kwdld1.zip
- SHA256 3d17040f30110c2d85c9f76575f740e05aafe5288eb28baba21b38b2b1d84a7e
Overview
overview
10Static
static
10kwdld1.zip
windows11-21h2-x64
1Release/Bi...er.exe
windows11-21h2-x64
1Release/Bi...gn.exe
windows11-21h2-x64
1Release/Bu....3.dll
windows11-21h2-x64
1Release/Ce...re.dll
windows11-21h2-x64
1Release/Ce...ss.exe
windows11-21h2-x64
1Release/Ce...me.dll
windows11-21h2-x64
1Release/Ce...re.dll
windows11-21h2-x64
1Release/Ce...ms.dll
windows11-21h2-x64
1Release/CefSharp.dll
windows11-21h2-x64
1Release/Sc...ET.dll
windows11-21h2-x64
1Release/Ve...PI.dll
windows11-21h2-x64
1Release/ch...lf.dll
windows11-21h2-x64
1Release/d3...47.dll
windows11-21h2-x64
1Release/dx...er.dll
windows11-21h2-x64
1Release/dxil.dll
windows11-21h2-x64
1Release/krnlss.exe
windows11-21h2-x64
10Release/libEGL.dll
windows11-21h2-x64
1Release/libGLESv2.dll
windows11-21h2-x64
1Release/libcef.dll
windows11-21h2-x64
1Release/vk...er.dll
windows11-21h2-x64
1Release/vulkan-1.dll
windows11-21h2-x64
1Behavioral task
behavioral1
Sample
kwdld1.zip
Resource
win11-20260911-en
Behavioral task
behavioral2
Sample
Release/Bin/Decompiler.exe
Resource
win11-20260911-en
Behavioral task
behavioral3
Sample
Release/Bin/erto3e4rortoergn.exe
Resource
win11-20260911-en
Behavioral task
behavioral4
Sample
Release/Bunifu_UI_v1.5.3.dll
Resource
win11-20260911-en
Behavioral task
behavioral5
Sample
Release/CefSharp.BrowserSubprocess.Core.dll
Resource
win11-20260911-en
Behavioral task
behavioral6
Sample
Release/CefSharp.BrowserSubprocess.exe
Resource
win11-20260911-en
Behavioral task
behavioral7
Sample
Release/CefSharp.Core.Runtime.dll
Resource
win11-20260911-en
Behavioral task
behavioral8
Sample
Release/CefSharp.Core.dll
Resource
win11-20260911-en
Behavioral task
behavioral9
Sample
Release/CefSharp.WinForms.dll
Resource
win11-20260911-en
Behavioral task
behavioral10
Sample
Release/CefSharp.dll
Resource
win11-20260911-en
Behavioral task
behavioral11
Sample
Release/ScintillaNET.dll
Resource
win11-20260911-en
Behavioral task
behavioral12
Sample
Release/VelocityAPI.dll
Resource
win11-20260911-en
Behavioral task
behavioral13
Sample
Release/chrome_elf.dll
Resource
win11-20260911-en
Behavioral task
behavioral14
Sample
Release/d3dcompiler_47.dll
Resource
win11-20260911-en
Behavioral task
behavioral15
Sample
Release/dxcompiler.dll
Resource
win11-20260911-en
Behavioral task
behavioral16
Sample
Release/dxil.dll
Resource
win11-20260911-en
Behavioral task
behavioral17
Sample
Release/krnlss.exe
Resource
win11-20260911-en
Behavioral task
behavioral18
Sample
Release/libEGL.dll
Resource
win11-20260911-en
Behavioral task
behavioral19
Sample
Release/libGLESv2.dll
Resource
win11-20260911-en
Behavioral task
behavioral20
Sample
Release/libcef.dll
Resource
win11-20260911-en
Behavioral task
behavioral21
Sample
Release/vk_swiftshader.dll
Resource
win11-20260911-en
Behavioral task
behavioral22
Sample
Release/vulkan-1.dll
Resource
win11-20260911-en
ratonrat
Professional
192.166.82.131:1488
QuXBDOHucYTZbvkiebLPAay
true
false
Error
I'm the message box description
Hello World
true
0
true
false
t.me/junk_code
true
silly21
3
true
Infected
true
true
https://t.me/example
| resource | yara_rule |
|---|---|
| static1/unpack001/Release/krnlss.exe | family_ratonrat |
Checks for missing Authenticode signature.
