Malware-1-master.zip
- SHA256 2ca4803498d7d375a61bfab2a3a4cf7e0eec41d116e50a838791a55b164e0f8c
24/09/2026, 04:14
260924-etscesdg7812/03/2026, 23:34
260312-3kx4baet7z03/02/2026, 02:33
260203-c1632sgw6a06/12/2025, 00:29
251206-as4lvaar3y1002/12/2025, 16:40
251202-t6s7tavmgx1002/12/2025, 16:34
251202-t29n1avme11002/12/2025, 15:52
251202-tbkbesgx7g1001/12/2025, 15:35
251201-s1m8yabs6f1014/11/2025, 18:45
251114-xd9kwafp9z03/11/2025, 07:54
251103-jry5eazjhq10darkcomet
Guest16
bibl1234.ddns.net:1604
pizdash.ddns.net:1604
DC_MUTEX-QKPH38W
MSDCSC\msdcsc.exe
2PaBrGj3TwxK
true
true
true
MicroUpdate
| resource | yara_rule |
|---|---|
| static1/unpack001/Malware-1-master/MEMZ-Destructive.exe | family_killmbr |
| resource | yara_rule |
|---|---|
| static1/unpack001/Malware-1-master/rig.exe | xmrig |
| resource | yara_rule |
|---|---|
| static1/unpack001/Malware-1-master/rig.exe | vmprotect |
AutoIT scripts compiled to PE executables.
| resource | yara_rule |
|---|---|
| static1/unpack001/Malware-1-master/Software.exe | autoit_exe |
| static1/unpack001/Malware-1-master/wintonic.exe | autoit_exe |
File was altered after it was signed.
| resource |
|---|
| unpack001/Malware-1-master/sserv.jpg |
| resource | yara_rule |
|---|---|
| static1/unpack001/Malware-1-master/Illuminati.exe | upx |
| static1/unpack001/Malware-1-master/apache.exe | upx |
| static1/unpack001/Malware-1-master/mysqlconf.exe | upx |
Checks for missing Authenticode signature.
| resource |
|---|
| unpack001/Malware-1-master/2530.exe |
| unpack001/Malware-1-master/2887140.exe |
| unpack001/Malware-1-master/32.exe |
| unpack001/Malware-1-master/5.exe |
| unpack001/Malware-1-master/96591.exe |
| unpack001/Malware-1-master/Amadey.exe |
| unpack001/Malware-1-master/Download.exe |
| unpack001/Malware-1-master/Illuminati.exe |
| unpack001/Malware-1-master/MEMZ-Clean.exe |
| unpack001/Malware-1-master/MEMZ-Destructive.exe |
| unpack001/Malware-1-master/Petya.exe |
| unpack001/Malware-1-master/Software.exe |
| unpack001/Malware-1-master/WannaCry.EXE |
| unpack001/Malware-1-master/Win32.EvilClusterFuck.exe |
| unpack001/Malware-1-master/apache.exe |
| unpack004/out.upx |
| unpack001/Malware-1-master/butterflyondesktop.exe |
| unpack001/Malware-1-master/crb.exe |
| unpack001/Malware-1-master/eternalblue.exe |
| unpack001/Malware-1-master/fear.png.exe |
| unpack001/Malware-1-master/iimo3.exe |
| unpack001/Malware-1-master/jey.exe |
| unpack001/Malware-1-master/m.exe |
| unpack001/Malware-1-master/mo3.exe |
| unpack001/Malware-1-master/mo332.exe |
| unpack001/Malware-1-master/mysqlconf.exe |
| unpack005/out.upx |
| unpack001/Malware-1-master/o.exe |
| unpack001/Malware-1-master/qOA7iZJcoB8.exe |
| unpack001/Malware-1-master/rig.exe |
| unpack001/Malware-1-master/stak.exe |
| unpack001/Malware-1-master/sysm.exe |
| unpack006/wannakey-master/bin/wannakey.exe |
| unpack006/wannakey-master/bin/wannakey_omp.exe |
| unpack006/wannakey-master/bin/winapi_check.exe |
| unpack001/Malware-1-master/youwin.exe |
Inno Setup installer
| resource | yara_rule |
|---|---|
| static1/unpack001/Malware-1-master/butterflyondesktop.exe | innosetup |
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
count=20, id=125, productName=VS2005 build 50727, version=50727,
count=97, id=109, productName=VS2005 build 50727, version=50727,
count=42, id=110, productName=VS2005 build 50727, version=50727,
