Ratcollection.rar
- SHA256 2806fdedc1eed8a8c164eeafbf1863fd0e17e0fb6cc7836fa6559fff5d44debd
Overview
overview
10Static
static
10stubs/Anti.exe
windows10-2004-x64
3stubs/Anti.exe
windows11-ltsc_2024-x64
3stubs/Stub.exe
windows10-2004-x64
10stubs/Stub.exe
windows11-ltsc_2024-x64
10stubs/dlen...nt.exe
windows10-2004-x64
3stubs/dlen...nt.exe
windows11-ltsc_2024-x64
3stubs/dlnormal.exe
windows10-2004-x64
7stubs/dlnormal.exe
windows11-ltsc_2024-x64
7Ultimate-R...on.dll
windows10-2004-x64
1Ultimate-R...on.dll
windows11-ltsc_2024-x64
1Ultimate-R...il.dll
windows10-2004-x64
1Ultimate-R...il.dll
windows11-ltsc_2024-x64
1Ultimate-R...Ra.exe
windows10-2004-x64
1Ultimate-R...Ra.exe
windows11-ltsc_2024-x64
1Ultimate-R..._u.rtf
windows10-2004-x64
1Ultimate-R..._u.rtf
windows11-ltsc_2024-x64
1Ultimate-R...ss.exe
windows10-2004-x64
7Ultimate-R...ss.exe
windows11-ltsc_2024-x64
7Ultimate-R...am.dll
windows10-2004-x64
3Ultimate-R...am.dll
windows11-ltsc_2024-x64
3Ultimate-R...ch.dll
windows10-2004-x64
3Ultimate-R...ch.dll
windows11-ltsc_2024-x64
3Ultimate-R...ic.dll
windows10-2004-x64
1Ultimate-R...ic.dll
windows11-ltsc_2024-x64
1Ultimate-R...lg.dll
windows10-2004-x64
3Ultimate-R...lg.dll
windows11-ltsc_2024-x64
3Ultimate-R...pw.dll
windows10-2004-x64
3Ultimate-R...pw.dll
windows11-ltsc_2024-x64
3Ultimate-R...c2.dll
windows10-2004-x64
1Ultimate-R...c2.dll
windows11-ltsc_2024-x64
1Ultimate-R...et.dll
windows10-2004-x64
1Ultimate-R...et.dll
windows11-ltsc_2024-x64
1Behavioral task
behavioral1
Sample
stubs/Anti.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
stubs/Anti.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral3
Sample
stubs/Stub.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral4
Sample
stubs/Stub.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral5
Sample
stubs/dlentrypoint.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral6
Sample
stubs/dlentrypoint.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral7
Sample
stubs/dlnormal.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral8
Sample
stubs/dlnormal.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral9
Sample
Ultimate-RAT-Collection-NjRat/njRAT v0.7d Golden Edition - Rus/njRAT v0.7d Golden Edition - Rus/InjectIcon.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral10
Sample
Ultimate-RAT-Collection-NjRat/njRAT v0.7d Golden Edition - Rus/njRAT v0.7d Golden Edition - Rus/InjectIcon.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral11
Sample
Ultimate-RAT-Collection-NjRat/njRAT v0.7d Golden Edition - Rus/njRAT v0.7d Golden Edition - Rus/Mono.Cecil.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral12
Sample
Ultimate-RAT-Collection-NjRat/njRAT v0.7d Golden Edition - Rus/njRAT v0.7d Golden Edition - Rus/Mono.Cecil.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral13
Sample
Ultimate-RAT-Collection-NjRat/njRAT v0.7d Golden Edition - Rus/njRAT v0.7d Golden Edition - Rus/NjRa.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral14
Sample
Ultimate-RAT-Collection-NjRat/njRAT v0.7d Golden Edition - Rus/njRAT v0.7d Golden Edition - Rus/NjRa.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral15
Sample
Ultimate-RAT-Collection-NjRat/njRAT v0.7d Golden Edition - Rus/njRAT v0.7d Golden Edition - Rus/Nj_u.rtf
Resource
win10v2004-20260911-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral16
Sample
Ultimate-RAT-Collection-NjRat/njRAT v0.7d Golden Edition - Rus/njRAT v0.7d Golden Edition - Rus/Nj_u.rtf
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral17
Sample
Ultimate-RAT-Collection-NjRat/njRAT v0.7d Golden Edition - Rus/njRAT v0.7d Golden Edition - Rus/Plugin/AntiProcess.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral18
Sample
Ultimate-RAT-Collection-NjRat/njRAT v0.7d Golden Edition - Rus/njRAT v0.7d Golden Edition - Rus/Plugin/AntiProcess.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral19
Sample
Ultimate-RAT-Collection-NjRat/njRAT v0.7d Golden Edition - Rus/njRAT v0.7d Golden Edition - Rus/Plugin/cam.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral20
Sample
Ultimate-RAT-Collection-NjRat/njRAT v0.7d Golden Edition - Rus/njRAT v0.7d Golden Edition - Rus/Plugin/cam.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
Behavioral task
behavioral21
Sample
Ultimate-RAT-Collection-NjRat/njRAT v0.7d Golden Edition - Rus/njRAT v0.7d Golden Edition - Rus/Plugin/ch.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral22
Sample
Ultimate-RAT-Collection-NjRat/njRAT v0.7d Golden Edition - Rus/njRAT v0.7d Golden Edition - Rus/Plugin/ch.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
Behavioral task
behavioral23
Sample
Ultimate-RAT-Collection-NjRat/njRAT v0.7d Golden Edition - Rus/njRAT v0.7d Golden Edition - Rus/Plugin/mic.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral24
Sample
Ultimate-RAT-Collection-NjRat/njRAT v0.7d Golden Edition - Rus/njRAT v0.7d Golden Edition - Rus/Plugin/mic.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral25
Sample
Ultimate-RAT-Collection-NjRat/njRAT v0.7d Golden Edition - Rus/njRAT v0.7d Golden Edition - Rus/Plugin/plg.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral26
Sample
Ultimate-RAT-Collection-NjRat/njRAT v0.7d Golden Edition - Rus/njRAT v0.7d Golden Edition - Rus/Plugin/plg.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
Behavioral task
behavioral27
Sample
Ultimate-RAT-Collection-NjRat/njRAT v0.7d Golden Edition - Rus/njRAT v0.7d Golden Edition - Rus/Plugin/pw.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral28
Sample
Ultimate-RAT-Collection-NjRat/njRAT v0.7d Golden Edition - Rus/njRAT v0.7d Golden Edition - Rus/Plugin/pw.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
Behavioral task
behavioral29
Sample
Ultimate-RAT-Collection-NjRat/njRAT v0.7d Golden Edition - Rus/njRAT v0.7d Golden Edition - Rus/Plugin/sc2.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral30
Sample
Ultimate-RAT-Collection-NjRat/njRAT v0.7d Golden Edition - Rus/njRAT v0.7d Golden Edition - Rus/Plugin/sc2.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral31
Sample
Ultimate-RAT-Collection-NjRat/njRAT v0.7d Golden Edition - Rus/njRAT v0.7d Golden Edition - Rus/WinMM.Net.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral32
Sample
Ultimate-RAT-Collection-NjRat/njRAT v0.7d Golden Edition - Rus/njRAT v0.7d Golden Edition - Rus/WinMM.Net.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
General
- Target Ratcollection.rar
- Size 69.2MB
- Sample261018-wpf72asycs
- SHA256 2806fdedc1eed8a8c164eeafbf1863fd0e17e0fb6cc7836fa6559fff5d44debd
- MD5 3f26615175a25c39deaec9a0e647218b
- SHA1 e982e03f8fff40e07d20b0fca5785461ba29221e
- SHA512 b3f0a1074dc9eb3d63a3ba8e940e1320b44ab18397b6e329b7e36bf9f5a9df604f328ea4f085fa4b592b3eada803e9f62657cd7174165c89213c46d726a5f3b1
- SSDEEP 1572864:5+Y5haasd+Y5h/j9a2E6PKg23h2h60Yc+MkYw1Y64VcYptyASmBqGpa:5lhilhbQ2nKg2RA6a+uwzhYvyAfBTpa
- TLSH T188F733939B812345AC48D43C568A8AAF3E4B82DB9C78C43C47BFEE5247994435FF9316
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
Family
-
njrat
Version
-
Njrat 0.7 Golden By Hassan Amiri
C2
-
:
Mutex
-
[RNVD]
Attributes
-
reg_key
[RNVD]
-
splitter
|Hassan|
Extracted
Family
-
njrat
Version
-
Platinum
Botnet
-
HacKed
C2
-
127.0.0.1:6522
Mutex
-
Client.exe
Attributes
-
reg_key
Client.exe
-
splitter
|Ghost|
Extracted
Family
-
xworm
Version
-
5.0
Mutex
-
PUNN2IQKR4QL0tlR
Attributes
-
install_file
USB.exe
-
localhost
127.0.0.1
aes.plain
Signatures
- Family: StormKitty
StormKitty is an open source info stealer written in C#.
- Contains code to disable Windows Defender 2 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
resource yara_rule static1/unpack004/XWorm V5.6/Plugins/Options.dll disable_win_def static1/unpack001/Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/Plugins/Options.dll disable_win_def - Detect Xworm Payload 3 IoCs
resource yara_rule static1/unpack004/XWorm V5.6/RES/XWorm.Resources.resources family_xworm static1/unpack001/Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/RES/XWorm.Resources.resources family_xworm static1/unpack001/Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/XClient.exe family_xworm - StormKitty payload 2 IoCs
resource yara_rule static1/unpack004/XWorm V5.6/Plugins/Recovery.dll family_stormkitty static1/unpack001/Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/Plugins/Recovery.dll family_stormkitty - Unsigned PE 131 IoCs
Checks for missing Authenticode signature.
resource unpack002/stubs/Anti.bin unpack002/stubs/Stub.bin unpack002/stubs/dlentrypoint.bin unpack002/stubs/dlnormal.bin unpack001/Ultimate-RAT-Collection-NjRat/njRAT v0.7d Golden Edition - Rus/njRAT v0.7d Golden Edition - Rus/InjectIcon.dll unpack001/Ultimate-RAT-Collection-NjRat/njRAT v0.7d Golden Edition - Rus/njRAT v0.7d Golden Edition - Rus/Mono.Cecil.dll unpack001/Ultimate-RAT-Collection-NjRat/njRAT v0.7d Golden Edition - Rus/njRAT v0.7d Golden Edition - Rus/NjRat 0.7D Golden Edition - Rus.exe unpack001/Ultimate-RAT-Collection-NjRat/njRAT v0.7d Golden Edition - Rus/njRAT v0.7d Golden Edition - Rus/Plugin/AntiProcess.dll unpack001/Ultimate-RAT-Collection-NjRat/njRAT v0.7d Golden Edition - Rus/njRAT v0.7d Golden Edition - Rus/Plugin/cam.dll unpack001/Ultimate-RAT-Collection-NjRat/njRAT v0.7d Golden Edition - Rus/njRAT v0.7d Golden Edition - Rus/Plugin/ch.dll unpack001/Ultimate-RAT-Collection-NjRat/njRAT v0.7d Golden Edition - Rus/njRAT v0.7d Golden Edition - Rus/Plugin/mic.dll unpack001/Ultimate-RAT-Collection-NjRat/njRAT v0.7d Golden Edition - Rus/njRAT v0.7d Golden Edition - Rus/Plugin/plg.dll unpack001/Ultimate-RAT-Collection-NjRat/njRAT v0.7d Golden Edition - Rus/njRAT v0.7d Golden Edition - Rus/Plugin/pw.dll unpack001/Ultimate-RAT-Collection-NjRat/njRAT v0.7d Golden Edition - Rus/njRAT v0.7d Golden Edition - Rus/Plugin/sc2.dll unpack001/Ultimate-RAT-Collection-NjRat/njRAT v0.7d Golden Edition - Rus/njRAT v0.7d Golden Edition - Rus/WinMM.Net.dll unpack001/Ultimate-RAT-Collection-NjRat/njRAT v0.7d Golden Edition - Rus/njRAT v0.7d Golden Edition - Rus/stubs/Anti.bin unpack001/Ultimate-RAT-Collection-NjRat/njRAT v0.7d Golden Edition - Rus/njRAT v0.7d Golden Edition - Rus/stubs/Stub.bin unpack001/Ultimate-RAT-Collection-NjRat/njRAT v0.7d Golden Edition - Rus/njRAT v0.7d Golden Edition - Rus/stubs/dlentrypoint.bin unpack001/Ultimate-RAT-Collection-NjRat/njRAT v0.7d Golden Edition - Rus/njRAT v0.7d Golden Edition - Rus/stubs/dlnormal.bin unpack001/Ultimate-RAT-Collection-NjRat/njRAT v0.7d Golden Edition - Rus/njRAT v0.7d Golden Edition - Rus/stubs/mpress.exe unpack001/Ultimate-RAT-Collection-NjRat/njRAT v0.7d Platinum Edition - Rus/njRAT v0.7d Platinum Edition - Rus/Client.exe unpack001/Ultimate-RAT-Collection-NjRat/njRAT v0.7d Platinum Edition - Rus/njRAT v0.7d Platinum Edition - Rus/Mono.Cecil.dll unpack001/Ultimate-RAT-Collection-NjRat/njRAT v0.7d Platinum Edition - Rus/njRAT v0.7d Platinum Edition - Rus/New Client.exe unpack001/Ultimate-RAT-Collection-NjRat/njRAT v0.7d Platinum Edition - Rus/njRAT v0.7d Platinum Edition - Rus/NjRat Platinum Edition.exe unpack001/Ultimate-RAT-Collection-NjRat/njRAT v0.7d Platinum Edition - Rus/njRAT v0.7d Platinum Edition - Rus/Plugin/cam.dll unpack001/Ultimate-RAT-Collection-NjRat/njRAT v0.7d Platinum Edition - Rus/njRAT v0.7d Platinum Edition - Rus/Plugin/ch.dll unpack001/Ultimate-RAT-Collection-NjRat/njRAT v0.7d Platinum Edition - Rus/njRAT v0.7d Platinum Edition - Rus/Plugin/mic.dll unpack001/Ultimate-RAT-Collection-NjRat/njRAT v0.7d Platinum Edition - Rus/njRAT v0.7d Platinum Edition - Rus/Plugin/plg.dll unpack001/Ultimate-RAT-Collection-NjRat/njRAT v0.7d Platinum Edition - Rus/njRAT v0.7d Platinum Edition - Rus/Plugin/pw.dll unpack001/Ultimate-RAT-Collection-NjRat/njRAT v0.7d Platinum Edition - Rus/njRAT v0.7d Platinum Edition - Rus/Plugin/sc2.dll unpack001/Ultimate-RAT-Collection-NjRat/njRAT v0.7d Platinum Edition - Rus/njRAT v0.7d Platinum Edition - Rus/WinMM.Net.dll unpack004/XWorm V5.6/FastColoredTextBox.dll unpack004/XWorm V5.6/GMap.NET.Core.dll unpack004/XWorm V5.6/GMap.NET.WindowsForms.dll unpack004/XWorm V5.6/IconExtractor.dll unpack004/XWorm V5.6/Plugins/ActiveWindows.dll unpack004/XWorm V5.6/Plugins/Chat.dll unpack004/XWorm V5.6/Plugins/Chromium.dll unpack004/XWorm V5.6/Plugins/Clipboard.dll unpack004/XWorm V5.6/Plugins/Cmstp-Bypass.dll unpack004/XWorm V5.6/Plugins/FileManager.dll unpack004/XWorm V5.6/Plugins/FilesSearcher.dll unpack004/XWorm V5.6/Plugins/HBrowser.dll unpack004/XWorm V5.6/Plugins/HRDP.dll unpack004/XWorm V5.6/Plugins/HVNC.dll unpack004/XWorm V5.6/Plugins/HVNCMemory.dll unpack004/XWorm V5.6/Plugins/HiddenApps.dll unpack004/XWorm V5.6/Plugins/Informations.dll unpack004/XWorm V5.6/Plugins/Keylogger.dll unpack004/XWorm V5.6/Plugins/Maps.dll unpack004/XWorm V5.6/Plugins/MessageBox.dll unpack004/XWorm V5.6/Plugins/Microphone.dll unpack004/XWorm V5.6/Plugins/Ngrok-Installer.dll unpack004/XWorm V5.6/Plugins/Options.dll unpack004/XWorm V5.6/Plugins/Pastime.dll unpack004/XWorm V5.6/Plugins/Performance.dll unpack004/XWorm V5.6/Plugins/ProcessManager.dll unpack004/XWorm V5.6/Plugins/Programs.dll unpack004/XWorm V5.6/Plugins/Ransomware.dll unpack004/XWorm V5.6/Plugins/Recovery.dll unpack004/XWorm V5.6/Plugins/Regedit.dll unpack004/XWorm V5.6/Plugins/RemoteDesktop.dll unpack004/XWorm V5.6/Plugins/ReverseProxy.dll unpack004/XWorm V5.6/Plugins/RunPE.dll unpack004/XWorm V5.6/Plugins/ServiceManager.dll unpack004/XWorm V5.6/Plugins/Shell.dll unpack004/XWorm V5.6/Plugins/StartupManager.dll unpack004/XWorm V5.6/Plugins/Stealer.dll unpack004/XWorm V5.6/Plugins/TCPConnections.dll unpack004/XWorm V5.6/Plugins/UACBypass.dll unpack004/XWorm V5.6/Plugins/VB.NET Compiler.dll unpack004/XWorm V5.6/Plugins/VoiceChat.dll unpack004/XWorm V5.6/Plugins/WSound.dll unpack004/XWorm V5.6/Plugins/WebCam.dll unpack004/XWorm V5.6/SimpleObfuscator.dll unpack004/XWorm V5.6/Xworm V5.6.exe unpack001/Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/FastColoredTextBox.dll unpack001/Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/GMap.NET.Core.dll unpack001/Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/GMap.NET.WindowsForms.dll unpack001/Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/IconExtractor.dll unpack001/Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/Plugins/ActiveWindows.dll unpack001/Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/Plugins/Chat.dll unpack001/Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/Plugins/Chromium.dll unpack001/Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/Plugins/Clipboard.dll unpack001/Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/Plugins/Cmstp-Bypass.dll unpack001/Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/Plugins/FileManager.dll unpack001/Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/Plugins/FilesSearcher.dll unpack001/Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/Plugins/HBrowser.dll unpack001/Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/Plugins/HRDP.dll unpack001/Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/Plugins/HVNC.dll unpack001/Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/Plugins/HVNCMemory.dll unpack001/Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/Plugins/HiddenApps.dll unpack001/Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/Plugins/Informations.dll unpack001/Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/Plugins/Keylogger.dll unpack001/Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/Plugins/Maps.dll unpack001/Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/Plugins/MessageBox.dll unpack001/Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/Plugins/Microphone.dll unpack001/Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/Plugins/Ngrok-Installer.dll unpack001/Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/Plugins/Options.dll unpack001/Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/Plugins/Pastime.dll unpack001/Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/Plugins/Performance.dll unpack001/Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/Plugins/ProcessManager.dll unpack001/Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/Plugins/Programs.dll unpack001/Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/Plugins/Ransomware.dll unpack001/Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/Plugins/Recovery.dll unpack001/Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/Plugins/Regedit.dll unpack001/Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/Plugins/RemoteDesktop.dll unpack001/Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/Plugins/ReverseProxy.dll unpack001/Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/Plugins/RunPE.dll unpack001/Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/Plugins/ServiceManager.dll unpack001/Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/Plugins/Shell.dll unpack001/Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/Plugins/StartupManager.dll unpack001/Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/Plugins/Stealer.dll unpack001/Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/Plugins/TCPConnections.dll unpack001/Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/Plugins/UACBypass.dll unpack001/Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/Plugins/VB.NET Compiler.dll unpack001/Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/Plugins/VoiceChat.dll unpack001/Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/Plugins/WSound.dll unpack001/Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/Plugins/WebCam.dll unpack001/Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/SimpleObfuscator.dll unpack001/Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/XClient.exe unpack001/Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/Xworm V5.6.exe unpack001/njRAT v0.7d Platinum Edition - Rus/njRAT-0.7d-Platinum-Edition-RuS/Mono.Cecil.dll unpack001/njRAT v0.7d Platinum Edition - Rus/njRAT-0.7d-Platinum-Edition-RuS/NjRat Platinum Edition.exe unpack001/njRAT v0.7d Platinum Edition - Rus/njRAT-0.7d-Platinum-Edition-RuS/Plugin/cam.dll unpack001/njRAT v0.7d Platinum Edition - Rus/njRAT-0.7d-Platinum-Edition-RuS/Plugin/ch.dll unpack001/njRAT v0.7d Platinum Edition - Rus/njRAT-0.7d-Platinum-Edition-RuS/Plugin/mic.dll unpack001/njRAT v0.7d Platinum Edition - Rus/njRAT-0.7d-Platinum-Edition-RuS/Plugin/plg.dll unpack001/njRAT v0.7d Platinum Edition - Rus/njRAT-0.7d-Platinum-Edition-RuS/Plugin/pw.dll unpack001/njRAT v0.7d Platinum Edition - Rus/njRAT-0.7d-Platinum-Edition-RuS/Plugin/sc2.dll unpack001/njRAT v0.7d Platinum Edition - Rus/njRAT-0.7d-Platinum-Edition-RuS/WinMM.Net.dll - Untrusted Codesign Signers 2 IoCs
Codesigned file was signed by an untrusted entity.
