1[.]02[.]rar | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
1.02.rar
Size 41.2MB
Sample260930-ss3cwsbd96
SHA256 fab1d675a0a47f075bd5dd8f05662edac58478059e4467f558c3bbb23cd79846
MD5 c9da11ca10b9937aaeeef39bd462d8a7
SHA1 cce441cdb0cbfa04e0098b008b13c08fcad3e78c
SHA512 18e887907a7b7dc2997a93f31a3b922be3ec006566da42a511c3816faa46315601981127d16082894fbfb6d8a66a6dc41c9f378f869e326a98a52af5f3ee8f53
SSDEEP 786432:w72MUMSh/nMLnSI/JME51iORTIbcoU9ZnZ5TzpDTto06RUh3ybUT:wiMSh0LrJX51nRaCZ/TERUxT
TLSH
T11997333BABF5CB9BF88533F80ADB950666965010B7BBE04D14A3B7C84CCB1919F61C49
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

pyinstaller

Malware Config

Signatures

Detects Pyinstaller 1 IoCs

pyinstaller

resource	yara_rule
static1/unpack001/1.02/Kitty.exe	pyinstaller

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
unpack001/1.02/Kitty.dll
unpack001/1.02/Kitty.exe

File Explorer

1.02.rar

.rar 41.2MB
1.02/Bg.jpg

.png 1.2MB
1.02/Kitty.dll

.dll 6.8MB
1.02/Kitty.exe

.exe 38.3MB
launcher.pyc

33KB

1.02.rar

SHA256 fab1d675a0a47f075bd5dd8f05662edac58478059e4467f558c3bbb23cd79846
MD5 c9da11ca10b9937aaeeef39bd462d8a7
SHA1 cce441cdb0cbfa04e0098b008b13c08fcad3e78c
SHA512 18e887907a7b7dc2997a93f31a3b922be3ec006566da42a511c3816faa46315601981127d16082894fbfb6d8a66a6dc41c9f378f869e326a98a52af5f3ee8f53
SSDEEP 786432:w72MUMSh/nMLnSI/JME51iORTIbcoU9ZnZ5TzpDTto06RUh3ybUT:wiMSh0LrJX51nRaCZ/TERUxT
TLSH
T11997333BABF5CB9BF88533F80ADB950666965010B7BBE04D14A3B7C84CCB1919F61C49
MD5 SHA1 SHA512 SSDEEP TLSH

1.02/Kitty.dll

IMPHASH 80153a3913d0b439e48b23d53685a41e
SHA256 7f2e8e736dc4272f87860dd7697e2ca422c4fd39135e0dd36693fbb511f585bc
MD5 e0b54914933860ec9c2ad56931e07d66
SHA1 e391f160e9aacbeab693794e7ac139b8eafd9108
SHA512 da0ad07b4799ff91479586190a57577ca51b7719ab05805288a4e6b3b92a575a66f65579dddb17b2747e6f5a5961ad57839ce11f22ed31eaded83d3d494f0e1d
SSDEEP 49152:tD6YUEfSRw5i3fFl5H1NUxIuYqJwSvEmpQYh/A7FgF52uo9wIvTFc1eENM13HZJ2:SB1KpQYlkQ1SJuBXXI3qT/g83j/
TLSH
T197769E17B741926DD43AC57CC7D38715A632B4460B22A2CF1348572C6EA7BF82F3A3A5
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1414288

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

c:\Users\kianh\Downloads\newvelo\velocity-improved-main\cs2\velocity-cs2\..\bin\velocity-cs2-dev.pdb

