Bypass2.31v.zip
- SHA256 a60ca57b1ed1ad33afa4e69c2e77faf77cb4e732d18edc15da86f43c8408e62e
Password
bypass
Overview
overview
5Static
static
5Bypass2.31v.zip
windows10-2004-x64
1Bypass2.31v.zip
windows11-ltsc_2024-x64
1Bypass2.31...1v.exe
windows10-2004-x64
4Bypass2.31...1v.exe
windows11-ltsc_2024-x64
4Bypass2.31...ig.ini
windows10-2004-x64
1Bypass2.31...ig.ini
windows11-ltsc_2024-x64
1Bypass2.31...08.bin
windows10-2004-x64
3Bypass2.31...08.bin
windows11-ltsc_2024-x64
3Bypass2.31...st.xml
windows10-2004-x64
3Bypass2.31...st.xml
windows11-ltsc_2024-x64
1Bypass2.31...el.exe
windows10-2004-x64
Bypass2.31...el.exe
windows11-ltsc_2024-x64
Bypass2.31...config
windows10-2004-x64
3Bypass2.31...config
windows11-ltsc_2024-x64
3Bypass2.31...s.yaml
windows10-2004-x64
3Bypass2.31...s.yaml
windows11-ltsc_2024-x64
3Bypass2.31...on.log
windows10-2004-x64
1Bypass2.31...on.log
windows11-ltsc_2024-x64
1Bypass2.31...11.dat
windows10-2004-x64
3Bypass2.31...11.dat
windows11-ltsc_2024-x64
3Bypass2.31...it.log
windows10-2004-x64
1Bypass2.31...it.log
windows11-ltsc_2024-x64
1Bypass2.31...DP.dll
windows10-2004-x64
1Bypass2.31...DP.dll
windows11-ltsc_2024-x64
1Bypass2.31...un.sys
windows10-2004-x64
3Bypass2.31...un.sys
windows11-ltsc_2024-x64
3Bypass2.31...pi.dll
windows10-2004-x64
1Bypass2.31...pi.dll
windows11-ltsc_2024-x64
1Bypass2.31...rd.dll
windows10-2004-x64
1Bypass2.31...rd.dll
windows11-ltsc_2024-x64
1Bypass2.31...si.dll
windows10-2004-x64
1Bypass2.31...si.dll
windows11-ltsc_2024-x64
1Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
Bypass2.31v.zip
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
Bypass2.31v.zip
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
Bypass2.31v/Bypass2.31v.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral4
Sample
Bypass2.31v/Bypass2.31v.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral5
Sample
Bypass2.31v/assets/config.ini
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral6
Sample
Bypass2.31v/assets/config.ini
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral7
Sample
Bypass2.31v/assets/data_2908.bin
Resource
win10v2004-20260911-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral8
Sample
Bypass2.31v/assets/data_2908.bin
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral9
Sample
Bypass2.31v/assets/plugins/manifest.xml
Resource
win10v2004-20260911-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral10
Sample
Bypass2.31v/assets/plugins/manifest.xml
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral11
Sample
Bypass2.31v/assets/plugins/tunnel.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral12
Sample
Bypass2.31v/assets/plugins/tunnel.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral13
Sample
Bypass2.31v/assets/wow64/app.config
Resource
win10v2004-20260911-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral14
Sample
Bypass2.31v/assets/wow64/app.config
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral15
Sample
Bypass2.31v/assets/wow64/rules.yaml
Resource
win10v2004-20260911-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral16
Sample
Bypass2.31v/assets/wow64/rules.yaml
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral17