resource unpack004/XWorm V5.6/Guna.UI2.dll unpack001/Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/Guna.UI2.dll
File Explorer
-
Ratcollection.rar.rar 69.2MB
-
Ultimate-RAT-Collection-NjRat/njRAT v0.7d Golden Edition - Rus/README.md160B
-
Ultimate-RAT-Collection-NjRat/njRAT v0.7d Golden Edition - Rus/Screenshot.png.png 22KB
-
Ultimate-RAT-Collection-NjRat/njRAT v0.7d Golden Edition - Rus/njRAT v0.7d Golden Edition - Rus.7z.7z 1.4MB
-
GeoIP.dat1.2MB
-
stubs/Anti.bin.exe 12KB
-
stubs/Bsod.egg5B
-
stubs/Exe.egg11B
-
stubs/Hide.egg5B
-
stubs/Mpress.egg5B
-
stubs/ReGKey.egg45B
-
stubs/Sound/Sound.wav23KB
-
stubs/Stub.bin.exe 44KB
-
stubs/VN.egg6B
-
stubs/copy.egg5B
-
stubs/dir.egg6B
-
stubs/dlentrypoint.bin.exe 11KB
-
stubs/dlnormal.bin.exe 11KB
-
stubs/host.egg9B
-
stubs/regch.egg5B
-
stubs/regname.egg14B
-
stubs/startupch.egg5B
-
stubs/startupname.egg11B
-
stubs/task.egg5B
-
Ultimate-RAT-Collection-NjRat/njRAT v0.7d Golden Edition - Rus/njRAT v0.7d Golden Edition - Rus/GeoIP.dat1.2MB
-
Ultimate-RAT-Collection-NjRat/njRAT v0.7d Golden Edition - Rus/njRAT v0.7d Golden Edition - Rus/InjectIcon.dll.dll 13KB
-
Ultimate-RAT-Collection-NjRat/njRAT v0.7d Golden Edition - Rus/njRAT v0.7d Golden Edition - Rus/Mono.Cecil.dll.dll 305KB
-
Ultimate-RAT-Collection-NjRat/njRAT v0.7d Golden Edition - Rus/njRAT v0.7d Golden Edition - Rus/NjRat 0.7D Golden Edition - Rus.exe.exe 1.9MB
-
Ultimate-RAT-Collection-NjRat/njRAT v0.7d Golden Edition - Rus/njRAT v0.7d Golden Edition - Rus/Nj_users/WINDOSW_egorv_14FD549D/Keylog.rtf.rtf 6KB
-
Ultimate-RAT-Collection-NjRat/njRAT v0.7d Golden Edition - Rus/njRAT v0.7d Golden Edition - Rus/Plugin/AntiProcess.dll.exe 16KB
-
Ultimate-RAT-Collection-NjRat/njRAT v0.7d Golden Edition - Rus/njRAT v0.7d Golden Edition - Rus/Plugin/cam.dll.dll 62KB
-
Ultimate-RAT-Collection-NjRat/njRAT v0.7d Golden Edition - Rus/njRAT v0.7d Golden Edition - Rus/Plugin/ch.dll.dll 23KB
-
Ultimate-RAT-Collection-NjRat/njRAT v0.7d Golden Edition - Rus/njRAT v0.7d Golden Edition - Rus/Plugin/mic.dll.dll 48KB
-
Ultimate-RAT-Collection-NjRat/njRAT v0.7d Golden Edition - Rus/njRAT v0.7d Golden Edition - Rus/Plugin/plg.dll.dll 28KB
-
Ultimate-RAT-Collection-NjRat/njRAT v0.7d Golden Edition - Rus/njRAT v0.7d Golden Edition - Rus/Plugin/pw.dll.dll 251KB
-
Ultimate-RAT-Collection-NjRat/njRAT v0.7d Golden Edition - Rus/njRAT v0.7d Golden Edition - Rus/Plugin/sc2.dll.dll 12KB
-
Ultimate-RAT-Collection-NjRat/njRAT v0.7d Golden Edition - Rus/njRAT v0.7d Golden Edition - Rus/WinMM.Net.dll.dll 43KB
-
Ultimate-RAT-Collection-NjRat/njRAT v0.7d Golden Edition - Rus/njRAT v0.7d Golden Edition - Rus/stubs/Anti.bin.exe 12KB
-
Ultimate-RAT-Collection-NjRat/njRAT v0.7d Golden Edition - Rus/njRAT v0.7d Golden Edition - Rus/stubs/Bsod.egg5B
-
Ultimate-RAT-Collection-NjRat/njRAT v0.7d Golden Edition - Rus/njRAT v0.7d Golden Edition - Rus/stubs/Exe.egg11B
-
Ultimate-RAT-Collection-NjRat/njRAT v0.7d Golden Edition - Rus/njRAT v0.7d Golden Edition - Rus/stubs/Hide.egg5B
-
Ultimate-RAT-Collection-NjRat/njRAT v0.7d Golden Edition - Rus/njRAT v0.7d Golden Edition - Rus/stubs/Mpress.egg5B
-
Ultimate-RAT-Collection-NjRat/njRAT v0.7d Golden Edition - Rus/njRAT v0.7d Golden Edition - Rus/stubs/ReGKey.egg45B
-
Ultimate-RAT-Collection-NjRat/njRAT v0.7d Golden Edition - Rus/njRAT v0.7d Golden Edition - Rus/stubs/Sound/Sound.wav23KB
-
Ultimate-RAT-Collection-NjRat/njRAT v0.7d Golden Edition - Rus/njRAT v0.7d Golden Edition - Rus/stubs/Stub.bin.exe 44KB
-
Ultimate-RAT-Collection-NjRat/njRAT v0.7d Golden Edition - Rus/njRAT v0.7d Golden Edition - Rus/stubs/VN.egg6B
-
Ultimate-RAT-Collection-NjRat/njRAT v0.7d Golden Edition - Rus/njRAT v0.7d Golden Edition - Rus/stubs/copy.egg4B
-
Ultimate-RAT-Collection-NjRat/njRAT v0.7d Golden Edition - Rus/njRAT v0.7d Golden Edition - Rus/stubs/dir.egg6B
-
Ultimate-RAT-Collection-NjRat/njRAT v0.7d Golden Edition - Rus/njRAT v0.7d Golden Edition - Rus/stubs/dlentrypoint.bin.exe 11KB
-
Ultimate-RAT-Collection-NjRat/njRAT v0.7d Golden Edition - Rus/njRAT v0.7d Golden Edition - Rus/stubs/dlnormal.bin.exe 11KB
-
Ultimate-RAT-Collection-NjRat/njRAT v0.7d Golden Edition - Rus/njRAT v0.7d Golden Edition - Rus/stubs/host.egg9B
-
Ultimate-RAT-Collection-NjRat/njRAT v0.7d Golden Edition - Rus/njRAT v0.7d Golden Edition - Rus/stubs/mpress.exe.exe 101KB
-
Ultimate-RAT-Collection-NjRat/njRAT v0.7d Golden Edition - Rus/njRAT v0.7d Golden Edition - Rus/stubs/regch.egg5B
-
Ultimate-RAT-Collection-NjRat/njRAT v0.7d Golden Edition - Rus/njRAT v0.7d Golden Edition - Rus/stubs/regname.egg14B
-
Ultimate-RAT-Collection-NjRat/njRAT v0.7d Golden Edition - Rus/njRAT v0.7d Golden Edition - Rus/stubs/startupch.egg5B
-
Ultimate-RAT-Collection-NjRat/njRAT v0.7d Golden Edition - Rus/njRAT v0.7d Golden Edition - Rus/stubs/startupname.egg11B
-
Ultimate-RAT-Collection-NjRat/njRAT v0.7d Golden Edition - Rus/njRAT v0.7d Golden Edition - Rus/stubs/task.egg5B
-
Ultimate-RAT-Collection-NjRat/njRAT v0.7d Platinum Edition - Rus/README.md162B
-
Ultimate-RAT-Collection-NjRat/njRAT v0.7d Platinum Edition - Rus/Screenshot.png.png 29KB
-
Ultimate-RAT-Collection-NjRat/njRAT v0.7d Platinum Edition - Rus/njRAT v0.7d Platinum Edition - Rus.7z.7z 8.6MB
-
njRAT-0.7d-Platinum-Edition-RuS/GeoIP.dat1.1MB
-
njRAT-0.7d-Platinum-Edition-RuS/NjRat Platinum Edition.exe.config.xml 1KB
-
njRAT-0.7d-Platinum-Edition-RuS/NjRat Platinum Edition.xml4KB
-
njRAT-0.7d-Platinum-Edition-RuS/Sound/Sound.wav680KB
-
njRAT-0.7d-Platinum-Edition-RuS/Stub/Stub.manifest.xml 487B
-
njRAT-0.7d-Platinum-Edition-RuS/Stub/stub.il659KB
-
njRAT-0.7d-Platinum-Edition-RuS/Terror/01.gif.gif 422KB
-
njRAT-0.7d-Platinum-Edition-RuS/Terror/02.gif.gif 676KB
-
njRAT-0.7d-Platinum-Edition-RuS/Terror/03.gif.gif 241KB
-
njRAT-0.7d-Platinum-Edition-RuS/Terror/04.gif.gif 297KB
-
njRAT-0.7d-Platinum-Edition-RuS/Terror/05.gif.gif 305KB
-
njRAT-0.7d-Platinum-Edition-RuS/Terror/Scream.wav42KB
-
Ultimate-RAT-Collection-NjRat/njRAT v0.7d Platinum Edition - Rus/njRAT v0.7d Platinum Edition - Rus/Client.exe.exe 65KB
-
Ultimate-RAT-Collection-NjRat/njRAT v0.7d Platinum Edition - Rus/njRAT v0.7d Platinum Edition - Rus/GeoIP.dat1.1MB
-
Ultimate-RAT-Collection-NjRat/njRAT v0.7d Platinum Edition - Rus/njRAT v0.7d Platinum Edition - Rus/Mono.Cecil.dll.dll 305KB
-
Ultimate-RAT-Collection-NjRat/njRAT v0.7d Platinum Edition - Rus/njRAT v0.7d Platinum Edition - Rus/New Client.exe.exe 65KB
-
Ultimate-RAT-Collection-NjRat/njRAT v0.7d Platinum Edition - Rus/njRAT v0.7d Platinum Edition - Rus/NjRat Platinum Edition.exe.exe 7.9MB
-
Ultimate-RAT-Collection-NjRat/njRAT v0.7d Platinum Edition - Rus/njRAT v0.7d Platinum Edition - Rus/NjRat Platinum Edition.exe.config.xml 1KB
-
Ultimate-RAT-Collection-NjRat/njRAT v0.7d Platinum Edition - Rus/njRAT v0.7d Platinum Edition - Rus/NjRat Platinum Edition.xml4KB
-
Ultimate-RAT-Collection-NjRat/njRAT v0.7d Platinum Edition - Rus/njRAT v0.7d Platinum Edition - Rus/Plugin/cam.dll.dll 63KB
-
Ultimate-RAT-Collection-NjRat/njRAT v0.7d Platinum Edition - Rus/njRAT v0.7d Platinum Edition - Rus/Plugin/ch.dll.dll 85KB
-
Ultimate-RAT-Collection-NjRat/njRAT v0.7d Platinum Edition - Rus/njRAT v0.7d Platinum Edition - Rus/Plugin/mic.dll.dll 49KB
-
Ultimate-RAT-Collection-NjRat/njRAT v0.7d Platinum Edition - Rus/njRAT v0.7d Platinum Edition - Rus/Plugin/plg.dll.dll 28KB
-
Ultimate-RAT-Collection-NjRat/njRAT v0.7d Platinum Edition - Rus/njRAT v0.7d Platinum Edition - Rus/Plugin/pw.dll.dll 39KB
-
Ultimate-RAT-Collection-NjRat/njRAT v0.7d Platinum Edition - Rus/njRAT v0.7d Platinum Edition - Rus/Plugin/sc2.dll.dll 12KB
-
Ultimate-RAT-Collection-NjRat/njRAT v0.7d Platinum Edition - Rus/njRAT v0.7d Platinum Edition - Rus/Sound/Sound.wav680KB
-
Ultimate-RAT-Collection-NjRat/njRAT v0.7d Platinum Edition - Rus/njRAT v0.7d Platinum Edition - Rus/Stub/Stub.manifest.xml 487B
-
Ultimate-RAT-Collection-NjRat/njRAT v0.7d Platinum Edition - Rus/njRAT v0.7d Platinum Edition - Rus/Stub/stub.il659KB
-
Ultimate-RAT-Collection-NjRat/njRAT v0.7d Platinum Edition - Rus/njRAT v0.7d Platinum Edition - Rus/Terror/01.gif.gif 422KB
-
Ultimate-RAT-Collection-NjRat/njRAT v0.7d Platinum Edition - Rus/njRAT v0.7d Platinum Edition - Rus/Terror/02.gif.gif 676KB
-
Ultimate-RAT-Collection-NjRat/njRAT v0.7d Platinum Edition - Rus/njRAT v0.7d Platinum Edition - Rus/Terror/03.gif.gif 241KB
-
Ultimate-RAT-Collection-NjRat/njRAT v0.7d Platinum Edition - Rus/njRAT v0.7d Platinum Edition - Rus/Terror/04.gif.gif 297KB
-
Ultimate-RAT-Collection-NjRat/njRAT v0.7d Platinum Edition - Rus/njRAT v0.7d Platinum Edition - Rus/Terror/05.gif.gif 305KB
-
Ultimate-RAT-Collection-NjRat/njRAT v0.7d Platinum Edition - Rus/njRAT v0.7d Platinum Edition - Rus/Terror/Scream.wav42KB
-
Ultimate-RAT-Collection-NjRat/njRAT v0.7d Platinum Edition - Rus/njRAT v0.7d Platinum Edition - Rus/WinMM.Net.dll.dll 43KB
-
Ultimate-RAT-Collection-NjRat/njRAT v0.7d Platinum Edition - Rus/njRAT v0.7d Platinum Edition - Rus/nj_users/WINDOSW_egorv_14FD549D/Keylog.rtf.rtf 1KB
-
Ultimate-RAT-Collection-XWorm/XWorm V5.6/README.md130B
-
Ultimate-RAT-Collection-XWorm/XWorm V5.6/Screenshot.png.png 26KB
-
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6.7z.7z 18.5MB
-
XWorm V5.6/Background.png.png 924KB
-
XWorm V5.6/FastColoredTextBox.dll.dll 333KB
-
XWorm V5.6/Fixer.bat122B
-
XWorm V5.6/GMap.NET.Core.dll.dll 2.9MB
-
XWorm V5.6/GMap.NET.WindowsForms.dll.dll 147KB
-
XWorm V5.6/GeoIP.dat1.2MB
-
XWorm V5.6/Guna.UI2.dll.dll 1.9MB
-
XWorm V5.6/IconExtractor.dll.dll 10KB
-
XWorm V5.6/Icons/icon (1).ico97KB
-
XWorm V5.6/Icons/icon (10).ico115KB
-
XWorm V5.6/Icons/icon (11).ico9KB
-
XWorm V5.6/Icons/icon (12).ico9KB
-
XWorm V5.6/Icons/icon (13).ico361KB
-
XWorm V5.6/Icons/icon (14).ico361KB
-
XWorm V5.6/Icons/icon (15).ico361KB
-
XWorm V5.6/Icons/icon (16).ico97KB
-
XWorm V5.6/Icons/icon (17).ico66KB
-
XWorm V5.6/Icons/icon (2).ico112KB
-
XWorm V5.6/Icons/icon (3).ico131KB
-
XWorm V5.6/Icons/icon (4).ico125KB
-
XWorm V5.6/Icons/icon (5).ico100KB
-
XWorm V5.6/Icons/icon (6).ico106KB
-
XWorm V5.6/Icons/icon (7).ico164KB
-
XWorm V5.6/Icons/icon (8).ico108KB
-
XWorm V5.6/Icons/icon (9).ico264KB
-
XWorm V5.6/Logs/ErrorLogs.txt224B
-
XWorm V5.6/NAudio.dll.dll 502KB
-
XWorm V5.6/Newtonsoft.Json.dll.dll 695KB
-
XWorm V5.6/Plugins/ActiveWindows.dll.dll 14KB
-
XWorm V5.6/Plugins/Chat.dll.dll 18KB
-
XWorm V5.6/Plugins/Chromium.dll.dll 32KB
-
XWorm V5.6/Plugins/Clipboard.dll.dll 14KB
-
XWorm V5.6/Plugins/Cmstp-Bypass.dll.dll 11KB
-
XWorm V5.6/Plugins/FileManager.dll.dll 679KB
-
XWorm V5.6/Plugins/FilesSearcher.dll.dll 478KB
-
XWorm V5.6/Plugins/HBrowser.dll.dll 25KB
-
XWorm V5.6/Plugins/HRDP.dll.dll 1.7MB
-
XWorm V5.6/Plugins/HVNC.dll.dll 58KB
-
XWorm V5.6/Plugins/HVNCMemory.dll.dll 39KB
-
XWorm V5.6/Plugins/HiddenApps.dll.dll 45KB
-
XWorm V5.6/Plugins/Informations.dll.dll 22KB
-
XWorm V5.6/Plugins/Keylogger.dll.dll 17KB
-
XWorm V5.6/Plugins/Maps.dll.dll 15KB
-
XWorm V5.6/Plugins/MessageBox.dll.dll 14KB
-
XWorm V5.6/Plugins/Microphone.dll.dll 540KB
-
XWorm V5.6/Plugins/Ngrok-Installer.dll.dll 400KB
-
XWorm V5.6/Plugins/Options.dll.dll .ps1 30KB
-
XWorm V5.6/Plugins/Pastime.dll.dll 17KB
-
XWorm V5.6/Plugins/Performance.dll.dll 16KB
-
XWorm V5.6/Plugins/ProcessManager.dll.dll 19KB
-
XWorm V5.6/Plugins/Programs.dll.dll 13KB
-
XWorm V5.6/Plugins/Ransomware.dll.dll 20KB
-
XWorm V5.6/Plugins/Recovery.dll.dll 1.1MB
-
XWorm V5.6/Plugins/Regedit.dll.dll 15KB
-
XWorm V5.6/Plugins/RemoteDesktop.dll.dll 18KB
-
XWorm V5.6/Plugins/ReverseProxy.dll.dll 16KB
-
XWorm V5.6/Plugins/RunPE.dll.dll 11KB
-
XWorm V5.6/Plugins/ServiceManager.dll.dll 14KB
-
XWorm V5.6/Plugins/Shell.dll.dll 14KB
-
XWorm V5.6/Plugins/StartupManager.dll.dll 188KB
-
XWorm V5.6/Plugins/Stealer.dll.dll 3.3MB
-
XWorm V5.6/Plugins/TCPConnections.dll.dll 16KB
-
XWorm V5.6/Plugins/UACBypass.dll.dll 10KB
-
XWorm V5.6/Plugins/VB.NET Compiler.dll.dll 14KB
-
XWorm V5.6/Plugins/VoiceChat.dll.dll 539KB
-
XWorm V5.6/Plugins/WSound.dll.dll 539KB
-
XWorm V5.6/Plugins/WebCam.dll.dll 209KB
-
XWorm V5.6/RES/U40957361f7481084776e6aedU9f0U195KB
-
XWorm V5.6/RES/XWorm.ACT.resources67KB
-
XWorm V5.6/RES/XWorm.About.resources3.3MB
-
XWorm V5.6/RES/XWorm.Builder.resources107KB
-
XWorm V5.6/RES/XWorm.Chat.resources99KB
-
XWorm V5.6/RES/XWorm.Clipboard.resources113KB
-
XWorm V5.6/RES/XWorm.Clipper.resources106KB
-
XWorm V5.6/RES/XWorm.CustomOpen.resources101KB
-
XWorm V5.6/RES/XWorm.DDosAttack.resources99KB
-
XWorm V5.6/RES/XWorm.EditReg.resources107KB
-
XWorm V5.6/RES/XWorm.FM.resources178KB
-
XWorm V5.6/RES/XWorm.FilesSearcher.resources151KB
-
XWorm V5.6/RES/XWorm.Ftp.resources109KB
-
XWorm V5.6/RES/XWorm.Fun.resources99KB
-
XWorm V5.6/RES/XWorm.HApps.resources128KB
-
XWorm V5.6/RES/XWorm.HBrowser.resources92KB
-
XWorm V5.6/RES/XWorm.HRDP.resources103KB
-
XWorm V5.6/RES/XWorm.HVNC.resources105KB
-
XWorm V5.6/RES/XWorm.Hash.resources99KB
-
XWorm V5.6/RES/XWorm.Hosts.resources102KB
-
XWorm V5.6/RES/XWorm.INFO.resources171KB
-
XWorm V5.6/RES/XWorm.Keylogger.resources124KB
-
XWorm V5.6/RES/XWorm.MBox.resources107KB
-
XWorm V5.6/RES/XWorm.MIC.resources119KB
-
XWorm V5.6/RES/XWorm.Main.resources1.8MB
-
XWorm V5.6/RES/XWorm.Maps.resources140KB
-
XWorm V5.6/RES/XWorm.Performance.resources106KB
-
XWorm V5.6/RES/XWorm.Port.resources139KB
-
XWorm V5.6/RES/XWorm.ProcessV.resources67KB
-
XWorm V5.6/RES/XWorm.Programs.resources164KB
-
XWorm V5.6/RES/XWorm.Proxy.resources108KB
-
XWorm V5.6/RES/XWorm.Ransomware.resources101KB
-
XWorm V5.6/RES/XWorm.Registry.resources169KB
-
XWorm V5.6/RES/XWorm.RemoteDesktop.resources99KB
-
XWorm V5.6/RES/XWorm.Resources.resources.vbs 1.6MB
-
XWorm V5.6/RES/XWorm.RunPE.resources103KB
-
XWorm V5.6/RES/XWorm.ServiceManager.resources221KB
-
XWorm V5.6/RES/XWorm.Shell.resources130KB
-
XWorm V5.6/RES/XWorm.Sound.resources189KB
-
XWorm V5.6/RES/XWorm.StartupManager.resources167KB
-
XWorm V5.6/RES/XWorm.TBotNotify.resources100KB
-
XWorm V5.6/RES/XWorm.TXT.resources101KB
-
XWorm V5.6/RES/XWorm.TcpConnectionForm.resources169KB
-
XWorm V5.6/RES/XWorm.ToolsBox.resources241KB
-
XWorm V5.6/RES/XWorm.VBCode.resources174KB
-
XWorm V5.6/RES/XWorm.VoiceChat.resources121KB
-
XWorm V5.6/RES/XWorm.WebCam.resources100KB
-
XWorm V5.6/RES/XWorm.ngrok.resources101KB
-
XWorm V5.6/SimpleObfuscator.dll.dll 1.4MB
-
XWorm V5.6/Sounds/Chat.wav45KB
-
XWorm V5.6/Sounds/Intro.wav238KB
-
XWorm V5.6/XWorm V5.6.exe.config.xml 183B
-
XWorm V5.6/Xworm V5.6.exe.exe 14.9MB
-
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/Background.png.png 924KB
-
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/FastColoredTextBox.dll.dll 333KB
-
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/Fixer.bat122B
-
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/GMap.NET.Core.dll.dll 2.9MB
-
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/GMap.NET.WindowsForms.dll.dll 147KB
-
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/GeoIP.dat1.2MB
-
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/Guna.UI2.dll.dll 1.9MB
-
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/IconExtractor.dll.dll 10KB
-
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/Icons/icon (1).ico97KB
-
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/Icons/icon (10).ico115KB
-
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/Icons/icon (11).ico9KB
-
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/Icons/icon (12).ico9KB
-
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/Icons/icon (13).ico361KB
-
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/Icons/icon (14).ico361KB
-
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/Icons/icon (15).ico361KB
-
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/Icons/icon (16).ico97KB
-
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/Icons/icon (17).ico66KB
-
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/Icons/icon (2).ico112KB
-
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/Icons/icon (3).ico131KB
-
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/Icons/icon (4).ico125KB
-
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/Icons/icon (5).ico100KB
-
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/Icons/icon (6).ico106KB
-
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/Icons/icon (7).ico164KB
-
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/Icons/icon (8).ico108KB
-
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/Icons/icon (9).ico264KB
-
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/Logs/ErrorLogs.txt224B
-
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/NAudio.dll.dll 502KB
-
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/Newtonsoft.Json.dll.dll 695KB
-
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/Plugins/ActiveWindows.dll.dll 14KB
-
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/Plugins/Chat.dll.dll 18KB
-
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/Plugins/Chromium.dll.dll 32KB
-
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/Plugins/Clipboard.dll.dll 14KB
-
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/Plugins/Cmstp-Bypass.dll.dll 11KB
-
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/Plugins/FileManager.dll.dll 679KB
-
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/Plugins/FilesSearcher.dll.dll 478KB
-
