Overview
overview
7Static
static
3Rus_Games_...et.exe
windows10-2004-x64
3Rus_Games_...et.exe
windows11-ltsc_2024-x64
3Rus_Games_...rd.pdf
windows10-2004-x64
3Rus_Games_...rd.pdf
windows11-ltsc_2024-x64
3Rus_Games_...rt.dll
windows10-2004-x64
1Rus_Games_...rt.dll
windows11-ltsc_2024-x64
1Rus_Games_...64.sys
windows10-2004-x64
3Rus_Games_...ck.cmd
windows10-2004-x64
3Rus_Games_...ck.cmd
windows11-ltsc_2024-x64
3Rus_Games_...ck.cmd
windows10-2004-x64
7Rus_Games_...ck.cmd
windows11-ltsc_2024-x64
5Rus_Games_...eck.sh
ubuntu-18.04-amd64
6Rus_Games_...eck.sh
debian-9-armhf
6Rus_Games_...eck.sh
debian-9-mips
6Rus_Games_...eck.sh
debian-9-mipsel
6Rus_Games_...log.sh
ubuntu-18.04-amd64
3Rus_Games_...log.sh
debian-9-armhf
3Rus_Games_...log.sh
debian-9-mips
3Rus_Games_...log.sh
debian-9-mipsel
3Rus_Games_...ase.sh
windows10-2004-x64
3Rus_Games_...ase.sh
windows11-ltsc_2024-x64
3Rus_Games_...log.sh
windows10-2004-x64
3Rus_Games_...log.sh
windows11-ltsc_2024-x64
3Rus_Games_...ate.sh
windows10-2004-x64
3Rus_Games_...ate.sh
windows11-ltsc_2024-x64
3Rus_Games_...ype.sh
windows10-2004-x64
3Rus_Games_...ype.sh
windows11-ltsc_2024-x64
3Rus_Games_...irt.sh
windows10-2004-x64
3Rus_Games_...irt.sh
windows11-ltsc_2024-x64
3Rus_Games_...et.exe
windows10-2004-x64
1Rus_Games_...et.exe
windows11-ltsc_2024-x64
1Rus_Games_...ig.exe
windows10-2004-x64
1Analysis
- max time kernel
0s - max time network
130s - platform
ubuntu-18.04_amd64 - resource
ubuntu1804-amd64-20260513-en - resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system - submitted
12/09/2026, 10:11
Behavioral task
behavioral1
Sample
Rus_Games_And_Sites_Unlocker_1-main/Cleaner for Zapret v1.3/Cleaner for Zapret.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral2
Sample
Rus_Games_And_Sites_Unlocker_1-main/Cleaner for Zapret v1.3/Cleaner for Zapret.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral3
Sample
Rus_Games_And_Sites_Unlocker_1-main/Discord.pdf
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral4
Sample
Rus_Games_And_Sites_Unlocker_1-main/Discord.pdf
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral5
Sample
Rus_Games_And_Sites_Unlocker_1-main/Sites-unlocker-rus/bin/WinDivert.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral6
Sample
Rus_Games_And_Sites_Unlocker_1-main/Sites-unlocker-rus/bin/WinDivert.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral7
Sample
Rus_Games_And_Sites_Unlocker_1-main/Sites-unlocker-rus/bin/WinDivert64.sys
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral8
Sample
Rus_Games_And_Sites_Unlocker_1-main/Sites-unlocker-rus/bin/blockcheck.cmd
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
Rus_Games_And_Sites_Unlocker_1-main/Sites-unlocker-rus/bin/blockcheck.cmd
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral10
Sample
Rus_Games_And_Sites_Unlocker_1-main/Sites-unlocker-rus/bin/blockcheck/blockcheck.cmd
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
Rus_Games_And_Sites_Unlocker_1-main/Sites-unlocker-rus/bin/blockcheck/blockcheck.cmd
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral12
Sample
Rus_Games_And_Sites_Unlocker_1-main/Sites-unlocker-rus/bin/blockcheck/zapret/blockcheck.sh
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
Behavioral task
behavioral13
Sample
Rus_Games_And_Sites_Unlocker_1-main/Sites-unlocker-rus/bin/blockcheck/zapret/blockcheck.sh
Resource
debian9-armhf-20260513-en
debian-9-armhf
Behavioral task
behavioral14
Sample
Rus_Games_And_Sites_Unlocker_1-main/Sites-unlocker-rus/bin/blockcheck/zapret/blockcheck.sh
Resource
debian9-mipsbe-20260513-en
debian-9-mips
Behavioral task
behavioral15
Sample
Rus_Games_And_Sites_Unlocker_1-main/Sites-unlocker-rus/bin/blockcheck/zapret/blockcheck.sh
Resource
debian9-mipsel-20260513-en
debian-9-mipsel
Behavioral task
behavioral16
Sample
Rus_Games_And_Sites_Unlocker_1-main/Sites-unlocker-rus/bin/blockcheck/zapret/blog.sh
