34db504936e949e42904ca84ded91575e580405326e132bc4d9e93152f2c50ee
- SHA256 34db504936e949e42904ca84ded91575e580405326e132bc4d9e93152f2c50ee
Behavioral task
behavioral1
Sample
frp_LoliaFRP-CLI 0.71.1_windows_386/frpc.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
frp_LoliaFRP-CLI 0.71.1_windows_386/frpc.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
Behavioral task
behavioral3
Sample
frp_LoliaFRP-CLI 0.71.1_windows_386/frps.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral4
Sample
frp_LoliaFRP-CLI 0.71.1_windows_386/frps.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
General
- Target 34db504936e949e42904ca84ded91575e580405326e132bc4d9e93152f2c50ee
- Size 13.4MB
- Sample261007-by65labx7m
- SHA256 34db504936e949e42904ca84ded91575e580405326e132bc4d9e93152f2c50ee
- MD5 f68c5cb7c9e25ba8891951129e14db4f
- SHA1 51f27a45b79386fe54c41883bf584740b9c619f1
- SHA512 2666b5b2caf075003d263c2859f9c7c0b6220b4acdcafb947b238293a9d85b9b4f01459b9877bf0a6d7b1f92dd563ea4d42e6ed329d1cda585fca9632da30fce
- SSDEEP 393216:KJJkWIPIwg5s+vrXnBzZPKcM0ZeQcXAEUCLREf:KJJkftQXnRZPpeVXNa
- TLSH T1E4E633B3A8FFACF5053070F3B7A70434354E80B42BA6A15AE9C6834765A376BC553B52
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Reverse proxy tool: FRP aka Fast Reverse Proxy 2 IoCs
FRP (Fast Reverse Proxy) can be abused to bypass network security and establish persistent backdoors. This open-source utility tunnels traffic through a public server to expose internal services behind NAT or firewalls.
resource yara_rule static1/unpack001/frp_LoliaFRP-CLI 0.71.1_windows_386/frpc.exe tool_frp static1/unpack001/frp_LoliaFRP-CLI 0.71.1_windows_386/frps.exe tool_frp - Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/frp_LoliaFRP-CLI 0.71.1_windows_386/frpc.exe unpack001/frp_LoliaFRP-CLI 0.71.1_windows_386/frps.exe
File Explorer
-
34db504936e949e42904ca84ded91575e580405326e132bc4d9e93152f2c50ee.zip 13.4MB
-
frp_LoliaFRP-CLI 0.71.1_windows_386/LICENSE11KB
-
frp_LoliaFRP-CLI 0.71.1_windows_386/frpc.exe.exe 15.6MB
-
frp_LoliaFRP-CLI 0.71.1_windows_386/frpc.toml142B
-
frp_LoliaFRP-CLI 0.71.1_windows_386/frps.exe.exe 18.7MB
-
frp_LoliaFRP-CLI 0.71.1_windows_386/frps.toml16B
frp_LoliaFRP-CLI 0.71.1_windows_386/LICENSE
- SHA256 c6596eb7be8581c18be736c846fb9173b69eccf6ef94c5135893ec56bd92ba08
- MD5 fa818a259cbed7ce8bc2a22d35a464fc
- SHA1 669a1e53b9dd9df3474300d3d959bb85bad75945
- SHA512 3069af3e0a19d4c47ebcfe37327b059d1862b60a780a34b9bcd2c42b304efbe6d3ed321cbd1ffbdeabc83537f0cb8b4adeeeaaa262bb745770a5ca671519c52d
- SSDEEP 192:fU6G5KXSD9VYUKhu1JVF9hFGvV/QiGkS594drFjuHYx5dvTrLh3kTSEjz7HbHJ:M9vlKM1zJlFvmNz5VrlkTS07Hd
- TLSH T18632623FBA48037716C20162BB9764CBF21E903F3B552568354CC1681F6BA6543FB6EA
- MD5 SHA1 SHA512 SSDEEP TLSH
frp_LoliaFRP-CLI 0.71.1_windows_386/frpc.exe
- IMPHASH c1a56dd2884ebae2645c18b421ad3aee
- SHA256 2181fee2f88ca44290583a60e4c05fe0041311d8ac1bc880939007cab2df469b
- MD5 9834badd8de413dc86bfa0e302a46d67
- SHA1 b87ce51795a455d5f8fe3f260c0141324a4c49ae
- SHA512 39a927e454d2edb0815c9a7b31b578f393a3314b8b67c9a3cab3ea03ef3757f07dc3d012abe10ba8aa5a2db6cc7a5067054b4f05e59e767795c02fda360bf65c
- SSDEEP 196608:Dkoh4Ie9h80SvnXGbrxai2Yu3SVkEJ+o7:q9hTS/XGAQjrp
- TLSH T1BCF65C01FE8BA0FAE9075471619B723F63345D098B64CBDBEB44BB69F9336920937205
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
6
Entry point
564960
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
WriteFile
WriteConsoleW
WerSetFlags
WerGetFlags
WaitForMultipleObjects
WaitForSingleObject
VirtualQuery
VirtualFree
VirtualAlloc
TlsAlloc
SwitchToThread
SuspendThread
SetWaitableTimer
SetUnhandledExceptionFilter
SetThreadPriority
SetProcessPriorityBoost
SetEvent
SetErrorMode