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/Plugins/HBrowser.dll.dll 25KB
-
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/Plugins/HRDP.dll.dll 1.7MB
-
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/Plugins/HVNC.dll.dll 58KB
-
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/Plugins/HVNCMemory.dll.dll 39KB
-
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/Plugins/HiddenApps.dll.dll 45KB
-
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/Plugins/Informations.dll.dll 22KB
-
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/Plugins/Keylogger.dll.dll 17KB
-
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/Plugins/Maps.dll.dll 15KB
-
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/Plugins/MessageBox.dll.dll 14KB
-
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/Plugins/Microphone.dll.dll 540KB
-
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/Plugins/Ngrok-Installer.dll.dll 400KB
-
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/Plugins/Options.dll.dll .ps1 30KB
-
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/Plugins/Pastime.dll.dll 17KB
-
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/Plugins/Performance.dll.dll 16KB
-
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/Plugins/ProcessManager.dll.dll 19KB
-
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/Plugins/Programs.dll.dll 13KB
-
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/Plugins/Ransomware.dll.dll 20KB
-
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/Plugins/Recovery.dll.dll 1.1MB
-
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/Plugins/Regedit.dll.dll 15KB
-
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/Plugins/RemoteDesktop.dll.dll 18KB
-
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/Plugins/ReverseProxy.dll.dll 16KB
-
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/Plugins/RunPE.dll.dll 11KB
-
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/Plugins/ServiceManager.dll.dll 14KB
-
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/Plugins/Shell.dll.dll 14KB
-
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/Plugins/StartupManager.dll.dll 188KB
-
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/Plugins/Stealer.dll.dll 3.3MB
-
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/Plugins/TCPConnections.dll.dll 16KB
-
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/Plugins/UACBypass.dll.dll 10KB
-
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/Plugins/VB.NET Compiler.dll.dll 14KB
-
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/Plugins/VoiceChat.dll.dll 539KB
-
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/Plugins/WSound.dll.dll 539KB
-
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/Plugins/WebCam.dll.dll 209KB
-
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/RES/U40957361f7481084776e6aedU9f0U195KB
-
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/RES/XWorm.ACT.resources67KB
-
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/RES/XWorm.About.resources3.3MB
-
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/RES/XWorm.Builder.resources107KB
-
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/RES/XWorm.Chat.resources99KB
-
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/RES/XWorm.Clipboard.resources113KB
-
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/RES/XWorm.Clipper.resources106KB
-
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/RES/XWorm.CustomOpen.resources101KB
-
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/RES/XWorm.DDosAttack.resources99KB
-
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/RES/XWorm.EditReg.resources107KB
-
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/RES/XWorm.FM.resources178KB
-
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/RES/XWorm.FilesSearcher.resources151KB
-
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/RES/XWorm.Ftp.resources109KB
-
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/RES/XWorm.Fun.resources99KB
-
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/RES/XWorm.HApps.resources128KB
-
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/RES/XWorm.HBrowser.resources92KB
-
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/RES/XWorm.HRDP.resources103KB
-
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/RES/XWorm.HVNC.resources105KB
-
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/RES/XWorm.Hash.resources99KB
-
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/RES/XWorm.Hosts.resources102KB
-
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/RES/XWorm.INFO.resources171KB
-
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/RES/XWorm.Keylogger.resources124KB
-
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/RES/XWorm.MBox.resources107KB
-
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/RES/XWorm.MIC.resources119KB
-
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/RES/XWorm.Main.resources1.8MB
-
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/RES/XWorm.Maps.resources140KB
-
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/RES/XWorm.Performance.resources106KB
-
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/RES/XWorm.Port.resources139KB
-
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/RES/XWorm.ProcessV.resources67KB
-
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/RES/XWorm.Programs.resources164KB
-
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/RES/XWorm.Proxy.resources108KB
-
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/RES/XWorm.Ransomware.resources101KB
-
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/RES/XWorm.Registry.resources169KB
-
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/RES/XWorm.RemoteDesktop.resources99KB
-
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/RES/XWorm.Resources.resources.vbs 1.6MB
-
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/RES/XWorm.RunPE.resources103KB
-
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/RES/XWorm.ServiceManager.resources221KB
-
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/RES/XWorm.Shell.resources130KB
-
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/RES/XWorm.Sound.resources189KB
-
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/RES/XWorm.StartupManager.resources167KB
-
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/RES/XWorm.TBotNotify.resources100KB
-
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/RES/XWorm.TXT.resources101KB
-
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/RES/XWorm.TcpConnectionForm.resources169KB
-
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/RES/XWorm.ToolsBox.resources241KB
-
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/RES/XWorm.VBCode.resources174KB
-
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/RES/XWorm.VoiceChat.resources121KB
-
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/RES/XWorm.WebCam.resources100KB
-
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/RES/XWorm.ngrok.resources101KB
-
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/SimpleObfuscator.dll.dll 1.4MB
-
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/Sounds/Chat.wav45KB
-
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/Sounds/Intro.wav238KB
-
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/XClient.exe.exe 32KB
-
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/XWorm V5.6.exe.config.xml 183B
-
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/Xworm V5.6.exe.exe 14.9MB
-
njRAT v0.7d Platinum Edition - Rus/njRAT-0.7d-Platinum-Edition-RuS/GeoIP.dat1.1MB
-
njRAT v0.7d Platinum Edition - Rus/njRAT-0.7d-Platinum-Edition-RuS/Mono.Cecil.dll.dll 305KB
-
njRAT v0.7d Platinum Edition - Rus/njRAT-0.7d-Platinum-Edition-RuS/NjRat Platinum Edition.exe.exe 7.9MB
-
njRAT v0.7d Platinum Edition - Rus/njRAT-0.7d-Platinum-Edition-RuS/NjRat Platinum Edition.exe.config.xml 1KB
-
njRAT v0.7d Platinum Edition - Rus/njRAT-0.7d-Platinum-Edition-RuS/NjRat Platinum Edition.xml4KB
-
njRAT v0.7d Platinum Edition - Rus/njRAT-0.7d-Platinum-Edition-RuS/Plugin/cam.dll.dll 63KB
-
njRAT v0.7d Platinum Edition - Rus/njRAT-0.7d-Platinum-Edition-RuS/Plugin/ch.dll.dll 85KB
-
njRAT v0.7d Platinum Edition - Rus/njRAT-0.7d-Platinum-Edition-RuS/Plugin/mic.dll.dll 49KB
-
njRAT v0.7d Platinum Edition - Rus/njRAT-0.7d-Platinum-Edition-RuS/Plugin/plg.dll.dll 28KB
-
njRAT v0.7d Platinum Edition - Rus/njRAT-0.7d-Platinum-Edition-RuS/Plugin/pw.dll.dll 39KB
-
njRAT v0.7d Platinum Edition - Rus/njRAT-0.7d-Platinum-Edition-RuS/Plugin/sc2.dll.dll 12KB
-
njRAT v0.7d Platinum Edition - Rus/njRAT-0.7d-Platinum-Edition-RuS/Sound/Sound.wav680KB
-
njRAT v0.7d Platinum Edition - Rus/njRAT-0.7d-Platinum-Edition-RuS/Stub/Stub.manifest.xml 487B
-
njRAT v0.7d Platinum Edition - Rus/njRAT-0.7d-Platinum-Edition-RuS/Stub/stub.il659KB
-
njRAT v0.7d Platinum Edition - Rus/njRAT-0.7d-Platinum-Edition-RuS/Terror/01.gif.gif 422KB
-
njRAT v0.7d Platinum Edition - Rus/njRAT-0.7d-Platinum-Edition-RuS/Terror/02.gif.gif 676KB
-
njRAT v0.7d Platinum Edition - Rus/njRAT-0.7d-Platinum-Edition-RuS/Terror/03.gif.gif 241KB
-
njRAT v0.7d Platinum Edition - Rus/njRAT-0.7d-Platinum-Edition-RuS/Terror/04.gif.gif 297KB
-
njRAT v0.7d Platinum Edition - Rus/njRAT-0.7d-Platinum-Edition-RuS/Terror/05.gif.gif 305KB
-
njRAT v0.7d Platinum Edition - Rus/njRAT-0.7d-Platinum-Edition-RuS/Terror/Scream.wav42KB
-
njRAT v0.7d Platinum Edition - Rus/njRAT-0.7d-Platinum-Edition-RuS/WinMM.Net.dll.dll 43KB
Ultimate-RAT-Collection-NjRat/njRAT v0.7d Golden Edition - Rus/README.md
- SHA256 11384bcac7d2ba22d293f10c85c779a40627e85a457a47854c1f3b40e6f7b284
- MD5 d9043c98b6a7aff53f83594d9d4839d6
- SHA1 ce8f396ae6e0c79575af965896477a7a4187a46e
- SHA512 586dedb7ca0c4a63b8c0e518f58c0f578c04bdcd4168df2a223793d97d9134e971a7dcb5a54874e153b938b62fde71ac7a3d7948ceb1b9647ace40f554e0b572
- TLSH T179C08CFF32060B388A27AAD2F9D7A4AC34B0045B9CB2943A5160542CC8692279B72969
- MD5 SHA1 SHA512 TLSH
Ultimate-RAT-Collection-NjRat/njRAT v0.7d Golden Edition - Rus/Screenshot.png
- SHA256 c3e37754f3c394dd63489ce63ff623c6309787aaaa0b16f603d94a959b25601f
- MD5 fd575bd82992a69042dcf0b035a22a21
- SHA1 c515306df7c90e26833f11fd17918e71cc952965
- SHA512 02e1f78db8cff17507ed989be5b64de8eb7b3b6d3e498fbe53f4d8b1eb9e0cddb77508e185da695730cb200a7568263bc3f16628713947a69d722f3b0a22700d
- SSDEEP 384:3kIkeUxuxIkWsUOo+YAls6PE9sfTROltWBSTZdy1/XdPio/XdPio/XdPio/XdPi3:3kIk/4izvOoj1QRCQsD+vhvhvhvhvhvk
- TLSH T178A207EA1CDC75439371A9A3E765F2FC563BDE9C980016117035D9A2386B00E8CBB2B2
- MD5 SHA1 SHA512 SSDEEP TLSH
Ultimate-RAT-Collection-NjRat/njRAT v0.7d Golden Edition - Rus/njRAT v0.7d Golden Edition - Rus.7z
- SHA256 ae50e71d2bec964bfd5f350ce0a6c2f306303eb6ed8f997d39dcf459948c07dd
- MD5 b766f110641fbf6df46d5e1d08e1fc37
- SHA1 c3079456c377ddb62e1790f9e9df1101d2e7e81f
- SHA512 40a9d8ba6d327d09621d4db5934f1d301f4dc9b90b3d5fac38fe31f8ed419fb18add36e2214c3e19a39f6de8d81e2cf582917224cc0d4e9a01111685a7841be1
- SSDEEP 24576:DzjoRX4+wV1ggqVbgXzi8bnqoggtMUdhr4SHcvwrhJMeyw1z6EWsHGAEBF2Pw3Mc:Dzjs5k1MVbgXz1DJ7rlHPjMeyw12ErH+
- TLSH T1BE6533B13D1B6145B953D8A3B14648A9773317EF760F0DF461DE0F06422B2E4AE8B31A
- MD5 SHA1 SHA512 SSDEEP TLSH
GeoIP.dat
- SHA256 8a0675001b5bc63d8389fc7ed80b4a7b0f9538c744350f00162533519e106426
- MD5 797b96cc417d0cde72e5c25d0898e95e
- SHA1 8c63d0cc8a3a09c1fe50c856b8e5170a63d62f13
- SHA512 9bb0c40c83551000577f8cf0b8a7c344bc105328a2c564df70fabec978ad267fa42e248c11fb78166855b0816d2ef3ec2c12fe52f8cc0b83e366e46301340882
- SSDEEP 24576:X49Ncvb7y4+FFfI12ky0dBRQ3fNLxDKefhoFbQfAACiTQVapg:o9Nhw1vJ83fNLxu2UVa2
- TLSH T106555A16FF8599DB08523D2EF81A8D9C08699D35FC0A0336316E7B5D90747A8EDE60E3
- MD5 SHA1 SHA512 SSDEEP TLSH
stubs/Anti.bin
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 01d0bedcc943e13e341578423a2fc6848d9f63f1c5800b9a16bd64f65a1fcdde
- MD5 2170473f4f2b81e9b909996b0f459d16
- SHA1 81be2df85521167bcffd449e22db1add18e7bc5c
- SHA512 f5d879a45dfa733e264018fc4a714421e8b5fef5f8f06f2293ac327bbc4f4d09fc123a38d271bbd1dbc6e0ca206ec618027a10bf5291d7bb804862cef4aeb416
- SSDEEP 192:J1o3yrrIXd2lBBVCfA+XZm7nloYk4kNIDLR7swYoxU5R09KxK:J1o2k6BBVIA+JT4g+LRwcCRCKx
- TLSH T11742291577A58374CFFD0F325C6356101BBAD706CA636B3F98D8427A99E32108663E32
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
17230
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\Users\Dark\Desktop\Desktop\My Src\SRC - Coringa-RAT 0.3\Stub AntiProcess\obj\Debug\MemoryDiagnostic.pdb
mscoree
_CorExeMain
Name
.text
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
512B
Virtual Size
159B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
stubs/Bsod.egg
- SHA256 60a33e6cf5151f2d52eddae9685cfa270426aa89d8dbc7dfb854606f1d1a40fe
- MD5 f8320b26d30ab433c5a54546d21f414c
- SHA1 97cdbdc7feff827efb082a6b6dd2727237cd49fd
- SHA512 af1aace54ec0ab736f8a6a262cc319740beb89d04efe071d451522e2cdb210bf0c81ae676ebc45781935cc18a3b939a6645b2ebe0a484e2594d672d81460b3dd
- MD5 SHA1 SHA512
stubs/Exe.egg
- SHA256 21a79c05c0f8307c51271987d8f78c2be7adc0ba1882cff03d9be82255e09dd5
- MD5 d81891c69f5b8e60db91a41be4249c8e
- SHA1 77b257e03fc069c535b42fe8c38bd5e9d8f21e86
- SHA512 55b1a8117193331375444324b81c488a738c88b8b0e53d72cfd7fd088677db0f7fb7f01af26930db816f2080bcc9bbb5847fd5cb8034f5971361c8bc71905a49
- MD5 SHA1 SHA512
stubs/Hide.egg
- SHA256 60a33e6cf5151f2d52eddae9685cfa270426aa89d8dbc7dfb854606f1d1a40fe
- MD5 f8320b26d30ab433c5a54546d21f414c
- SHA1 97cdbdc7feff827efb082a6b6dd2727237cd49fd
- SHA512 af1aace54ec0ab736f8a6a262cc319740beb89d04efe071d451522e2cdb210bf0c81ae676ebc45781935cc18a3b939a6645b2ebe0a484e2594d672d81460b3dd
- MD5 SHA1 SHA512
stubs/Mpress.egg
- SHA256 60a33e6cf5151f2d52eddae9685cfa270426aa89d8dbc7dfb854606f1d1a40fe
- MD5 f8320b26d30ab433c5a54546d21f414c
- SHA1 97cdbdc7feff827efb082a6b6dd2727237cd49fd
- SHA512 af1aace54ec0ab736f8a6a262cc319740beb89d04efe071d451522e2cdb210bf0c81ae676ebc45781935cc18a3b939a6645b2ebe0a484e2594d672d81460b3dd
- MD5 SHA1 SHA512
stubs/ReGKey.egg
- SHA256 b8fa5aa5af1c96f87c35e32117364155dfab8f913fcd098b71f59888e0609154
- MD5 c7e93739b6dec45a71cce1da31ccdcd8
- SHA1 7b65dd11ab20361e4c4d9dad4a1c5d0389d0af2b
- SHA512 016f6e6bfe36567430870da31d1bebc134f07e68ab7574e2bd22e17f80aad19e9036c9c97322ada577fdd6cb67056fc528b1351086d02eae69bbe62dd475d2c7
- MD5 SHA1 SHA512
stubs/Sound/Sound.wav
- SHA256 a76aa44b4924a960d020cc82c0e29e840f46fd81ec05c91ddbf4f42169ade4db
- MD5 ff8b7adc4209146b4ec595a986fd6384
- SHA1 1630cfd169baad76ba47fc725f296bd4fbd26bbd
- SHA512 f6e6ef9dd841d8265f6d6f0f26965c467c8db6d60b81eaf6bc8aa85c2b77ad5e9cb939a30ef37349f7ed666480847e0dd0d26e61fb0a5b12bac1d58045d6f510
- SSDEEP 384:2fNSnOOUe9RcnAEtrNEAl0Zcp1+XKnRPXnIbMUjwu8SKZelRGSQMQRWFV:W4nB1OnXLPlmcL+XKRPvUEu8elRosFV
- TLSH T132B26B9384E1B0425E0FC6B9FE1BC9A8F14AD8DDCDCDD75A5114E63690F6232C29F982
- MD5 SHA1 SHA512 SSDEEP TLSH
stubs/Stub.bin
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 f9901a131548492470fab93c1d607be4d5cfa174f5b2efe2a592fddfa3af9fdd
- MD5 2ca8aa52af999240dddb9790a1f474bc
- SHA1 599fa5e9ce3f7a634543595f73dd92bd5e406d8e
- SHA512 5bad1d2bfdd6259456b8beba60a93341a6f3dab3d673bfdc6003891357e3bf1344059849c8941f532f46791d25ddd29040c5a4549ae676a80cd545471658a9e9
- SSDEEP 384:7F7RVdzu0ohd1vwyxEsvgvRpkhcaE1EgRqmVldNCJ9yko5lwWHWqb4Zz8ujoLT3m:BMDzBd7vAcIqAdQJ9O5GWHW6UkA
- TLSH T13F23A64DB2508574E6EF4BF1B8A162D806719057A946A10FC9F2B5E94FB3EC08710FE7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
50222
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\Users\Dark\Desktop\Stub1\Stub1\obj\x86\Release\Stub.pdb
mscoree
_CorExeMain
Name
.text
Size
41KB
Virtual Size
41KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
512B
Virtual Size
111B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
578B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
stubs/VN.egg
- SHA256 417dacf7bc522f756571e33110ad80a23a17a16abea66fa1c004e91b5535140b
- MD5 8746d62c81bb0c573a0a1086f9955c7b
- SHA1 80ee75364815abf7c4ac88639279d2137bd8668c
- SHA512 a3d26b5cb548f85a567fbcae79f5769f99f1164e2d44ed3594c220f52d63d5996e3c9cbcb972f129a54937857facdb0b82763e782f68bb27cafa419ccd956e49
- MD5 SHA1 SHA512
stubs/copy.egg
- SHA256 60a33e6cf5151f2d52eddae9685cfa270426aa89d8dbc7dfb854606f1d1a40fe
- MD5 f8320b26d30ab433c5a54546d21f414c
- SHA1 97cdbdc7feff827efb082a6b6dd2727237cd49fd
- SHA512 af1aace54ec0ab736f8a6a262cc319740beb89d04efe071d451522e2cdb210bf0c81ae676ebc45781935cc18a3b939a6645b2ebe0a484e2594d672d81460b3dd
- MD5 SHA1 SHA512
stubs/dir.egg
- SHA256 07f8b1a4dba9ee295d9af001e6859fd115c69f452d287fc6e6c0ec6ac49cafdd
- MD5 2fbcfac1e2d2302c87300af0d4f592a5
- SHA1 c73400d24e0b5332a354df36b33f90a0e980d619
- SHA512 000f85bdda6558866153c7c2a7fc0de0eb9e36218f3e4748af0909c7a74caff707b8f46a51949ed63454d4c1d8045382136d9338c7fff492737fe12169df75af
- MD5 SHA1 SHA512
stubs/dlentrypoint.bin
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 c8294263bb4e447f53eeb9e639dba6ec24d735d80a7d05894e8b88bd115f2970
- MD5 4a7b5a4da67c17c762cb538e6fec9ed1
- SHA1 65945d34c9484151c67f9a780c488186db4aece7
- SHA512 fcea20011c5cfc91b1f523bafe7df96a1723bab7a7bf182ba14caddd76eb658faae9a8840b9095a8f30d6ea8665e163b014649dc32dc3c0f781a435f4be11c2b
- SSDEEP 192:RFXnc1L11AvlszLq65grqZmGnloYk4KNIDLT7pnElS+Fs:RFs1LnAvlszeILy4a+LT7pElf
