General

  • Target
    Spoofer.exe
  • Size 57.2MB
  • Sample260916-st87tszzfv
  • SHA256 12b439c38619b4f2acf52e2b170c9bb1bc0941e208ca8fd03d71c17a6164b74d
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10

Malware Config

Signatures

  • Unsigned PE 31 IoCs

    Checks for missing Authenticode signature.

File Explorer

  • Spoofer.exe
    .exe 57.2MB
  • $PLUGINSDIR/SpiderBanner.dll
    .dll 9KB
  • $PLUGINSDIR/StdUtils.dll
    .dll 100KB
  • $PLUGINSDIR/System.dll
    .dll 12KB
  • $PLUGINSDIR/WinShell.dll
    .dll 3KB
  • $PLUGINSDIR/app-64.7z
    .7z 56.7MB
  • LICENSE.electron.txt
    1KB
  • LICENSES.chromium.html
    4.5MB
  • Zerathveil.exe
    .exe 120.4MB
  • chrome_100_percent.pak
    121KB
  • chrome_200_percent.pak
    181KB
  • d3dcompiler_47.dll
    .dll 4.3MB
  • ffmpeg.dll
    .dll 2.7MB
  • icudtl.dat
    10.0MB
  • libEGL.dll
    .dll 438KB
  • libGLESv2.dll
    .dll 7.3MB
  • locales/am.pak
    142KB
  • locales/ar.pak
    144KB
  • locales/bg.pak
    154KB
  • locales/bn.pak
    203KB
  • locales/ca.pak
    99KB
  • locales/cs.pak
    101KB
  • locales/da.pak
    92KB
  • locales/de.pak
    98KB
  • locales/el.pak
    172KB
  • locales/en-GB.pak
    82KB
  • locales/en-US.pak
    83KB
  • locales/es-419.pak
    97KB
  • locales/es.pak
    99KB
  • locales/et.pak
    88KB
  • locales/fa.pak
    138KB
  • locales/fi.pak
    91KB
  • locales/fil.pak
    101KB
  • locales/fr.pak
    107KB
  • locales/gu.pak
    194KB
  • locales/he.pak
    122KB
  • locales/hi.pak
    201KB
  • locales/hr.pak
    96KB
  • locales/hu.pak
    103KB
  • locales/id.pak
    89KB
  • locales/it.pak
    96KB
  • locales/ja.pak
    116KB
  • locales/kn.pak
    223KB
  • locales/ko.pak
    98KB
  • locales/lt.pak
    105KB
  • locales/lv.pak
    104KB
  • locales/ml.pak
    235KB
  • locales/mr.pak
    191KB
  • locales/ms.pak
    91KB
  • locales/nb.pak
    90KB
  • locales/nl.pak
    93KB
  • locales/pl.pak
    101KB
  • locales/pt-BR.pak
    96KB
  • locales/pt-PT.pak
    97KB
  • locales/ro.pak
    99KB
  • locales/ru.pak
    157KB
  • locales/sk.pak
    103KB
  • locales/sl.pak
    98KB
  • locales/sr.pak
    148KB
  • locales/sv.pak
    89KB
  • locales/sw.pak
    91KB
  • locales/ta.pak
    230KB
  • locales/te.pak
    213KB
  • locales/th.pak
    183KB
  • locales/tr.pak
    94KB
  • locales/uk.pak
    158KB
  • locales/vi.pak
    111KB
  • locales/zh-CN.pak
    83KB
  • locales/zh-TW.pak
    83KB
  • node_modules/@primno/dpapi/dist/index.js
    .js 412B
  • node_modules/@primno/dpapi/package.json
    1KB
  • node_modules/@primno/dpapi/prebuilds/win32-x64/node.napi.node
    .dll 137KB
  • node_modules/adm-zip/adm-zip.js
    .js 37KB
  • node_modules/adm-zip/headers/entryHeader.js
    .js 11KB
  • node_modules/adm-zip/headers/index.js
    94B
  • node_modules/adm-zip/headers/mainHeader.js
    .js 4KB
  • node_modules/adm-zip/methods/deflater.js
    .js 1021B
  • node_modules/adm-zip/methods/index.js
    128B
  • node_modules/adm-zip/methods/inflater.js
    .js 1KB
  • node_modules/adm-zip/methods/zipcrypto.js
    .js 5KB
  • node_modules/adm-zip/package.json
    1KB
  • node_modules/adm-zip/util/constants.js
    6KB
  • node_modules/adm-zip/util/decoder.js
    130B
  • node_modules/adm-zip/util/errors.js
    2KB
  • node_modules/adm-zip/util/fattr.js
    .js 1KB
  • node_modules/adm-zip/util/index.js
    226B
