8INSD.zip
- SHA256 6802e16a9c3f8781410aeb8e09c87c5c0aa57dee1741f116c870c80beb29d2ef
Overview
overview
8Static
static
38INSD.zip
windows10-2004-x64
18INSD.zip
windows11-ltsc_2024-x64
1net10.0-wi...s.json
windows10-2004-x64
3net10.0-wi...s.json
windows11-ltsc_2024-x64
3net10.0-wi...er.exe
windows10-2004-x64
1net10.0-wi...er.exe
windows11-ltsc_2024-x64
1net10.0-wi...er.exe
windows10-2004-x64
8net10.0-wi...er.exe
windows11-ltsc_2024-x64
8net10.0-wi...er.pdb
windows10-2004-x64
3net10.0-wi...er.pdb
windows11-ltsc_2024-x64
3net10.0-wi...g.json
windows10-2004-x64
3net10.0-wi...g.json
windows11-ltsc_2024-x64
3net10.0-wi...ON.jpg
windows10-2004-x64
1net10.0-wi...ON.jpg
windows11-ltsc_2024-x64
1net10.0-wi...nd.jpg
windows10-2004-x64
1net10.0-wi...nd.jpg
windows11-ltsc_2024-x64
1Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
8INSD.zip
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
8INSD.zip
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
net10.0-windows/Booststrapper.deps.json
Resource
win10v2004-20260911-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral4
Sample
net10.0-windows/Booststrapper.deps.json
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral5
Sample
net10.0-windows/Booststrapper.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
net10.0-windows/Booststrapper.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral7
Sample
net10.0-windows/Booststrapper.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral8
Sample
net10.0-windows/Booststrapper.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
14 signatures
150 seconds
Behavioral task
behavioral9
Sample
net10.0-windows/Booststrapper.pdb
Resource
win10v2004-20260911-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral10
Sample
net10.0-windows/Booststrapper.pdb
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral11
Sample
net10.0-windows/Booststrapper.runtimeconfig.json
Resource
win10v2004-20260911-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral12
Sample
net10.0-windows/Booststrapper.runtimeconfig.json
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
Behavioral task
behavioral13
Sample
net10.0-windows/DOWNLOADICON.jpg
Resource
win10v2004-20260911-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral14
Sample
net10.0-windows/DOWNLOADICON.jpg
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral15
Sample
net10.0-windows/background.jpg
Resource
win10v2004-20260911-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral16
Sample
net10.0-windows/background.jpg
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
General
- Target 8INSD.zip
- Size 114KB
- Sample261003-wwhpfaef52
- SHA256 6802e16a9c3f8781410aeb8e09c87c5c0aa57dee1741f116c870c80beb29d2ef
- MD5 3b165b5c7ec7a2ddb16070b43a4a8b6f
- SHA1 6cc0528ca174331fa89c299aa4149cd3f6d73891
- SHA512 a450ad97f1b126cd1d0c3bb13858389d66556599da9e302127082cadffedc59e5b87021fc9bfc089847f8696388e2aac255916dfc4475b7635d9ebeaecaafabf
- SSDEEP 3072:3jhRJVk37vogDmlhK4Q1SMUmmTw+m0ynzSERF2EWGjqucwm:5eLulkQ0ay+4FdWCqucX
- TLSH T11CB3126CC8307910F48F18797E7C57AFBC8C270679A9316B095392693C7606F7AA4D63
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/net10.0-windows/Booststrapper.dll unpack001/net10.0-windows/Booststrapper.exe
File Explorer
-
8INSD.zip.zip 114KB
-
net10.0-windows/Booststrapper.deps.json433B
-
net10.0-windows/Booststrapper.dll.exe 35KB
-
net10.0-windows/Booststrapper.exe.exe 158KB
-
net10.0-windows/Booststrapper.pdb22KB
