GANG-Nuker.zip
- SHA256 502b2bfc63c501480abe0209a1ad8889fba1903571d92da7b57990e2eee8b672
General
- Target GANG-Nuker.zip
- Size 119.6MB
- Sample260910-1bdxzawfpb
- SHA256 502b2bfc63c501480abe0209a1ad8889fba1903571d92da7b57990e2eee8b672
- MD5 e603ebe3f649129748e6f42292d29d42
- SHA1 23362f52a8ae9c79cebcf6bd0e8d5e3b992537a5
- SHA512 a2e6630d318b5e93c2adcc4bfb43b5a1a909adc882b04dc83927a3a04e4481ebd22c62ffaee8e71ba98293afe257fc2a59bce984068b22158099124c12269c64
- SSDEEP 3145728:3vcJgb/VIeZ0t5btsyY+o3vElePzIOTohqTY4sE3vjn26ib/:fdb/V1856v3s2sPBwLn26ib/
- TLSH T1A25833E0F0715D4F6945D736F4004FB47992E8A32441B4A82FDB27D8382AB9B79A5F0B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Detects Pyinstaller 1 IoCs
resource yara_rule static1/unpack001/GANG-Nuker/GANG.exe pyinstaller - Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/GANG-Nuker/GANG.exe
File Explorer
-
GANG-Nuker.zip.zip 119.6MB
-
GANG-Nuker/GANG.exe.exe 120.3MB
-
GANG.pyc39KB
-
GANG-Nuker/data/useragent.txt107KB
-
GANG-Nuker/utilities/Avatars/GANG.png.png 292KB
-
GANG-Nuker/utilities/Plugins/Account_Nuker.py5KB
-
GANG-Nuker/utilities/Plugins/Auto_Login.py2KB
-
GANG-Nuker/utilities/Plugins/DM_Deleter.py688B
-
GANG-Nuker/utilities/Plugins/QR_Grabber.py7KB
-
GANG-Nuker/utilities/Plugins/Server_Lookup.py2KB
-
GANG-Nuker/utilities/Plugins/Token_Info.py6KB
-
GANG-Nuker/utilities/Plugins/ignore/ignore.py15B
-
GANG-Nuker/utilities/Settings/common.py16KB
-
GANG-Nuker/utilities/Settings/libarys.py5KB
-
GANG-Nuker/utilities/Settings/update.py5KB
-
GANG-Nuker/utilities/Settings/version6B
GANG-Nuker/GANG.exe
- IMPHASH 69eb46a9f63edcc604b0bdaaa8e0f2f5
- SHA256 2f44de5a3a84543ecc843d0e1af4770e1b7c7417e431c3d6b6ad011e50d30644
- MD5 715013fb4fd49928e4d06441af90cd6a
- SHA1 577048f59e756d16594f687bbe30c619033ef898
- SHA512 743b42f7d178edd74ceb750b0076c0579ff3a48f1db209a2a7bbac7721a7fb1b9c7c0794439fa2dd7eead48736160943d57197a4acd05eb4555f2c3fe3c3f326
- SSDEEP 3145728:9ZWYDtBQgwothCWoMI13jKDKVaTZKIWFZKIv7Ma0pHTUJwUa:6+tePYIW6uDUn4ha0dgJwUa
- TLSH T18B583361E5412C8FEA8DC3379420CE34D59274CE8167992D1EAA10F53C8B7EF3A7A719
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects Pyinstaller
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
2
Major OS version
5
Entry point
41792
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
kernel32
GetCommandLineW
GetEnvironmentVariableW
SetEnvironmentVariableW
ExpandEnvironmentStringsW
CreateDirectoryW
GetTempPathW
WaitForSingleObject
Sleep
GetExitCodeProcess
CreateProcessW
GetStartupInfoW
LoadLibraryExW
SetConsoleCtrlHandler
FindClose
FindFirstFileExW
CloseHandle
GetCurrentProcess
LocalFree
FormatMessageW
MultiByteToWideChar
WideCharToMultiByte
SetEndOfFile
GetProcAddress
GetModuleFileNameW
SetDllDirectoryW
FreeLibrary
GetLastError
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetModuleHandleW
RtlUnwindEx
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
EncodePointer
RaiseException
RtlPcToFileHeader
GetCommandLineA
CreateFileW
GetDriveTypeW
GetFileInformationByHandle
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
GetFullPathNameW
RemoveDirectoryW
FindNextFileW
SetStdHandle
DeleteFileW
ReadFile
GetStdHandle
WriteFile
ExitProcess
GetModuleHandleExW
HeapFree
GetConsoleMode
ReadConsoleW
SetFilePointerEx
GetConsoleOutputCP
GetFileSizeEx
HeapAlloc
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
CompareStringW
LCMapStringW
GetCurrentDirectoryW
FlushFileBuffers
HeapReAlloc
GetFileAttributesExW
GetStringTypeW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
GetTimeZoneInformation
HeapSize
WriteConsoleW
advapi32
ConvertSidToStringSidW
GetTokenInformation
OpenProcessToken
ConvertStringSecurityDescriptorToSecurityDescriptorW
Name
.text
Size
162KB
Virtual Size
161KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
74KB
Virtual Size
73KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
64KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_RDATA
Size
512B
Virtual Size
348B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=7, id=259, version=30795,
count=190, id=261, version=30795,
count=10, id=260, version=30795,
count=3, id=253, version=31328,
count=40, id=261, version=31328,
count=17, id=260, version=31328,
count=9, id=259, version=31328,
count=5, id=257, version=30795,
count=117, id=1, productName=Unmarked objects,
count=20, id=260, version=31332,
count=1, id=258, version=31332,
GANG.pyc
- SHA256 95001b9b93a183bce1741be0eb526f25853be5d086120197f7715aa135a1e79c
- MD5 599306b7e7159b076399086c81519b3b
- SHA1 d7b3050bc6fed6252750d06cccb0798d9799fc53
- SHA512 eb43339a2ef686d1f2829c29b837dfd2cfa10aeaf38568e21c63408d88dcf2a12d6854559cd9f91e758bb188fe79cd554123d9074232126de34c6ec1f182ebde
- SSDEEP 768:0LyvlkA8e+W9p+Qbjv2DArJBg8FG8mpbdCrBNMunTrjZ+N1qPDOk:0Ly1Vrv2D84UnycFyunjZ+N1qSk
- TLSH T13B0308976021095BF5F0FF3E14A10B5A261A57E9F3C84272B05EE1E67F472CA7C252AC
- MD5 SHA1 SHA512 SSDEEP TLSH
GANG-Nuker/data/useragent.txt
- SHA256 c509a66661a5da1ec3c46730a93ecc6fc0352a5ebd94662f0b2239c073909bfd
- MD5 87611a383aad3f9339fc180c5a28ca6e
- SHA1 d875860243886421f2f156a1e9cd320b89abde86
- SHA512 e61839e4bbec81b73ce0f556cc4ecc93f8989773e663d38cd9608ee97cf52268b1d66080fc2f0218a3e76671d0ab346eb804ff920d4e37dcc0d4bdfd800c39e0
- SSDEEP 384:6Vyfd3K85+0RGDv8Vw9NF2OJb8d+45kyypFsxKA5tapSfVr+iPLTfrlbFHDz:jlQ0mw75gpFIjfr9Fjz
- TLSH T1CFB36D27C3254898B22808C2217731D0ED9A937FA8EA31D3F9520D51BEA9D5F15BBFD1
- MD5 SHA1 SHA512 SSDEEP TLSH
GANG-Nuker/utilities/Avatars/GANG.png
- SHA256 f7a931ef99512e0e4c4059295b356d2878c79549199aa6b5f4eae8d52dc5151f
- MD5 c8f94d22ce486c07a1fe48050f0949ec
- SHA1 647d0327c7af7428167650060671e2ecba5f1ed5