Sample
Bypass2.31v/assets/wow64/session.log
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral18
Sample
Bypass2.31v/assets/wow64/session.log
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral19
Sample
Bypass2.31v/clientsmodels/amd64/data_1111.dat
Resource
win10v2004-20260911-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral20
Sample
Bypass2.31v/clientsmodels/amd64/data_1111.dat
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral21
Sample
Bypass2.31v/clientsmodels/arm64/audit.log
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral22
Sample
Bypass2.31v/clientsmodels/arm64/audit.log
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral23
Sample
Bypass2.31v/clientsmodels/arm64/fdSSDP.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral24
Sample
Bypass2.31v/clientsmodels/arm64/fdSSDP.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral25
Sample
Bypass2.31v/clientsmodels/cache/tun.sys
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral26
Sample
Bypass2.31v/clientsmodels/cache/tun.sys
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral27
Sample
Bypass2.31v/clientsmodels/common/iphlpapi.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral28
Sample
Bypass2.31v/clientsmodels/common/iphlpapi.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral29
Sample
Bypass2.31v/clientsmodels/netguard.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral30
Sample
Bypass2.31v/clientsmodels/netguard.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral31
Sample
Bypass2.31v/clientsmodels/res/winnsi.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral32
Sample
Bypass2.31v/clientsmodels/res/winnsi.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
General
- Target Bypass2.31v.zip
- Size 1.3MB
- Sample261011-hp1psade98
- SHA256 a60ca57b1ed1ad33afa4e69c2e77faf77cb4e732d18edc15da86f43c8408e62e
- MD5 6ca9426cbed6d4a06c5149fd6d02a771
- SHA1 3e061b035e10c192aaf58a15dfac617752a2373e
- SHA512 3e4e6510a2ff5ee2900bbb6325c8413924d7e84e0afa721f30a37451579dd9f2ac17b64ff08582178ddc0483208df86aa8d3ed576c2d6465da05b5f7441adad1
- SSDEEP 24576:nWbnUIHC4GEngeTJZR+u4kYw8cQoVHbBXLS3wNS5g02THZfRRYztaRLHj+Ksjv7N:LIi4ln9TJZF4VcQoRVb/0WHHRRStaIKo
- TLSH T15A553379D31E97D6C0DC7EFBCDCD629410A06B20CBB67F9B05164B831A065C60AFBA19
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- DLL Hijacking vulnerability 1 IoCs
Signed PE file loads submitted unsigned PE file, allowing DLL hijacking/sideloading/preloading.
resource unpack001/Bypass2.31v/libcurl.dll - Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Bypass2.31v/libcurl.dll
File Explorer
-
Bypass2.31v.zip.zip 1.3MB
-
Bypass2.31v/Bypass2.31v.exe.exe 785KB
-
Bypass2.31v/assets/config.ini24KB
-
Bypass2.31v/assets/data_2908.bin60KB
-
Bypass2.31v/assets/plugins/manifest.xml84KB
-
Bypass2.31v/assets/plugins/tunnel.exe40KB
-
Bypass2.31v/assets/wow64/app.config19KB
-
Bypass2.31v/assets/wow64/rules.yaml6KB
-
Bypass2.31v/assets/wow64/session.log23KB
-
Bypass2.31v/clientsmodels/amd64/data_1111.dat1KB
-
Bypass2.31v/clientsmodels/arm64/audit.log30KB
-
Bypass2.31v/clientsmodels/arm64/fdSSDP.dll131KB
-
Bypass2.31v/clientsmodels/cache/tun.sys6KB