- TLSH T11B32082653858776CF3F0B72082375404BB6C306D296AB7E9DD466AA8FD72460BB3371
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
16350
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\Users\Dark\AppData\Local\Temporary Projects\class\obj\x86\Release\class.pdb
mscoree
_CorExeMain
Name
.text
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
512B
Virtual Size
131B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
578B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
stubs/dlnormal.bin
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 0e36c6fbbc68953d2702c3d5f84eeb35912ce9a53aadf467f8df60faf51a7f5e
- MD5 2b53e572879a63aaa6ab032221a24d99
- SHA1 cecfb4dad0d128bc78369aba53839828af223ff1
- SHA512 327d26775f38f29f462c8a3a9d921ab0d89cf80527acb2ddd539d0842988f93c2cbf335a865cea893ab2a81915a95683cdfd8033f9a357aacbf0b8d3360e8188
- SSDEEP 192:3d3WKytoFQldQKDFdzG1nvlldKXZmGnloYk46NIDLRKQVuYvpxGBA:N3Wuy7FBGJvl7KJy4q+LRK6lx8A
- TLSH T1CB320829A7918770CFBE0BB2086775800BB6D30AC7936F3FCCD4695696E311947B2626
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
16718
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
E:\Stub Downloader\ClassLibrary2\ClassLibrary2\obj\Debug\Class.pdb
mscoree
_CorExeMain
Name
.text
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
512B
Virtual Size
119B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
stubs/host.egg
- SHA256 12ca17b49af2289436f303e0166030a21e525d266e209267433801a8fd4071a0
- MD5 f528764d624db129b32c21fbca0cb8d6
- SHA1 4b84b15bff6ee5796152495a230e45e3d7e947d9
- SHA512 2f8748abdbb42c16f5d62251f8adea1f65443b6ed0ec063b49be332a6c8cc200892828deee3bbc44bffff040677446dfe0fe5d9dc5a2150d342dd93456b54e22
- MD5 SHA1 SHA512
stubs/regch.egg
- SHA256 60a33e6cf5151f2d52eddae9685cfa270426aa89d8dbc7dfb854606f1d1a40fe
- MD5 f8320b26d30ab433c5a54546d21f414c
- SHA1 97cdbdc7feff827efb082a6b6dd2727237cd49fd
- SHA512 af1aace54ec0ab736f8a6a262cc319740beb89d04efe071d451522e2cdb210bf0c81ae676ebc45781935cc18a3b939a6645b2ebe0a484e2594d672d81460b3dd
- MD5 SHA1 SHA512
stubs/regname.egg
- SHA256 d9bf5215fd3470cebfaa8f90e670edd92e2192d7561f0fb0563d54fcfa6efdbe
- MD5 99c7315e03761ceafc2e151ae808f267
- SHA1 799d0cb439a58d27b92cdf4a8f177aa3fa49d4af
- SHA512 5132ccf17ff8726c7bb338df203e45b639adbd5665dd57a9f5b8e4e4f80f916abb74f4c96fffd017f2b5bf9a84208a211225f3d8ef8337b4aa0442e6303b070b
- MD5 SHA1 SHA512
stubs/startupch.egg
- SHA256 60a33e6cf5151f2d52eddae9685cfa270426aa89d8dbc7dfb854606f1d1a40fe
- MD5 f8320b26d30ab433c5a54546d21f414c
- SHA1 97cdbdc7feff827efb082a6b6dd2727237cd49fd
- SHA512 af1aace54ec0ab736f8a6a262cc319740beb89d04efe071d451522e2cdb210bf0c81ae676ebc45781935cc18a3b939a6645b2ebe0a484e2594d672d81460b3dd
- MD5 SHA1 SHA512
stubs/startupname.egg
- SHA256 46237cbc19353167743677a80ab15a202877d968d907ecd4341ecae2cea2d3db
- MD5 7797cd8b4621ffc45f229516be6ecdbc
- SHA1 6ee10b56197f3d7732c93c35229af02373466caa
- SHA512 f993de6f1494d6fdeb3f489e6baf83a5c307c9bea1bbac2e7ab838439be445350e53a13f125d03a7208ecd84617ebcbee49022b2f8ac814d9ce73d2a2edef63d
- MD5 SHA1 SHA512
stubs/task.egg
- SHA256 60a33e6cf5151f2d52eddae9685cfa270426aa89d8dbc7dfb854606f1d1a40fe
- MD5 f8320b26d30ab433c5a54546d21f414c
- SHA1 97cdbdc7feff827efb082a6b6dd2727237cd49fd
- SHA512 af1aace54ec0ab736f8a6a262cc319740beb89d04efe071d451522e2cdb210bf0c81ae676ebc45781935cc18a3b939a6645b2ebe0a484e2594d672d81460b3dd
- MD5 SHA1 SHA512
Ultimate-RAT-Collection-NjRat/njRAT v0.7d Golden Edition - Rus/njRAT v0.7d Golden Edition - Rus/GeoIP.dat
- SHA256 8a0675001b5bc63d8389fc7ed80b4a7b0f9538c744350f00162533519e106426
- MD5 797b96cc417d0cde72e5c25d0898e95e
- SHA1 8c63d0cc8a3a09c1fe50c856b8e5170a63d62f13
- SHA512 9bb0c40c83551000577f8cf0b8a7c344bc105328a2c564df70fabec978ad267fa42e248c11fb78166855b0816d2ef3ec2c12fe52f8cc0b83e366e46301340882
- SSDEEP 24576:X49Ncvb7y4+FFfI12ky0dBRQ3fNLxDKefhoFbQfAACiTQVapg:o9Nhw1vJ83fNLxu2UVa2
- TLSH T106555A16FF8599DB08523D2EF81A8D9C08699D35FC0A0336316E7B5D90747A8EDE60E3
- MD5 SHA1 SHA512 SSDEEP TLSH
Ultimate-RAT-Collection-NjRat/njRAT v0.7d Golden Edition - Rus/njRAT v0.7d Golden Edition - Rus/InjectIcon.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 98348ffe70a68f69d934118a2d14b86b382d698601827a4c1d322d878d36bbdc
- MD5 83921e813f885ae1669aa0efa21f8695
- SHA1 130f59f513eb64018736c0173d45a2b524c282fc
- SHA512 f123ef9c5fd3157c6f51b1ac02d6103baa1ebd2a02e3c2d95355b15ce3730f241c0d61d1ffc07713b8d3af7600730d29049683c589c7007a9a4e7bb4707f58c3
- SSDEEP 192:OLCpu5eYPefzYTZVzunlYJL/eBvnaDNIDLTHqaf0+E+sQAE8UBscU:OL+1qe09prqNnq+LTGQY
- TLSH T1EB52D70693D6C332CE6E873A5C1377A45B31DE00DA52AB3F55A0B2676DB33440E93762
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
17102
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
C:\Users\Dark\Desktop\InjectIcon\InjectIcon\obj\Release\InjectIcon.pdb
mscoree
_CorDllMain
Name
.text
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
512B
Virtual Size
123B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Ultimate-RAT-Collection-NjRat/njRAT v0.7d Golden Edition - Rus/njRAT v0.7d Golden Edition - Rus/Mono.Cecil.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 cdadc26c09f869e21053ee1a0acf3b2d11df8edd599fe9c377bd4d3ce1c9cda9
- MD5 851ec9d84343fbd089520d420348a902
- SHA1 f8e2a80130058e4db3cf569cf4297d07d05c93e0
- SHA512 5e1d1b953fda4a905749eff8c4133a164748ba08c4854348539d335cf53c873eae7c653807a2701bf307693a049ae6c523bd1497a8e659bdea0a71085a58a5f1
- SSDEEP 6144:ueMQM/aMOZabe3h1PtRjAqmYVNf3yTXcYBbt6KMBhu:uF/aMDb8BtRjA7XcYNclB
- TLSH T1D46429185AEC5B3ADD6F97BFD0E6581183B0F0126643E30E4BE4B2B22CB3761C95255B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
318190
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
C:\Users\njq8\Desktop\jbevain-cecil-0.9.5-73-ga5ffcc0\jbevain-cecil-a5ffcc0\obj\net_2_0_Debug\Mono.Cecil.pdb
mscoree
_CorDllMain
Name
.text
Size
303KB
Virtual Size
302KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
824B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Ultimate-RAT-Collection-NjRat/njRAT v0.7d Golden Edition - Rus/njRAT v0.7d Golden Edition - Rus/NjRat 0.7D Golden Edition - Rus.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 c81d701c3a4d6b7bcaa40f9c92a1bcfdf2f829954cf1ca15556712fbdc792834
- MD5 8d540934a359a0480de188a748b3d573
- SHA1 556693330454d09e461b0cc16c2c8f69f7f3cd45
- SHA512 d2214389578a2928cc51b7fb098dd8d1ed4677f97a3f6bb18ec5494a3247866c400af7fe5d1a326cd25faf6090139849d3ef0fbb43c62075e5a436c0599d47b9
- SSDEEP 24576:S69t3fGD4IC7VS2s5G8xQ63UJzyS6P/qY7/:S6T3vs5txQ63OqP/P7
- TLSH T138950F03B302EE55E9B832F450058FA052697E4E9174C6B62A743A78E9F98D3FD913CD
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1966382
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
1.9MB
Virtual Size
1.9MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
70KB
Virtual Size
70KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Ultimate-RAT-Collection-NjRat/njRAT v0.7d Golden Edition - Rus/njRAT v0.7d Golden Edition - Rus/Nj_users/WINDOSW_egorv_14FD549D/Keylog.rtf
- SHA256 cad44420af35930f40e7d4835eba1d472a73bcfa804e97510fdce319e8476187
- MD5 037e663c71182bd4e87ca62b5be36aba
- SHA1 97e6b63dfc663c933de67eaea339cb769197b574
- SHA512 c0db2a91d09ade1527a5997df7ecf1543d210d71c9d64490bacc17762e268ecf2bcaabb4920d6091d2fb94e9f0381fe8a5a5eb3b0feb9702894f62a1aef3c3f6
- SSDEEP 192:syfbsvssv/yfv7gBfvYfvXfvQfvCfvCfv4fv8fv/fvS2:kNMTgNmHOEU2Cvq2
- TLSH T1ADE1F581A966859E061B407E033B33D6179CEC6F5DFC5624BCBBD30B692A86C874F4D2
- MD5 SHA1 SHA512 SSDEEP TLSH
Ultimate-RAT-Collection-NjRat/njRAT v0.7d Golden Edition - Rus/njRAT v0.7d Golden Edition - Rus/Plugin/AntiProcess.dll
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 f643ab116e7bd8515032a502b8700afb5bdbfc08fc1caa08817b3061e98b763e
- MD5 b21947a28760750689f46e071d575d07
- SHA1 6008a9ff367e7a715422d2e2f96312f1a3231a9e
- SHA512 75fd467e4be5480e7dc4ce665a50cf5fcea3c4301f17674feec866d04e0f7036efaec0feffa35fc07ab19b70ff82d133c457c88d7c776f62160bff6cf13a2399
- SSDEEP 384:0sRt7Wow+KPUhkRf1jJXMgthizKN8dhct+1W7Lf45kNQfjO8pZ3TR:xRt7Wow+KPUhkRf1jJX4dhVI/mf
- TLSH T1F4720817A3E6873BCFED0EB48526150483F1C3069553FF2F9DC665768AA33404B9279A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
21678
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
D:\برامج\اختراق\سورسات كود برامج الاختراق\Anti\Anti\obj\x86\Release\Stub-Anti.pdb
mscoree
_CorExeMain
Name
.text
Size
13KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
512B
Virtual Size
167B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Ultimate-RAT-Collection-NjRat/njRAT v0.7d Golden Edition - Rus/njRAT v0.7d Golden Edition - Rus/Plugin/cam.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 5f00cda5808e3fd126d452708308ddee6556cb83adaccd02efe83654a40fc641
- MD5 7eba4d9562bf7fc14f2c1bb142a1aa6f
- SHA1 7c0f49bd672100881e7340a480dc6674d5dfc862
- SHA512 5e7e9ee05674eb6a943b84437a46cd6c4dd7d63cd95bf308cd614026383eafc087590f6238a5282e275cf1875038aaa46ef843a5c6d322e3b7b1a63e2d454830
- SSDEEP 1536:CfGJpkk261SBIAPVQfiZba2epz5B7hzUzaQo:QGJt3MIAdZbLepz5BlzUz5
- TLSH T126534C6E6798541AC58D46BC94770F1053F0CA1EA337EB8E2B7891BCCDB23814A5379B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
70590
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
61KB
Virtual Size
60KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Ultimate-RAT-Collection-NjRat/njRAT v0.7d Golden Edition - Rus/njRAT v0.7d Golden Edition - Rus/Plugin/ch.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 3bc2898da9cd9e202b7795b330fa3daff81a4b02ab4ecfe47fdd712c53252f12
- MD5 2490eda5b4450138ba79f39fcc90048a
- SHA1 f8af994fdeeb8afbf7d95e816da389a7eb09806e
- SHA512 4f96028666bcb0a80730e8429082c2ab839fe8662086ad9735641fe8e55d51f909171124b1500c1da4065f26a9d3118c8b6c24d1827d12c5c887cd1e358a2d58
- SSDEEP 384:B3RxTVz/Cn1CfWok/7+I98wxOaPlXfNIsGwPEvMnNKp9p:fxTVzK10N69XfNIUUpz
- TLSH T19EB2F81963E5C762CCFD07790862621167F2CD51DB13EF6F2ED870E92AB37048B4269A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
28414
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
20KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Ultimate-RAT-Collection-NjRat/njRAT v0.7d Golden Edition - Rus/njRAT v0.7d Golden Edition - Rus/Plugin/mic.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 7d327985d7e4f83adffbdf831c1e999c68cb90238790b63260af19d24bfa66b8
- MD5 1607999c56366fc2096a27a8bd237b98
- SHA1 0e0a61c55c6a7e8fecaa2053afeaf816095374a2
- SHA512 d30a642f26307f16a88782de2635b6e7b852dcbc90975c3920d61468dde06ed921074d95bd9d3b3b058ce4ce54973254370830d68f94a0d56b5072e82b890b85
- SSDEEP 768:fI3iafm1WcNQtd53fddlGemdITB8l/zkgQM8QRyHQuhwWCTxqPbojlfB:H1WcGyem7QXMryHQvWCTxqPbojl
- TLSH T19D23D6407A981CBAC52F067D7CE71621F6B18D64A327E26B1CBD60F718877DE96006F2
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
56254
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
47KB
Virtual Size
46KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Ultimate-RAT-Collection-NjRat/njRAT v0.7d Golden Edition - Rus/njRAT v0.7d Golden Edition - Rus/Plugin/plg.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 6f8770a35ec0845226a28dd57c8ae414dc8814a6871bd0bb818bb13ca3b82106
- MD5 04cb30a874ee349721b0398594de65fe
- SHA1 8f3272e318edd73c1f4194f3a90143e18f158e10
- SHA512 a69b3bc0e30ddaae10478626ac231b214864b722c9254d932a81ea1016f4f49cf04551d17cbe93819f9e1bd88f679fdc1f5446761c7065e2b0d30a8b7edf40ae
- SSDEEP 768:l78dTGdbp1AD8CYDMxelHpWuVP1eksWwnb9s7:+5hD8C2MxeSidBeb9s
- TLSH T162D2D70D2BA4C925C5BE57359D2223224FF346134817FF6E4CCF9AEC19A23884B56A5F
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
35358
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
27KB
Virtual Size
26KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Ultimate-RAT-Collection-NjRat/njRAT v0.7d Golden Edition - Rus/njRAT v0.7d Golden Edition - Rus/Plugin/pw.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 3a1cc072effd8c38406a6fddf4d8f49c5366bb0e32071311d90db669940987ce
- MD5 872401528fc94c90f3de6658e776cc36
- SHA1 c58e22158774d16831350de79eb4e1711379e8a6
- SHA512 6da881fb968ba9d9200777a9f19d69220468482f3eaaf687c433790d512da520f5adb23441fdc8f3fd10785918eb2864ea3ef32ddb80d2f6665550ea455f4a2f
- SSDEEP 6144:/e31bXJVFJmShoCKFdZ3aDGjXsCUjguhyUOMO1:WxJ/JmSG9T8CEgdM
- TLSH T16C44E02722CE3CA1E17E4A7033B353C2C3A9DD108612D51E29D83556AA7E1D37A42FD6
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
250558
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
C:\Users\Super\Documents\visual studio 2013\Projects\pw plugin\WindowsApplication12\obj\Release\pw.pdb
mscoree
_CorDllMain
Name
.text
Size
237KB
Virtual Size
236KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
512B
Virtual Size
312B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Ultimate-RAT-Collection-NjRat/njRAT v0.7d Golden Edition - Rus/njRAT v0.7d Golden Edition - Rus/Plugin/sc2.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 f97aadb4d1c59f4b3155a9ec57f91a05700aed38b0090096f8f1e0e7975b6561
- MD5 9c8b5c9ec7d24ef02c7df4e589dba366
- SHA1 6f939463f40343cf62afc072978c833ee864914f
- SHA512 a4bf281274c22b41b8faf0cbe7559c5a62bd7614bcc06cdc29f8f28419010bdadcb70a850886b4be9d7b6edb370fb34283a5f0991a1320edbaa12b5a194f8196
- SSDEEP 192:dUFqUAbp57yUnWcL90wG1YL7ANg5egmdOnB61f8a54qwynam0q61pLWnVG:dUcNWcL90wG10MNg5PTM1Ea54qwOaz2G
- TLSH T1A242F80D6F88C613E7AD0ABD26A3431593B6C1664312FB5B5ECE74F569AA7C202083D5
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
18798
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
10KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Ultimate-RAT-Collection-NjRat/njRAT v0.7d Golden Edition - Rus/njRAT v0.7d Golden Edition - Rus/WinMM.Net.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 59e2ac1b79840274bdfcef412a10058654e42f4285d732d1487e65e60ffbfb46
- MD5 d4b80052c7b4093e10ce1f40ce74f707
- SHA1 2494a38f1c0d3a0aa9b31cf0650337cacc655697
- SHA512 3813b81f741ae3adb07ae370e817597ed2803680841ccc7549babb727910c7bff4f8450670d0ca19a0d09e06f133a1aaefecf5b5620e1b0bdb6bcd409982c450
- SSDEEP 768:LyasDzF2TDSemqD9tGI+ffwj2Au0LVpqmf7KxcOOrYCPTxqPb85:LyaXKemqD9tGI+ffwj2Au0LVpq4KWrlv
- TLSH T1EB13B60479A85CB9CB2F013D6CD61211FAB18D647227B62B1CBE70F318977DE9A41AF1
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
50302
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
41KB
Virtual Size
41KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Ultimate-RAT-Collection-NjRat/njRAT v0.7d Golden Edition - Rus/njRAT v0.7d Golden Edition - Rus/stubs/Anti.bin
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 01d0bedcc943e13e341578423a2fc6848d9f63f1c5800b9a16bd64f65a1fcdde
- MD5 2170473f4f2b81e9b909996b0f459d16
- SHA1 81be2df85521167bcffd449e22db1add18e7bc5c
- SHA512 f5d879a45dfa733e264018fc4a714421e8b5fef5f8f06f2293ac327bbc4f4d09fc123a38d271bbd1dbc6e0ca206ec618027a10bf5291d7bb804862cef4aeb416
- SSDEEP 192:J1o3yrrIXd2lBBVCfA+XZm7nloYk4kNIDLR7swYoxU5R09KxK:J1o2k6BBVIA+JT4g+LRwcCRCKx
- TLSH T11742291577A58374CFFD0F325C6356101BBAD706CA636B3F98D8427A99E32108663E32
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
17230
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\Users\Dark\Desktop\Desktop\My Src\SRC - Coringa-RAT 0.3\Stub AntiProcess\obj\Debug\MemoryDiagnostic.pdb
mscoree
_CorExeMain
Name
.text
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
512B
Virtual Size
159B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Ultimate-RAT-Collection-NjRat/njRAT v0.7d Golden Edition - Rus/njRAT v0.7d Golden Edition - Rus/stubs/Bsod.egg
- SHA256 60a33e6cf5151f2d52eddae9685cfa270426aa89d8dbc7dfb854606f1d1a40fe
- MD5 f8320b26d30ab433c5a54546d21f414c
- SHA1 97cdbdc7feff827efb082a6b6dd2727237cd49fd
- SHA512 af1aace54ec0ab736f8a6a262cc319740beb89d04efe071d451522e2cdb210bf0c81ae676ebc45781935cc18a3b939a6645b2ebe0a484e2594d672d81460b3dd
- MD5 SHA1 SHA512
Ultimate-RAT-Collection-NjRat/njRAT v0.7d Golden Edition - Rus/njRAT v0.7d Golden Edition - Rus/stubs/Exe.egg
- SHA256 21a79c05c0f8307c51271987d8f78c2be7adc0ba1882cff03d9be82255e09dd5
- MD5 d81891c69f5b8e60db91a41be4249c8e
- SHA1 77b257e03fc069c535b42fe8c38bd5e9d8f21e86
- SHA512 55b1a8117193331375444324b81c488a738c88b8b0e53d72cfd7fd088677db0f7fb7f01af26930db816f2080bcc9bbb5847fd5cb8034f5971361c8bc71905a49
- MD5 SHA1 SHA512
Ultimate-RAT-Collection-NjRat/njRAT v0.7d Golden Edition - Rus/njRAT v0.7d Golden Edition - Rus/stubs/Hide.egg
- SHA256 60a33e6cf5151f2d52eddae9685cfa270426aa89d8dbc7dfb854606f1d1a40fe
- MD5 f8320b26d30ab433c5a54546d21f414c
- SHA1 97cdbdc7feff827efb082a6b6dd2727237cd49fd
- SHA512 af1aace54ec0ab736f8a6a262cc319740beb89d04efe071d451522e2cdb210bf0c81ae676ebc45781935cc18a3b939a6645b2ebe0a484e2594d672d81460b3dd
- MD5 SHA1 SHA512
Ultimate-RAT-Collection-NjRat/njRAT v0.7d Golden Edition - Rus/njRAT v0.7d Golden Edition - Rus/stubs/Mpress.egg
- SHA256 60a33e6cf5151f2d52eddae9685cfa270426aa89d8dbc7dfb854606f1d1a40fe
- MD5 f8320b26d30ab433c5a54546d21f414c
- SHA1 97cdbdc7feff827efb082a6b6dd2727237cd49fd
- SHA512 af1aace54ec0ab736f8a6a262cc319740beb89d04efe071d451522e2cdb210bf0c81ae676ebc45781935cc18a3b939a6645b2ebe0a484e2594d672d81460b3dd
- MD5 SHA1 SHA512
Ultimate-RAT-Collection-NjRat/njRAT v0.7d Golden Edition - Rus/njRAT v0.7d Golden Edition - Rus/stubs/ReGKey.egg
- SHA256 b8fa5aa5af1c96f87c35e32117364155dfab8f913fcd098b71f59888e0609154
- MD5 c7e93739b6dec45a71cce1da31ccdcd8
- SHA1 7b65dd11ab20361e4c4d9dad4a1c5d0389d0af2b