-
net10.0-windows/Booststrapper.runtimeconfig.json447B
-
net10.0-windows/DOWNLOADICON.jpg11KB
-
net10.0-windows/background.jpg.jpg 4KB
net10.0-windows/Booststrapper.deps.json
- SHA256 4abb39f68404e288cfba33ed8667c4beb842eb03b0e7da60f3bf816b4bc6dc07
- MD5 436016eca9e3a0f2e470001228cf36cd
- SHA1 3259d6ac9a3fd086ac52ae04d2b552f21cde670c
- SHA512 8f0d5c83bb195e7d6f0e94c14d5b961f59a8e80b08b69782b5d451e4d9d02217bdef504be2f7791a09304a7008f11d35d97c7c45569192ca3484a7b46dbe0af6
- TLSH T1D7E09209E2981C9300F123BD643A4792F53297339011290AB7FF921C0F72C2B6625F75
- MD5 SHA1 SHA512 TLSH
net10.0-windows/Booststrapper.dll
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 48f97a293a27847d1860d2a28b365085636383641bd8f81e395b21810ba030fd
- MD5 6a1b9437464c86ed8c4939ccb3caba81
- SHA1 644f4269fa04cfa99fb62a0abec1425d9549c0ba
- SHA512 6e0b19f8ba3c57441a519e90e9f33adcebbee6a7ad9b48b576512cc90e6621cc142d9fc3200028c612d854455d94fac499d401bc0ae942e234cadb09657146ac
- SSDEEP 768:dsEpuNR20eRKrkOkqLqufbuFHOU9U8ypesxkdTV+b1q+B+bOczUbxYTdvet:fpuNQ0eRKrkOkqLqCbuFHZ+xkdTsb1qK
- TLSH T114F23A0867F98B23D0BE47BC9466610057B1E53AF223E74D4EC9F4EA1DA33A087517A7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
41934
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\Usser\Desktop\Booststraper\Booststrapper\Booststrapper\obj\Debug\net10.0-windows\Booststrapper.pdb
mscoree
_CorExeMain
Name
.text
Size
33KB
Virtual Size
32KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
net10.0-windows/Booststrapper.exe
- IMPHASH 53e4e12437621212a425d294842d0a96
- SHA256 6059fb8b5b7567946f81ecd629a4b02ba116c6bb12739059d88ac7d3e1eaa329
- MD5 89d5a3ca6be44ae32e86e350c592874f
- SHA1 052617afe8dc08e41ca0ca8f52ec9fa67516953e
- SHA512 66706760b9e7d9259892ba05ecad0e818766a5ce0ceae234d16c491c576418adacbb4ebcc0173125632a5e73504feaf1ef9934c14aaa710f9bd772ca564e9d74
- SSDEEP 3072:cVDxk88wN1nLVu7dL1Z9Qnlf9rE38wGTbzaAT51b:IHRu7F1nQnB8KKO
- TLSH T1D0F33C13A6A851BEE1B3D678C9924941FB7278594B71A7CF03504EBA0F77BD09E39302
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
80800
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
D:\a\_work\1\s\src\runtime\artifacts\obj\win-x64.Release\corehost\apphost\standalone\apphost.pdb
shell32
ShellExecuteW
advapi32
RegCloseKey
ReportEventW
RegisterEventSourceW
RegOpenKeyExW
RegGetValueW
DeregisterEventSource
kernel32
TlsFree
CreateActCtxW
ActivateActCtx
GetLastError
FindResourceW
GetWindowsDirectoryW
GetProcAddress
GetModuleHandleW
FreeLibrary
LoadLibraryExW
FindFirstFileExW
EnterCriticalSection
GetFullPathNameW
FindNextFileW
GetCurrentProcess
GetStdHandle
GetModuleHandleExW
GetModuleFileNameW
LeaveCriticalSection
GetEnvironmentVariableW
FindClose
GetFileAttributesW
MultiByteToWideChar
GetConsoleMode
GetFileAttributesExW
LoadLibraryA
WriteConsoleW
DeleteCriticalSection
WideCharToMultiByte
IsWow64Process
OutputDebugStringW
GetCurrentProcessId
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
SetLastError
RaiseException
RtlPcToFileHeader
RtlUnwindEx
InitializeSListHead
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetStringTypeW
SwitchToThread
GetCurrentThreadId
InitializeCriticalSectionEx
EncodePointer
DecodePointer
LCMapStringEx
QueryPerformanceCounter
GetSystemTimeAsFileTime
user32
MessageBoxW
api-ms-win-crt-runtime-l1-1-0
terminate
_register_thread_local_exe_atexit_callback
_c_exit
__p___wargv
__p___argc
_exit
exit
_initterm_e
_errno
_initterm