count=7, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=114, id=1, productName=Unmarked objects,
count=1, id=114, version=50727,
count=1, id=124, productName=VS2005 build 50727, version=50727,
count=1, id=120, productName=VS2005 build 50727, version=50727,
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
count=23, id=241, version=40116,
count=175, id=243, version=40116,
count=49, id=242, version=40116,
count=7, id=199, version=41118,
count=31, id=259, version=24123,
count=120, id=261, version=24123,
count=38, id=260, version=24123,
count=11, id=203, version=65501,
count=168, id=1, productName=Unmarked objects,
count=62, id=260, productName=VS2015 Update 3 [14.0] build 24210, version=24210,
count=111, id=261, productName=VS2015 Update 3 [14.0] build 24210, version=24210,
count=2, id=265, version=24210,
count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,
count=1, id=151,
count=1, id=258, productName=VS2015 Update 3 [14.0] build 24210, version=24210,
Unsigned PE
Checks for missing Authenticode signature.
count=15, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=57, id=1, productName=Unmarked objects,
count=5, id=261, productName=VS2015 Update 3 [14.0] build 24210, version=24210,
count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,
count=1, id=258, productName=VS2015 Update 3 [14.0] build 24210, version=24210,
Detects KillMBR
Unsigned PE
Checks for missing Authenticode signature.
count=15, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=61, id=1, productName=Unmarked objects,
count=5, id=261, productName=VS2015 Update 3 [14.0] build 24210, version=24210,
count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,
count=1, id=258, productName=VS2015 Update 3 [14.0] build 24210, version=24210,
Unsigned PE
Checks for missing Authenticode signature.
count=73, id=225, productName=VS2013 build 21005, version=21005,
count=30, id=223, productName=VS2013 build 21005, version=21005,
count=201, id=224, productName=VS2013 build 21005, version=21005,
count=2, id=225, version=20806,
count=4, id=206, version=65501,
count=33, id=203, version=65501,
count=468, id=1, productName=Unmarked objects,
count=101, id=229, version=30501,
count=1, id=219, productName=VS2013 build 21005, version=21005,
count=1, id=222, productName=VS2013 UPD2 build 30501, version=30501,
AutoIT Executable
AutoIT scripts compiled to PE executables.
Unsigned PE
Checks for missing Authenticode signature.
count=1, id=199, version=41118,
count=51, id=205, version=50929,
count=174, id=206, version=50929,
count=50, id=207, version=50929,
count=9, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=37, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=532, id=1, productName=Unmarked objects,
count=77, id=216, version=61030,
count=2, id=205, productName=VS2012 UPD4 build 61030, version=61030,
count=1, id=201, productName=VS2012 UPD4 build 61030, version=61030,
count=1, id=151,
count=1, id=204, productName=VS2012 UPD4 build 61030, version=61030,
Unsigned PE
Checks for missing Authenticode signature.
count=2, id=12, version=7291,
count=1, id=11, version=8047,
count=4, id=14, version=7299,
count=11, id=10, version=8047,
count=4, id=4, version=8047,
count=13, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=163, id=1, productName=Unmarked objects,
count=7, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Inno Setup is an open-source installation builder for Windows applications.
