x64.zip
- SHA256 7f1e804c7e147c9d4b569c9545a725995a46727744eacd37d9437c8d6e71500e
Behavioral task
behavioral1
Sample
defendnot-loader.exe
Resource
win11-20260911-en
windows11-21h2-x64
2 signatures
900 seconds
Behavioral task
behavioral2
Sample
defendnot.dll
Resource
win11-20260911-en
windows11-21h2-x64
0 signatures
900 seconds
Behavioral task
behavioral3
Sample
extra-strip.bat
Resource
win11-20260911-en
windows11-21h2-x64
5 signatures
900 seconds
General
- Target x64.zip
- Size 3.4MB
- Sample260930-vh2pqade69
- SHA256 7f1e804c7e147c9d4b569c9545a725995a46727744eacd37d9437c8d6e71500e
- MD5 3ca1a46a786ee1b287502144de032c99
- SHA1 1816fd1f67303938aa210753134d892633bdf9de
- SHA512 382aa8eb6f9cb57c42e132dcdaf2efdac2b1deeef0d35222a6f481fdc4dc83499ab001dcd3dd8dd94a7dd11b41cfd346b70203cd668bc2b94bc71afc29263c9b
- SSDEEP 98304:6neLpxRAE2bKRPNqQ5hLLJ/slTlXT+mYVX2i3thLsy2:6neSrbnQ5Z5sTjVY2
- TLSH T1E6F533CF73E74CBB46CF7AF140366206E996A63D0EAF4781D202C7C267A9545814B87E
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects Defendnot 1 IoCs
resource yara_rule static1/unpack001/defendnot-loader.exe family_defendnot - Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/defendnot-loader.exe unpack001/defendnot.dll
File Explorer
-
x64.zip.zip 3.4MB
-
defendnot-loader.exe.exe 581KB
-
defendnot-loader.pdb8.1MB
-
defendnot.dll.dll 426KB
-
defendnot.pdb6.2MB
-
extra-strip.bat.bat 2KB
defendnot-loader.exe
- IMPHASH 59d65f5efacbdb1aa2a6cf745b07c058
- SHA256 f57a4dd3bd3ce82eaf6d7143e837b3fa59a0accdac76fd3dc053433efdd50e5e
- MD5 aa636642fb9c479c7a9763d18862b12e
- SHA1 100d02103379ba284c465933394af8b55a90d0b1
- SHA512 b03126a3ff4809511388c787bdf6c65f22306840d8b1887924bc5ac0d1e52571cb832771260decbf6e115386aec8bda0b4434086d2b3f07f47f347f768a6db82
- SSDEEP 6144:iQbKLBXMhgqo62sYoFJqiE3Wy13avn7aC8xmph0lhSMXlBXBWnlgh7RB9PCn:/1sriq13UaZxmph0lhSMXli4v9m
- TLSH T14BC49D26B7A940F9E1A7C27889930A16EA737C4643516BCF03E44A675F236E04F3FB11
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects Defendnot
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
166292
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
defendnot-loader.pdb
kernel32
WaitForSingleObject
GetModuleHandleA
LoadLibraryA
CloseHandle
GetProcAddress
VirtualAllocEx
CreateRemoteThread
WriteProcessMemory
VirtualFreeEx
TerminateProcess
UnmapViewOfFile
CreateFileMappingA
MapViewOfFile
AllocConsole
SetEndOfFile
VerifyVersionInfoW
VerSetConditionMask
GetLastError
GetModuleHandleExA
CreateProcessA
GetModuleFileNameA
WriteConsoleW
GetProcessHeap
SetStdHandle
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
GetACP
LocalFree
FormatMessageA
GetLocaleInfoEx
CreateFileW
FindClose
FindFirstFileW
FindFirstFileExW
FindNextFileW
GetFileAttributesExW
AreFileApisANSI
GetModuleHandleW
GetFileInformationByHandleEx
MultiByteToWideChar
WideCharToMultiByte
InitOnceComplete
InitOnceBeginInitialize
QueryPerformanceCounter
QueryPerformanceFrequency
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
SleepConditionVariableSRW
Sleep
GetCurrentThreadId
InitializeCriticalSectionEx