-
Bypass2.31v/clientsmodels/common/iphlpapi.dll45KB
-
Bypass2.31v/clientsmodels/netguard.dll44KB
-
Bypass2.31v/clientsmodels/res/winnsi.dll62KB
-
Bypass2.31v/clientsmodels/socket.dll377KB
-
Bypass2.31v/clientsmodels/tunnel.json20KB
-
Bypass2.31v/clientsmodels/utils/data_7665.dat22KB
-
Bypass2.31v/clientsmodels/utils/network.toml103KB
-
Bypass2.31v/clientsmodels/utils/processor.exe13KB
-
Bypass2.31v/data_6344.dat82KB
-
Bypass2.31v/data_8495.bin305KB
-
Bypass2.31v/gup.xml.xml 4KB
-
Bypass2.31v/libcurl.dll.dll 5.0MB
-
Bypass2.31v/route.dll75KB
-
Bypass2.31v/rules.yaml162KB
-
Bypass2.31v/v2/secureweb.dll362KB
Bypass2.31v/Bypass2.31v.exe
- IMPHASH 0b43764663ba024c8202f35227fe0bff
- SHA256 eaac64c113ebaba1fae924ad1b6239a44c8806bf2b85d8dc11a27ad65a981cc1
- MD5 bca6478b230b6920fe79b97a3066e835
- SHA1 f61e771c53c63f35f5a2b416c260c74d29329adf
- SHA512 463f16b737768ac2bb285efc09e69781132e95c234e2eab37eb98be797606e45d1dbb38df3a6ef55144f4f7e1b08a213768e915b7d967b8c90bd03b216a07ff7
- SSDEEP 12288:/AstffLBk3Q45wU0/St0Z4j9lAx5ylTxEIyTXnxYV:4s9uQ45oyj9lE5yFuTXmV
- TLSH T1CB058E6A66AC01F8E0B7D17989964907F7B27845137197CF43A087AB2F276E05F7E320
- MD5 SHA1 SHA512 SSDEEP TLSH
Password
bypass
Digest
1b:65:e0:ab:b1:b0:2b:aa:fb:5f:cd:96:90:30:b6:76:7d:fa:2d:44:21:c4:2e:57:95:3b:dc:e4:a6:f6:1f:98
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Notepad\+\+,O=Notepad\+\+,L=Saint Cloud,ST=Ile-de-France,C=FR
Chains
Mar 7, 2025
CN=Notepad\+\+,O=Notepad\+\+,L=Saint Cloud,ST=Ile-de-France,C=FR
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=Notepad\+\+,O=Notepad\+\+,L=Saint Cloud,ST=Ile-de-France,C=FR
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Serial Number
08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Apr 29, 2021 - Apr 28, 2036
Subject
CN=Notepad\+\+,O=Notepad\+\+,L=Saint Cloud,ST=Ile-de-France,C=FR
Serial Number
03:aa:64:92:de:9d:96:a9:0a:4b:ca:97:be:ad:b4:4a
Issuer
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
May 13, 2022 - May 14, 2025
Subject
CN=DigiCert Timestamp 2024,O=DigiCert,C=US
Serial Number
0b:ae:66:bc:5a:ba:7f:95:87:c6:f9:e9:04:e3:33:04
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Sep 26, 2024 - Nov 25, 2035
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
0
Major OS version
6
Entry point
261440
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
libcurl
curl_easy_setopt
curl_easy_cleanup
curl_easy_init
curl_easy_perform
comctl32
InitCommonControlsEx
shlwapi
PathFileExistsA
PathFindExtensionW
PathIsDirectoryW
PathFileExistsW
PathFindFileNameW
PathRemoveFileSpecW
kernel32
CreateFileW
HeapSize
SetEndOfFile
HeapReAlloc
SetStdHandle
GetProcessHeap
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
CreateDirectoryW
lstrlenW
GetCurrentThreadId
Sleep
OutputDebugStringW
DeleteFileW
CreateThread
lstrcpyW
lstrcmpW
MulDiv
MoveFileW
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
ReleaseSemaphore
InitializeCriticalSection
WriteConsoleW
CreateEventW
GetLastError
SetEvent
CloseHandle
ResetEvent
CreateSemaphoreW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
GetTimeZoneInformation
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
GetConsoleOutputCP