- SHA512 742a7b4b0e98e7c7b5e6184e2aac59195b7449e524be2b341575bc464f3bc5daadb4c3c58f825c6d88eadda911857400e1910701691dac236f7d8f2e7f490bae
- SSDEEP 6144:Kx0mNIkEhwsZpttn9UiZzmczxR2Ur2bWXbLAH/A8OVT:KxzNlqwktt9bmczPKbWXbr
- TLSH T1E75412A506C7801EEA839E9F072EF1234945706D143D60739F31CBA92EADB52D68E8D5
- MD5 SHA1 SHA512 SSDEEP TLSH
GANG-Nuker/utilities/Plugins/Account_Nuker.py
- SHA256 22048ee9d20120554b817d6292caeee2336604270f3d7f84947e4db4ea4fdcad
- MD5 c1e94efccc970a642d468a719017cae8
- SHA1 94fcb3b6084b1aa7c311ba434e9e6a3dcbbdf9d2
- SHA512 83dc3c12fba8700d17130f36ca7b6190a5787234666e6a0bd1eec23f46fde47c07bc9734dd6c16518f2ef953e0f30b064c169d23071ddcca8832a7580e5c2372
- SSDEEP 96:odBu4DmDrZ+0m3VAtqk3nNmgXhTh+RUNRQyIFgO+:CBu4D49bGAd9DRQdFu
- TLSH T166B11322C4112926870E887EC81A46131367641F9D4F3875B8EC92AE5FCD56ED176DFC
- MD5 SHA1 SHA512 SSDEEP TLSH
GANG-Nuker/utilities/Plugins/Auto_Login.py
- SHA256 e9a3d79a5c3216e169a1451c6e899085940f72f94fe263ecd3a9739f4c650b1f
- MD5 5f1e03d33dc4f2c1d78a0109c5778550
- SHA1 a6f44af43b5a45938fa77aba6414b476d6813023
- SHA512 316b33dee5fb95c999589f1b7f3319f64a6b4d17fc03f3b731cbecd15b6165894a6a61038c98856f467400769223255625ba6781749d175235b180a923e232d1
- TLSH T16B51101205402E1297B789FC482B41072B7B41672CABB432B4ECA395CF8483FC763A7E
- MD5 SHA1 SHA512 TLSH
GANG-Nuker/utilities/Plugins/DM_Deleter.py
- SHA256 5cd19808a91cbe40e89a2de9ff24d153b81d022179dbe4c3b23d0474ce3e8e96
- MD5 a0281892c4cc47df836acdc86d2f536a
- SHA1 fda81e4b55658c5471f5734764f56742819ac706
- SHA512 9cb8d770b8a275be09bb9f9d0621142a0923eb6ec0101e44d50e25277a3ba3e6d9c3fa6efc83feb14f25b093fedc94fe7577152c86f812191c43df50d9ccf1cf
- TLSH T14D01ACD2E104300B930F67D9CD466217231E761BEE87B8B9B4DC634CCBD9E21C2AAC56
- MD5 SHA1 SHA512 TLSH
GANG-Nuker/utilities/Plugins/QR_Grabber.py
- SHA256 ed80578d80f6828f88badeb3c3b74720fd76233eb823b786f6cfe5ee308d62b3
- MD5 8318cf91fadaed5b13703be18e432b99
- SHA1 2eeaf7763e8010056399f8591edebe0cf844c517
- SHA512 ec39fc9b7bfffee14f6b53ad359bd392d201755047646ad55be44f0c29473525d20af53ae928f1977740b9a7b6d3b7abb5a2bd287a45af4d445291b012d01b09
- SSDEEP 192:lvtb3r8reFpWwg7UzyiDdMz8Gt/5x3uiLK:lVpjoUz11Gt/5xu
- TLSH T15AF1942644551912039741BC5D9B401E3B6304A7DE8A7C217E9C83E9FFC493FE2AAF9A
- MD5 SHA1 SHA512 SSDEEP TLSH
GANG-Nuker/utilities/Plugins/Server_Lookup.py
- SHA256 a55a516416c59294be36cfae89ab848c7339db53c138416c9b1fe9b62d93815e
- MD5 5525d43dd9604f2001dd7e16fddec630
- SHA1 4f4cbcf679881d139f721f70f3bb1835ae53a9e7
- SHA512 976d3cc527537b6f03503fd1d317779611b643324b72c2f5f739fd48ccdd692f8266a59d76481c72c7ab349bffcb3b59342f407d9d26c284575ecea7ab557e0c
- TLSH T1D54110B714492C05037E09D89802A091F3178517AF17B5793CEC43ACBB5A78299F3D6E
- MD5 SHA1 SHA512 TLSH
GANG-Nuker/utilities/Plugins/Token_Info.py
- SHA256 e5b89869e7d0873c8c34a5ffe8a78b5ca0414a8a3bfcb91e46cf8322b6a68231