kernel32

AcquireSRWLockExclusive AcquireSRWLockShared AddVectoredExceptionHandler AreFileApisANSI CloseHandle CloseThreadpoolTimer CloseThreadpoolWait CompareStringEx CompareStringW CopyFileW CreateDirectoryExW CreateDirectoryW CreateEventExW CreateFileA CreateFileMappingA CreateFileW CreateHardLinkW CreateSemaphoreExW CreateSymbolicLinkW CreateThread CreateThreadpoolTimer CreateThreadpoolWait DecodePointer DeleteCriticalSection DeleteFileW DeviceIoControl DisableThreadLibraryCalls EncodePointer EnterCriticalSection EnumSystemLocalesW ExitProcess ExitThread FindClose FindFirstFileExW FindFirstFileW FindNextFileW FlsAlloc FlsFree FlsGetValue FlsSetValue FlushFileBuffers FlushProcessWriteBuffers FormatMessageA FreeEnvironmentStringsW FreeLibrary FreeLibraryAndExitThread FreeLibraryWhenCallbackReturns GetACP GetCPInfo GetCommandLineA GetCommandLineW GetConsoleMode GetConsoleOutputCP GetCurrentDirectoryA GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentProcessorNumber GetCurrentThread GetCurrentThreadId GetDateFormatW GetDiskFreeSpaceExW GetEnvironmentStringsW GetEnvironmentVariableA GetEnvironmentVariableW GetExitCodeThread GetFileAttributesExW GetFileAttributesW GetFileInformationByHandle GetFileInformationByHandleEx GetFileSizeEx GetFileType GetFinalPathNameByHandleW GetFullPathNameW GetLastError GetLocalTime GetLocaleInfoEx GetLocaleInfoW GetModuleFileNameA GetModuleFileNameW GetModuleHandleA GetModuleHandleExA GetModuleHandleExW GetModuleHandleW GetNativeSystemInfo GetOEMCP GetProcAddress GetProcessHeap GetProcessId GetProcessTimes GetStartupInfoW GetStdHandle GetStringTypeW GetSystemInfo GetSystemTimeAsFileTime GetTempPathW GetThreadContext GetThreadId GetTickCount64 GetTimeFormatW GetTimeZoneInformation GetUserDefaultLCID GetVersionExA GlobalAlloc GlobalLock GlobalUnlock HeapAlloc HeapFree HeapReAlloc HeapSize InitOnceBeginInitialize InitOnceComplete InitOnceExecuteOnce InitializeCriticalSectionAndSpinCount InitializeCriticalSectionEx InitializeSListHead InterlockedFlushSList InterlockedPushEntrySList IsDebuggerPresent IsProcessorFeaturePresent IsThreadAFiber IsValidCodePage IsValidLocale LCMapStringEx LCMapStringW LeaveCriticalSection LoadLibraryExW LoadLibraryW LocalFree MapViewOfFile MoveFileExW MultiByteToWideChar OutputDebugStringA OutputDebugStringW QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReadConsoleW ReadFile ReadProcessMemory ReleaseSRWLockExclusive ReleaseSRWLockShared RemoveVectoredExceptionHandler ResumeThread RtlCaptureContext RtlLookupFunctionEntry RtlPcToFileHeader RtlUnwind RtlUnwindEx RtlVirtualUnwind SetConsoleCtrlHandler SetCurrentDirectoryW SetEndOfFile SetEnvironmentVariableW SetFileAttributesW SetFileInformationByHandle SetFilePointerEx SetFileTime SetLastError SetStdHandle SetThreadpoolTimer SetThreadpoolWait SetUnhandledExceptionFilter Sleep SleepConditionVariableSRW SuspendThread SwitchToThread TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue TryAcquireSRWLockExclusive TryAcquireSRWLockShared UnhandledExceptionFilter UnmapViewOfFile VirtualProtect WaitForSingleObject WaitForSingleObjectEx WaitForThreadpoolTimerCallbacks WakeAllConditionVariable WakeConditionVariable WideCharToMultiByte WriteConsoleW WriteFile

shell32

SHGetFolderPathW

user32

CloseClipboard CreateWindowExA DefWindowProcA DestroyWindow EmptyClipboard GetAsyncKeyState GetClipboardData GetCursorPos GetSystemMetrics GetWindowLongPtrW LoadCursorW MapVirtualKeyW OpenClipboard RegisterClassExA SetClipboardData SetCursor SetCursorPos UnregisterClassA

advapi32

GetUserNameA RegCloseKey RegCreateKeyExW RegDeleteValueW RegEnumValueW RegOpenKeyExW RegQueryValueExW RegSetValueExW

ole32

CoCreateInstance CoInitializeEx CoUninitialize CreateStreamOnHGlobal PropVariantClear

winhttp

WinHttpCloseHandle WinHttpConnect WinHttpCrackUrl WinHttpOpen WinHttpOpenRequest WinHttpQueryDataAvailable WinHttpQueryHeaders WinHttpReadData WinHttpReceiveResponse WinHttpSendRequest WinHttpSetTimeouts WinHttpWriteData