WaitForSingleObject
FlushFileBuffers
GetFileSizeEx
HeapAlloc
HeapFree
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WakeAllConditionVariable
SleepConditionVariableSRW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
InitializeSListHead
MultiByteToWideChar
WideCharToMultiByte
WakeConditionVariable
TryAcquireSRWLockExclusive
WaitForSingleObjectEx
GetExitCodeThread
RtlUnwind
InitializeCriticalSectionEx
EncodePointer
DecodePointer
GetLocaleInfoEx
LCMapStringEx
GetProcAddress
GetStringTypeW
CompareStringEx
GetCPInfo
RtlUnwindEx
RtlPcToFileHeader
RaiseException
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
ReadFile
ExitThread
FreeLibraryAndExitThread
GetModuleHandleExW
ExitProcess
GetModuleFileNameW
GetStdHandle
WriteFile
SetFilePointerEx
GetConsoleMode
ReadConsoleW
GetFileType
user32
CallNextHookEx
EndDialog
SetWindowTextW
SetDlgItemTextW
CreateWindowExW
MessageBoxA
UnhookWindowsHookEx
SetWindowsHookExW
GetDlgItemInt
SystemParametersInfoW
SetDlgItemInt
DialogBoxParamW
LoadImageW
ReleaseDC
MessageBoxW
SendMessageW
SetWindowPos
GetDC
GetWindowRect
FindWindowExW
GetDlgItemTextW
gdi32
GetDeviceCaps
shell32
SHGetFolderPathW
ShellExecuteW
SHFileOperationW
Name
.text
Size
595KB
Virtual Size
595KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
134KB
Virtual Size
134KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
13KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
23KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=5, id=259, version=30795,
count=190, id=261, version=30795,
count=16, id=260, version=30795,
count=1, id=253, version=33731,
count=10, id=259, version=33731,
count=16, id=260, version=33731,
count=90, id=261, version=33731,
count=12, id=257, version=30795,
count=3, id=257, version=33811,
count=182, id=1, productName=Unmarked objects,
count=35, id=265, version=33811,
count=1, id=255, version=33811,
count=1, id=151,
count=1, id=258, version=33811,
Bypass2.31v/assets/config.ini
- SHA256 739fbcb79cdd6f5345c055e1c6cd5b96437c863db2466e3e4cb3a2ac78049ae9
- MD5 63cbafbdf7d62fa7500f76219bb3b89d
- SHA1 fbc64187f7e593596328866de99c6c8c3a016d06
- SHA512 1dac1d74c2fa24e440136c33cc6f50352fa5b42834d3f29952d95bd39063f41f149bc7da4a69a3a05f2efed8911cd62ea32812b2f614a0c59b456242303f87db
- SSDEEP 768:KAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA3:KAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA3
- TLSH T13FB21B0DA62714E7476F4450F43674416BF9485647D9404D053BC7D8DC540A5BF5F6F0
- MD5 SHA1 SHA512 SSDEEP TLSH
Bypass2.31v/assets/data_2908.bin
- SHA256 adec2e42ac3891ea6e412aee8647949694aff0e51a68ddb4fa59d20d366492da
- MD5 5c0b9d292c3b8f863c5b5e60561fdc34
- SHA1 2550a29a0d6c0109bd4b5761973b83742952b728
- SHA512 b144035596f5c52814d5fb71939650e3cb08a000c04f593be79844d25d4f7207dd516ce8bdaa53dae6cf3bb6163a28dbc4c0bbbca8aa224c1bcb036455b27167
- SSDEEP 12:KAcAcAcAcAcAcAcAcAcAcAcAcAcAcAcAcAcAcAcAcAcAcAcAcAcAcAcAcAcAcAc1:6
- MD5 SHA1 SHA512 SSDEEP
Bypass2.31v/assets/plugins/manifest.xml
- SHA256 393afe99f8f0427aeb494262c3f04eac00b2d5136835a57fc65b771f1a00d571
- MD5 44df3ce59a1a2ec7ffcbc8e0330e027d
- SHA1 0a2a923809645fb39fa6d95349b8d8c6e4d3423f