GetSystemTimeAsFileTime
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
EncodePointer
DecodePointer
LCMapStringEx
GetStringTypeW
GetCPInfo
WakeAllConditionVariable
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
IsProcessorFeaturePresent
GetCurrentProcessId
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
RtlUnwindEx
RtlPcToFileHeader
RaiseException
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetCommandLineA
GetCommandLineW
GetStdHandle
WriteFile
GetModuleFileNameW
HeapAlloc
HeapFree
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
VirtualProtect
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetFileType
GetConsoleOutputCP
GetConsoleMode
GetFileSizeEx
SetFilePointerEx
FlushFileBuffers
GetExitCodeProcess
CreateProcessW
ReadFile
ReadConsoleW
HeapReAlloc
HeapSize
HeapQueryInformation
IsValidCodePage
RtlUnwind
advapi32
OpenSCManagerW
StartServiceW
OpenServiceW
QueryServiceStatusEx
CloseServiceHandle
ole32
CoCreateInstance
CoInitializeEx
oleaut32
SysAllocString
VariantInit
VariantClear
SysFreeString
Name
.text
Size
318KB
Virtual Size
317KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
234KB
Virtual Size
233KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
7KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
16KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
488B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=185, id=261, version=33145,
count=18, id=260, version=33145,
count=8, id=259, version=33145,
count=17, id=260, version=35207,
count=1, id=262, version=33145,
count=12, id=259, version=35207,
count=101, id=261, version=35207,
count=9, id=257, version=33145,
count=182, id=1, productName=Unmarked objects,
count=4, id=265, version=35228,
count=1, id=255, version=35228,
count=1, id=258, version=35228,
defendnot-loader.pdb
- SHA256 265b96b90f12bccfe1329c294c08c2f1cab79cf9333fcd0545d37b469949a636
- MD5 c2140a431bcc0335c5e5d6a9463ce1ed
- SHA1 32492a2408880dccf21bbf0287751390f2f7b48a
- SHA512 101024c9a7343420e680b696cdf3c4d92824ed807340ea2e8e07f0e1395c51ac56584b505c29b1c6b02d9d6d8cacf4f9c230c52d390632025405ff2536b2a45b
- SSDEEP 49152:rIGHz0EKH+PYRFYceuABsCS2RToRTIPmHfgq8HaqG+Sqj8pmz0uRTl3bTKNRTFPN:rIGYFYcVABsHLITWzHstcrmp
- TLSH T1EA868D12F6554D23C4AF2375A08B072CA3E5D902ABCE77CB994E93255DCA38CDF9B580
- MD5 SHA1 SHA512 SSDEEP TLSH
defendnot.dll
- IMPHASH 90f1c2d7c9b84440d617e12ff6db513d
- SHA256 b0870e105c7ad37fb0bdcb9305279b2943810d55300e8721eb64bdaa588cc84e
- MD5 a9283ba8a7afa573b616856fcd00d597
- SHA1 904a26e329804812ea42e4a1bb2d62f9eaafcac2
- SHA512 81f47b5f5323b099e3c8b2b92576f41cfdde1a3204880f9bf5692dd04b6867ac79dd93c53b830afba5cebd4aeef20a1bee37a4cf57bedfcf67f551ac1f485e5b
- SSDEEP 6144:JJnzyCQ6dPBn6KjhoKUpMoAOOLph0lhSMXlBXBWnH7sLBQX1wLj:OCFJUHAOOLph0lhSMXliHoLSXS
- TLSH T11494AE15B7A590B9E16B8274C8570A05EB737C414791EBCF03A4DAB26F237D16B3EB02
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
87436
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
defendnot.pdb
kernel32
GetModuleFileNameA
GetModuleHandleExA