  • node_modules/adm-zip/util/utils.js
    .js 10KB
  • node_modules/adm-zip/zipEntry.js
    .js 15KB
  • node_modules/adm-zip/zipFile.js
    .js 15KB
  • node_modules/archiver/index.js
    .js 2KB
  • node_modules/archiver/lib/core.js
    .js 23KB
  • node_modules/archiver/lib/error.js
    .js 1KB
  • node_modules/archiver/lib/plugins/json.js
    .js 2KB
  • node_modules/archiver/lib/plugins/tar.js
    .js 3KB
  • node_modules/archiver/lib/plugins/zip.js
    .js 4KB
  • node_modules/archiver/package.json
    1KB
  • node_modules/axios/dist/axios.js
    .js 142KB
  • node_modules/axios/dist/axios.min.js
    .js 51KB
  • node_modules/axios/dist/esm/axios.js
    .js 102KB
  • node_modules/axios/dist/esm/axios.min.js
    .js 35KB
  • node_modules/axios/lib/adapters/adapters.js
    .js 3KB
  • node_modules/axios/lib/adapters/fetch.js
    .js 8KB
  • node_modules/axios/lib/adapters/http.js
    .js 26KB
  • node_modules/axios/lib/adapters/xhr.js
    .js 6KB
  • node_modules/axios/lib/axios.js
    2KB
  • node_modules/axios/lib/cancel/CancelToken.js
    .js 2KB
  • node_modules/axios/lib/cancel/CanceledError.js
    618B
  • node_modules/axios/lib/cancel/isCancel.js
    99B
  • node_modules/axios/lib/core/Axios.js
    .js 7KB
  • node_modules/axios/lib/core/AxiosError.js
    2KB
  • node_modules/axios/lib/core/AxiosHeaders.js
    .js 7KB
  • node_modules/axios/lib/core/InterceptorManager.js
    1KB
  • node_modules/axios/lib/core/buildFullPath.js
    .js 783B
  • node_modules/axios/lib/core/dispatchRequest.js
    2KB
  • node_modules/axios/lib/core/mergeConfig.js
    3KB
  • node_modules/axios/lib/core/settle.js
    836B
  • node_modules/axios/lib/core/transformData.js
    .js 776B
  • node_modules/axios/lib/defaults/index.js
    .js 4KB
  • node_modules/axios/lib/defaults/transitional.js
    159B
  • node_modules/axios/lib/env/classes/FormData.js
    106B
  • node_modules/axios/lib/env/data.js
    32B
  • node_modules/axios/lib/helpers/AxiosTransformStream.js
    .js 3KB
  • node_modules/axios/lib/helpers/AxiosURLSearchParams.js
    1KB
  • node_modules/axios/lib/helpers/HttpStatusCode.js
    1KB
  • node_modules/axios/lib/helpers/ZlibHeaderTransformStream.js
    681B
  • node_modules/axios/lib/helpers/bind.js
    444B
  • node_modules/axios/lib/helpers/buildURL.js
    .js 1KB
  • node_modules/axios/lib/helpers/callbackify.js
    .js 372B
  • node_modules/axios/lib/helpers/combineURLs.js
    382B
  • node_modules/axios/lib/helpers/composeSignals.js
    .js 1KB
  • node_modules/axios/lib/helpers/cookies.js
    .js 1KB
  • node_modules/axios/lib/helpers/deprecatedMethod.js
    .js 746B
  • node_modules/axios/lib/helpers/estimateDataURLDecodedBytes.js
    .js 2KB
  • node_modules/axios/lib/helpers/formDataToJSON.js
    .js 2KB
  • node_modules/axios/lib/helpers/formDataToStream.js
    .js 2KB
  • node_modules/axios/lib/helpers/fromDataURI.js
    1KB
  • node_modules/axios/lib/helpers/isAbsoluteURL.js
    618B
  • node_modules/axios/lib/helpers/isAxiosError.js
    371B
  • node_modules/axios/lib/helpers/isURLSameOrigin.js
    420B
  • node_modules/axios/lib/helpers/null.js
    56B
  • node_modules/axios/lib/helpers/parseHeaders.js
    .js 1KB
  • node_modules/axios/lib/helpers/parseProtocol.js
    151B
  • node_modules/axios/lib/helpers/progressEventReducer.js
    .js 1KB
  • node_modules/axios/lib/helpers/readBlob.js