Inno Setup installer
Unsigned PE
Checks for missing Authenticode signature.
count=23, id=225, version=20806,
count=16, id=223, version=20806,
count=97, id=224, version=20806,
count=19, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=198, id=1, productName=Unmarked objects,
count=30, id=229, version=21005,
count=3, id=223, productName=VS2013 build 21005, version=21005,
count=1, id=219, productName=VS2013 build 21005, version=21005,
count=1, id=222, productName=VS2013 build 21005, version=21005,
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
count=5, id=150, version=20413,
count=30, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=157, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=7, id=109, productName=VS2005 build 50727, version=50727,
count=29, id=123, productName=VS2005 build 50727, version=50727,
count=560, id=1, productName=Unmarked objects,
count=151, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=148, productName=VS2008 build 21022, version=21022,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
Unsigned PE
Checks for missing Authenticode signature.
count=1, id=14, version=7299,
count=12, id=9, version=8783,
count=1, id=13, version=9782,
Unsigned PE
Checks for missing Authenticode signature.
count=22, id=223, productName=VS2013 build 21005, version=21005,
count=113, id=224, productName=VS2013 build 21005, version=21005,
count=40, id=225, productName=VS2013 build 21005, version=21005,
count=13, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=100, id=1, productName=Unmarked objects,
count=1, id=30977, version=25408,
count=1, id=219, productName=VS2013 build 21005, version=21005,
count=1, id=32874, version=35237,
Unsigned PE
Checks for missing Authenticode signature.
count=1, id=150, version=20413,
count=28, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=152, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=130, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=7, id=109, productName=VS2005 build 50727, version=50727,
count=29, id=123, productName=VS2005 build 50727, version=50727,
count=529, id=1, productName=Unmarked objects,
count=2, id=138, version=30729,
count=1, id=148, productName=VS2008 build 21022, version=21022,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
Unsigned PE
Checks for missing Authenticode signature.
count=5, id=150, version=20413,
count=29, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=161, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=7, id=109, productName=VS2005 build 50727, version=50727,
count=27, id=123, productName=VS2005 build 50727, version=50727,
count=574, id=1, productName=Unmarked objects,
count=6, id=138, version=30729,
count=148, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=148, productName=VS2008 build 21022, version=21022,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
count=2, id=4, version=8047,
count=1, id=14, version=7299,
count=11, id=10, version=8047,
count=9, id=123, productName=VS2005 build 50727, version=50727,
count=40, id=1, productName=Unmarked objects,
count=1, id=138, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
Unsigned PE
Checks for missing Authenticode signature.
count=23, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=27, id=1, productName=Unmarked objects,
count=1, productName=Unmarked objects (old),
count=1, id=219, productName=VS2013 build 21005, version=21005,
count=1, id=222, productName=VS2013 build 21005, version=21005,
XMRig Miner payload
Unsigned PE
Checks for missing Authenticode signature.
count=17, id=259, version=24610,
count=176, id=261, version=24610,
count=23, id=260, version=24610,
count=6, id=199, version=41118,
count=27, id=259, version=25305,
count=120, id=261, version=25305,
count=38, id=260, version=25305,
count=17, id=257, version=24610,
count=285, id=1, productName=Unmarked objects,
count=75, id=265, version=25547,
count=1, id=255, productName=VS2017 v15.4.5 build 25547, version=25547,
count=1, id=151,
count=1, id=258, productName=VS2017 v15.4.5 build 25547, version=25547,
Codesign digest Mismatch
File was altered after it was signed.
Jan 1, 0001
count=9, id=123, productName=VS2005 build 50727, version=50727,
count=145, id=1, productName=Unmarked objects,
count=1, id=131, productName=VS2008 build 21022, version=21022,
count=4, productName=Unmarked objects (old),
count=1, id=148, productName=VS2008 build 21022, version=21022,
count=1, id=145, productName=VS2008 build 21022, version=21022,
Unsigned PE
Checks for missing Authenticode signature.
count=22, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=4, id=259, version=25305,
count=13, id=260, version=25305,
count=4, id=257, version=25305,
count=31, id=261, version=25305,
count=1, id=259, productName=VS2017 v15.4.5 build 25547, version=25547,
count=5, id=260, productName=VS2017 v15.4.5 build 25547, version=25547,
count=15, id=257, version=24610,
count=305, id=1, productName=Unmarked objects,
count=15, id=264, version=25547,
count=17, id=261, productName=VS2017 v15.4.5 build 25547, version=25547,
count=1, id=255, productName=VS2017 v15.4.5 build 25547, version=25547,
count=1, id=258, productName=VS2017 v15.4.5 build 25547, version=25547,
Unsigned PE
Checks for missing Authenticode signature.
