5 SHA1 SHA512 TLSH
Masquerade's Discord Server.url
- SHA256 532b14df267f8ffda80012f2960426ae2189a18c6b2f11643422060742309616
- MD5 3e860cce14cc58e30858269184992671
- SHA1 7bb15e37e622a442b3e606a2c1e6cf0791ce450a
- SHA512 9a8d232103cd21d89e231f85ff87754a2347443785d0e0f523a353e00628673da1e44a29813064e544be98e09f62b708f94fc9217676367ff546e93f73e3d221
- TLSH T166B092AF91058AA9D242445E40A2F808980EB9A408E2909D6189EECE0C48092C845B6A
- MD5 SHA1 SHA512 TLSH
Setup.exe
- IMPHASH e569e6f445d32ba23766ad67d1e3787f
- SHA256 019209ff4301e84efb20536b8fcf5483af4964d6a6e4fc35071f7dbd8fb0a5b6
- MD5 cca888c528af21eaaf60cef050f88bf9
- SHA1 2b3a0dbae403ed872309d2d2f84da042c952c556
- SHA512 e0853e3b68e5eb23c8a609a9063e354c63906424b804484b07593774d4415ff905a289b779f17c4075fd25da58554678f448d12ee97ffb2170ac2d87a5a3e18b
- SSDEEP 98304:0kLqdg0rF3WOVCX7+SfuWP9BeG2AS+WkW+:DqdFW1XFfLP9LS+WkW+
- TLSH T11106013FB268663EC96E0B3205739360997BBB61791B8C1E47F4480DCF664601E3FA56
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
-
Inno Setup is an open-source installation builder for Windows applications.
Inno Setup installer
Minor OS version
1
Major OS version
6
Entry point
745196
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
PDB paths
kernel32
GetACP
GetExitCodeProcess
LocalFree
CloseHandle
SizeofResource
VirtualProtect
VirtualFree
GetFullPathNameW
ExitProcess
HeapAlloc
GetCPInfoExW
RtlUnwind
GetCPInfo
GetStdHandle
GetModuleHandleW
FreeLibrary
HeapDestroy
ReadFile
CreateProcessW
GetLastError
GetModuleFileNameW
SetLastError
FindResourceW
CreateThread
CompareStringW
LoadLibraryA
ResetEvent
GetVersion
RaiseException
FormatMessageW
SwitchToThread
GetExitCodeThread
GetCurrentThread
LoadLibraryExW
LockResource
GetCurrentThreadId
UnhandledExceptionFilter
VirtualQuery
VirtualQueryEx
Sleep
EnterCriticalSection
SetFilePointer
LoadResource
SuspendThread
GetTickCount
GetFileSize
GetStartupInfoW
GetFileAttributesW
InitializeCriticalSection
GetSystemWindowsDirectoryW
GetThreadPriority
SetThreadPriority
GetCurrentProcess
VirtualAlloc
GetSystemInfo
GetCommandLineW
LeaveCriticalSection
GetProcAddress
ResumeThread
GetVersionExW
VerifyVersionInfoW
HeapCreate
GetWindowsDirectoryW
VerSetConditionMask
GetDiskFreeSpaceW
FindFirstFileW
GetUserDefaultUILanguage
lstrlenW
QueryPerformanceCounter
SetEndOfFile
HeapFree
WideCharToMultiByte
FindClose
MultiByteToWideChar
LoadLibraryW
SetEvent
CreateFileW
GetLocaleInfoW
GetSystemDirectoryW
DeleteFileW
GetLocalTime
GetEnvironmentVariableW
WaitForSingleObject
WriteFile
ExitThread
DeleteCriticalSection
TlsGetValue
GetDateFormatW
SetErrorMode
IsValidLocale
TlsSetValue
CreateDirectoryW
GetSystemDefaultUILanguage
EnumCalendarInfoW
LocalAlloc
GetUserDefaultLangID
RemoveDirectoryW
CreateEventW
SetThreadLocale
GetThreadLocale
comctl32
InitCommonControls
version
GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW
user32
CreateWindowExW
TranslateMessage
CharLowerBuffW
CallWindowProcW
CharUpperW
PeekMessageW
GetSystemMetrics
SetWindowLongW
MessageBoxW
DestroyWindow
CharUpperBuffW
CharNextW
MsgWaitForMultipleObjects
LoadStringW
ExitWindowsEx
DispatchMessageW
oleaut32
SysAllocStringLen
SafeArrayPtrOfIndex
VariantCopy
SafeArrayGetLBound
SafeArrayGetUBound
VariantInit
VariantClear
SysFreeString
SysReAllocStringLen
VariantChangeType
SafeArrayCreate
netapi32
NetWkstaGetInfo
NetApiBufferFree
advapi32
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegQueryValueExW
AdjustTokenPrivileges
GetTokenInformation
ConvertSidToStringSidW
LookupPrivilegeValueW
RegCloseKey
OpenProcessToken
RegOpenKeyExW
TMethodImplementationIntercept
__dbk_fcall_wrapper
dbkFCallWrapperAddr
Name
.text
Size
718KB
Virtual Size
718KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.itext
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
14KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.bss
Size
Virtual Size
27KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.didata
Size
512B
Virtual Size
420B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.edata
Size
512B
Virtual Size
154B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.tls
Size
Virtual Size
24B
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
512B
Virtual Size
93B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
17KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
Verify.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 0e6b18ce98b4b54e00cc9b00fec71dad3900476e569c2669df57ae93de081a64
- MD5 2f39a5e607d4a8f1857f8240440380e0
- SHA1 614d2003a1bfdaf091349fb03e5a0a08be057e35
- SHA512 a4933137007a87de7742e711c81c408e0c4fbb8482a0ea8d88f3655565b3e0b2b2e87b8c39e734cd7c93f9a653f187724b2d6bd0fde70fad25e195fb4c01eec4
- SSDEEP 1536:9AadqV4XlaDB20CSFGCiI/vNc89tt6Zr:SakV4Xol2R2Ndtt6Zr
- TLSH T170934916B3D4B62EC5A72A34496DD2754633FDEE682ECA0A77C40DCF7C967AC040172A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
83702
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
G:\Masquerade Repacks\Hasher\obj\Debug\Hasher.pdb
mscoree
_CorExeMain
Name
.text
Size
74KB
Virtual Size
73KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
18KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