    318B
  • node_modules/axios/lib/helpers/resolveConfig.js
    2KB
  • node_modules/axios/lib/helpers/speedometer.js
    .js 1KB
  • node_modules/axios/lib/helpers/spread.js
    566B
  • node_modules/axios/lib/helpers/throttle.js
    .js 852B
  • node_modules/axios/lib/helpers/toFormData.js
    .js 5KB
  • node_modules/axios/lib/helpers/toURLEncodedForm.js
    540B
  • node_modules/axios/lib/helpers/trackStream.js
    .js 1KB
  • node_modules/axios/lib/helpers/validator.js
    .js 2KB
  • node_modules/axios/lib/platform/browser/classes/Blob.js
    71B
  • node_modules/axios/lib/platform/browser/classes/FormData.js
    81B
  • node_modules/axios/lib/platform/browser/classes/URLSearchParams.js
    188B
  • node_modules/axios/lib/platform/browser/index.js
    305B
  • node_modules/axios/lib/platform/common/utils.js
    1KB
  • node_modules/axios/lib/platform/index.js
    130B
  • node_modules/axios/lib/platform/node/classes/FormData.js
    60B
  • node_modules/axios/lib/platform/node/classes/URLSearchParams.js
    74B
  • node_modules/axios/lib/platform/node/index.js
    .js 828B
  • node_modules/axios/lib/utils.js
    .js 19KB
  • node_modules/axios/package.json
    7KB
  • node_modules/form-data/lib/browser.js
    117B
  • node_modules/form-data/lib/form_data.js
    .js 14KB
  • node_modules/form-data/lib/populate.js
    .js 232B
  • node_modules/form-data/package.json
    2KB
  • node_modules/node-stream-zip/node_stream_zip.js
    .js 38KB
  • node_modules/node-stream-zip/package.json
    1KB
  • node_modules/play-sound/index.js
    .js 1KB
  • node_modules/play-sound/package.json
    888B
  • node_modules/sqlite3/build/Release/node_sqlite3.node
    .dll 1.8MB
  • node_modules/sqlite3/lib/sqlite3-binding.js
    59B
  • node_modules/sqlite3/lib/sqlite3.js
    .js 6KB
  • node_modules/sqlite3/lib/trace.js
    .js 1KB
  • node_modules/sqlite3/node_modules/node-addon-api/package.json
    10KB
  • node_modules/sqlite3/package.json
    2KB
  • node_modules/ws/lib/buffer-util.js
    .js 2KB
  • node_modules/ws/lib/constants.js
    503B
  • node_modules/ws/lib/event-target.js
    .js 7KB
  • node_modules/ws/lib/extension.js
    .js 6KB
  • node_modules/ws/lib/limiter.js
    1KB
  • node_modules/ws/lib/permessage-deflate.js
    .js 14KB
  • node_modules/ws/lib/receiver.js
    .js 16KB
  • node_modules/ws/lib/sender.js
    .js 16KB
  • node_modules/ws/lib/stream.js
    .js 4KB
  • node_modules/ws/lib/subprotocol.js
    .js 1KB
  • node_modules/ws/lib/validation.js
    .js 3KB
  • node_modules/ws/lib/websocket-server.js
    .js 16KB
  • node_modules/ws/lib/websocket.js
    .js 35KB
  • node_modules/ws/package.json
    1KB
  • resources.pak
    4.8MB
  • resources/app-update.yml
    105B
  • resources/app.asar
    24.1MB
  • resources/app.asar.unpacked/node_modules/@primno/dpapi/prebuilds/win32-x64/node.napi.node
    .dll 137KB
  • resources/app.asar.unpacked/node_modules/lzma-native/bin/lzmajs
    .sh .js 1KB
  • resources/app.asar.unpacked/node_modules/lzma-native/index.js
    .js 13KB
  • resources/app.asar.unpacked/node_modules/lzma-native/liblzma-build.sh
    .sh .vbs 138B
  • resources/app.asar.unpacked/node_modules/lzma-native/liblzma-config.sh
    .sh .vbs 733B
  • resources/app.asar.unpacked/node_modules/lzma-native/package.json
    777B
  • resources/app.asar.unpacked/node_modules/lzma-native/prebuilds/darwin-arm64/electron.napi.node