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
Behavioral task
behavioral17
Sample
Rus_Games_And_Sites_Unlocker_1-main/Sites-unlocker-rus/bin/blockcheck/zapret/blog.sh
Resource
debian9-armhf-20260513-en
debian-9-armhf
Behavioral task
behavioral18
Sample
Rus_Games_And_Sites_Unlocker_1-main/Sites-unlocker-rus/bin/blockcheck/zapret/blog.sh
Resource
debian9-mipsbe-20260513-en
debian-9-mips
Behavioral task
behavioral19
Sample
Rus_Games_And_Sites_Unlocker_1-main/Sites-unlocker-rus/bin/blockcheck/zapret/blog.sh
Resource
debian9-mipsel-20260513-en
debian-9-mipsel
Behavioral task
behavioral20
Sample
Rus_Games_And_Sites_Unlocker_1-main/Sites-unlocker-rus/bin/blockcheck/zapret/common/base.sh
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
Rus_Games_And_Sites_Unlocker_1-main/Sites-unlocker-rus/bin/blockcheck/zapret/common/base.sh
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral22
Sample
Rus_Games_And_Sites_Unlocker_1-main/Sites-unlocker-rus/bin/blockcheck/zapret/common/dialog.sh
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral23
Sample
Rus_Games_And_Sites_Unlocker_1-main/Sites-unlocker-rus/bin/blockcheck/zapret/common/dialog.sh
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral24
Sample
Rus_Games_And_Sites_Unlocker_1-main/Sites-unlocker-rus/bin/blockcheck/zapret/common/elevate.sh
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral25
Sample
Rus_Games_And_Sites_Unlocker_1-main/Sites-unlocker-rus/bin/blockcheck/zapret/common/elevate.sh
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral26
Sample
Rus_Games_And_Sites_Unlocker_1-main/Sites-unlocker-rus/bin/blockcheck/zapret/common/fwtype.sh
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral27
Sample
Rus_Games_And_Sites_Unlocker_1-main/Sites-unlocker-rus/bin/blockcheck/zapret/common/fwtype.sh
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral28
Sample
Rus_Games_And_Sites_Unlocker_1-main/Sites-unlocker-rus/bin/blockcheck/zapret/common/virt.sh
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral29
Sample
Rus_Games_And_Sites_Unlocker_1-main/Sites-unlocker-rus/bin/blockcheck/zapret/common/virt.sh
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral30
Sample
Rus_Games_And_Sites_Unlocker_1-main/Sites-unlocker-rus/bin/blockcheck/zapret/ip2net/ip2net.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral31
Sample
Rus_Games_And_Sites_Unlocker_1-main/Sites-unlocker-rus/bin/blockcheck/zapret/ip2net/ip2net.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral32
Sample
Rus_Games_And_Sites_Unlocker_1-main/Sites-unlocker-rus/bin/blockcheck/zapret/mdig/mdig.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
General
- Target Rus_Games_And_Sites_Unlocker_1-main/Sites-unlocker-rus/bin/blockcheck/zapret/blockcheck.sh
- Size 53KB
- Sample260912-l735eahe55
- SHA256 bb38faab791e0b79697860e1a1bc8530f97b6c64e22a1b29e617f64e228710a9
- MD5 1d4793171a5beb6d5bb24aa06a167958
- SHA1 0c4d71fb0c34e2413538b44c8c4a2fff946b5b55
- SHA512 6a4aa215219820aadd93b7afc8e57c08c0fa125902098d20afca87028906877cf72351e6d754b0c4c93597c83983b35ec611e566f58cf5fc0fba666ebd8e4980
- SSDEEP 1536:VQ3Ds3LshycxUpercI4wi1uwmvdHfrtwWLlQLMnxXi1vIbIksApwmBx:GycOwi1uw4d/rjBx
- TLSH T115332CECF62F94AD3BA4616CDE09B45E371FDF27490C199DF1AE9A64002493B823EC45
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Enumerates running processes
Discovers information about currently running processes on the system
- Reads CPU attributes 1 TTPs 2 IoCs
description ioc Process File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/online pgrep -