- SHA512 016f6e6bfe36567430870da31d1bebc134f07e68ab7574e2bd22e17f80aad19e9036c9c97322ada577fdd6cb67056fc528b1351086d02eae69bbe62dd475d2c7
- MD5 SHA1 SHA512
Ultimate-RAT-Collection-NjRat/njRAT v0.7d Golden Edition - Rus/njRAT v0.7d Golden Edition - Rus/stubs/Sound/Sound.wav
- SHA256 a76aa44b4924a960d020cc82c0e29e840f46fd81ec05c91ddbf4f42169ade4db
- MD5 ff8b7adc4209146b4ec595a986fd6384
- SHA1 1630cfd169baad76ba47fc725f296bd4fbd26bbd
- SHA512 f6e6ef9dd841d8265f6d6f0f26965c467c8db6d60b81eaf6bc8aa85c2b77ad5e9cb939a30ef37349f7ed666480847e0dd0d26e61fb0a5b12bac1d58045d6f510
- SSDEEP 384:2fNSnOOUe9RcnAEtrNEAl0Zcp1+XKnRPXnIbMUjwu8SKZelRGSQMQRWFV:W4nB1OnXLPlmcL+XKRPvUEu8elRosFV
- TLSH T132B26B9384E1B0425E0FC6B9FE1BC9A8F14AD8DDCDCDD75A5114E63690F6232C29F982
- MD5 SHA1 SHA512 SSDEEP TLSH
Ultimate-RAT-Collection-NjRat/njRAT v0.7d Golden Edition - Rus/njRAT v0.7d Golden Edition - Rus/stubs/Stub.bin
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 f9901a131548492470fab93c1d607be4d5cfa174f5b2efe2a592fddfa3af9fdd
- MD5 2ca8aa52af999240dddb9790a1f474bc
- SHA1 599fa5e9ce3f7a634543595f73dd92bd5e406d8e
- SHA512 5bad1d2bfdd6259456b8beba60a93341a6f3dab3d673bfdc6003891357e3bf1344059849c8941f532f46791d25ddd29040c5a4549ae676a80cd545471658a9e9
- SSDEEP 384:7F7RVdzu0ohd1vwyxEsvgvRpkhcaE1EgRqmVldNCJ9yko5lwWHWqb4Zz8ujoLT3m:BMDzBd7vAcIqAdQJ9O5GWHW6UkA
- TLSH T13F23A64DB2508574E6EF4BF1B8A162D806719057A946A10FC9F2B5E94FB3EC08710FE7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
50222
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\Users\Dark\Desktop\Stub1\Stub1\obj\x86\Release\Stub.pdb
mscoree
_CorExeMain
Name
.text
Size
41KB
Virtual Size
41KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
512B
Virtual Size
111B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
578B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Ultimate-RAT-Collection-NjRat/njRAT v0.7d Golden Edition - Rus/njRAT v0.7d Golden Edition - Rus/stubs/VN.egg
- SHA256 417dacf7bc522f756571e33110ad80a23a17a16abea66fa1c004e91b5535140b
- MD5 8746d62c81bb0c573a0a1086f9955c7b
- SHA1 80ee75364815abf7c4ac88639279d2137bd8668c
- SHA512 a3d26b5cb548f85a567fbcae79f5769f99f1164e2d44ed3594c220f52d63d5996e3c9cbcb972f129a54937857facdb0b82763e782f68bb27cafa419ccd956e49
- MD5 SHA1 SHA512
Ultimate-RAT-Collection-NjRat/njRAT v0.7d Golden Edition - Rus/njRAT v0.7d Golden Edition - Rus/stubs/copy.egg
- SHA256 3cbc87c7681f34db4617feaa2c8801931bc5e42d8d0f560e756dd4cd92885f18
- MD5 f827cf462f62848df37c5e1e94a4da74
- SHA1 88b33e4e12f75ac8bf792aebde41f1a090f3a612
- SHA512 28a91492cbd2575e48007219b2b990a75abbf70708f6b93fe7a7fbd41e310dccad1e7d7fdfa568f4bcb95cfdec21dbcf8a125d683d0b34e53441027f856bb3e1
- MD5 SHA1 SHA512
Ultimate-RAT-Collection-NjRat/njRAT v0.7d Golden Edition - Rus/njRAT v0.7d Golden Edition - Rus/stubs/dir.egg
- SHA256 07f8b1a4dba9ee295d9af001e6859fd115c69f452d287fc6e6c0ec6ac49cafdd
- MD5 2fbcfac1e2d2302c87300af0d4f592a5
- SHA1 c73400d24e0b5332a354df36b33f90a0e980d619
- SHA512 000f85bdda6558866153c7c2a7fc0de0eb9e36218f3e4748af0909c7a74caff707b8f46a51949ed63454d4c1d8045382136d9338c7fff492737fe12169df75af
- MD5 SHA1 SHA512
Ultimate-RAT-Collection-NjRat/njRAT v0.7d Golden Edition - Rus/njRAT v0.7d Golden Edition - Rus/stubs/dlentrypoint.bin
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 c8294263bb4e447f53eeb9e639dba6ec24d735d80a7d05894e8b88bd115f2970
- MD5 4a7b5a4da67c17c762cb538e6fec9ed1
- SHA1 65945d34c9484151c67f9a780c488186db4aece7
- SHA512 fcea20011c5cfc91b1f523bafe7df96a1723bab7a7bf182ba14caddd76eb658faae9a8840b9095a8f30d6ea8665e163b014649dc32dc3c0f781a435f4be11c2b
- SSDEEP 192:RFXnc1L11AvlszLq65grqZmGnloYk4KNIDLT7pnElS+Fs:RFs1LnAvlszeILy4a+LT7pElf
- TLSH T11B32082653858776CF3F0B72082375404BB6C306D296AB7E9DD466AA8FD72460BB3371
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
16350
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\Users\Dark\AppData\Local\Temporary Projects\class\obj\x86\Release\class.pdb
mscoree
_CorExeMain
Name
.text
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
512B
Virtual Size
131B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
578B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Ultimate-RAT-Collection-NjRat/njRAT v0.7d Golden Edition - Rus/njRAT v0.7d Golden Edition - Rus/stubs/dlnormal.bin
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 0e36c6fbbc68953d2702c3d5f84eeb35912ce9a53aadf467f8df60faf51a7f5e
- MD5 2b53e572879a63aaa6ab032221a24d99
- SHA1 cecfb4dad0d128bc78369aba53839828af223ff1
- SHA512 327d26775f38f29f462c8a3a9d921ab0d89cf80527acb2ddd539d0842988f93c2cbf335a865cea893ab2a81915a95683cdfd8033f9a357aacbf0b8d3360e8188
- SSDEEP 192:3d3WKytoFQldQKDFdzG1nvlldKXZmGnloYk46NIDLRKQVuYvpxGBA:N3Wuy7FBGJvl7KJy4q+LRK6lx8A
- TLSH T1CB320829A7918770CFBE0BB2086775800BB6D30AC7936F3FCCD4695696E311947B2626
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
16718
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
E:\Stub Downloader\ClassLibrary2\ClassLibrary2\obj\Debug\Class.pdb
mscoree
_CorExeMain
Name
.text
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
512B
Virtual Size
119B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Ultimate-RAT-Collection-NjRat/njRAT v0.7d Golden Edition - Rus/njRAT v0.7d Golden Edition - Rus/stubs/host.egg
- SHA256 12ca17b49af2289436f303e0166030a21e525d266e209267433801a8fd4071a0
- MD5 f528764d624db129b32c21fbca0cb8d6
- SHA1 4b84b15bff6ee5796152495a230e45e3d7e947d9
- SHA512 2f8748abdbb42c16f5d62251f8adea1f65443b6ed0ec063b49be332a6c8cc200892828deee3bbc44bffff040677446dfe0fe5d9dc5a2150d342dd93456b54e22
- MD5 SHA1 SHA512
Ultimate-RAT-Collection-NjRat/njRAT v0.7d Golden Edition - Rus/njRAT v0.7d Golden Edition - Rus/stubs/mpress.exe
- IMPHASH 51e7ef6b1d43d0d05d7109dee9789560
- SHA256 2852680c94a9d68cdab285012d9328a1ceca290db60c9e35155c2bb3e46a41b4
- MD5 8b632bfc3fe653a510cba277c2d699d1
- SHA1 d6a57aa17e5eb51297def9bac04e574c1e36d9c7
- SHA512 b9ea70ed984d3b4a42eceb9f34f222b722c4c1985b79b368d769fe0fd1f19f037ffebe2cf938aa98ed450337836a7469d911848448d99223995f7fb3a9304587
- SSDEEP 3072:S0+mlNniJkkKcfqBOb65VgB183gUGQ340HpL:SvmlNn4kkeOAVA1rUGh0Hp
- TLSH T125A3F1A1B140A61DF98F4E39CCC7B38994D2EC21953352466573FA8F84B27E43F12B49
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
225455
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
kernel32
GetModuleHandleA
GetProcAddress
imagehlp
CheckSumMappedFile
Name
.MPRESS1
Size
88KB
Virtual Size
216KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.MPRESS2
Size
1024B
Virtual Size
862B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
11KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
Ultimate-RAT-Collection-NjRat/njRAT v0.7d Golden Edition - Rus/njRAT v0.7d Golden Edition - Rus/stubs/regch.egg
- SHA256 60a33e6cf5151f2d52eddae9685cfa270426aa89d8dbc7dfb854606f1d1a40fe
- MD5 f8320b26d30ab433c5a54546d21f414c
- SHA1 97cdbdc7feff827efb082a6b6dd2727237cd49fd
- SHA512 af1aace54ec0ab736f8a6a262cc319740beb89d04efe071d451522e2cdb210bf0c81ae676ebc45781935cc18a3b939a6645b2ebe0a484e2594d672d81460b3dd
- MD5 SHA1 SHA512
Ultimate-RAT-Collection-NjRat/njRAT v0.7d Golden Edition - Rus/njRAT v0.7d Golden Edition - Rus/stubs/regname.egg
- SHA256 d9bf5215fd3470cebfaa8f90e670edd92e2192d7561f0fb0563d54fcfa6efdbe
- MD5 99c7315e03761ceafc2e151ae808f267
- SHA1 799d0cb439a58d27b92cdf4a8f177aa3fa49d4af
- SHA512 5132ccf17ff8726c7bb338df203e45b639adbd5665dd57a9f5b8e4e4f80f916abb74f4c96fffd017f2b5bf9a84208a211225f3d8ef8337b4aa0442e6303b070b
- MD5 SHA1 SHA512
Ultimate-RAT-Collection-NjRat/njRAT v0.7d Golden Edition - Rus/njRAT v0.7d Golden Edition - Rus/stubs/startupch.egg
- SHA256 60a33e6cf5151f2d52eddae9685cfa270426aa89d8dbc7dfb854606f1d1a40fe
- MD5 f8320b26d30ab433c5a54546d21f414c
- SHA1 97cdbdc7feff827efb082a6b6dd2727237cd49fd
- SHA512 af1aace54ec0ab736f8a6a262cc319740beb89d04efe071d451522e2cdb210bf0c81ae676ebc45781935cc18a3b939a6645b2ebe0a484e2594d672d81460b3dd
- MD5 SHA1 SHA512
Ultimate-RAT-Collection-NjRat/njRAT v0.7d Golden Edition - Rus/njRAT v0.7d Golden Edition - Rus/stubs/startupname.egg
- SHA256 46237cbc19353167743677a80ab15a202877d968d907ecd4341ecae2cea2d3db
- MD5 7797cd8b4621ffc45f229516be6ecdbc
- SHA1 6ee10b56197f3d7732c93c35229af02373466caa
- SHA512 f993de6f1494d6fdeb3f489e6baf83a5c307c9bea1bbac2e7ab838439be445350e53a13f125d03a7208ecd84617ebcbee49022b2f8ac814d9ce73d2a2edef63d
- MD5 SHA1 SHA512
Ultimate-RAT-Collection-NjRat/njRAT v0.7d Golden Edition - Rus/njRAT v0.7d Golden Edition - Rus/stubs/task.egg
- SHA256 60a33e6cf5151f2d52eddae9685cfa270426aa89d8dbc7dfb854606f1d1a40fe
- MD5 f8320b26d30ab433c5a54546d21f414c
- SHA1 97cdbdc7feff827efb082a6b6dd2727237cd49fd
- SHA512 af1aace54ec0ab736f8a6a262cc319740beb89d04efe071d451522e2cdb210bf0c81ae676ebc45781935cc18a3b939a6645b2ebe0a484e2594d672d81460b3dd
- MD5 SHA1 SHA512
Ultimate-RAT-Collection-NjRat/njRAT v0.7d Platinum Edition - Rus/README.md
- SHA256 f13c5ecf788a15dc13b14aed905680ba8d80234729391a490b323c5a371452d5
- MD5 0a6831a3c868a730967af15edee4642d
- SHA1 5202cfaf0d9d87d96efa91d2137250f2db065d7d
- SHA512 02a8bb5e92ae9cbd744c7083625925da7e27dafbc2c2135fc8e7590512729e2e47d6fd1ec5d0489dd9b33a5f1bec7c60b9afe4bde96de44037df4c0ded3880ff
- TLSH T190C0C0FF32020B3848139BC3F8D2949C347004074C3144361020002CC0140335331C34
- MD5 SHA1 SHA512 TLSH
Ultimate-RAT-Collection-NjRat/njRAT v0.7d Platinum Edition - Rus/Screenshot.png
- SHA256 cfeed18f3bae5ef1c9ece0c423f85e5d69d66f21a2b47c3cc4cfa4027d8f780f
- MD5 6742b9ebfd57b0663389cbc5160a7e4f
- SHA1 869eb35711bf85819917cbab56689c814593e09c
- SHA512 e22370074384fc81cc446acfcbbcae0413bc3412986de4412fa63ed7a5dcf07a537a7a83b2ead7d7ad3ab34f0a90366eb4e0ce89f8d2aa26ce4a28e6f220a40d
- SSDEEP 384:tCFmbfUFzIqdYX9hM+KO56ug/DTTlX2a9IPRzdSLXfyQOT5jZEls3RivcwXRF3sr:UOOIyYX9queHR2aAJwfY1ZECMQ
- TLSH T1C3D248B4A181BE61DF4443CC6D9F9084AE483F8F69EF940C95428D531FE7CD11A2AE6B
- MD5 SHA1 SHA512 SSDEEP TLSH
Ultimate-RAT-Collection-NjRat/njRAT v0.7d Platinum Edition - Rus/njRAT v0.7d Platinum Edition - Rus.7z
- SHA256 651743357f4e649b928a099025dec7291da8fe8787b15fa78cd3f272e2b835a8
- MD5 9605c098b4da00c374e98436ef887a61
- SHA1 5694b31fe710313077dc710e362f161fe6e66367
- SHA512 757e597c3853972eb2505735b4acffa3ec39a3dfa0559bb1b836d1bff4ca8d62f4df38c6d936851f0d390e9f5f35b318fc01a9c618d018ccd80f8a486af0a98c
- SSDEEP 196608:tQgUuEEyrZpyjj2pQHyvxRFYGieS6A9SSjjIk4PlUg8:ZU9/dUn2tZbYOPSjd4PlUg8
- TLSH T10C96336E5E6002011ECCD87FFB74661BF9A1430BD923D98DB083FF6606E45DA6FA8254
- MD5 SHA1 SHA512 SSDEEP TLSH
njRAT-0.7d-Platinum-Edition-RuS/GeoIP.dat
- SHA256 b4bfd1ebc50f0eaab3d3f4c2152feae7aa8efad380b85064153a6bfd006c6210
- MD5 a0a228c187329ad148f33c81ddb430bb
- SHA1 d70ec83d1b15b3156df73802dd1bec024b1b9346
- SHA512 0fe0a62c07f7ade0e6bfac8843c13c055369177935d801488a993bc4bcdb9da220ba1b37df2027dab8af7c15e5cf00b3e8f223b12165d8a1b0b9c30dc9939332
- SSDEEP 24576:WUH7rp/TXKHJBjsN0wjAu6e3akVX7k+k7bKnz+AHxOxaz+hnV647KyMLh:WUH3p/TKpBjs0b+akV4+C0axaz+ZVL7o
- TLSH T129358C22FF0696DBA9413D9EBD189EDC18148DB9FD071339625E379C60B8374CCC26A6
- MD5 SHA1 SHA512 SSDEEP TLSH
njRAT-0.7d-Platinum-Edition-RuS/NjRat Platinum Edition.exe.config
- SHA256 c45c9d1d30f940289498be2af978d74178a5c24ceb7755c2648f6c7a89353813
- MD5 da15a1d8d770b57356ddd384342b3034
- SHA1 b03d6cb907c139492c7b914147a498b31ef839fd
- SHA512 3cf7dd0d14244c543e3442873ce7e495ade87ad906a42d53f3b38180ffc453bd74ae022b91306445d359475dbee4caa1514c4e913e823d174b8470b45fed7cfc
- TLSH T1FE21CE45A5D08CB5466396636A544EC0FF364B9F724C154CF8DEBA9B8F3342C4707192
- MD5 SHA1 SHA512 TLSH
njRAT-0.7d-Platinum-Edition-RuS/NjRat Platinum Edition.xml
- SHA256 25fdf1bf3806ef92e022c6085f63d44ee314764cb053b9456ad0c8d86abd1301
- MD5 0f2ee4833bfbf61f404bb982c40ba249
- SHA1 b3559917b919bf8dc2067ebc5f72a5b9b45e6ccd
- SHA512 971f5f58e09d49ab4a544146dcda7b2594efaa3531ac9b005edd5c362585912a6c5ab78eec99eecf39b0f4056c155d5918a66eafc7cb11e1c8f758def0b255ee
- SSDEEP 48:3CsG8vgH0cJPcJ6cJFcJ4cJTcJocJzjcJlcJanUycJQc7afgkccJYocJUvBUMmu4:3i0q/o1KlsU1tC+G6Weyn9dIyKqV
- TLSH T11CA166468767EF390D3411BB7EB0B5C024635E22956C280EE8AA1C7347D22DA36FBE54
- MD5 SHA1 SHA512 SSDEEP TLSH
njRAT-0.7d-Platinum-Edition-RuS/Sound/Sound.wav
- SHA256 9430fec62eb1bfecb35f4a9ceb2ddd5ce6294751cde85fd7169c8def811af49e
- MD5 11ca5b5feba113ccf66d6649b5b3cb40
- SHA1 503f3a2a449b195d6e71237fba623c3a7b5a08fa
- SHA512 2183286132157f0122b1c8cbfbf0ccf49cf59ca033453d983fb4e25850203e1c03beff98bf99580b20c8049180d4afce339680ba70e1bd7c5a95f859afa70da3
- SSDEEP 12288:3435BUAwzT1eE7M9oxyAdP9qc1lHQJg6j4DUZTkznCBtt+doeUnk:3i/UAWkEkoxbl6grUBH3EoeUk
- TLSH T1F7E423E6E031FE10F8FC067769C10D44AB21BA495D172FAD7438D6A929B334339197AE
- MD5 SHA1 SHA512 SSDEEP TLSH
njRAT-0.7d-Platinum-Edition-RuS/Stub/Stub.manifest
- SHA256 835a00d6e7c43db49ae7b3fa12559f23c2920b7530f4d3f960fd285b42b1efb5
- MD5 4d18ac38a92d15a64e2b80447b025b7e
- SHA1 5c34374c2dd5afa92e0489f1d6f86dde616aca6c
- SHA512 72be79acd72366b495e0f625a50c9bdf01047bcf5f9ee1e3bdba10dab7bd721b0126f429a91d8c80c2434e8bc751defdf4c05bdc09d26a871df1bb2e22e923bf
- TLSH T16EF0DCC1D188CA6AD73042A13A66E410A2AD435B19DD49EC74DC2ABB6F0BAC680C30F1
- MD5 SHA1 SHA512 TLSH
njRAT-0.7d-Platinum-Edition-RuS/Stub/stub.il
- SHA256 4eaa0830f3a6b72e6380875b82c28fc48d22d3c14ab2adab87e2deafdbf19ea8
- MD5 8a1ea88a0ce54fbe8a85aedc751e0edc
- SHA1 2e3622edeaa569f4b38f740f593f4bd9f913c97a
- SHA512 e01a5511b9e21610d3e2e325fbf15068432dda6dbc976ca7395ad9c3e2d8a91883be813db75339d51e0bd5ea7c23a9c37c9b7e7384399489b21d15d953397f64
- SSDEEP 12288:kPY73AmnxaCpY4uqmXSxyosK+M8K2J2SzsWBpyP2KGLLGGjVVc0t3L5v7eWcwgZv:8pgT
- TLSH T129E4ED2943289989D5B2601DBE72CB46F77F52270E71AC963CEFC654FF32189427423A
- MD5 SHA1 SHA512 SSDEEP TLSH
njRAT-0.7d-Platinum-Edition-RuS/Terror/01.gif
- SHA256 cbc8a31345ac302681cac85e5347de1ffcbaa12bdc50c679ecf99cda7fc5157e
- MD5 705a10144ffd51597b863af7b6dc6761
- SHA1 68e3ff4a0c5c498e958431cc4379f33042900194
- SHA512 00685116a9471c2f95534932eedf29e70c0486cdb16235770ff3ab8655396ead19378c29f57f298ac2d17e202ed8e75b4ecab282a1be4cb40dd27774568107a3
- SSDEEP 6144:T291eyhNrmabJq3z2MHrM3r5O03HWMofchjgHy5r6vUlxWXPYt5AmvwCPr5Pn9GT:ToJUaGHrMbS1khjgHHOiQHAmvt9n9yuW
- TLSH T1F394230AD248D4B05BD858FC3434E0EB8FE8F3A895BFBA7310461AA1E551053FE96D55
- MD5 SHA1 SHA512 SSDEEP TLSH
njRAT-0.7d-Platinum-Edition-RuS/Terror/02.gif
- SHA256 94333c1e9a0961648a33db91f9e453e65b25e40106db6b639637fbedcc05e2a6
- MD5 830902dd51dad22083b885a7b51ac3cc
- SHA1 a5cfc3391721b40f4c6219f7644628116ef0ae71
- SHA512 9d409da6f1eba7041726df402ae2fb183e320a5bb81fd3837f6f4b67a88b628d4f571f7e1e2df33d0357bea396683036e9af6c2acac1d9e9931f6faf607cdd8b
- SSDEEP 12288:RNvP2rOQiVfaMkS5yKnO8zhk/rJyALyMCnHuqb2kkWy/jdV/OsdQ1:RNXcLMy8ziJyrMAO+nJyP/Osm1
- TLSH T1E2E423C3C7E13378EA1EE1B8494D8754C20BC8B45B701BB9398879AFBFA11392301DA5
- MD5 SHA1 SHA512 SSDEEP TLSH
njRAT-0.7d-Platinum-Edition-RuS/Terror/03.gif
- SHA256 b4bc127b5d66ab018235635fc12fe65d6ce97f9f8350e965213d9dca9264da45
- MD5 5a7b5ec0c06f5cbe1e04dbf070c510fb
- SHA1 8376a1e841035cec698bc1711672e7dba79aaf87
- SHA512 336f830d2ebe82ed782f1a9881a87f2726ef33e26a1659875ca346c8c8b325ec65cbb55ad8fcaaeb5da58865bb79a2d03192cb0fe75fe9be77da41b2537df2df
- SSDEEP 6144:8p3sCQ1AWnK1NOZ2l8iQojWaCZ0pak0l1aNmN4/nzx:4i1Az18YDQ1aq0ok0d+nzx
- TLSH T157341299DE97C513D28C9A767AD3840A4C5E04F02797BD5C7AC88D9CAD4CC232A8F4DE
- MD5 SHA1 SHA512 SSDEEP TLSH
njRAT-0.7d-Platinum-Edition-RuS/Terror/04.gif
- SHA256 8d070d9c04be926f34064e585edc84c8837bc4476eacde6b046e855d213f48fc
- MD5 c29a3be5142c2304ec7b8a6d8a4fe0f1
- SHA1 2df712ce87e022d9c69e3bc9f4e17822840715f0
- SHA512 62166c06c7e340d779670a75654fe4538133d1f0022a9ae4869192375ca6133802c006fabe0f67d1c7f155a13d6e28f70a3f9c199927ad628227e744d454728b
- SSDEEP 6144:PXt50HhZafhJ2zcDk1DeNxwO4xh0bRaFIVYGE9Gt2DcBV:PXeofhLA1DAwOJjVYB4ucBV
- TLSH T1CD5423F11B1D2849C45C6F61B8070AC26E2294E7832A6F590F23E654F4F77B486AE72C
- MD5 SHA1 SHA512 SSDEEP TLSH
njRAT-0.7d-Platinum-Edition-RuS/Terror/05.gif
- SHA256 57f082caa1766e60c46f69300475be4e6dee3e0330ff329e3ceec3d5bce69dda
- MD5 44290f48408be4840de97bed814fe8df
- SHA1 8bfe3baad8cd4fbb6b3a1374a3b1f6123f42706c
- SHA512 3139d77e9e626a45cd7faea5d5fcdfb7d7758b4a940e31e593bc9bceb999426418cfc690c2568776e659abfaf2733e96813470b21838e0a6c0740c07073aeb2e
- SSDEEP 6144:gHzZv+LGCkXOqNzD9EXJoMGNXMOJIABS8U+A7IZAabW0Hu38g5Tqk:4zZvykpDwJoMO861jAaPHuMgp
- TLSH T18D6423C343209ED2ED9225F9B306AD3674271CE3B12E83D286E4285644ADB71DEFDB45
- MD5 SHA1 SHA512 SSDEEP TLSH
njRAT-0.7d-Platinum-Edition-RuS/Terror/Scream.wav
- SHA256 ee9567223d773a67e8797005ba60fa2c1e672a6cff9b210f76240dcd9a16dd49
- MD5 d4a1c2e18d1dcc4c2e71e6297bf5cccb
- SHA1 89143c582be0767a07323813581599de3267b68e
- SHA512 6af431456112867cb840d2e55237b1d7c05161231ec4ae4c8682ad810731ce3a9544966794b3543dbbf499fdbd2c65242febd27ca9938b40047083beb30bcb0a
- SSDEEP 768:DeUJ+CNzdLn5+ZVvjyQu7J/41yQWLZg/dvvD83IzqovOxd9B/0PYoh7N9oFW23rp:DeUJ+CdYHyA1wLZg/dHDgsqovOxd/cPy
- TLSH T18813395FF192F4468D0BCEF9FEFFC428B113D8819D898E88750873596074461AAAF64B
- MD5 SHA1 SHA512 SSDEEP TLSH
Ultimate-RAT-Collection-NjRat/njRAT v0.7d Platinum Edition - Rus/njRAT v0.7d Platinum Edition - Rus/Client.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 d17acf5e6fc1e698fdd68352433551c211c7bbb8429624654ea1ec64045cc91e
- MD5 2a95e9df07cb556acc3126cab7ce0b9f
- SHA1 a8a0b26d37d8210012ee2a523149ea406f484d24