- SHA512 32aec37eae61fe0e55be8aa387a615281e1b3ad4f346deb55206086b22d9107ab81b22706b174067854d070ca272e7af5a9e14e3515ce53d6d8af2cfa48d1fb8
- SSDEEP 1536:KAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA+:X
- TLSH T10B832B1DA22300E3436F4450F0327401ABF9081603C8000D043BC3D8DC540B0BF1F6F0
- MD5 SHA1 SHA512 SSDEEP TLSH
Bypass2.31v/assets/plugins/tunnel.exe
- SHA256 ba4aa852189a56a7d8ef1b2e5f184729b9b82026314106a31bdb665b9f31212d
- MD5 7accc6f98c40c607051b44c6934e44d4
- SHA1 bde60e6a2693f728c9d4f49ee6947f25440ae824
- SHA512 b7a31fbd5ecfdb66787d92d5870a5b724fe3a23ee048d4098af04c9e0ea0aa36e1f369115ab0bd3b0c96fc16e14cec9c2e1ff871192ef53200447336e31600a4
- SSDEEP 3:Wltgl+:i2
- MD5 SHA1 SHA512 SSDEEP
Bypass2.31v/assets/wow64/app.config
- SHA256 e84a48dd75e5dd74ef4d4c84a3999dfe497f3901400965fccbe084d0b01e5968
- MD5 d4dd4d6e6dff31a4bce32a2f4b4e851c
- SHA1 706073447612fb12dd43fb86743cc2751ccb64b4
- SHA512 bf9e014c7f67469be9d5270e8df982d4bdad1b5efbfa87c36e2aa2fbdb0f19682f59a8bf3cfd400aa689a20fc995cf8d4a1ba61621529fadb720c765a57c5734
- SSDEEP 12:KAcAcAcAcAcAcAcAcAcAcAcAcAcAcAcAcAcAcAcAcAcAcAcAcAcAcAcAcAcAcAcO:J
- MD5 SHA1 SHA512 SSDEEP
Bypass2.31v/assets/wow64/rules.yaml
- SHA256 c5a5117b4b1259f0bc8ba3d0ca31a8be696335b3b4b516f703a5b7a597ea2ea8
- MD5 f5336232e0df8cc4aa2e6a6da96d554a
- SHA1 25bc41ff6a89f8b2c3101899048735d370b5a2db
- SHA512 ecb0e8412fe1fa1f11761ec1d8a89438cfc0b1bb09651741364395d90e77cf0abc0dffc77004771acc3530cca6a4b27103c1e5960622c57d8a9107fb12f53499
- SSDEEP 192:D+gM+gM+gM+gM+gM+gM+gM+gM+gM+gM+gM+gM+gM+gM+gM+gM+gM+gM+gM+gM+gG:KAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAj
- TLSH T12ED11A0EA22300E3836F48A0F0327801ABF9086647C9004E093BC7E8EC980A1BF5F6F0
- MD5 SHA1 SHA512 SSDEEP TLSH
Bypass2.31v/assets/wow64/session.log
- SHA256 c2b5aa150bd1c99b782d6a169d779d9794f0b7934bedf9fcb1e7021211784521
- MD5 c34cff9aaa2b23e3d4a60d22b60866ea
- SHA1 30d68609224e0e3d9626ce32e5c0b7f03b3ce354
- SHA512 ee0e1f96b7d25fad4d20f766b3bef33113dbfc7fcce4696df36ba8b22e8622a42a2752f6cfc15a02a4f194e0a410f005e978470770c0ed08e1521bfac95e541f
- SSDEEP 384:K++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++f:K++++++++++++++++++++++++++++++/
- TLSH T1F8B2222F9A1320F3437B6481F031240A6AF9046BA398104C613787ECCC040F9FB2F9E0
- MD5 SHA1 SHA512 SSDEEP TLSH
Bypass2.31v/clientsmodels/amd64/data_1111.dat
- SHA256 5043fafa18ffa605eec3120791a98aa2c4ec8a0371ef09b615a098507f5c52d6
- MD5 f1063b2d6d5ecc0e205c911d731c1fd8
- SHA1 82287eaed564f30e6fccd000fc83a5713805a4a6
- SHA512 52a3e1badc7b879adcb1e088173407da503b1d727996f945125878edd01f43053ad2d70fad6e1d11e6d4312fdad487193b3424bccdfa80eccd8aea122d4832d6
- MD5 SHA1 SHA512
Bypass2.31v/clientsmodels/arm64/audit.log
- SHA256 861c512d79365044a1368e19d66a5005e9f1490f4cfd4dd5889824b0b90d1263
- MD5 704f42dc3687a5b76d5f5ca6b690c022
- SHA1 896f5a8dfa157e6fdf9125c06970184a0b5e771f
- SHA512 b8dcc7b00154cbe4cccbfeb423f1a7c9fe8b8036243bc0b4b227207aea38c2dbad50c0f409c216be51ce08ca5183cfa6a06b6d51691f0759a40d911a73e05ac5
- SSDEEP 768:K+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++:K++++++++++++++++++++++++++++++e
- TLSH T1F1E2222F9A1320F3437F6881F031240A6FF9047BA799104D653787E8D8440B9EF2E9E0
- MD5 SHA1 SHA512 SSDEEP TLSH