VerSetConditionMask
VerifyVersionInfoW
AllocConsole
FreeLibraryAndExitThread
UnmapViewOfFile
CloseHandle
CreateThread
OpenFileMappingA
MapViewOfFile
SetEndOfFile
WriteConsoleW
HeapSize
SetStdHandle
GetProcessHeap
FreeEnvironmentStringsW
GetEnvironmentStringsW
LocalFree
FormatMessageA
GetLocaleInfoEx
CreateFileW
FindClose
FindFirstFileExW
FindNextFileW
AreFileApisANSI
GetLastError
GetModuleHandleW
GetProcAddress
MultiByteToWideChar
WideCharToMultiByte
QueryPerformanceCounter
QueryPerformanceFrequency
InitOnceComplete
InitOnceBeginInitialize
Sleep
GetCurrentThreadId
InitializeCriticalSectionEx
GetSystemTimeAsFileTime
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
EncodePointer
DecodePointer
LCMapStringEx
GetStringTypeW
GetCPInfo
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
GetCurrentProcessId
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
RtlUnwindEx
RtlPcToFileHeader
RaiseException
InterlockedFlushSList
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
GetFileSizeEx
SetFilePointerEx
GetStdHandle
GetFileType
HeapAlloc
HeapFree
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
VirtualProtect
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
WriteFile
GetConsoleOutputCP
GetConsoleMode
FlushFileBuffers
ReadFile
ReadConsoleW
HeapReAlloc
IsValidCodePage
GetACP
GetOEMCP
GetCommandLineA
GetCommandLineW
RtlUnwind
user32
MessageBoxA
ole32
CoInitialize
CoCreateInstance
oleaut32
SysAllocString
SysFreeString
Name
.text
Size
192KB
Virtual Size
191KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
213KB
Virtual Size
212KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
5KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
11KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=173, id=261, version=33145,
count=18, id=260, version=33145,
count=8, id=259, version=33145,
count=14, id=260, version=35207,
count=12, id=259, version=35207,
count=80, id=261, version=35207,
count=9, id=257, version=33145,
count=162, id=1, productName=Unmarked objects,
count=3, id=265, version=35228,
count=1, id=255, version=35228,
count=1, id=258, version=35228,
defendnot.pdb
- SHA256 40fb8285642ac9b10c1d0651332e74e00a1fc7aef2808841e669198f0bf916e1
- MD5 cdbf5aa0cb88a7517528df3d5d920a5b
- SHA1 2492cdce805a594aed819b27063b5d945f554f2c
- SHA512 d9c2c3bc1810b3c87c458ed3e35877dccee4f110051b497e746dc59c967b2214c63e8d7ab1ef1604a11fbc223d98401b39925eb61e4ed2715fa2d3ff953bd2d0
- SSDEEP 49152:RIPUVnDxNMVbpwxAgAmOfp4lGKEE62F44NDSY74e1oH4H6HxH3Hnh8PNL8bPr9bi:RIPUVnDTMVbpt5Pe
- TLSH T15E669D52F6998C23C45F1735A15F076EA3D8DA074BCE3BCB8A89E2549DDA348DF1E180
- MD5 SHA1 SHA512 SSDEEP TLSH
extra-strip.bat
- SHA256 4f77953b248bb6ecd3d20cebc8b5a4a0927cd0f8bc40225293778eb10e1dc198
- MD5 6b3336e8462bc35f30e6865cdd3b843a
- SHA1 e49ab6817d2d16178ccd6944a29b0fe528d3d739
- SHA512 69481820a32314d5130afd0353a732f333b903aafda8a5674a7a8c851f490b96d3326a7d78fdac2fd8c58a953eb7a52f04d8e2239f17936b489d7f4c6dfc642e
- TLSH T1B0414620A07F662AD3B2F680DC867E47EBEAB28360E243517BE771164543A8B443D5C6
- MD5 SHA1 SHA512 TLSH