- SHA512 a5c31bad9943397903a14004ff973cb1915de260827a6045045fa65fc7d5230c1c8fb8afa17fc4cc250a4ad116b5763e1f5f650c06ac81f6f4d99a90827fa752
- SSDEEP 1536:1x1KqboN36twQviFw1x3OEBnvbgfLteF3nLrB9z3n/aF9b/S9vM:1DKqboN36twQviFC97BnMfWl9zPaF9bj
- TLSH T100634B4877958A55D2BD2E7814F296518730F60B7D03F72E48D120EBABB3EC44A42BE7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
72702
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
63KB
Virtual Size
63KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
576B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Ultimate-RAT-Collection-NjRat/njRAT v0.7d Platinum Edition - Rus/njRAT v0.7d Platinum Edition - Rus/GeoIP.dat
- SHA256 b4bfd1ebc50f0eaab3d3f4c2152feae7aa8efad380b85064153a6bfd006c6210
- MD5 a0a228c187329ad148f33c81ddb430bb
- SHA1 d70ec83d1b15b3156df73802dd1bec024b1b9346
- SHA512 0fe0a62c07f7ade0e6bfac8843c13c055369177935d801488a993bc4bcdb9da220ba1b37df2027dab8af7c15e5cf00b3e8f223b12165d8a1b0b9c30dc9939332
- SSDEEP 24576:WUH7rp/TXKHJBjsN0wjAu6e3akVX7k+k7bKnz+AHxOxaz+hnV647KyMLh:WUH3p/TKpBjs0b+akV4+C0axaz+ZVL7o
- TLSH T129358C22FF0696DBA9413D9EBD189EDC18148DB9FD071339625E379C60B8374CCC26A6
- MD5 SHA1 SHA512 SSDEEP TLSH
Ultimate-RAT-Collection-NjRat/njRAT v0.7d Platinum Edition - Rus/njRAT v0.7d Platinum Edition - Rus/Mono.Cecil.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 cdadc26c09f869e21053ee1a0acf3b2d11df8edd599fe9c377bd4d3ce1c9cda9
- MD5 851ec9d84343fbd089520d420348a902
- SHA1 f8e2a80130058e4db3cf569cf4297d07d05c93e0
- SHA512 5e1d1b953fda4a905749eff8c4133a164748ba08c4854348539d335cf53c873eae7c653807a2701bf307693a049ae6c523bd1497a8e659bdea0a71085a58a5f1
- SSDEEP 6144:ueMQM/aMOZabe3h1PtRjAqmYVNf3yTXcYBbt6KMBhu:uF/aMDb8BtRjA7XcYNclB
- TLSH T1D46429185AEC5B3ADD6F97BFD0E6581183B0F0126643E30E4BE4B2B22CB3761C95255B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
318190
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
C:\Users\njq8\Desktop\jbevain-cecil-0.9.5-73-ga5ffcc0\jbevain-cecil-a5ffcc0\obj\net_2_0_Debug\Mono.Cecil.pdb
mscoree
_CorDllMain
Name
.text
Size
303KB
Virtual Size
302KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
824B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Ultimate-RAT-Collection-NjRat/njRAT v0.7d Platinum Edition - Rus/njRAT v0.7d Platinum Edition - Rus/New Client.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 cc5d069c226e0924b3084e70689aa683a7fb6d4607d4d712996ebe224e916317
- MD5 96112a6e9506a2390450e9dee01ce5f8
- SHA1 3d9fb8ad5d6b3d2364c0278bb02591ee3eb6e05c
- SHA512 d5f16504abcc953018ee47161267370788a66afd4f55dc03af9a19def4fc10c7b140ea6d9ac0a19f342c502391340d413391d6c0c22d53ed22ce8b7a38df330e
- SSDEEP 1536:DG10zQoN36tKQviFw14fnqBnvAcfLteF3nLrB9z3neaF9b3S9vM:DG10zQoN36tKQviFC0qBnrfWl9zOaF9/
- TLSH T1E8634B4877958A45D2BD2E7844F296518770E50B6D03FB2E48D120FBABB3FC44A42BE7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
72702
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
63KB
Virtual Size
63KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
576B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Ultimate-RAT-Collection-NjRat/njRAT v0.7d Platinum Edition - Rus/njRAT v0.7d Platinum Edition - Rus/NjRat Platinum Edition.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 989114eac06b024e0fd631d7d7b6e5435f86ea349cdb59c9b7c4407d1527ae38
- MD5 9ea34bd96a5e4c536787107a532e1bf2
- SHA1 66941b6165076379114b4216ff4f60d9623c407a
- SHA512 e80b6ccd07e4187331085a23fea83acc6fbee611e0af2b4f1c724f2ae5b50688692c8aa917852dca400c705d25b83b95c4201e70c12cf68b35a276ee3a23cabf
- SSDEEP 98304:gPRpwrSEEwml7hCwOtV/QHyXjvlbqyo86RMDoMu2jx1sA6iOGIm1eOVqn:gPTwWeml7hcD5XjkNwfsA6iOdm1eOEn
- TLSH T15586CF037340EE19C5BA66F460528F909175BE0EA138C1FA25B43B68FAF52D2FD913D6
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
8288370
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
7.9MB
Virtual Size
7.9MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
35KB
Virtual Size
35KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Ultimate-RAT-Collection-NjRat/njRAT v0.7d Platinum Edition - Rus/njRAT v0.7d Platinum Edition - Rus/NjRat Platinum Edition.exe.config
- SHA256 c45c9d1d30f940289498be2af978d74178a5c24ceb7755c2648f6c7a89353813
- MD5 da15a1d8d770b57356ddd384342b3034
- SHA1 b03d6cb907c139492c7b914147a498b31ef839fd
- SHA512 3cf7dd0d14244c543e3442873ce7e495ade87ad906a42d53f3b38180ffc453bd74ae022b91306445d359475dbee4caa1514c4e913e823d174b8470b45fed7cfc
- TLSH T1FE21CE45A5D08CB5466396636A544EC0FF364B9F724C154CF8DEBA9B8F3342C4707192
- MD5 SHA1 SHA512 TLSH
Ultimate-RAT-Collection-NjRat/njRAT v0.7d Platinum Edition - Rus/njRAT v0.7d Platinum Edition - Rus/NjRat Platinum Edition.xml
- SHA256 25fdf1bf3806ef92e022c6085f63d44ee314764cb053b9456ad0c8d86abd1301
- MD5 0f2ee4833bfbf61f404bb982c40ba249
- SHA1 b3559917b919bf8dc2067ebc5f72a5b9b45e6ccd
- SHA512 971f5f58e09d49ab4a544146dcda7b2594efaa3531ac9b005edd5c362585912a6c5ab78eec99eecf39b0f4056c155d5918a66eafc7cb11e1c8f758def0b255ee
- SSDEEP 48:3CsG8vgH0cJPcJ6cJFcJ4cJTcJocJzjcJlcJanUycJQc7afgkccJYocJUvBUMmu4:3i0q/o1KlsU1tC+G6Weyn9dIyKqV
- TLSH T11CA166468767EF390D3411BB7EB0B5C024635E22956C280EE8AA1C7347D22DA36FBE54
- MD5 SHA1 SHA512 SSDEEP TLSH
Ultimate-RAT-Collection-NjRat/njRAT v0.7d Platinum Edition - Rus/njRAT v0.7d Platinum Edition - Rus/Plugin/cam.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 8aeec9c0a673f2043bec795d8430c280392913ac275fbaa3380524ad2148eaf8
- MD5 b0f1130c6da19dbdb8556f910f168420
- SHA1 e09ffdb725dc2ca0bc28a58a4615c0f3bcf08adb
- SHA512 4d97ac1ec120120c22d2fa39c3bcdafbaf6796da4742154323860ede74a56fffadfd3734b2fcd37e60ea0334e951e3c2d7b05c52235db89bde3fa2a1424224fa
- SSDEEP 1536:SwmVRUhn1vP9QJwnXusCEtsIbepigBULPqa:SwmYZ1WJQIEeIbepigBy1
- TLSH T15853392A2B98641BC58E577C90B30F0003F0D65A7623EB8A6F7961BDDD723944B173A7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
70926
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
61KB
Virtual Size
61KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
512B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Ultimate-RAT-Collection-NjRat/njRAT v0.7d Platinum Edition - Rus/njRAT v0.7d Platinum Edition - Rus/Plugin/ch.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 47f7c69c4cc4c0feb6a6f1730d697ca95e24d5cedd490c31d8e30cd1fa3b3859
- MD5 9000a99ee61e1c87fb811a77df2e7b91
- SHA1 61a026acdbeea3c8e68a55bce7c4803aa678adbb
- SHA512 d45a1e2530143dab919b892b7e21657a2e6e62533046d75aa787da9ad012b73245aa033de5c169aed08a66fb117be1df1f87253cb4e49cf9b47b89e58d799c15
- SSDEEP 1536:buvVvVdtKqzOR6ergb9hZwh4nXVtn+99p4oG0CEI81:YVvjt1bbA4nX+vp4oo0
- TLSH T15E839D0ABB8AE3E3DA6E0A785021561103B6DD204E33EF677D9D349AD5737540F79360
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
92446
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
82KB
Virtual Size
82KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Ultimate-RAT-Collection-NjRat/njRAT v0.7d Platinum Edition - Rus/njRAT v0.7d Platinum Edition - Rus/Plugin/mic.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 7bae6ec2613874287c20ddcbdf75e7cca0ac65132485dfcfd632d0e5f97c1719
- MD5 e9214452435d0e6f782b545ec0123331
- SHA1 1705609d15c0c7cab4ebcb28f082cfcb8e1f80ac
- SHA512 05cbe650b1ed26193128cba8d58fbe4c96ccb5931d877a6937e4a442f74412fd3cdda46b5cff4390a71133cba4c10c778377988c657eebfe5e631ae4f445ebce
- SSDEEP 768:F6YK5hvcdWNbu/GemZgXEFajkt22rB7BJodsx7fuhwWFTxqPbqgmB:F6/xemZgY9V7Jx7fvWFTxqPb7m
- TLSH T16333D6507EA41CBAC16B067DACE61112F6B18D68B227E76B1CFD60F758833DE86406F1
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
56430
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
47KB
Virtual Size
47KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
512B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Ultimate-RAT-Collection-NjRat/njRAT v0.7d Platinum Edition - Rus/njRAT v0.7d Platinum Edition - Rus/Plugin/plg.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 bd5a390efa75b9a47077fa1e7558713842563ec5822eb7f1dbf35ad9020012dc
- MD5 4643db3dbf75200efa97e80cfcf2da1d
- SHA1 cd65423fbeb54a82f1312ad96c848a261047ccba
- SHA512 ccacfcf1e9325ee3dba0556cc527eae2b856531a7d963072181549e3e76395d42be27206f0312a5fa30d8d35df75a64382a399fb61c26cef703671fe21fb25e9
- SSDEEP 384:uLPMDSXbwv1qppRt9LmCfvEk/LcEf6snTlC3/b3DP0lpm+x6dzWxQpbiqWz5matX:48tyRt9LmCfD2j3rc+KUbkoa+h
- TLSH T1BED2B40D2BA5C42AC37E47355D6643224AF3421B4915EE2E0CDF8EED1BA37C84B85A5B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
35342
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
27KB
Virtual Size
26KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
512B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Ultimate-RAT-Collection-NjRat/njRAT v0.7d Platinum Edition - Rus/njRAT v0.7d Platinum Edition - Rus/Plugin/pw.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 a3e4bee1b6944aa9266bd58de3f534a4c1896df621881a5252a0d355a6e67c70
- MD5 db87daf76c15f3808cec149f639aa64f
- SHA1 d67f84a44ddc25432ce179aeba9cff778af746ee
- SHA512 ad7dc75254180ff7c988b7f394ad76b696384002457d558469d2c6401dd97cba54c532245bb555ab28d2beda3ab504736bb2b89040a21ba6598929392daab473
- SSDEEP 768:fqcFOkBO3jzamnEjt0Wp8em0nktiwRnKSg42+:fvg3jumny0Wp8em08NBgG
- TLSH T10F037D067BC69301EABD8FB51CB281444372D28F5D13E79E1CE988F42B76B900955BEB
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
46542
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
37KB
Virtual Size
37KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Ultimate-RAT-Collection-NjRat/njRAT v0.7d Platinum Edition - Rus/njRAT v0.7d Platinum Edition - Rus/Plugin/sc2.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 8e816523110bb2ab5e7611c0322cc4aa2d6c8d2a899b3a03731965ed1644549b
- MD5 801a5d1e272399ca14ff7d6da60315ef
- SHA1 e546ef8f00d96404823a1ed242ed7b56167da2f7
- SHA512 32eeb2302cfe06e996f2d729d440fc2796d16e33fd9d793c5eaf379e8450d67e177d5c254721c6fd5636c92e55439054b982e0820a757ebd5e65584d3f0c739a
- SSDEEP 192:0SDIUapMH4ftIjPPjb3DX8oB2/mZLkM0Lj08Lt21TGzRpy7yNVILDB61d+ZMt2jt:0SDi+4lILL6/IQM0n0881TE3y2QXM1dY
- TLSH T18A42F70DBF18C217E65C0BBD116357259376C05B1303FF2B9EC9A4F7A8AA3C26658399
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
18814
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
10KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
512B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Ultimate-RAT-Collection-NjRat/njRAT v0.7d Platinum Edition - Rus/njRAT v0.7d Platinum Edition - Rus/Sound/Sound.wav
- SHA256 9430fec62eb1bfecb35f4a9ceb2ddd5ce6294751cde85fd7169c8def811af49e
- MD5 11ca5b5feba113ccf66d6649b5b3cb40
- SHA1 503f3a2a449b195d6e71237fba623c3a7b5a08fa
- SHA512 2183286132157f0122b1c8cbfbf0ccf49cf59ca033453d983fb4e25850203e1c03beff98bf99580b20c8049180d4afce339680ba70e1bd7c5a95f859afa70da3
- SSDEEP 12288:3435BUAwzT1eE7M9oxyAdP9qc1lHQJg6j4DUZTkznCBtt+doeUnk:3i/UAWkEkoxbl6grUBH3EoeUk
- TLSH T1F7E423E6E031FE10F8FC067769C10D44AB21BA495D172FAD7438D6A929B334339197AE
- MD5 SHA1 SHA512 SSDEEP TLSH
Ultimate-RAT-Collection-NjRat/njRAT v0.7d Platinum Edition - Rus/njRAT v0.7d Platinum Edition - Rus/Stub/Stub.manifest
- SHA256 835a00d6e7c43db49ae7b3fa12559f23c2920b7530f4d3f960fd285b42b1efb5
- MD5 4d18ac38a92d15a64e2b80447b025b7e
- SHA1 5c34374c2dd5afa92e0489f1d6f86dde616aca6c
- SHA512 72be79acd72366b495e0f625a50c9bdf01047bcf5f9ee1e3bdba10dab7bd721b0126f429a91d8c80c2434e8bc751defdf4c05bdc09d26a871df1bb2e22e923bf
- TLSH T16EF0DCC1D188CA6AD73042A13A66E410A2AD435B19DD49EC74DC2ABB6F0BAC680C30F1
- MD5 SHA1 SHA512 TLSH
Ultimate-RAT-Collection-NjRat/njRAT v0.7d Platinum Edition - Rus/njRAT v0.7d Platinum Edition - Rus/Stub/stub.il
- SHA256 4eaa0830f3a6b72e6380875b82c28fc48d22d3c14ab2adab87e2deafdbf19ea8
- MD5 8a1ea88a0ce54fbe8a85aedc751e0edc
- SHA1 2e3622edeaa569f4b38f740f593f4bd9f913c97a
- SHA512 e01a5511b9e21610d3e2e325fbf15068432dda6dbc976ca7395ad9c3e2d8a91883be813db75339d51e0bd5ea7c23a9c37c9b7e7384399489b21d15d953397f64
- SSDEEP 12288:kPY73AmnxaCpY4uqmXSxyosK+M8K2J2SzsWBpyP2KGLLGGjVVc0t3L5v7eWcwgZv:8pgT
- TLSH T129E4ED2943289989D5B2601DBE72CB46F77F52270E71AC963CEFC654FF32189427423A
- MD5 SHA1 SHA512 SSDEEP TLSH
Ultimate-RAT-Collection-NjRat/njRAT v0.7d Platinum Edition - Rus/njRAT v0.7d Platinum Edition - Rus/Terror/01.gif
- SHA256 cbc8a31345ac302681cac85e5347de1ffcbaa12bdc50c679ecf99cda7fc5157e
- MD5 705a10144ffd51597b863af7b6dc6761
- SHA1 68e3ff4a0c5c498e958431cc4379f33042900194
- SHA512 00685116a9471c2f95534932eedf29e70c0486cdb16235770ff3ab8655396ead19378c29f57f298ac2d17e202ed8e75b4ecab282a1be4cb40dd27774568107a3
- SSDEEP 6144:T291eyhNrmabJq3z2MHrM3r5O03HWMofchjgHy5r6vUlxWXPYt5AmvwCPr5Pn9GT:ToJUaGHrMbS1khjgHHOiQHAmvt9n9yuW
- TLSH T1F394230AD248D4B05BD858FC3434E0EB8FE8F3A895BFBA7310461AA1E551053FE96D55
- MD5 SHA1 SHA512 SSDEEP TLSH
Ultimate-RAT-Collection-NjRat/njRAT v0.7d Platinum Edition - Rus/njRAT v0.7d Platinum Edition - Rus/Terror/02.gif
- SHA256 94333c1e9a0961648a33db91f9e453e65b25e40106db6b639637fbedcc05e2a6
- MD5 830902dd51dad22083b885a7b51ac3cc
- SHA1 a5cfc3391721b40f4c6219f7644628116ef0ae71
- SHA512 9d409da6f1eba7041726df402ae2fb183e320a5bb81fd3837f6f4b67a88b628d4f571f7e1e2df33d0357bea396683036e9af6c2acac1d9e9931f6faf607cdd8b
- SSDEEP 12288:RNvP2rOQiVfaMkS5yKnO8zhk/rJyALyMCnHuqb2kkWy/jdV/OsdQ1:RNXcLMy8ziJyrMAO+nJyP/Osm1
- TLSH T1E2E423C3C7E13378EA1EE1B8494D8754C20BC8B45B701BB9398879AFBFA11392301DA5
- MD5 SHA1 SHA512 SSDEEP TLSH
Ultimate-RAT-Collection-NjRat/njRAT v0.7d Platinum Edition - Rus/njRAT v0.7d Platinum Edition - Rus/Terror/03.gif
- SHA256 b4bc127b5d66ab018235635fc12fe65d6ce97f9f8350e965213d9dca9264da45
- MD5 5a7b5ec0c06f5cbe1e04dbf070c510fb
- SHA1 8376a1e841035cec698bc1711672e7dba79aaf87
- SHA512 336f830d2ebe82ed782f1a9881a87f2726ef33e26a1659875ca346c8c8b325ec65cbb55ad8fcaaeb5da58865bb79a2d03192cb0fe75fe9be77da41b2537df2df
- SSDEEP 6144:8p3sCQ1AWnK1NOZ2l8iQojWaCZ0pak0l1aNmN4/nzx:4i1Az18YDQ1aq0ok0d+nzx
- TLSH T157341299DE97C513D28C9A767AD3840A4C5E04F02797BD5C7AC88D9CAD4CC232A8F4DE
- MD5 SHA1 SHA512 SSDEEP TLSH
Ultimate-RAT-Collection-NjRat/njRAT v0.7d Platinum Edition - Rus/njRAT v0.7d Platinum Edition - Rus/Terror/04.gif
- SHA256 8d070d9c04be926f34064e585edc84c8837bc4476eacde6b046e855d213f48fc
- MD5 c29a3be5142c2304ec7b8a6d8a4fe0f1
- SHA1 2df712ce87e022d9c69e3bc9f4e17822840715f0
- SHA512 62166c06c7e340d779670a75654fe4538133d1f0022a9ae4869192375ca6133802c006fabe0f67d1c7f155a13d6e28f70a3f9c199927ad628227e744d454728b
- SSDEEP 6144:PXt50HhZafhJ2zcDk1DeNxwO4xh0bRaFIVYGE9Gt2DcBV:PXeofhLA1DAwOJjVYB4ucBV
- TLSH T1CD5423F11B1D2849C45C6F61B8070AC26E2294E7832A6F590F23E654F4F77B486AE72C
- MD5 SHA1 SHA512 SSDEEP TLSH
Ultimate-RAT-Collection-NjRat/njRAT v0.7d Platinum Edition - Rus/njRAT v0.7d Platinum Edition - Rus/Terror/05.gif
- SHA256 57f082caa1766e60c46f69300475be4e6dee3e0330ff329e3ceec3d5bce69dda
- MD5 44290f48408be4840de97bed814fe8df
- SHA1 8bfe3baad8cd4fbb6b3a1374a3b1f6123f42706c
- SHA512 3139d77e9e626a45cd7faea5d5fcdfb7d7758b4a940e31e593bc9bceb999426418cfc690c2568776e659abfaf2733e96813470b21838e0a6c0740c07073aeb2e
- SSDEEP 6144:gHzZv+LGCkXOqNzD9EXJoMGNXMOJIABS8U+A7IZAabW0Hu38g5Tqk:4zZvykpDwJoMO861jAaPHuMgp
- TLSH T18D6423C343209ED2ED9225F9B306AD3674271CE3B12E83D286E4285644ADB71DEFDB45
- MD5 SHA1 SHA512 SSDEEP TLSH
Ultimate-RAT-Collection-NjRat/njRAT v0.7d Platinum Edition - Rus/njRAT v0.7d Platinum Edition - Rus/Terror/Scream.wav
- SHA256 ee9567223d773a67e8797005ba60fa2c1e672a6cff9b210f76240dcd9a16dd49
- MD5 d4a1c2e18d1dcc4c2e71e6297bf5cccb
- SHA1 89143c582be0767a07323813581599de3267b68e
- SHA512 6af431456112867cb840d2e55237b1d7c05161231ec4ae4c8682ad810731ce3a9544966794b3543dbbf499fdbd2c65242febd27ca9938b40047083beb30bcb0a
- SSDEEP 768:DeUJ+CNzdLn5+ZVvjyQu7J/41yQWLZg/dvvD83IzqovOxd9B/0PYoh7N9oFW23rp:DeUJ+CdYHyA1wLZg/dHDgsqovOxd/cPy
- TLSH T18813395FF192F4468D0BCEF9FEFFC428B113D8819D898E88750873596074461AAAF64B
- MD5 SHA1 SHA512 SSDEEP TLSH
Ultimate-RAT-Collection-NjRat/njRAT v0.7d Platinum Edition - Rus/njRAT v0.7d Platinum Edition - Rus/WinMM.Net.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 59e2ac1b79840274bdfcef412a10058654e42f4285d732d1487e65e60ffbfb46
- MD5 d4b80052c7b4093e10ce1f40ce74f707
- SHA1 2494a38f1c0d3a0aa9b31cf0650337cacc655697
- SHA512 3813b81f741ae3adb07ae370e817597ed2803680841ccc7549babb727910c7bff4f8450670d0ca19a0d09e06f133a1aaefecf5b5620e1b0bdb6bcd409982c450
- SSDEEP 768:LyasDzF2TDSemqD9tGI+ffwj2Au0LVpqmf7KxcOOrYCPTxqPb85:LyaXKemqD9tGI+ffwj2Au0LVpq4KWrlv
- TLSH T1EB13B60479A85CB9CB2F013D6CD61211FAB18D647227B62B1CBE70F318977DE9A41AF1
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
50302
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
41KB
Virtual Size
41KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Ultimate-RAT-Collection-NjRat/njRAT v0.7d Platinum Edition - Rus/njRAT v0.7d Platinum Edition - Rus/nj_users/WINDOSW_egorv_14FD549D/Keylog.rtf
- SHA256 40f7b2bd251f90ef5d5fbd297409099dcb1fe7a60c92369bfdb7957b750794d1
- MD5 2c76da06f369e8af3df8a78d85c7a292
- SHA1 6248858bbb89d766f754d08239f619cf86f6ee52
- SHA512 ff8a44c0290b427625133f4579f4a333e7b39724807cefc4549098604421863cf89e7a648ae11a3a2b530976bfcb23f2cfad2bef102bab5eff0e9bf266e1da5b
- TLSH T1A031E4945C21F14D0B490D2E5367D2B2168CAB6D5DF877543CEBBD072D2682F43424ED
- MD5 SHA1 SHA512 TLSH
Ultimate-RAT-Collection-XWorm/XWorm V5.6/README.md
- SHA256 4e30618f378fcd37c4d0a87b6f924d0795f6be1568d86519e9a9f3c6c374970f
- MD5 c9d5b8f400b1ab3e44702e037cbaa1a2
- SHA1 bbc07b53bb64163f4b6a7f9313a47118176c95a6