Bypass2.31v/clientsmodels/arm64/fdSSDP.dll
- SHA256 3fe54a46940ff1e372a172489e75b4d9021e37ec4d81665c5e558f3e6be9bef6
- MD5 c85fb469cd706092958f756ab6ceb2da
- SHA1 2b817aee2d8fc90f67685e56510d2ebcf6aaca46
- SHA512 de5698beef55f57c93c3cdff9033c9e42caed2533315cbfbaec9ff9934cfad20fb9b7ea8d26f82e63463a93d1538cadcd57d7c06f2ad8a201f3d1f58a58a32b4
- SSDEEP 3:Wltgl+:i2
- MD5 SHA1 SHA512 SSDEEP
Bypass2.31v/clientsmodels/cache/tun.sys
- SHA256 f463dc34e08c889c0f68bc89a9fdef0c92af716c74249b91af5af73f46a28aa7
- MD5 33b2101cba4459588435392a991680bc
- SHA1 7bb7b01ce3e8445fd5274a531e5aea578511824b
- SHA512 0690ffe0e596c3cc8e2bbf5a8431d6bb5e0b3cf86118cf7c370aa65a8a357ce536a7302c29c9af1f07d490fe9f627f21389b2bcfd14e11b51741b3d4a3511fca
- SSDEEP 3:Wltgl+:i2
- MD5 SHA1 SHA512 SSDEEP
Bypass2.31v/clientsmodels/common/iphlpapi.dll
- SHA256 2bbb13aa4367d7b82236a98ae57a7afb9d153fa05d126ecdc97f7f593d8880d9
- MD5 29a2183669dceaed1d16120e542ff261
- SHA1 0c120a5a988ff722bd524797496ac3aced374ef5
- SHA512 8ae961c4ad7add2e7bc0c5145c4fc344f53e3c4d4a444b6f19a85549359d1c7b046e354aaa2e6574baa5994d15a5cabb9f9aaae7e47460898398d1f9198c602d
- SSDEEP 3:Wltgl+:i2
- MD5 SHA1 SHA512 SSDEEP
Bypass2.31v/clientsmodels/netguard.dll
- SHA256 a57b009aa644e1131fedfc8af59b98b327181fb7823e26879a3615ef64ee8908
- MD5 c796b0e6cb7f43644bba46a1d05cd71e
- SHA1 363a98476d676dfa1ed4c774b344919820889372
- SHA512 bfeb9405f16976edee5beeedfb6f5d170528d93de32a7571a84df730cca145d2d00878c86c684b6d01513b5d47f1921a08011a158d4616c6ad7f760b801c7b13
- SSDEEP 3:Wltgl+:i2
- MD5 SHA1 SHA512 SSDEEP
Bypass2.31v/clientsmodels/res/winnsi.dll
- SHA256 4ea894d8e6fd5fd5027ad9b64ff54f9eba6ed466c0d480f7d92b598b12ee4e1b
- MD5 53610a4ba00f979dcc969120f5e6cbd9
- SHA1 572a35a655da8cf1ce2e3b201847c216762f8ba3
- SHA512 5c4d324138d8df0601d3a15335c2de905d34f57890e0eb5423f3bafc0c59c37519658bc46f4a03f5949dce1e8aeb42f70398377b081330921559f091942be1b1
- SSDEEP 3:Wltgl+:i2
- MD5 SHA1 SHA512 SSDEEP
Bypass2.31v/clientsmodels/socket.dll
- SHA256 dc7485fb87b91ee9dd28249c5062017569900ba9036a8e050ad2fdcc65b202de
- MD5 90d1e1614b754f5335f8774a2a063e5d
- SHA1 a0f902f6120f8dc5f1d4dc2d73e60644c6b734a3
- SHA512 8d167ecf64081add8f6eaa9149d0f907115e444a559a41a5b972920ad4aaeb0e4b8bb8476919e9a5f3ca7608471e562421c6345bb5654a019be214d7084a5180
- SSDEEP 3:Wltgl+:i2
- MD5 SHA1 SHA512 SSDEEP
Bypass2.31v/clientsmodels/tunnel.json
- SHA256 3665237ef4bd73cc053f1dce562c237e7d92d075b77f44335ea2fa807288c4cf
- MD5 8a7e259ccbc549b632e499e1ef0ec7ed
- SHA1 43420b04125307abc168067b68d9ff929aee4afb
- SHA512 20be39bcddf067f8be23469ae9e312e6d8d4bd6b7c256ce82af2297d65eb4c1457363e12b05f638bb1f3cd97d8944d826e5bc5e82df769ad35408edc9629ed1b
- SSDEEP 384:KAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAb:KAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAb
- TLSH T181921A1DA22300E3436F4450F0327801ABF9081603C9004D053BC3D8DC540A1BF1F6F0
- MD5 SHA1 SHA512 SSDEEP TLSH
Bypass2.31v/clientsmodels/utils/data_7665.dat
- SHA256 73cf594fd3d07ddabec42ff8451ec9535cb2bfb85d4b0fc41e40cff24aca1523
- MD5 27968ff01ca3cff3ae1e2bf9578a7d09
- SHA1 da186403767d452c0568c0f12f70c9addc4205e8