api-ms-win-core-synch-l1-2-0

WaitOnAddress

version

GetFileVersionInfoA GetFileVersionInfoSizeA VerQueryValueW

d3d11

D3D11CreateDeviceAndSwapChain

Name

.text

Size

3.2MB

Virtual Size

3.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.4MB

Virtual Size

1.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

2.0MB

Virtual Size

2.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

208KB

Virtual Size

208KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.retplne

Size

512B

Virtual Size

200B

Characteristics

Name

.tls

Size

17KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

512B

Virtual Size

500B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_addr

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_guard_c

Size

512B

Virtual Size

36B

Characteristics

Name

_guard_d

Size

512B

Virtual Size

36B

Characteristics

Name

memcpy_

Size

512B

Virtual Size

264B

Characteristics

Name

.rsrc

Size

512B

Virtual Size

232B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

16KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

1.02/Kitty.exe

IMPHASH e3e80a143805ea18936c8f612e25d363
SHA256 b57b1b2fc73b7926301d93c0bdd24f349524ff31bb9b2d87a7269f958e4af201
MD5 2addb3a597c27031d45c96349424fcb6
SHA1 211afcedb1b97f39132f5ec4a7a8c9cde7400990
SHA512 4f43908da6a8410fb535167f1460508ee8010ad3874fbd3cc0839f21c036a6a892f8503f73a68a5b9588343efaa4bb10b139284bd1b1d401a92c19eaafb1ef6c
SSDEEP 786432:kI/a5z7Zw+mG3ezBJEUI/5WvqZXBBSpQIntFfKRELtAbxxDYMc3n0zM:kISzCkCBby5ZXBB92FicCxZvc3nm
TLSH
T1CE9733901FA5DEC7D812D1FB462B08CAF7ABA8E142762055FF221727F61A6C1715E323
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects Pyinstaller

pyinstaller
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

59248

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

user32

CreateWindowExW ShutdownBlockReasonCreate MsgWaitForMultipleObjects ShowWindow DestroyWindow RegisterClassW DefWindowProcW PeekMessageW DispatchMessageW TranslateMessage GetMonitorInfoW MonitorFromPoint GetCursorPos GetSystemMetrics PostMessageW GetMessageW MessageBoxW MessageBoxA SystemParametersInfoW DestroyIcon SetWindowLongPtrW GetWindowLongPtrW GetClientRect InvalidateRect ReleaseDC GetDC DrawTextW GetDialogBaseUnits EndDialog DialogBoxIndirectParamW MoveWindow SendMessageW

comctl32

ord380

kernel32

GetACP IsValidCodePage GetStringTypeW GetFileAttributesExW SetEnvironmentVariableW FlushFileBuffers LCMapStringW CompareStringW VirtualProtect GetCurrentDirectoryW HeapAlloc GetFileSizeEx GetConsoleOutputCP GetOEMCP GetCPInfo GetLastError FreeLibrary GetProcAddress LoadLibraryExW GetModuleHandleW MulDiv FormatMessageW CloseHandle GetCurrentProcess GetModuleFileNameW SetDllDirectoryW GetEnvironmentStringsW SetErrorMode GetCurrentProcessId OpenProcess QueryFullProcessImageNameW CreateToolhelp32Snapshot Process32FirstW Process32NextW CreateDirectoryW GetCommandLineW GetEnvironmentVariableW ExpandEnvironmentStringsW DeleteFileW FindClose FindFirstFileW FindNextFileW GetDriveTypeW RemoveDirectoryW GetTempPathW QueryPerformanceCounter QueryPerformanceFrequency WaitForSingleObject Sleep TerminateProcess GetExitCodeProcess CreateProcessW GetStartupInfoW LocalFree SetConsoleCtrlHandler K32EnumProcessModules K32GetModuleFileNameExW CreateFileW FindFirstFileExW GetFinalPathNameByHandleW MultiByteToWideChar WideCharToMultiByte SetFilePointerEx FreeEnvironmentStringsW GetProcessHeap GetTimeZoneInformation HeapSize HeapReAlloc WriteConsoleW SetEndOfFile CreateSymbolicLinkW GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter RtlUnwindEx SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection RtlLookupFunctionEntry EncodePointer RaiseException RtlPcToFileHeader GetCommandLineA GetFileInformationByHandle GetFileType PeekNamedPipe SystemTimeToTzSpecificLocalTime FileTimeToSystemTime ReadFile GetFullPathNameW SetStdHandle GetStdHandle WriteFile ExitProcess GetModuleHandleExW IsProcessorFeaturePresent RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter HeapFree GetConsoleMode ReadConsoleW

advapi32

GetTokenInformation OpenProcessToken ConvertSidToStringSidW ConvertStringSecurityDescriptorToSecurityDescriptorW

gdi32

SelectObject DeleteObject CreateFontIndirectW

Name

.text

Size

200KB

Virtual Size

200KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

82KB

Virtual Size

82KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

10KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

424KB

Virtual Size

423KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

1.02.rar

1.02/Bg.jpg

1.02/Kitty.dll

kernel32

shell32

user32

advapi32

ole32

winhttp

api-ms-win-core-synch-l1-2-0

version

d3d11

generic

1.02/Kitty.exe

user32

comctl32

kernel32

advapi32

gdi32

generic

launcher.pyc