    .bundle 227KB
  • resources/app.asar.unpacked/node_modules/lzma-native/prebuilds/darwin-arm64/node.napi.node
    .bundle 227KB
  • resources/app.asar.unpacked/node_modules/lzma-native/prebuilds/darwin-x64/electron.napi.node
    .bundle 434KB
  • resources/app.asar.unpacked/node_modules/lzma-native/prebuilds/darwin-x64/node.napi.node
    .bundle 434KB
  • resources/app.asar.unpacked/node_modules/lzma-native/prebuilds/linux-arm64/electron.napi.node
    .elf 421KB
  • resources/app.asar.unpacked/node_modules/lzma-native/prebuilds/linux-arm64/node.napi.node
    .elf 421KB
  • resources/app.asar.unpacked/node_modules/lzma-native/prebuilds/linux-x64/electron.napi.node
    .elf 421KB
  • resources/app.asar.unpacked/node_modules/lzma-native/prebuilds/linux-x64/node.napi.node
    .elf 421KB
  • resources/app.asar.unpacked/node_modules/lzma-native/prebuilds/win32-ia32/electron.napi.node
    .dll 619KB
  • resources/app.asar.unpacked/node_modules/lzma-native/prebuilds/win32-ia32/liblzma.dll
    .dll 148KB
  • resources/app.asar.unpacked/node_modules/lzma-native/prebuilds/win32-ia32/node.napi.node
    .dll 619KB
  • resources/app.asar.unpacked/node_modules/lzma-native/prebuilds/win32-x64/electron.napi.node
    .dll 797KB
  • resources/app.asar.unpacked/node_modules/lzma-native/prebuilds/win32-x64/liblzma.dll
    .dll 147KB
  • resources/app.asar.unpacked/node_modules/lzma-native/prebuilds/win32-x64/node.napi.node
    .dll 796KB
  • resources/app.asar.unpacked/node_modules/lzma-native/src/filter-array.cpp
    1KB
  • resources/app.asar.unpacked/node_modules/lzma-native/src/index-parser.cpp
    15KB
  • resources/app.asar.unpacked/node_modules/lzma-native/src/index-parser.h
    7KB
  • resources/app.asar.unpacked/node_modules/lzma-native/src/liblzma-functions.cpp
    2KB
  • resources/app.asar.unpacked/node_modules/lzma-native/src/liblzma-node.hpp
    7KB
  • resources/app.asar.unpacked/node_modules/lzma-native/src/lzma-stream.cpp
    10KB
  • resources/app.asar.unpacked/node_modules/lzma-native/src/module.cpp
    5KB
  • resources/app.asar.unpacked/node_modules/lzma-native/src/mt-options.cpp
    793B
  • resources/app.asar.unpacked/node_modules/lzma-native/src/util.cpp
    4KB
  • resources/app.asar.unpacked/node_modules/sqlite3/build/Release/node_sqlite3.node
    .dll 1.8MB
  • resources/elevate.exe
    .exe 105KB
  • script/crypted.js
    .js 4.9MB
  • script/discord-injection-obf.js
    .js 1.2MB
  • snapshot_blob.bin
    50KB
  • swiftshader/libEGL.dll
    .dll 460KB
  • swiftshader/libGLESv2.dll
    .dll 3.1MB
  • v8_context_snapshot.bin
    168KB
  • vk_swiftshader.dll
    .dll 4.3MB
  • vk_swiftshader_icd.json
    106B
  • vulkan-1.dll
    .dll 715KB
  • $PLUGINSDIR/nsExec.dll
    .dll 6KB
  • $PLUGINSDIR/nsis7z.dll
    .dll 424KB
  • $R0/Uninstall Zerathveil.exe
    .exe 135KB
  • $PLUGINSDIR/StdUtils.dll
    .dll 100KB
  • $PLUGINSDIR/System.dll
    .dll 12KB
  • $PLUGINSDIR/WinShell.dll
    .dll 3KB
  • $PLUGINSDIR/nsExec.dll
    .dll 6KB

Spoofer.exe

  • IMPHASH b34f154ec913d2d2c435cbd644e91687
  • SHA256 12b439c38619b4f2acf52e2b170c9bb1bc0941e208ca8fd03d71c17a6164b74d
  • MD5 SHA1 SHA512 SSDEEP TLSH
  • Unsigned PE

    Checks for missing Authenticode signature.

Minor OS version
0
Major OS version
4
Entry point
13199
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE
PDB paths