description ioc Process File opened for reading /proc/611/cmdline pgrep File opened for reading /proc/1337/status pgrep File opened for reading /proc/1006/status pgrep File opened for reading /proc/25/cmdline pgrep File opened for reading /proc/29/status pgrep File opened for reading /proc/31/cmdline pgrep File opened for reading /proc/201/status pgrep File opened for reading /proc/268/status pgrep File opened for reading /proc/993/status pgrep File opened for reading /proc/1357/status pgrep File opened for reading /proc/15/cmdline pgrep File opened for reading /proc/432/cmdline pgrep File opened for reading /proc/26/status pgrep File opened for reading /proc/36/cmdline pgrep File opened for reading /proc/171/cmdline pgrep File opened for reading /proc/160/cmdline pgrep File opened for reading /proc/170/cmdline pgrep File opened for reading /proc/1503/status pgrep File opened for reading /proc/5/cmdline pgrep File opened for reading /proc/12/status pgrep File opened for reading /proc/159/status pgrep File opened for reading /proc/970/cmdline pgrep File opened for reading /proc/2/status pgrep File opened for reading /proc/173/cmdline pgrep File opened for reading /proc/201/cmdline pgrep File opened for reading /proc/583/cmdline pgrep File opened for reading /proc/1042/cmdline pgrep File opened for reading /proc/1105/status pgrep File opened for reading /proc/1006/cmdline pgrep File opened for reading /proc/1063/status pgrep File opened for reading /proc/4/cmdline pgrep File opened for reading /proc/82/status pgrep File opened for reading /proc/172/cmdline pgrep File opened for reading /proc/455/cmdline pgrep File opened for reading /proc/612/cmdline pgrep File opened for reading /proc/997/cmdline pgrep File opened for reading /proc/1/cmdline sed File opened for reading /proc/533/status pgrep File opened for reading /proc/715/cmdline pgrep File opened for reading /proc/727/cmdline pgrep File opened for reading /proc/115/status pgrep File opened for reading /proc/437/status pgrep File opened for reading /proc/1006/status pgrep File opened for reading /proc/1170/status pgrep File opened for reading /proc/14/cmdline pgrep File opened for reading /proc/32/status pgrep File opened for reading /proc/937/status pgrep File opened for reading /proc/1092/cmdline pgrep File opened for reading /proc/6/status pgrep File opened for reading /proc/441/status pgrep File opened for reading /proc/1030/status pgrep File opened for reading /proc/1501/status pgrep File opened for reading /proc/908/status pgrep File opened for reading /proc/957/cmdline pgrep File opened for reading /proc/1021/cmdline pgrep File opened for reading /proc/1063/status pgrep File opened for reading /proc/566/status pgrep File opened for reading /proc/915/cmdline pgrep File opened for reading /proc/1063/cmdline pgrep File opened for reading /proc/159/cmdline pgrep File opened for reading /proc/444/cmdline pgrep File opened for reading /proc/686/cmdline pgrep File opened for reading /proc/10/cmdline pgrep File opened for reading /proc/1074/cmdline pgrep
Processes
-
/tmp/Rus_Games_And_Sites_Unlocker_1-main/Sites-unlocker-rus/bin/blockcheck/zapret/blockcheck.sh/tmp/Rus_Games_And_Sites_Unlocker_1-main/Sites-unlocker-rus/bin/blockcheck/zapret/blockcheck.sh1⤵PID:1505
-
/usr/bin/dirnamedirname /tmp/Rus_Games_And_Sites_Unlocker_1-main/Sites-unlocker-rus/bin/blockcheck/zapret/blockcheck.sh2⤵PID:1506
-
-
/bin/sleepsleep 0.0012⤵PID:1508
-
-
/bin/grepgrep -Fxq /usr/sbin2⤵PID:1510
-
-
/bin/grepgrep -Fxq /sbin2⤵PID:1512
-
-
/bin/unameuname2⤵PID:1513
-
-
/usr/bin/headhead -n 12⤵PID:1516
-
-
/bin/sedsed "s/\\x0/\\n/g" /proc/1/cmdline2⤵
- Reads runtime system information
PID:1515
-
-
/bin/readlinkreadlink /sbin/init2⤵PID:1517
-
-
/usr/bin/basenamebasename /lib/systemd/systemd2⤵PID:1518
-
-
/bin/sedsed -nre "s/^Linux version ([0-9]+)\\.[0-9]+.*\$/\\1/p" /proc/version2⤵PID:1519
-
-
/bin/sedsed -nre "s/^Linux version [0-9]+\\.([0-9]+).*\$/\\1/p" /proc/version2⤵PID:1520
-
-
/usr/bin/pgreppgrep "^nfqws\$"2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1521
-
-
/usr/bin/pgreppgrep "^tpws\$"2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1522
-
-
/usr/bin/idid -u2⤵PID:1527
-