- SHA512 79752879d57966a4e614eb98bc5621bf20b86429a40f31e250767db65b70fbb672df465fb61c5d405ac92335744103ddc97250c237bfed2b275077f880a0a1ba
- SSDEEP 12:KAcAcAcAcAcAcAcAcAcAcAcAcAcAcAcAcAcAcAcAcAcAcAcAcAcAcAcAcAcAcAcx:e
- MD5 SHA1 SHA512 SSDEEP
Bypass2.31v/clientsmodels/utils/network.toml
- SHA256 3b46edb8f7ef045b7885aaf0b025425650b4c09c3a8fbe885d902424ed92ba32
- MD5 6eb846d58565a4cabd0239d6a3c4c6cf
- SHA1 b423b2d2490cca6addb370b74b08451d0333e8fa
- SHA512 2a3cc10d14fec0b50912a8811d8bca3266fcb836928f3568ee12e5a8209a28629f4cb2cad6a25de41d811326a79f13447e74321621de07f0e8ca0f14e5e1dd27
- SSDEEP 1536:KAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAK:x
- TLSH T148A31A0EA62300E3836F4890F43274026BF9086647C9004D093BC7D8DC940A5BF5F6F0
- MD5 SHA1 SHA512 SSDEEP TLSH
Bypass2.31v/clientsmodels/utils/processor.exe
- SHA256 1880f87060eb2d4e5d4ad99f20df922b9f8edcb2e49ac5681c37a050b1673574
- MD5 983cb2c4333a7afdaae5dfe3f6c3194b
- SHA1 8e9cdd44851452e3832457e71d71d76b8d2a13b5
- SHA512 65a2ee9a4dcd9693b02f969a9236001bd401e435b8d07ac82e2eb3130033de6b5076ebf4f37dd21f170bb20c7bb41e2ec8f5be18c569882ebfe4b50b244d379d
- SSDEEP 3:Wltgl+:i2
- MD5 SHA1 SHA512 SSDEEP
Bypass2.31v/data_6344.dat
- SHA256 cb89e70a0d46ba17d6cf84a15e8f25cd22eec6e57f357b8f4a5fceec2b51a53c
- MD5 fd483095f3b974b05153827409e770e9
- SHA1 45cf2528e9fe8cfb2a9a20f61614067b0ba929a9
- SHA512 663f4cb12c633967d8131223f016b5e8e5ec7a41793100f57b0c88bec0dbc2ff993cc08c8111e6c9da1d20650ac69368979c16e45ff63bb1daf3b62c2cc36744
- SSDEEP 12:KAcAcAcAcAcAcAcAcAcAcAcAcAcAcAcAcAcAcAcAcAcAcAcAcAcAcAcAcAcAcAcs:l
- MD5 SHA1 SHA512 SSDEEP
Bypass2.31v/data_8495.bin
- SHA256 fda9028d14234292cecfafc469ecfc2a3889b68008869e03c9fb60f38fcc5329
- MD5 0e5de082de7bac684bb0c350d3cf9cf9
- SHA1 ed69ad70a64ad369bc7d8a773cc912c0466d76e8
- SHA512 b6f1dc368399d8597f9266a0d789493f0b93483644e81e3b8ee45a82ec489ae456dcf0761933248acff2089acf02757f9d49c1836cfa1959ef3411249edc6203
- SSDEEP 12:KAcAcAcAcAcAcAcAcAcAcAcAcAcAcAcAcAcAcAcAcAcAcAcAcAcAcAcAcAcAcAcw:x
- MD5 SHA1 SHA512 SSDEEP
Bypass2.31v/gup.xml
- SHA256 92717951aae89e960b142cef3d273f104051896a3d527a78ca4a88c22b5216a5
- MD5 abde55a0b1cb4a904e622c02f559dcd1
- SHA1 1662f8445a000bbf7c61c40e39266658f169bf13
- SHA512 8fe75fb468f87be1153a6a0d70c0583a355f355bfe988027c88d154b500e97f2c5241d9557ebb981067205e2f23ad07b6a49c669cd3e94eaa728201173b235a0
- SSDEEP 96:rrxgFDl+72Y+WbPRkrm1+U4YeJS2kG6QrABYUCJ8PYPwJrkFI:rVgFhunzbpka1+UNQo2sBCPwJrkFI
- TLSH T19491944B57DCC3770C3112A178AE9191D33409F932B5500138A8809BA36ADA6BBBF7E9
- MD5 SHA1 SHA512 SSDEEP TLSH
Bypass2.31v/libcurl.dll
- IMPHASH c5b9157ce6eb5d7ef63ada2556f7d1d1
- SHA256 a77abb016874edd4f76fd6a73fb139e09113a138126436e67c2d5b238840b4b3
- MD5 37b20cc4231356664402e75ad328b056
- SHA1 6d3a7502a963ed4cbd2ea93ecb6d7fff0695b068
- SHA512 71cd74e3974259b467b90f624b6b1df207df5b979f1a30c3c21ab5194fb92e26fbf394fe1377af0cf9de4d5a2d57598b7fbc923665ac1cc7d281fd328627153a
- SSDEEP 24576:z2mxfDnjxQlnn+C3yZL2ECftDQYXeBRA:zSd+uoiFtxev
- TLSH T1913613460F864CE2EEB52632C4F19C7696FBA8C5F02C5B623509A4714EDBE4D14B236F
- MD5 SHA1 SHA512 SSDEEP TLSH
-
DLL Hijacking vulnerability
Signed PE file loads submitted unsigned PE file, allowing DLL hijacking/sideloading/preloading.