count=19, id=149, productName=VS2008 build 21022, version=21022,
count=114, id=131, productName=VS2008 build 21022, version=21022,
count=13, id=123, productName=VS2005 build 50727, version=50727,
count=115, id=1, productName=Unmarked objects,
count=45, id=14245, version=28510,
count=1, id=148, productName=VS2008 build 21022, version=21022,
count=1, id=65311, version=23896,
Jul 13, 2016
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Jul 13, 2016
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
count=7, id=241, version=40116,
count=107, id=243, version=40116,
count=26, id=242, version=40116,
count=4, id=261, version=24123,
count=19, id=259, version=24123,
count=12, id=260, version=24123,
count=5, id=203, version=65501,
count=98, id=1, productName=Unmarked objects,
count=14, id=265, version=24123,
count=1, id=256, version=24123,
count=1, id=255, version=24123,
count=1, id=258, version=24123,
Unsigned PE
Checks for missing Authenticode signature.
count=16, id=241, version=40116,
count=152, id=243, version=40116,
count=30, id=242, version=40116,
count=23, id=259, version=23907,
count=60, id=261, version=23907,
count=34, id=260, version=23907,
count=9, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=108, id=1, productName=Unmarked objects,
count=7, id=261, productName=VS2015 UPD2 build 23918, version=23918,
count=1, id=255, productName=VS2015 UPD2 build 23918, version=23918,
count=1, id=258, productName=VS2015 UPD2 build 23918, version=23918,
Unsigned PE
Checks for missing Authenticode signature.
count=16, id=241, version=40116,
count=152, id=243, version=40116,
count=30, id=242, version=40116,
count=2, id=257, version=23907,
count=24, id=259, version=23907,
count=60, id=261, version=23907,
count=34, id=260, version=23907,
count=9, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=114, id=1, productName=Unmarked objects,
count=7, id=261, productName=VS2015 UPD2 build 23918, version=23918,
count=1, id=255, productName=VS2015 UPD2 build 23918, version=23918,
count=1, id=258, productName=VS2015 UPD2 build 23918, version=23918,
Unsigned PE
Checks for missing Authenticode signature.
count=16, id=241, version=40116,
count=150, id=243, version=40116,
count=30, id=242, version=40116,
count=22, id=259, version=23907,
count=60, id=261, version=23907,
count=34, id=260, version=23907,
count=11, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=113, id=1, productName=Unmarked objects,
count=4, id=261, productName=VS2015 UPD2 build 23918, version=23918,
count=1, id=255, productName=VS2015 UPD2 build 23918, version=23918,
count=1, id=258, productName=VS2015 UPD2 build 23918, version=23918,
AutoIT Executable
AutoIT scripts compiled to PE executables.
Sep 23, 2026
CN=PC Tonics Inc,OU=PC Tonics Inc,O=PC Tonics Inc,POSTALCODE=302020,STREET=48/94\, Rajat Path\, Mansarover,L=Jaipur,ST=Rajasthan,C=IN,2.5.4.18=#1306333032303230
CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Jun 18, 2018
CN=PC Tonics Inc,OU=PC Tonics Inc,O=PC Tonics Inc,POSTALCODE=302020,STREET=48/94\, Rajat Path\, Mansarover,L=Jaipur,ST=Rajasthan,C=IN,2.5.4.18=#1306333032303230
CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
count=2, id=225, version=20806,
count=1, id=199, version=41118,
count=51, id=223, productName=VS2013 build 21005, version=21005,
count=177, id=224, productName=VS2013 build 21005, version=21005,
count=53, id=225, productName=VS2013 build 21005, version=21005,
count=9, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=37, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=544, id=1, productName=Unmarked objects,
count=80, id=234, version=40629,
count=1, id=223, productName=VS2013 UPD5 build 40629, version=40629,
count=1, id=219, productName=VS2013 build 21005, version=21005,
count=1, id=151,
count=1, id=222, productName=VS2013 UPD5 build 40629, version=40629,
Unsigned PE
Checks for missing Authenticode signature.