SetConsoleCtrlHandler
ResumeThread
RaiseFailFastException
PostQueuedCompletionStatus
LoadLibraryW
LoadLibraryExW
SetThreadContext
GetThreadContext
GetSystemInfo
GetSystemDirectoryA
GetStdHandle
GetQueuedCompletionStatusEx
GetProcessAffinityMask
GetProcAddress
GetErrorMode
GetEnvironmentStringsW
GetCurrentThreadId
GetConsoleMode
FreeEnvironmentStringsW
ExitProcess
DuplicateHandle
CreateWaitableTimerExW
CreateWaitableTimerA
CreateThread
CreateIoCompletionPort
CreateEventA
CloseHandle
AddVectoredExceptionHandler
Name
.text
Size
7.1MB
Virtual Size
7.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
7.4MB
Virtual Size
7.4MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
766KB
Virtual Size
969KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
355KB
Virtual Size
355KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.symtab
Size
512B
Virtual Size
4B
Characteristics
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
frp_LoliaFRP-CLI 0.71.1_windows_386/frpc.toml
- SHA256 479cfb36746fac97ba24324fe2b79b86b8b927970867725d236bf6f8fa14a29f
- MD5 2ee048dc214b19aa04d9395ca1c64be3
- SHA1 e8e6234d4e7ea810255727e608de99e768d847cf
- SHA512 a31f8da07fb8eccd6cd72bffde419ebf44278ddb60f0d45ec67b93bc2d62a1b5a737557c22b94d1a70c2859c82e7c4791bd288e4291473ac60fcba893837c7e7
- TLSH T159C09291D92F1D5FAC2F1082946B2A66ABE7F2805509004A3109442B2CA5AEFC898629
- MD5 SHA1 SHA512 TLSH
frp_LoliaFRP-CLI 0.71.1_windows_386/frps.exe
- IMPHASH c1a56dd2884ebae2645c18b421ad3aee
- SHA256 dd21dbe4ccb5f4a50529914cf2a9aad81c358cc5e9aff48a51201a651a382e6d
- MD5 48b147c38ca87e83fe62c325a977931a
- SHA1 3a260727844d8f276e8007e08509ecee11d0e8c9
- SHA512 073042e0ae9aeee2cad65cdeda4974dc5f1a230cf4056aa1b35cdd9974a46c053c018e762f733aee92d86e537aab0af23417c90382544806ff9e5aad6e3723b1
- SSDEEP 98304:8rHIDyk4uFDuxPnr8xOvNSP3hRAsUJwWX+uBUBDtOp1Dq3wBnFN8EiyTl+9b+E:88+k4SUrEzAsUqWX+uBgD01W3wBR+d7
- TLSH T1B4173981F98790F6EA0749364097727F23305D054B34CBEBEB587A69F9372D2993A306
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
6
Entry point
567744
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
WriteFile
WriteConsoleW
WerSetFlags
WerGetFlags
WaitForMultipleObjects
WaitForSingleObject
VirtualQuery
VirtualFree
VirtualAlloc
TlsAlloc
SwitchToThread
SuspendThread
SetWaitableTimer
SetUnhandledExceptionFilter
SetThreadPriority
SetProcessPriorityBoost
SetEvent
SetErrorMode
SetConsoleCtrlHandler
ResumeThread
RaiseFailFastException
PostQueuedCompletionStatus
LoadLibraryW
LoadLibraryExW
SetThreadContext
GetThreadContext
GetSystemInfo
GetSystemDirectoryA
GetStdHandle
GetQueuedCompletionStatusEx
GetProcessAffinityMask
GetProcAddress
GetErrorMode
GetEnvironmentStringsW
GetCurrentThreadId
GetConsoleMode
FreeEnvironmentStringsW
ExitProcess
DuplicateHandle
CreateWaitableTimerExW
CreateWaitableTimerA
CreateThread
CreateIoCompletionPort
CreateEventA
CloseHandle
AddVectoredExceptionHandler
Name
.text
Size
8.6MB
Virtual Size
8.6MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
9.0MB
Virtual Size
9.0MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
730KB
Virtual Size
936KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
435KB
Virtual Size
434KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.symtab
Size
512B
Virtual Size
4B
Characteristics
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
frp_LoliaFRP-CLI 0.71.1_windows_386/frps.toml
- SHA256 a532a41986c1c5059cc464707cb10c671e155dae573c42751d89433f1ebcc80a
- MD5 ad80d6bb5eacc7b5e679022bc28c3185
- SHA1 8cec3d73b681090313948abf025018dd2d3da33f
- SHA512 b56f3a282a1e1555e9482115a5e1dfc9fdcee7ca9d9974865ca60b80c2a9fc0cd3a8f7190453be9b621a0329b54649eccbbc889c17795a75e54892cb3c7984b3
- MD5 SHA1 SHA512