- SHA512 936b20c85437d2e73e2ffda1c5fc8b699040ed0c5fd160aafc700cfae347040e967abc14dffe774b33de1585e6c22e55b7bb95f6c2c98df0b856757e9f6b4bf9
- TLSH T111C02BF791C21B7C0D1329E3FC8650AC22700824CC3150239050D92CC8952130330308
- MD5 SHA1 SHA512 TLSH
Ultimate-RAT-Collection-XWorm/XWorm V5.6/Screenshot.png
- SHA256 75fa3d41cf12a2dced97e038702dffb437b707e46d1147515fed8e21daf06292
- MD5 edcb8408ba6d8ec439b8cbbf68210ee8
- SHA1 6be74eddf46e9d8254c87e812bda518622940dd7
- SHA512 d08d4bac2aa33c534b42fd1b053f801ee6a4180b604344702245168146292ec32a30f4d6a7b6aeb04b8abd6c90cfa9bbb114e550819c0d463cb1107c759b93b3
- SSDEEP 384:EyDSB3OF4WrUnwdHEenEZOrkh0kqrifia9H43+TOp59XA2NUz5ZZpRc:EB3eryskKEgwh0k5W3ZA1NZZPc
- TLSH T158C24B57CC88755F391202899F9339E6E57019A738986FDF9FE146310C13AC0F636E66
- MD5 SHA1 SHA512 SSDEEP TLSH
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6.7z
- SHA256 7c431981e1962c71f936fc53951982071462f853f53c92dc3d4103ee5e3efe70
- MD5 ea35b74bbe3cf8de1ddbd5ab10ada9b1
- SHA1 6f20dd8865e84581ddfa7d4666bffeb812f2deed
- SHA512 d9296919eec861a1e8ea72b5d590e8d6092a188208bda0f17ebb52744fbb702391022d25a51bbea041eb4db9f9d8c48ac3a0a2b14c4a5ed792c2914a7b657504
- SSDEEP 393216:ACEYC65G+SwHO1JoCzXq5i+dDmpu06beWxEkNgwTZDZerBjkDGp5:6YC65G1wHezB+Ypt6beWES6rBjkDGp5
- TLSH T1261733956B97464A8FBB40381DFAD298255E539B02FDED28C2EF2C6B0399C13D776013
- MD5 SHA1 SHA512 SSDEEP TLSH
Password
infected
XWorm V5.6/Background.png
- SHA256 2f691caff7e1980cfb069d2608b6470b3a06cdb90467ce47820e8602115a0c5b
- MD5 c93ee3abeff4ac24936471f80b36ec7a
- SHA1 0120649571a4b692ff5d10aae8dd87dffd3a0f81
- SHA512 dd319d1eea708284588ff67268cb23bd7b5cde505f3a8a1e7a27a587920ee5877efa4c1d8264cae48de343cabbf11bbe457b49f348b46288765eeff45d20cab5
- SSDEEP 24576:raWlRrTw9AK8jrGL+sUGBcD1MoEX1r/HXKIIfnbY:r/3w/8jzG+OomB/HXKa
- TLSH T1041523D6478670A5AECAC71881C71F777696DFA0AE64436DA6031BCCC3C0D525CE2BB8
- MD5 SHA1 SHA512 SSDEEP TLSH
XWorm V5.6/FastColoredTextBox.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 3701b19ccdac79b880b197756a972027e2ac609ebed36753bd989367ea4ef519
- MD5 b746707265772b362c0ba18d8d630061
- SHA1 4b185e5f68c00bef441adb737d0955646d4e569a
- SHA512 fd67f6c55940509e8060da53693cb5fbac574eb1e79d5bd8f9bbd43edbd05f68d5f73994798a0eed676d3e583e1c6cde608b54c03604b3818520fa18ad19aec8
- SSDEEP 6144:4FErOIif3RzSHh+20lXs1TzCeBcQeDbNlz7:eEeR52bmeh0n
- TLSH T1D274292422F84665E27F47BCD4B5A000D3FAB53699DFDB4E8B64A0DA2F63340D526633
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
346910
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
C:\Projects_CSharp\FastColoredTextBox\FastColoredTextBox\obj\Debug\FastColoredTextBox.pdb
mscoree
_CorDllMain
Name
.text
Size
331KB
Virtual Size
330KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm V5.6/Fixer.bat
- SHA256 a11703fd47d16020fa099a95bb4e46247d32cf8821dc1826e77a971cdd3c4c55
- MD5 2dabc46ce85aaff29f22cd74ec074f86
- SHA1 208ae3e48d67b94cc8be7bbfd9341d373fa8a730
- SHA512 6a50b525bc5d8eb008b1b0d704f9942f72f1413e65751e3de83d2e16ef3cf02ef171b9da3fff0d2d92a81daac7f61b379fcf7a393f46e914435f6261965a53b3
- TLSH T10DB02B177482E290838004430271224D39FDA002C291F2C375224530CD84CF0C333795
- MD5 SHA1 SHA512 TLSH
XWorm V5.6/GMap.NET.Core.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 58c755fcfc65cddea561023d736e8991f0ad69da5e1378dea59e98c5db901b86
- MD5 819352ea9e832d24fc4cebb2757a462b
- SHA1 aba7e1b29bdcd0c5a307087b55c2ec0c7ca81f11
- SHA512 6a5b0e1553616ea29ec72c12072ae05bdd709468a173e8adbdfe391b072c001ecacb3dd879845f8d599c6152eca2530cdaa2c069b1f94294f778158eaaebe45a
- SSDEEP 49152:ot12Gb/hz7ZsK9qY5uyUW57VC4IB1+fXhQ1hyCzMw/22fSg7gjxhUE/nbTC0xemh:oLbteKb57W1+PhQ1HM1gmJ/SZmh
- TLSH T152D5234D77FC068BF5BFDBBD7870069A8331F106AA37E30E15A154A91D23B818851BA7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
3002430
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
2.9MB
Virtual Size
2.9MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1016B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm V5.6/GMap.NET.WindowsForms.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 741e1a8f05863856a25d101bd35bf97cba0b637f0c04ecb432c1d85a78ef1365
- MD5 32a8742009ffdfd68b46fe8fd4794386
- SHA1 de18190d77ae094b03d357abfa4a465058cd54e3
- SHA512 22418d5e887a6022abe8a7cbb0b6917a7478d468d211eecd03a95b8fb6452fc59db5178573e25d5d449968ead26bb0b2bfbfada7043c9a7a1796baca5235a82b
- SSDEEP 3072:k1GmgYqIY/0YSDBRGlDUqL63budipxj64m8HWYh3vHbFwMhLJSb+:lIO6rGloqL63qW62lJ
- TLSH T1DCE3BF6173A58D2FD6BF4BBFA46240C1A371E603F602C38D6D8820ED2897F5587523A7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
155790
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
144KB
Virtual Size
144KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm V5.6/GeoIP.dat
- SHA256 bc07ff22d4ee0b6fafcc12482ecf2981c172a672194c647cedf9b4d215ad9740
- MD5 8ef41798df108ce9bd41382c9721b1c9
- SHA1 1e6227635a12039f4d380531b032bf773f0e6de0
- SHA512 4c62af04d4a141b94eb3e1b0dbf3669cb53fe9b942072ed7bea6a848d87d8994cff5a5f639ab70f424eb79a4b7adabdde4da6d2f02f995bd8d55db23ce99f01b
- SSDEEP 24576:0L/59ah0USm3uwl00odi9AnW1fUmdbxv6bA3wOzRAc3InsZLONMrZb:+/59a6USdi9Ues6bV6boLO6rZ
- TLSH T10C457B47FF0A85DB5845B91EF9019EDC5810EE76BD0A1335226E37ACA0B8360ECD71A7
- MD5 SHA1 SHA512 SSDEEP TLSH
XWorm V5.6/Guna.UI2.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 c6264665a882e73eb2262a74fea2c29b1921a9af33180126325fb67a851310ef
- MD5 bcc0fe2b28edd2da651388f84599059b
- SHA1 44d7756708aafa08730ca9dbdc01091790940a4f
- SHA512 3bfc3d27c095dde988f779021d0479c8c1de80a404454813c6cae663e3fe63dc636bffa7de1094e18594c9d608fa7420a0651509544722f2a00288f0b7719cc8
- SSDEEP 24576:FIVZLRYIVQd9INo3FDbWX7SsOobBTEAjg+m+ZFNwaxwGoHQ/jzK+:+oWodbi9XFEAjg+m+ZFKaxw
- TLSH T1EE9508007ED0DB26D16B4E33D5E75010D3F2B4A26BB2E70F72D5A77C145378AA88A366
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
eb:22:ce:41:1a:e8:9c:9e:92:46:cc:c0:c9:06:fc:f3:4b:8d:c1:21
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Sobatdata Software
Chains
Feb 21, 2023
CN=Sobatdata Software
Subject
CN=Sobatdata Software
Serial Number
7a:98:1b:7d:3e:b4:86:bb:45:84:c4:3c:c9:a8:3f:db
Issuer
CN=Sobatdata Root CA
Timespan
Oct 23, 2019 - Oct 22, 2025
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 1, 2022 - Nov 9, 2031
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US
Serial Number
0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Sep 21, 2022 - Nov 21, 2033
Minor OS version
0
Major OS version
4
Entry point
2031518
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
1.9MB
Virtual Size
1.9MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm V5.6/IconExtractor.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 440912d85d2f98bb4f508ab82847067c18e1e15be0d8ecdcff0cc19327527fc2
- MD5 640d8ffa779c6dd5252a262e440c66c0
- SHA1 3252d8a70a18d5d4e0cc84791d587dd12a394c2a
- SHA512 e12084f87bd46010aded22be30e902c5269a6f6bc88286d3bef17c71d070b17beada0fe9e691a2b2f76202b5f9265329f6444575f89aff8551c486eafe4d5f32
- SSDEEP 192:7f77J4cGYyfQknxLvIgyLY5xJeU5pPpZlEAs:HS2yINgyLYLJR5wl
- TLSH T179223809E7EA4B37DEB7873654134656E334BA10994FEF5B05CA50642CA73A00B12FBA
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
16170
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\HMJ\Desktop\IconExtractor-master\IconExtractor\obj\Release\IconExtractor.pdb
mscoree
_CorDllMain
Name
.text
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
940B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm V5.6/Icons/icon (1).ico
- SHA256 115f0db669b624d0a7782a7cfaf6e7c17282d88de3a287855dbd6fe0f8551a8f
- MD5 4f409511e9f93f175cd18187379e94cb
- SHA1 598893866d60cd3a070279cc80fda49ee8c06c9b
- SHA512 0d1f50243a3959968174aa3fd8f1a163946e9f7e743cbb2c9ef2492073f20da97949bf7d02c229096b97482ff725c08406e2e9aa72c820489535758470cf604f
- SSDEEP 1536:RBrn6a7/Zu/M615kfNOfEK3EpQkGhD94TtcmeVQU71qiLSeznFkKeUqvllR/t6c1:RBz65/M6If+3Js+3JFkKeTn1
- TLSH T1DFA39283B511D2E1E5308A33E15BE9F10F227C5EEB5A281B7684FF173873151AE2791A
- MD5 SHA1 SHA512 SSDEEP TLSH
XWorm V5.6/Icons/icon (10).ico
- SHA256 7a97547954aaad629b0563cc78bca75e3339e8408b70da2ed67fa73b4935d878
- MD5 ad1740cb3317527aa1acae6e7440311e
- SHA1 7a0f8669ed1950db65632b01c489ed4d9aba434e
- SHA512 eee7807b78d4dd27b51cee07a6567e0d022180e007e1241266f4c53f1192c389be97332fcd9f0b8fda50627b40b8cf53027872304a68a210f4d754aa0243b0c2
- SSDEEP 768:VDRRKECMsn3H2GkmPe3KUDlGEJ57ukb8rJXAtnvWrpLDvZ8EZN:tjls3WGkoe6Uso9T8r9AtnertLFN
- TLSH T1B9C31747A1281C21DBB0EE39A2DCC8BB594F5E79F1A6464C7CB5FC6864F68F1053AC06
- MD5 SHA1 SHA512 SSDEEP TLSH
XWorm V5.6/Icons/icon (11).ico
- SHA256 3b64b79e4092251ebf090164cd2c4815390f34849bbd76fb51085b6a13301b6d
- MD5 1c2cea154deedc5a39daec2f1dadf991
- SHA1 6b130d79f314fa9e4015758dea5f331bbe1e8997
- SHA512 dceebc1e6fdfe67afebaef1aff11dd23eda6fae79eb6b222de16edebdfebd8e45de896e501608254fb041824080cb41c81ac972032638407efc6bfeb930bfd00
- SSDEEP 96:hc4i1w+DSf0RxO/Csg9nL2CupMqM4pSg36IfgT9A+QdwhFKQfkIvxIm3sW88H:qa+DSf0RxOQnLjoSg3hfG5/X8cOO88H
- TLSH T122123AC826B0CF07E6591B36C8B27FB5142D4DD0DAAA262B94CCFF4471A0FF87585994
- MD5 SHA1 SHA512 SSDEEP TLSH
XWorm V5.6/Icons/icon (12).ico
- SHA256 84b48ca52dfcd7c74171cf291d2ef1247c3c7591a56b538083834d82857fee50
- MD5 4ea9ab789f5ae96766e3f64c8a4e2480
- SHA1 423cb762ce81fab3b2b4c9066fe6ea197d691770
- SHA512 f917059b6f85e4a25909a27cad38b1ef0659161c32df54860226ff3d858127d8da592ea9072ad41d5a9986dd8c04a37e9ad34e2251883a8c2f0933e6aa201414
- SSDEEP 192:8mEKEEjOjzSId77Fe0ggzSXlYtAMXa77gieRHw9S1IId:HUNdsgzS1EAEaHB8IId
- TLSH T13312C764B449D511C83A4139CC2BC9AD03250EF5C5340C1BA89AFF6736DBAC5131B56E
- MD5 SHA1 SHA512 SSDEEP TLSH
XWorm V5.6/Icons/icon (13).ico
- SHA256 2e2f17b7dd15007192e7cbbd0019355f8be58068dc5042323123724b99ae4b44
- MD5 e6fec4185b607e01a938fa405e0a6c6c
- SHA1 565e72809586e46700b74931e490e2dc1e7e3db1
- SHA512 13daeb2bf124e573590359f18a1d962157dc635a88319c9ed1a2e8ccad6322fb081579e1e8fbe62ffe55c8286c2bc8acb251d572a4beb00641ad5009a380e513
- SSDEEP 384:AyIh9xb9bexqcmOg1/JuiiiiiilllllioiiiilllliiiiiuGxbu:9Ih9Z91hJy
- TLSH T1B674056F7E12B9BAC77856BF0810B18D59586C2696DCF103791FFB2CAC3DD076A09242
- MD5 SHA1 SHA512 SSDEEP TLSH
XWorm V5.6/Icons/icon (14).ico
- SHA256 8fc693238afc49a8098dac1762bfae891e818bb84749c6eef5f1b0c6c8ffddb2
- MD5 0c24edec606abda7c6570b7dcf439298
- SHA1 4478a102892e5eb4bb1da8e9c62d17724965691a
- SHA512 f8de3ffb8f9fe1394b3626ae5616213d4612b43f0635fa9053d74ac6fe536657e796289487f245b8abff74f1de8368c0df8e56bf21f540366ed86a378649ea24
- SSDEEP 384:FY9tDXICTUj6Q+CUsn2JiAAA/////////A+AA////////AAAiA////kujYYFsG3I:+PMXT0
- TLSH T13574D45560B2F99CE512CAF714F0D5005DF2AC68AE6CA65EB9317FBE4E7708230867B0
- MD5 SHA1 SHA512 SSDEEP TLSH
XWorm V5.6/Icons/icon (15).ico
- SHA256 b2f57a23ecc789c1bbf6037ac0825bf98babc7bf0c5d438af5e2767a27a79188
- MD5 e3143e8c70427a56dac73a808cba0c79
- SHA1 63556c7ad9e778d5bd9092f834b5cc751e419d16
- SHA512 74e0f4b55625df86a87b9315e4007be8e05bbecca4346a6ea06ef5b1528acb5a8bb636ef3e599a3820dbddcf69563a0a22e2c1062c965544fd75ec96fd9803fc
- SSDEEP 768:0nnnnnnnnnnnnnnnnnnnnnnnQInU2/gohN/yRUZZZZZZZZZZZaaa0KaaILjeuFgZ:Rkccckccccct
- TLSH T18E74051CB53AFC87E85A9E727E42E77588BE2C135F608841F604FFBE9639505A3D8811
- MD5 SHA1 SHA512 SSDEEP TLSH
XWorm V5.6/Icons/icon (16).ico
- SHA256 3f3c5ce486e5b9fa88dc60b60916053e8808c69167df1a11287fd3cd6db1ca6e
- MD5 14465d8d0f4688a4366c3bf163ba0a17
- SHA1 9f1fa68a285db742e4834f7d670cae415ce6b3b6
- SHA512 01db4fac75136baf9c162265785877b21fba9c4b8d9dbe4e495191f15aa9c914e3d5baf1c4606041279a7138c7e5c8f4ccf6e64689354fc3fb3fa66ab3b1da2d
- SSDEEP 768:5As1Fd6jrW6QKysmsolxc4nvPQIfjRuw+mqbz9j1MWLQes2aXS5Cjr:5AMwflmsolaTIrRuw+mqbz9j1MWLQs2
- TLSH T15DA3D2F1A740C465D8A796B9883BDAA7A423A24DDC6C490D3D92FF0B7D723474027C9B
- MD5 SHA1 SHA512 SSDEEP TLSH
XWorm V5.6/Icons/icon (17).ico
- SHA256 12f600b09c0db00877684a950fc14936ecc28df8f0ddc6821d68e4b82077ad92
- MD5 167425a3fa7114b1800aa903adc35b2a
- SHA1 601e8bd872ea31aff03721a0361e65a57b299cad
- SHA512 586ce1360eb06f1df8e95ad178abfae7c9d41cba1be55276b3d3947d0504ca09185e543b7dbf1ba72dde4942ff626859a6d2e8a1faaaf6c5daaebd8740dcf538
- SSDEEP 384:keGRHCUZYDikdQarfw8lGqMtxoYDQqrp0KR1QCOICdu2kkyPgE+zi/hScVsUIGVN:8fY/lVoTlR1vCU/he6H
- TLSH T10163C4D2F200C5A8FC398B75D53B4A7411137CBEDDB4A56F78887E2236B72A2402B957
- MD5 SHA1 SHA512 SSDEEP TLSH
XWorm V5.6/Icons/icon (2).ico
- SHA256 142b529799268a753f5214265c53a26a7a6f8833b31640c90a69a4ff94cee5ec
- MD5 f1463f4e1a6ef6cc6e290d46830d2da1
- SHA1 bda0d74a53c3f7aaf0da0f375d0c1b5aca2a7aaf
- SHA512 0fa93d009cc2f007d19e6fdda7ebe44c7ed77f30b49a6ef65c319133c0570ab84f2d86e8282b5069d7f2e238547722ac3966d2fa2fae4504133f0001a0387ae2
- SSDEEP 1536:WE4NpLpq8Bb7RFRz8nqF+o2Hc0cccwccyccxcccMcccNmccdccccTccccncccNJ+:j4NpVq8BxFRzaqF+o2GQJ7/JzqVfGv2
- TLSH T186B30F6A8EEBB642C5425474797363814A3D1F78A4CE35518EF33FED5AF3CA521230A2
- MD5 SHA1 SHA512 SSDEEP TLSH
XWorm V5.6/Icons/icon (3).ico
- SHA256 b2f7fb22cd5b935cf19a2f58f7fef9db99db40772ff4bb331a73c345161c2574
- MD5 a512719efc9e6ecc5e2375abceb1669a
- SHA1 51fae98edfab7cd6b6baac6df5ecbda082eeb1db
- SHA512 e0153dbc8f3fdda8d1a7082bc30a3895d7f4b3bc2982b4b4ece55653d1b4c293eba3ba6d4a0a581f0f7db95ab287d6616ef7bf03af4485904111798bf9d9e625
- SSDEEP 1536:Ms6se7llqn17KineXd2wwKtivEYoNRh8RX9EIKhI49NT:MsgbcUieNJHKoPC5+Ld
- TLSH T1C5D36CFF29A9491FC2052D78C249F735044EFD6278C6CA03B5A57E9FF23996A1C20993
- MD5 SHA1 SHA512 SSDEEP TLSH
XWorm V5.6/Icons/icon (4).ico
- SHA256 5bb21d6c04ed64a1368dace8f44aff855860e69f235492a5dc8b642a9ea88e41
- MD5 9c053bef57c4a7b575a0726af0e26dae
- SHA1 47148d30bc9a6120a1d92617bf1f3e1ba6ca1a2c
- SHA512 482d639ba60f57827d8a343f807f4f914289c45643307efaa666b584a085fe01ac7892252f41b7756fde93d215b4f3fed16e608bc45102d320d77239fa93146a
- SSDEEP 1536:zVRUhw3TWxcZss+SP21wH7QOK/PPLr8zdYpizfgMRHGuTRLJHPxDsPsx3CXhRcVN:ZRUGKXs+S++7KFSbxeY+qDDrMY
- TLSH T1BAC32C2D5E4BB8DBE42449B558A6EBD10A6CEFA4F4E1169834E8FE3CB7D1474C500F90
- MD5 SHA1 SHA512 SSDEEP TLSH
XWorm V5.6/Icons/icon (5).ico
- SHA256 45c85bdaaf0e0c30678d8d77e2585871ea6d1298ee0d30037745bacea6338484
- MD5 9dbdd6972e129d31568661a89c81d8f9
- SHA1 747399af62062598120214cef29761c367cfd28a
- SHA512 e52572de3f0d57d24a24d65eca4ff638890ccc9c5aca3f213ff885eda3c40de115849eb64c341f557d601f566ce21f8fc0df25cc4b13aaad5e941449a6b7f87d
- SSDEEP 192:sVLDqC6ot/2AlVx1qa6mgIwEk4w00wILxuudXCnadwyHXZ:EH/6A/9d1qDIwEk4w00wsuuXdwyHJ
- TLSH T112A379CB6E1486B7CB4CF63054A7B33C032BA83D6BD38E0EE55B3E59AB3265C9945105
- MD5 SHA1 SHA512 SSDEEP TLSH
XWorm V5.6/Icons/icon (6).ico
- SHA256 6ea04cf08751a2f6bb2f0e994258a44d5183b6cdb1471a0ee285659eada045b5
- MD5 d7c9666d30936e29ce156a2e04807863
- SHA1 845e805d55156372232e0110e5dc80380e2cb1e5
- SHA512 3cfd7a41f65c5a0dc23a90c6af358179efb3ae771f50534c3d76c486fe2d432ea3128a46b4b367c4714e86e8c0862a7385bd80662fe6ea82d7048f453570ed56
- SSDEEP 768:LZe7enyslZ87gUcXmEHNBFNJC5jWb2NM2:Npysa7iAM2
- TLSH T1E1B3EEA41820C65DD5C4A776CD17B37D37882E5C14319B8A9270B8EEB23710D297EAFE
- MD5 SHA1 SHA512 SSDEEP TLSH
XWorm V5.6/Icons/icon (7).ico
- SHA256 29d38c75af79aa0554f34cdfecb311f88f8dd02b02facaa299b9700841806ab8
- MD5 7891c91d1761dc8a8846d362e6e31869
- SHA1 0229bb01b7b4a0fca305eb521ec5dfbaa53674ea
- SHA512 ed14614a706da985566853dc13df0d1128a718f39ec9957320813803fe07e59de337d51033970e2f57d9f56da3546c506f5f0f3becfa91ce741576855be14ba7
- SSDEEP 3072:Y8SKfbzxcwg7es6/Vsb8VKTu549oJMfF/H9N3Ky9NzLn+:YUhcX7elbKTua9bfF/H9d9n+
- TLSH T1A6F3BF6D2E55CD46E9854C7544B7D3BCE66C4DB32E4C8912E72C7EA41B3AE483E22323
- MD5 SHA1 SHA512 SSDEEP TLSH
XWorm V5.6/Icons/icon (8).ico
- SHA256 a65cbbdc2ca671a9edd7edac0c6737b3b116e357727e003e5fdeff163c6c21ab
- MD5 af1739a9b1a1bf72e7072ad9551c6eea
- SHA1 8da0a34c3a8040c4b7c67d7143c853c71b3d208d
- SHA512 eeeac307371c38b75e256083c55a3fe4ab096c1c7520a4b7acb40fad3af5a0d6c88aaf85f2c3e418034abee422c2a3ba13731adf7ee6078016da4dd2e989b120
- SSDEEP 768:ygjWAisCkoAbhMDB8dfO944J+IiIxzAILEhmtkW9iVHD:yOybBYfOS4J+1oEhyiHD
- TLSH T168B3A69A1D055BF7E70CF43480F3732D637ECE3A3E961E4DE9AE7EA862708491598811
- MD5 SHA1 SHA512 SSDEEP TLSH
XWorm V5.6/Icons/icon (9).ico
- SHA256 bd1c33a67244801e828035904882ec53bd2ea8a1db9265a06d1aa08cf444ca80
- MD5 3e24e40b41ecc59750c9231d8f8da40b
- SHA1 91a701cf25aea2984f75846b6c83865d668ccad6
- SHA512 fe62edddb62dd4b695f1ef40ffb7a0119d480d1c176f0254acee19a45d6433ef6c308acbe567c721018390626c71f7a0f7bcd195d59d54c19cf019f13c4f7572
- SSDEEP 3072:HAZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZ+ZZZZZZZZZZZZZZZZZZZZZZvZZZ+:H+GIIIIIIIhIIIIIIIIIIIIIIIUP
- TLSH T13344EE606A050EBCEFE0BA78EBDD536513A52E91017B54CF13D03F8A3537E53BA9A052
- MD5 SHA1 SHA512 SSDEEP TLSH
XWorm V5.6/Logs/ErrorLogs.txt
- SHA256 633eef2d5302c0c224cd71aeb7d29901564f30e5a9b3d31cc0a55c1c6eeb3d5c
- MD5 f77f4fb386c891a5640cf26473cebea4
- SHA1 db2fc673ed4b895561caf8670d1e40204a3d6fa6
- SHA512 47fe461ccb295c95d951c0499d943febdc7b9b41923bd03b9b0876e52abc220cde47dd4a3ff13e98f991636fc21b6ef5297b679dde8dcd38b51cd0648eea38f9
- TLSH T120D0A73C04B8D135F117E568761855724239603E61D782A829BBA2183AD6E36C13D92C
- MD5 SHA1 SHA512 TLSH
XWorm V5.6/NAudio.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 81b3f1dc3f1eac9762b8a292751a44b64b87d0d4c3982debfdd2621012186451
- MD5 3b87d1363a45ce9368e9baec32c69466
- SHA1 70a9f4df01d17060ec17df9528fca7026cc42935
- SHA512 1f07d3b041763b4bc31f6bd7b181deb8d34ff66ec666193932ffc460371adbcd4451483a99009b9b0b71f3864ed5c15c6c3b3777fabeb76f9918c726c35eb7d7