- MD5 b4d77d60541fae8713c8e576533a7d17
- SHA1 b6f3c7141bdbbfa31fca5e02e06033962b5597a1
- SHA512 69d8062cf0095561021a27dfadf1d231fd5a20e6dc25ba15244ab65e48b3493ec12f4be9f3f8ca526adcc1a7eda8656d8d65a34b14d04ab0df1be74af6a7320c
- SSDEEP 96:+GVyBwiJGx23wLJnBT2pTFDgQOjNOas6q8GZq8ctwGaW1sYIOfe:+GVHiQnJ52pNgQOgapCRGaWxNm
- TLSH T19BD155390016146AB70F076E4D9B8401333558A7CE47383A7EDC41DD9FC5ABA8DB9A79
- MD5 SHA1 SHA512 SSDEEP TLSH
GANG-Nuker/utilities/Plugins/ignore/ignore.py
- SHA256 9f2ebe4ee8506911c79d986221dde75966f3628e4cb0ab8bc7832b6a1e5cfaea
- MD5 a6fdb61bf0958f708077a3dfe721ba7a
- SHA1 9cb4236f3be9069892093299cfb64118712e991c
- SHA512 34a08158aa31918ba758de0d18d9f468f728495445243751573c47a87997fbcbfd86ffc0f27dfd68d6a922767b44b5132dddecf4550453469921a1d0b8a64121
- MD5 SHA1 SHA512
GANG-Nuker/utilities/Settings/common.py
- SHA256 a44a1c3133a6dac1e882c2e4409d3d5d270b281e282b86d85f22a2138c8b1855
- MD5 f186cc9dc18205a284841cc4f2d9404b
- SHA1 23fae132129a9e4ac12d8a7d2dac5b11f19ac525
- SHA512 c20f402af617891da2f5eae126ba76cd3d488255f25a23cb3066190bb3d312a05375690383de2b8a4630c6aa8af1cbb82a4c48f08bcb392990e9c10ce8b98bc7
- SSDEEP 192:pF+ZPh7K+/e10aa70UEee10FVumZ/e00OhED16oDmBqTJ2Stm6MGXCjIIEqv1n:pF+VRW+EYBxLhED1NiB8J2omQCZn
- TLSH T1D57284664D12582143338E1E4D47A482F75742274E3B6417BAFC84A4AFB096DC1B9EFE
- MD5 SHA1 SHA512 SSDEEP TLSH
GANG-Nuker/utilities/Settings/libarys.py
- SHA256 df597e1bccf9909ead31a2c9b4c535021eb12b5f8a1a0c607a4630fd1e9c9aca
- MD5 696f535444e0cff335a95930ebf63d90
- SHA1 6ef10467e7a25b1a6f441d75d5584c569d1f7d36
- SHA512 d3cf09f60c4ce63804b7f38c3687028c03885703db1b97a73d5ecd97d9ae89d24968c2ff9563ed2b944084e5e6ec70f1b13181d831a7f966d73936dde57c821a
- SSDEEP 96:OkHRqUXKp8MQFzmYxeRwj3RFTp7b2ETIp9tgPKcfEBWVPFcGIX++01QVEBW0w:OkP1RfbVTStY+WVP6tXAzW0w
- TLSH T180B1119B4A2A240A97B0C6DF449794B1E337025B6F331057B8FC577C4FF99211A11AB6
- MD5 SHA1 SHA512 SSDEEP TLSH
GANG-Nuker/utilities/Settings/update.py
- SHA256 4272ea902df70571c3d862a50258604b65907fa68fed8b5b607b204763759774
- MD5 4bf2fc54a6ae687c63d7fbe7af60c08e
- SHA1 25cd8319ded225a40b633156b70f0849ab44b43d
- SHA512 23d188285954c5f222be7d850c3b9d86b8bf47848f3d89f79ef89ab33cafa739d6cf1d5156dbfb4a8a979c45425abc8a24dd5b1f91dc128b53fa164e64b97e18
- SSDEEP 48:gih832plNYwHFYhYAzX1Ra7VThRDkib1XKm+tiNr7Q+bn81+fPly:O32pDxHF+YGXjQV/+ohhy
- TLSH T1FCB10E920D15181407B61DAACD0BAD5DF642E01F9D33BC6936FE90E08FB29E5C079A6F
- MD5 SHA1 SHA512 SSDEEP TLSH
GANG-Nuker/utilities/Settings/version
- SHA256 99600f6a7bfe6c33ebd1a2518f44a861a67afc40c25da42bc622595716529584
- MD5 90d03bebeb88f1b007f47b68aaeb9893
- SHA1 9a1a4bc4ca9e44b3ccf4c764cb670aae41b078a0
- SHA512 f2dd4209f2ff2a09aaa63267411caaaf0434ba9e1df833add86dbb4b1c96397670e3173b22ecf087bf9fe8236a703e8fb080e14c12fed081c3710b57993b0925
- MD5 SHA1 SHA512