Rainbow_colorbot_clean[.]exe

Resubmissions

19/09/2026, 22:09

260919-12t2wafn81

19/09/2026, 22:06

260919-11e7bsty5k3

Sharing

Copy URL Twitter E-mail

General

Target
Rainbow_colorbot_clean.exe
Size 1.4MB
Sample260919-11e7bsty5k
SHA256 9af3c411b4196b76f9066fad5640bf1e715f09b975d771de157c53521ffa0b48
MD5 e49da98e04e606344c4666d38dd2300a
SHA1 6ef2596ecf8e16bd1b4fda6818aea6eadec04dcc
SHA512 9002e0a5a5b36948cd2373684f4c489583734951fc2d4b89dd71166d81709119e6aa33d69d3d236758b60aafb148df582e5d6a45b31fea55175b6532bb6a669c
SSDEEP 24576:iuvRsp4+Efb20L6AnIVvxB8BK1tyFDG4OIKkM2NzL:ZvqvIPL9n4wLOIJL
TLSH
T10165BE5AF3EA47AAD063863D9F90E533A1B07C11271037DB7B854A2D2F676C44EB071A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Rainbow_colorbot_clean.exe

File Explorer

Rainbow_colorbot_clean.exe

.exe 1.4MB

Rainbow_colorbot_clean.exe

IMPHASH 6044ce7fe7e7a3004d3cb9addbd46489
SHA256 9af3c411b4196b76f9066fad5640bf1e715f09b975d771de157c53521ffa0b48
MD5 e49da98e04e606344c4666d38dd2300a
SHA1 6ef2596ecf8e16bd1b4fda6818aea6eadec04dcc
SHA512 9002e0a5a5b36948cd2373684f4c489583734951fc2d4b89dd71166d81709119e6aa33d69d3d236758b60aafb148df582e5d6a45b31fea55175b6532bb6a669c
SSDEEP 24576:iuvRsp4+Efb20L6AnIVvxB8BK1tyFDG4OIKkM2NzL:ZvqvIPL9n4wLOIJL
TLSH
T10165BE5AF3EA47AAD063863D9F90E533A1B07C11271037DB7B854A2D2F676C44EB071A
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

312536

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

user32

DispatchMessageA PeekMessageA DefWindowProcW PostQuitMessage UnregisterClassW RegisterClassExW CreateWindowExW DestroyWindow ShowWindow LoadCursorA ScreenToClient ClientToScreen SetCursor SetCursorPos IsWindowUnicode GetCapture GetKeyState GetMessageExtraInfo TrackMouseEvent EmptyClipboard GetClipboardData SetClipboardData CloseClipboard OpenClipboard GetClientRect GetWindowTextA InvalidateRect EndPaint BeginPaint ReleaseDC GetDC GetForegroundWindow mouse_event GetAsyncKeyState SetLayeredWindowAttributes CreateWindowExA RegisterClassA DefWindowProcA SetProcessDpiAwarenessContext GetCursorPos GetWindowRect SetWindowRgn UpdateWindow GetSystemMetrics ReleaseCapture SetCapture SetWindowPos TranslateMessage

gdi32

CreateCompatibleDC CreatePen CreateCompatibleBitmap BitBlt GetStockObject CreateSolidBrush SelectObject CreateRoundRectRgn GetDIBits Ellipse DeleteObject DeleteDC

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_47

D3DCompile

dwmapi

DwmSetWindowAttribute DwmExtendFrameIntoClientArea

kernel32

ReadConsoleW GetConsoleMode GetConsoleOutputCP FlushFileBuffers LCMapStringW VirtualProtect FlsFree FlsSetValue FlsGetValue FlsAlloc HeapAlloc HeapFree OutputDebugStringW WriteFile ExitProcess ReadFile FreeLibraryAndExitThread ExitThread SetFilePointerEx GetFileSizeEx FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW GetProcessHeap CreateThread WriteConsoleW SetStdHandle GetStringTypeW GetModuleHandleExW GetModuleFileNameW CreateFileW GetStdHandle LoadLibraryExW TlsFree GetFileAttributesA GetModuleHandleA GetProcAddress Sleep GetTickCount GlobalAlloc GlobalUnlock GlobalLock GlobalFree MultiByteToWideChar WideCharToMultiByte QueryPerformanceCounter QueryPerformanceFrequency FreeLibrary LoadLibraryA CloseHandle GetCurrentThreadId ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW InitializeCriticalSectionEx GetSystemTimeAsFileTime GetModuleHandleW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetCurrentProcess TerminateProcess GetCurrentProcessId InitializeSListHead TlsSetValue HeapSize HeapReAlloc SetEndOfFile GetFileType RtlPcToFileHeader RaiseException RtlUnwindEx GetLastError SetLastError EncodePointer EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue

imm32

ImmGetContext ImmReleaseContext ImmSetCompositionWindow ImmSetCandidateWindow

Name

.text

Size

464KB

Virtual Size

464KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

159KB

Virtual Size

158KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

802KB

Virtual Size

807KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

22KB

Virtual Size

21KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

Rainbow_colorbot_clean.exe

user32

gdi32

d3d11

d3dcompiler_47

dwmapi

kernel32

imm32

generic