| resource |
|---|
| unpack001/Release/Bin/Decompiler.exe |
| unpack001/Release/Bin/erto3e4rortoergn.exe |
| unpack001/Release/Bunifu_UI_v1.5.3.dll |
| unpack001/Release/CefSharp.BrowserSubprocess.Core.dll |
| unpack001/Release/CefSharp.BrowserSubprocess.exe |
| unpack001/Release/CefSharp.Core.Runtime.dll |
| unpack001/Release/CefSharp.Core.dll |
| unpack001/Release/CefSharp.WinForms.dll |
| unpack001/Release/CefSharp.dll |
| unpack001/Release/ScintillaNET.dll |
| unpack001/Release/VelocityAPI.dll |
| unpack001/Release/chrome_elf.dll |
| unpack001/Release/dxcompiler.dll |
| unpack001/Release/krnlss.exe |
| unpack002/aforge.dll |
| unpack002/aforge.video.directshow.dll |
| unpack002/aforge.video.dll |
| unpack002/costura.dll |
| unpack002/naudio.asio.dll |
| unpack002/naudio.core.dll |
| unpack002/naudio.dll |
| unpack002/naudio.midi.dll |
| unpack002/naudio.wasapi.dll |
| unpack002/naudio.winforms.dll |
| unpack002/naudio.winmm.dll |
| unpack002/stuff.dll |
| unpack001/Release/libEGL.dll |
| unpack001/Release/libGLESv2.dll |
| unpack001/Release/libcef.dll |
| unpack001/Release/vk_swiftshader.dll |
| unpack001/Release/vulkan-1.dll |
Unsigned PE
Checks for missing Authenticode signature.
count=12, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=257, version=34321,
count=3, id=259, version=34321,
count=9, id=260, version=34321,
count=23, id=261, version=34321,
count=203, id=1, productName=Unmarked objects,
count=1152, productName=Unmarked objects (old),
count=1, id=258, version=34435,
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
count=6, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=257, version=29395,
count=2, id=147, productName=VS2008 build 21022, version=21022,
count=26, id=261, version=30034,
count=8, id=260, version=30034,
count=3, id=259, version=30034,
count=7, id=257, version=30034,
count=2, productName=Unmarked objects (old),
count=261, id=1, productName=Unmarked objects,
count=146, id=261, version=30157,
count=1, id=256, version=30157,
count=1, id=255, version=30157,
count=1, id=151,
count=1, id=258, version=30157,
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
count=6, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=147, productName=VS2008 build 21022, version=21022,
count=26, id=261, version=30034,
count=8, id=260, version=30034,
count=3, id=259, version=30034,
count=6, id=257, version=30034,
count=5, id=257, version=29395,
count=2, productName=Unmarked objects (old),
count=242, id=1, productName=Unmarked objects,
count=149, id=261, version=30157,
count=1, id=256, version=30157,
count=1, id=255, version=30157,
count=1, id=151,
count=1, id=258, version=30157,
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Feb 21, 2025
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
count=2, id=257, version=33140,
count=60, id=261, version=33030,
count=8, id=260, version=33030,
count=67, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1217, id=1, productName=Unmarked objects,
count=1, productName=Unmarked objects (old),
count=5, id=259, version=33140,
count=40, id=261, version=33140,
count=13, id=260, version=33140,
count=1, id=256, version=33140,
count=150, id=264, version=33140,
count=2, id=253, version=33140,
count=1, id=255, version=33140,
count=1, id=258, version=33140,
Unsigned PE
Checks for missing Authenticode signature.
Feb 21, 2025
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
count=53, id=260, version=32595,
count=28, id=259, version=32595,
count=201, id=261, version=32595,
count=2, id=261, version=32533,
count=9, id=257, version=30795,
count=152, id=1, productName=Unmarked objects,
count=177, id=265, version=32595,
count=1, id=256, version=32595,
count=1, id=255, version=32595,
count=1, id=151,
count=1, id=258, version=32595,
Detects RatonRAT payload
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Nov 15, 2019
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Sep 16, 2025
SERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=Washington,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553
CN=.NET Foundation Projects Code Signing CA2,O=.NET Foundation,C=US
CN=DigiCert CS RSA4096 Root G5,O=DigiCert\, Inc.,C=US
Unsigned PE
Checks for missing Authenticode signature.
Feb 19, 2020
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
May 8, 2022
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
May 15, 2018
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
May 15, 2018
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Oct 31, 2023
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Sep 13, 2019
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Nov 15, 2019
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Nov 15, 2019
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.