193_R-Aimbot_v1.0.rar
- SHA256 d506a0aadb1658a3d7a5381920f42d76b776632866484e4a41837911773a431f
Behavioral task
behavioral1
Sample
R-Aimbot v1.0/r-aimbot.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
R-Aimbot v1.0/r-aimbot.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral3
Sample
R-Aimbot v1.0/r-aimbot.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
General
- Target 193_R-Aimbot_v1.0.rar
- Size 19KB
- Sample260910-ajwjwasepd
- SHA256 d506a0aadb1658a3d7a5381920f42d76b776632866484e4a41837911773a431f
- MD5 b41ba2e8164bccbc2721c3a49e780118
- SHA1 4a4e5afc741ccb632f1de5639a5255836d15b349
- SHA512 0bd7e2dfed71eeee6cf14e910630b123bbd68226b0ac22e513e92f526e80e94506cf15cc62da7963458fff6bffe36484592df9ae5a9ae3ab0712240ef42f91e3
- SSDEEP 384:Ht9JcRl2f4M7IgUc/7TX4K+aHL8uRO7PLP7whRNEsYUJQezSD4aBEh:HtTcLY478okAuqPUhRNEsYUHSDhEh
- TLSH T13A92E12A32485EF1FE531EC0C21B07603D2438BBD65C8E2016CED1AF6A2ED04B71B272
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
-
resource yara_rule static1/unpack001/R-Aimbot v1.0/r-aimbot.exe upx - Unsigned PE 3 IoCs
Checks for missing Authenticode signature.
resource unpack001/R-Aimbot v1.0/r-aimbot.dll unpack001/R-Aimbot v1.0/r-aimbot.exe unpack002/out.upx
File Explorer
-
193_R-Aimbot_v1.0.rar.rar 19KB
-
R-Aimbot v1.0/r-aimbot.cfg162B
-
R-Aimbot v1.0/r-aimbot.dll.dll 17KB
-
R-Aimbot v1.0/r-aimbot.exe.exe 5KB
-
out.upx.exe 7KB
-
Прочитать.txt42B
R-Aimbot v1.0/r-aimbot.cfg
- SHA256 8749d251efdef3ba4126b135279a1c4546415432dcdd466e21afd6020e9ab996
- MD5 22ef77d376dce77cc20fbcfe3cc54ecd
- SHA1 9f580770ab95b2faec9f11969fb329c3f45bd48d
- SHA512 15506b412bf328955e65ace0a68ea14f7ee46d61a29a61f41f43c585561cc23d1974e3fe6efef4b10e999d3a1f08bdef8f2a2708a2780e70c368d3fc45a05e56
- TLSH T1D7C02B3B27482B5FE893C9F13D434241887C6380C97653D0F8AF2982AC9B04C3394F50
- MD5 SHA1 SHA512 TLSH
R-Aimbot v1.0/r-aimbot.dll
- IMPHASH b9e80ad2c93637b6803ec6126cc4a8f4
- SHA256 b093e329b2c43f183016d719b78ac20143c3221720d10793ccd16bd6bcf1bc07
- MD5 bfa33deef42692a702715c9c898b7f3c
- SHA1 8014fb681c7f9b887c2f523a4590c7eb350e5146
- SHA512 2e309e8f5258f202217ccd7bbb5ddcf86d55952d4b629ec2d5d04dcb904813acb9d2260d222f6ebe653e194ab9a7cd4097ebfbd9e5a353dbeea75513a5d537bf
- SSDEEP 384:HYA+oAzNCebGHn56Iov+Ib9WgqN75iZPhJWkSl3ZXcOJtYA:/AzNCMGH53FIb9WDsZOkpOJtN
- TLSH T1C982BFA0EE818E63CE541DB0B4470A77F22D55D00A566222E5DCC92A3E774E336E306A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
50122
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree
msvcr90
_decode_pointer
opengl32
glLoadIdentity
Name
.text
Size
12KB
Virtual Size
44KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
3KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
512B
Virtual Size
512B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=14, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=5, id=123, productName=VS2005 build 50727, version=50727,
count=70, id=1, productName=Unmarked objects,
count=23, id=138, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
R-Aimbot v1.0/r-aimbot.exe
- SHA256 7fc254954bcc79de826439460697c10e392861bd22df5c6b9a26b6a6b5558b9f
- MD5 474ef2b507f2828faf212417ebb84eee
- SHA1 de97020b7be94f5b78dbd105c9580c12d7faa705
- SHA512 decbc46d8de10eae11a9a2cb2460cfe47e04d283b69919a8b25dc3c1ba75e204c180942534ade61e9e2a3f7c37c94ec556b3b793fab0e86a2e48627a7f9b957c
- SSDEEP 96:rp0ILOQhuiv6ZXfAoXOtCrZQ9uARO+UtDmVthcX:rjL7hVgXfAlCrZQ9uSOjtAC
- TLSH T138C14A47F2CDAB3EC7568073A78BD012129FA76803EE13482CF8E55FA95B47903150A7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
27312
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
UPX0
Size
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
3KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=2, id=123, productName=VS2005 build 50727, version=50727,
count=1, id=110, productName=VS2005 build 50727, version=50727,
count=1, id=125, productName=VS2005 build 50727, version=50727,
count=20, id=109, productName=VS2005 build 50727, version=50727,
count=3, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=62, id=1, productName=Unmarked objects,
count=1, id=114, version=50727,
count=1, id=120, productName=VS2005 build 50727, version=50727,
out.upx
- SHA256 8789adf6e82421ebb1ff31109022c31a68d5bfc7d6362dce05fd9ee1133a7ee6
- MD5 e2f057944b566bd145cfb9f6dfe3deed
- SHA1 2249663351ee681276a776c3a3d74fe6ea5bdefc
- SHA512 8ea7e2291c2f3d3bdeda837441f769ca9a4a98bd70d8661f3be79464e6469ea00fd94f08b8ea8f1d98ee0fcdbc86472799d2dcbeb30941ec19d87460e63f18fc
- SSDEEP 96:r9G6wua2ScSC/1q4kT55hyw8QIQZ/F+FKOVthc:rA6wuahI04Qqw8MZ/F+FKs
- TLSH T106E1B40BBBC0D632E7DA4CF11C71855243ABB8715B99A2C73BB329CACD248F58816009
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
5623
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
.text
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
428B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=123, productName=VS2005 build 50727, version=50727,
count=1, id=110, productName=VS2005 build 50727, version=50727,
count=1, id=125, productName=VS2005 build 50727, version=50727,
count=20, id=109, productName=VS2005 build 50727, version=50727,
count=3, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=62, id=1, productName=Unmarked objects,
count=1, id=114, version=50727,
count=1, id=120, productName=VS2005 build 50727, version=50727,
Прочитать.txt
- SHA256 2bdeace2367d2d7a22c273d38c0d100b8539203824a060b1a5fa224f5b4aaa0a
- MD5 bd3d668f48115372d93d9afda729a9ba
- SHA1 3d2ea972432a316a8fce1b827eeea171e43d272f
- SHA512 2c2cfb11c91956819f86d2f51771f97c7807014938480d70109abb342c05d7d6c829026eaacb9fff3bac19af9e4977f5297ec7401ad2f7dd7e0dbed59c2c8216
- MD5 SHA1 SHA512