_get_initial_wide_environment
_initialize_wide_environment
_configure_wide_argv
_set_app_type
_seh_filter_exe
_cexit
_crt_atexit
_register_onexit_function
_initialize_onexit_table
abort
_invoke_watson
api-ms-win-crt-heap-l1-1-0
_set_new_mode
calloc
malloc
_callnewh
free
api-ms-win-crt-time-l1-1-0
_time64
_gmtime64_s
wcsftime
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vfwprintf
__p__commode
fputwc
__acrt_iob_func
__stdio_common_vswprintf
_set_fmode
_wfsopen
fflush
setvbuf
__stdio_common_vsnwprintf_s
api-ms-win-crt-locale-l1-1-0
_create_locale
___mb_cur_max_func
___lc_codepage_func
___lc_locale_name_func
__pctype_func
_configthreadlocale
setlocale
_lock_locales
_free_locale
_unlock_locales
api-ms-win-crt-string-l1-1-0
strlen
strcmp
wcsncmp
toupper
strcpy_s
_wcsdup
wcsnlen
api-ms-win-crt-convert-l1-1-0
_wtoi
wcstoul
api-ms-win-crt-math-l1-1-0
__setusermatherr
Name
.text
Size
97KB
Virtual Size
96KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
49KB
Virtual Size
49KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
828B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=10, id=259, version=35207,
count=13, id=260, version=35207,
count=86, id=261, version=35207,
count=16, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=9, id=257, version=33145,
count=212, id=1, productName=Unmarked objects,
count=10, id=265, version=35228,
count=1, id=258, version=35228,
net10.0-windows/Booststrapper.pdb
- SHA256 dffa355856028f899a381ad940d8f577099fecbc2a34eea91ecdf3c17260ddc9
- MD5 6b21e450e248fc0bd233ef955cff0e3b
- SHA1 78b92a91f2e11e2bd2c4d1632799347b4ce7fbe4
- SHA512 23e5906df2ea22611d26b95f945dfa3d598f902077b2964cd7decbc0c41a3458a2c21c5e0714cc5812741dd1256ee4c9d9acab03dd51c726097f1d72d85b3bbb
- SSDEEP 384:Dqh2+Ybi2pTAkxwtiQpQmuGTaIQPUUbrMURQMC1lHz73dRDdPKkXOH+fzRftVzJe:DEMtThC1lnDfnWvPDTcJPlq
- TLSH T131A2D6336388CE16C2021A7B6566C2DD3778C310270AEF79F1D46A1DDDAF79507BA1A1
- MD5 SHA1 SHA512 SSDEEP TLSH
net10.0-windows/Booststrapper.runtimeconfig.json
- SHA256 039a0defb81019310fa2e8a17ef8d2ad086b1a37656149aa598f1f75893f2a22
- MD5 b451096fec6028f9acbd24badac69055
- SHA1 d7d2be96751913015927effb0d58b0ac1d3fd839
- SHA512 cb3e5230de93c3fed5cf8165107de145c613655fbda729e604419a80e3a51431ceaf4e30c92a71fb73a8ffe2c713bd95f8f34abad7e12d0f1bc692fc9886d490
- TLSH T141F0222ACA100DA308B973BAD62AC182FF30432B20141956B5FC081C2FB3A611100F99
- MD5 SHA1 SHA512 TLSH
net10.0-windows/DOWNLOADICON.jpg
- SHA256 2119f81ff4d7ab99a268a8e1c89e6c19f6512f7e1f3de8c2d174e4b3d2250bce
- MD5 e81c4b853220be97c44643d4cb33ec25
- SHA1 24bf54c27a68bab696dbdee9b58035ea1f15bc23
- SHA512 8f1adf26a6090e184f01db5168887661da4ce43610a5b79ba02b0ff694b917075c9fc7412a02e521c72652d81a1e38f7d3b9f95c2594f48a2e3c69e7057a11d0
- SSDEEP 192:p6DCGwDF4CKH9Oe9Bcg4oH7lPAdtOptz2gq8Qo/llgeX:8VcFf2OU4i7lPae6gq4/lqeX
- TLSH T11832B04F9F674AE3CF7D4270815D070A1AD9FD20D222DF878AFD2921149F1580F43192
- MD5 SHA1 SHA512 SSDEEP TLSH
net10.0-windows/background.jpg
- SHA256 77017135f40cfd270ddb2c301231677c89b67d97055aed1dddfe8ca15b587013
- MD5 93618a9c8158e54329f86cfed35c7960
- SHA1 167cd118867aa31e0f409c6f125fd8a6b6449b75
- SHA512 c7eb28c758f43ff38eb1c1ca32094ece448308191437dda87fb67f399d603c3ac5fba24518de248e90934aaf828356d3def33aaea50e15c870647209d8308c1a
- SSDEEP 96:4qkj9xUbqUeSV2NGmyBZ0jP6xe7RO0suR/oAXRcjv6:qj9uWUeDpuZ0jixe74zi9XRc76
- TLSH T180816D090A742682CB414C7C86E5CA64920E3D29F7733B34A38AF645CA4336DE2DBB56
- MD5 SHA1 SHA512 SSDEEP TLSH