-
Unsigned PE
Checks for missing Authenticode signature.
Password
bypass
Minor OS version
0
Major OS version
6
Entry point
25280
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
kernel32
CloseHandle
CreateFileW
CreateProcessA
CreateProcessW
ExitProcess
GetCurrentProcess
GetProcAddress
GetTempPathW
GetTickCount
HeapFree
LoadLibraryA
LocalAlloc
LocalFree
QueryPerformanceCounter
Sleep
VirtualAlloc
VirtualFree
VirtualProtect
WaitForSingleObject
WriteFile
lstrcatA
lstrcatW
lstrcpyW
lstrlenW
advapi32
AllocateAndInitializeSid
CheckTokenMembership
FreeSid
ws2_32
freeaddrinfo
recv
select
setsockopt
crypt32
CertFreeCertificateChain
CertGetCertificateChain
CertOpenStore
curl_easy_cleanup
curl_easy_duphandle
curl_easy_getinfo
curl_easy_init
curl_easy_nextheader
curl_easy_pause
curl_easy_perform
curl_easy_recv
curl_easy_reset
curl_easy_send
curl_easy_setopt
curl_easy_strerror
curl_formadd
curl_free
curl_getdate
curl_getenv
curl_global_cleanup
curl_global_init
curl_maprintf
curl_mime_addpart
curl_mime_init
curl_mime_type
curl_multi_add_handle
curl_multi_cleanup
curl_multi_init
curl_multi_perform
curl_multi_remove_handle
curl_multi_socket_action
curl_multi_strerror
curl_mvfprintf
curl_share_init
curl_slist_append
curl_slist_free_all
curl_strnequal
curl_url_get
curl_version
curl_version_info
Name
.48dbf6
Size
228KB
Virtual Size
227KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.8e3f9d
Size
4.7MB
Virtual Size
4.7MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.53f3b8
Size
512B
Virtual Size
352B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.6dd01e
Size
28KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.c6ae94
Size
512B
Virtual Size
40B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
792B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=5, id=270, version=30822,
count=52, id=145, version=27939,
count=25, id=261, version=30815,
count=72, id=226, version=30798,
Bypass2.31v/route.dll
- SHA256 9fa18d8935c49dba51409c7f25d33c2039210425ed0a174f727d73313e67eca2
- MD5 064a6ce9ae3d153f69f92c2bf3af040b
- SHA1 0086f5add834ed25467ceed4893fe410be884bb8
- SHA512 b7d72e3b09bf8bf4a6b55fda2d1a0f8f29b446114ed3696cf31e96195b3fe024b13e293761f3ad161103b684e682f573c74c37b91f2b2bd879f690ef7ac59658
- SSDEEP 3:Wltgl+:i2
- MD5 SHA1 SHA512 SSDEEP
Bypass2.31v/rules.yaml
- SHA256 725e53c563b4e6e8e4fca91ab39209b4de2c22618b6760676f93f52c13b54efa
- MD5 00e1aa69114c72297caba3ced9d56ed6
- SHA1 652f0e954b3c5dae332fc58f918703f3d6e6f2aa
- SHA512 e7ebd7b0be650fae901419e529cacb15b1a418abda9934a5219f3cbb64f0d6c5eda58191a0264efb4fbfa6804dffd4d763936c893dfb4433cfdb57380b08ac18
- SSDEEP 1536:KAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAW:R
- TLSH T18AF31B0DA62314E7476F4450F43674416BF9485647D9004D053BC7D8DC540A5BF5F6F0
- MD5 SHA1 SHA512 SSDEEP TLSH
Bypass2.31v/v2/secureweb.dll
- SHA256 b0d288f6e7ed1af8da77ae5f454ad4d21cb912fb8cb9ed40b0e406d966927a2e
- MD5 f529810d058b6eb321e5bd4830c3da91
- SHA1 09a95dde8782924ff845fff0419ef1d38cde2747
- SHA512 dee8ac2b87b4e01666940eec6958e762c833e8d97860bcd4ab263e680c674308ec0a37c677da39e89bdc2672ce5741f26957bc3b4dcec97b3bd49ef325f1c28c
- SSDEEP 3:Wltgl+:i2
- MD5 SHA1 SHA512 SSDEEP