- SSDEEP 6144:96/i10SZtfzWctj98vZcE0wmLlaIZs5eku2sX2hrjAzvgmXa6W9FwsT9idwktQZG:9yrSKMJR9aGs55T1X9Fwspi2tGpmS
- TLSH T156B45C2237E4962BD1AF5775E4E1191B8BB1F8423237D78F8684BB6E1D837924C407A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
d0:94:af:d7:9f:51:16:9c:c5:1a:e7:ea:23:e5:08:16:11:ae:03:76:1d:25:05:ee:5f:c2:9d:59:4a:68:c8:54
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Razer USA Ltd.,O=Razer USA Ltd.,L=Irvine,ST=California,C=US
Chains
Jun 3, 2020
CN=Razer USA Ltd.,O=Razer USA Ltd.,L=Irvine,ST=California,C=US
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Subject
CN=Razer USA Ltd.,O=Razer USA Ltd.,L=Irvine,ST=California,C=US
Serial Number
37:37:aa:de:9f:72:21:81:eb:6e:a4:00:21:65:fb:e1
Issuer
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Jan 22, 2019 - Feb 27, 2022
Subject
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Serial Number
3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Issuer
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Dec 10, 2013 - Dec 9, 2023
Subject
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Serial Number
7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Issuer
CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 21, 2012 - Dec 30, 2020
Subject
CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US
Serial Number
0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Issuer
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Oct 18, 2012 - Dec 29, 2020
Minor OS version
0
Major OS version
4
Entry point
510758
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\code\GitHub\NAudio\NAudio\obj\Release\NAudio.pdb
mscoree
_CorDllMain
Name
.text
Size
494KB
Virtual Size
493KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
952B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm V5.6/Newtonsoft.Json.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 e1e27af7b07eeedf5ce71a9255f0422816a6fc5849a483c6714e1b472044fa9d
- MD5 195ffb7167db3219b217c4fd439eedd6
- SHA1 1e76e6099570ede620b76ed47cf8d03a936d49f8
- SHA512 56eb7f070929b239642dab729537dde2c2287bdb852ad9e80b5358c74b14bc2b2dded910d0e3b6304ea27eb587e5f19db0a92e1cbae6a70fb20b4ef05057e4ac
- SSDEEP 12288:GBja5bBvR8Q0TE2HB0WLmvXbsVG1Gw03RzxNHgKhwFBkjSHXP36RMGy1NqTUO:GBjk38WuBcAbwoA/BkjSHXP36RMG/
- TLSH T166E4394123F98F2BE1AF6B75B4704E1543F9F917A6B5E78F9A04D9A91C43B408E403A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
38:27:11:d0:35:02:fc:58:64:ae:1e:6c:cb:c5:eb:67:eb:5d:dc:c8:86:9e:e4:59:cc:0d:02:0e:5f:d1:fc:9b
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=Washington,C=US,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Chains
Mar 8, 2023
SERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=Washington,C=US,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
CN=.NET Foundation Projects Code Signing CA2,O=.NET Foundation,C=US
CN=DigiCert CS RSA4096 Root G5,O=DigiCert\, Inc.,C=US
Subject
CN=DigiCert CS RSA4096 Root G5,O=DigiCert\, Inc.,C=US
Serial Number
06:ce:e1:31:be:6d:55:c8:07:f7:c0:c7:fb:44:e6:20
Issuer
CN=DigiCert CS RSA4096 Root G5,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jan 15, 2021 - Jan 14, 2046
Subject
CN=.NET Foundation Projects Code Signing CA2,O=.NET Foundation,C=US
Serial Number
0a:de:32:e9:50:9b:44:aa:34:b1:da:f1:bc:0e:c8:73
Issuer
CN=DigiCert CS RSA4096 Root G5,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Jul 15, 2021 - Jul 14, 2031
Subject
SERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=Washington,C=US,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Serial Number
0c:d1:40:7a:5a:bd:ed:43:d5:c1:73:12:1d:38:c5:29
Issuer
CN=.NET Foundation Projects Code Signing CA2,O=.NET Foundation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Aug 13, 2021 - Oct 29, 2024
Subject
CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US
Serial Number
0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Sep 21, 2022 - Nov 21, 2033
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
0
Major OS version
4
Entry point
704578
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
/_/Src/Newtonsoft.Json/obj/Release/net45/Newtonsoft.Json.pdb
mscoree
_CorDllMain
Name
.text
Size
681KB
Virtual Size
680KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm V5.6/Plugins/ActiveWindows.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 567b9861026a0dbc5947e7515dc7ab3f496153f6b3db57c27238129ec207fc52
- MD5 5a766a4991515011983ceddf7714b70b
- SHA1 4eb00ae7fe780fa4fe94cedbf6052983f5fd138b
- SHA512 4bd6b24e236387ff58631207ea42cd09293c3664468e72cd887de3b3b912d3795a22a98dcf4548fb339444337722a81f8877abb22177606d765d78e48ec01fd8
- SSDEEP 384:vRt5r7olU5QrGPbMrodT8ptsY7XZ1EDI6:vRtSRrGPb9t0Z1ED7
- TLSH T11F624968E3E44375C6FE1FB25C7363001370C6088C07FBAE1ADCA2569D5BA9D8B5176A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
20742
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
920B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm V5.6/Plugins/Chat.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 aab20f465955d77d6ec3b5c1c5f64402a925fb565dda5c8e38c296cb7406e492
- MD5 59f75c7ffaccf9878a9d39e224a65adf
- SHA1 46b0f61a07e85e3b54b728d9d7142ddc73c9d74b
- SHA512 80056163b96ce7a8877874eaae559f75217c0a04b3e3d4c1283fe23badfc95fe4d587fd27127db4be459b8a3adf41900135ea12b0eeb4187adbcf796d9505cb8
- SSDEEP 384:4MOna4ifKQtuUvl0BY0iYUsBG/crwTKvh6GIKoIafWUWmfN:vKQtuq2Y0lUUG0r0pIafWXe
- TLSH T185821829939583B3C6FE2AF69D76E19043B1D211CA07FF6F6DDCA0AA4C933528341791
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
24714
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
16KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
856B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm V5.6/Plugins/Chromium.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 b6d8bccdf123ceac6b9642ad3500d4e0b3d30b9c9dd2d29499d38c02bd8f9982
- MD5 edb2f0d0eb08dcd78b3ddf87a847de01
- SHA1 cc23d101f917cad3664f8c1fa0788a89e03a669c
- SHA512 8f87da834649a21a908c95a9ea8e2d94726bd9f33d4b7786348f6371dfae983cc2b5b5d4f80a17a60ded17d4eb71771ec25a7c82e4f3a90273c46c8ee3b8f2c3
- SSDEEP 768:6SyQlmUmBlEu0FXfjq2sgDrLjfcVJ5sN9aWdMIxbKhJ+GEq3ZsL5f62:3yQltmBlmFXfjq2sgDrLjfcVJ5sNkQOa
- TLSH T1CAE2294873F8C614EEFE0D75983865600372A143AD57F7AD0AC1A0AA1BB3B958D61FD3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
38630
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
30KB
Virtual Size
29KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
888B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm V5.6/Plugins/Clipboard.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 e31a1c2b1baa2aa2c36cabe3da17cd767c8fec4c206bd506e889341e5e0fa959
- MD5 831eb0de839fc13de0abab64fe1e06e7
- SHA1 53aad63a8b6fc9e35c814c55be9992abc92a1b54
- SHA512 2f61bcf972671d96e036b3c99546cd01e067bef15751a87c00ba6d656decb6b69a628415e5363e650b55610cf9f237585ada7ce51523e6efc0e27d7338966bee
- SSDEEP 192:xh23MTInqHX7qRlrZk1/X7eOFXgNTer149iY6IW1mX/YWMqS7RSLOIU:cTWElV0/X7eUSTe5Wi2X/ShIU
- TLSH T1A0524C5863E4823DC7FD0AB24C73B3801774D705ED82FB2E1DD860A25E97699874276B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
20054
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
888B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm V5.6/Plugins/Cmstp-Bypass.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 fa420fd3d1a5a2bb813ef8e6063480099f19091e8fa1b3389004c1ac559e806b
- MD5 cf15259e22b58a0dfd1156ab71cbd690
- SHA1 3614f4e469d28d6e65471099e2d45c8e28a7a49e
- SHA512 7302a424ed62ec20be85282ff545a4ca9e1aecfe20c45630b294c1ae72732465d8298537ee923d9e288ae0c48328e52ad8a1a503e549f8f8737fabe2e6e9ad38
- SSDEEP 192:KpXpS1QWlPkiqdE7FNNGGO9mWbpGkjgyaYcIW1vr/8TNU7aL7YiLsO08hdW5:Kp5IfL0mWbEkUyaYir/oNJL7KQ
- TLSH T1EB32F62CA7E182B5C97E0E7248A7E3111770DA049D23FB2F55E4A10A5D7734883A7B7A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
17130
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
920B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm V5.6/Plugins/FileManager.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 b58ed3ebbcd27c7f4b173819528ff4db562b90475a5e304521ed5c564d39fffd
- MD5 641a8b61cb468359b1346a0891d65b59
- SHA1 2cdc49bcd7428fe778a94cdcd19cabf5ece8c9c0
- SHA512 042702d34664ea6288e891c9f7aa10a5b4b07317f25f82d6c9fa9ba9b98645c14073d0f66637060b416a30c58dec907d9383530320a318523c51f19ebd0a4fee
- SSDEEP 12288:bVnchrRTHcQ3nrn6xtI9qR5WcygA5KeirCDD/:btJQ3nrnMI9MUlr5Kei+DD/
- TLSH T172E418203FE8E01FE4AE73B5D4E1972156B4E6427296FF8F258056E80E833886C555BF
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
700934
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
677KB
Virtual Size
676KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
900B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm V5.6/Plugins/FilesSearcher.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 e66e1273dc59ee9e05ce3e02f1b760b18dd296a47d92b3ce5b24efb48e5fb21b
- MD5 6f8f1621c16ac0976600146d2217e9d2
- SHA1 b6aa233b93aae0a17ee8787576bf0fbc05cedde4
- SHA512 eb55acdea8648c8cdefee892758d9585ff81502fc7037d5814e1bd01fee0431f4dde0a4b04ccb2b0917e1b11588f2dc9f0bfe750117137a01bbd0c508f43ef6a
- SSDEEP 6144:ZAHdfUpnnBuIbE7SCQeGtSV41QJDsTDDh0Yhe6dwxLV/Quhg08OwR75:yVUpnkZ7slS4Ys50ie6Cfzg0M
- TLSH T170A49E416BE8C657E1BF27B2C0E252A1CBB0E555A62EDFCF6D4025EE1C17340E9107AB
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
495966
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
476KB
Virtual Size
476KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
916B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm V5.6/Plugins/HBrowser.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 75e8ff57fa6d95cf4d8405bffebb2b9b1c55a0abba0fe345f55b8f0e88be6f3c
- MD5 f0e921f2f850b7ec094036d20ff9be9b
- SHA1 3b2d76d06470580858cc572257491e32d4b021c0
- SHA512 16028ae56cd1d78d5cb63c554155ae02804aac3f15c0d91a771b0dcd5c8df710f39481f6545ca6410b7cd9240ec77090f65e3379dcfe09f161a3dff6aec649f3
- SSDEEP 384:tp33X3L5/QrX8nB9d13+6HcLReMWaFnp9l/1DRVTbg0Ut4xh+TfYMoKAB1R:tR3nL5/QrQ13kRR9bTbz+DYMoFBf
- TLSH T1F6B25B4967F49630E1FD0A75987367148370F6935812EF8F0AC9641A2E3B7E846247EB
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
31318
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
23KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
888B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm V5.6/Plugins/HRDP.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 4aa18745a5fddf7ec14adaff3ad1b4df1b910f4b6710bf55eb27fb3942bb67de
- MD5 f27b6e8cf5afa8771c679b7a79e11a08
- SHA1 6c3fcf45e35aaf6b747f29a06108093c284100da
- SHA512 0d84966bbc9290b04d2148082563675ec023906d58f5ba6861c20542271bf11be196d6ab24e48372f339438204bd5c198297da98a19fddb25a3df727b5aafa33
- SSDEEP 24576:3rKxoVT2iXc+IZ++6WiaTAsN/3ebTvK+63CWH8iA/iD2hgPjcC8SVdKumYr7:WHZ5pdqYH8ia6GcKuR7
- TLSH T13B851918F6D8423ED857D2359A7153B2D7FAB9482F20738A2928075A7F2B3D02B3575C
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1790470
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
1.7MB
Virtual Size
1.7MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
856B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm V5.6/Plugins/HVNC.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 3a287acb1c89692f2c18596dd4405089ac998bb9cf44dd225e5211923d421e96
- MD5 30eb33588670191b4e74a0a05eecf191
- SHA1 08760620ef080bb75c253ba80e97322c187a6b9f
- SHA512 820cca77096ff2eea8e459a848f7127dc46af2e5f42f43b2b7375be6f4778c1b0e34e4aa5a97f7fbabe0b53dcd351d09c231bb9afedf7bcec60d949918a06b97
- SSDEEP 768:XsKVHERYe3lgPPTxOEUyP82P6mUrYrthCO7h2ORS9SQdHfiLpmbG8p:8K1ERYe0TEE3P82P1EMS36Kp
- TLSH T1E4434B99A7E98A34E2FE0F79887357144372E15B4513EF0E07C6A0666FB33828551BE3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
23238
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
56KB
Virtual Size
56KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
856B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm V5.6/Plugins/HVNCMemory.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 285b462e3cd4a5b207315ad33ee6965a8b98ca58abb8d16882e4bc2d758ff1a4
- MD5 065f0830d1e36f8f44702b0f567082e8
- SHA1 724c33558fcc8ecd86ee56335e8f6eb5bfeac0db
- SHA512 bac0148e1b78a8fde242697bff1bbe10a18ffab85fdced062de3dc5017cd77f0d54d8096e273523b8a3910fe17fac111724acffa5bec30e4d81b7b3bd312d545
- SSDEEP 768:EofXMCBlQ6Kms0n6GE30IU1YKtq9oQog1zq/xPP7:EyXTa6hEZU1YKwo8Uj
- TLSH T166032B4937FA0621F1FE0AF5C873A7289331F5935506DB0E2AC960696B736C29610FE7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
46462
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
37KB
Virtual Size
37KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
904B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm V5.6/Plugins/HiddenApps.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 6a098f5a7f9328b35d73ee232846b13e2d587d47f473cbc9b3f1d74def7086ea
- MD5 ba2141a7aefa1a80e2091bf7c2ca72db
- SHA1 9047b546ce9c0ea2c36d24a10eb31516a24a047d
- SHA512 91e43620e5717b699e34e658d6af49bba200dcf91ac0c9a0f237ec44666b57117a13bc8674895b7a9cac5a17b2f91cdc3daa5bcc52c43edbabd19bc1ed63038c
- SSDEEP 768:aEN0W4dmvWt9VG2LqIvwYGYRpXpWk/x0qqBi3qMG0gpfN3ffiCIT:SdmvWHVGMVwtYRtpl/x5qIXdEdXiCK
- TLSH T1B1233848B7F88620E1FE1B3AA87363149370F4A71A16E74F0AC6A0592F723C45758BD6
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
51742
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
43KB
Virtual Size
42KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
904B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm V5.6/Plugins/Informations.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 cba453460be46cfa705817abbe181f9bf65dca6b6cea1ad31629aa08dbeaf72b
- MD5 67a884eeb9bd025a1ef69c8964b6d86f
- SHA1 97e00d3687703b1d7cc0939e45f8232016d009d9
- SHA512 52e852021a1639868e61d2bd1e8f14b9c410c16bfca584bf70ae9e71da78829c1cada87d481e55386eec25646f84bb9f3baee3b5009d56bcbb3be4e06ffa0ae7
- SSDEEP 384:SCUEeL4D574MvGjydqXwxDJop0n3TmyxhxJNgSg4PbOFsK:SCXeL4DSjydqXwx1FjfNfwr
- TLSH T1B8A21A4837F986A5D1FE1FB14C32A24543B6E60B8C12FA2F2DD8909E1D63784CA55B73
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
28658
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
20KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
920B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm V5.6/Plugins/Keylogger.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 acfe5c3aa2a3bae3437ead42e90044d7eee972ead25c1f7486bea4a23c201d3a
- MD5 246f7916c4f21e98f22cb86587acb334
- SHA1 b898523ed4db6612c79aad49fbd74f71ecdbd461
- SHA512 1c256ca9b9857e6d393461b55e53175b7b0d88d8f3566fd457f2b3a4f241cb91c9207d54d8b0867ea0abd3577d127835beb13157c3e5df5c2b2b34b3339bd15d
- SSDEEP 192:rJV/HNfwK5RSpyv3RIw9RtO1Lnq4Ur1XneDN6IW1Y6Uph1KzaA0UbnnSLWqV:fFl5Rp3RntMO4U5uD8Upml0yhqV
- TLSH T17E824B5D77D4837EDEFD1EB25C3263011770E2069903FB2918EC21665EE3E898361AA7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
23606
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
15KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
888B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm V5.6/Plugins/Maps.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 34b532a4d0560e26b0d5b81407befdc2424aacc9ef56e8b13de8ad0f4b3f1ab6
- MD5 806c3802bfd7a97db07c99a5c2918198
- SHA1 088393a9d96f0491e3e1cf6589f612aa5e1df5f8
- SHA512 ed164822297accd3717b4d8e3927f0c736c060bb7ec5d99d842498b63f74d0400c396575e9fa664ad36ae8d4285cfd91e225423a0c77a612912d66ea9f63356c
- SSDEEP 192:E0XOBqmqKYNg/ymxa07XW5U6chariK8GtnNK7gGteb1/C9T6IW14X/bmjIAd2vLV:mBqmqunYL6thaujK4jtepa9BX/bY1h2
- TLSH T17F623916E3944271C6FE0FF65C7262004776E609CC07FF1E2DCC209A6E6769A8E257B2
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
21794
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
13KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
856B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm V5.6/Plugins/MessageBox.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 bc09b671894c9a36f4eca45dd6fbf958a967acea9e85b66c38a319387b90dd29
- MD5 7db8b7e15194fa60ffed768b6cf948c2
- SHA1 3de1b56cc550411c58cd1ad7ba845f3269559b5c
- SHA512 e7f5430b0d46f133dc9616f9eeae8fb42f07a8a4a18b927dd7497de29451086629dfc5e63c0b2a60a4603d8421c6570967c5dbde498bb480aef353b3ed8e18a1
- SSDEEP 384:56lIcAn3tURnUKCvUUVT/95gG3UX/NZSQW9:56lIL3tUSvbVa/NZG
- TLSH T11D621AA97BE08379C2FE0FB65CB262405771EA0D9C02FF2E59D810565EA7984C720F67
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
20958
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
904B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm V5.6/Plugins/Microphone.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 612898afdf9120cfef5843f9b136c66ecc3e0bb6f3d1527d0599a11988b7783c
- MD5 9c3d90ccf5d47f6eef83542bd08d5aeb
- SHA1 0c0aa80c3411f98e8db7a165e39484e8dae424c7
- SHA512 0786f802fbd24d4ab79651298a5ba042c275d7d01c6ac2c9b3ca1e4ee952de7676ec8abf68d226b72696e9480bd4d4615077163efbcda7cff6a5f717736cbdfe
- SSDEEP 12288:+0OeMv3MrIb8CkZKobg3Wi1bRuSvazv+Uro:ROe+WIb8CkZLbg3Wa8Waz2j
- TLSH T14CC46E21BBE0851BD16F33B2E0E60B2A57F1E4467726EB8F548096EA5ED37534C40B93
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
558638
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
538KB
Virtual Size
537KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
868B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm V5.6/Plugins/Ngrok-Installer.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 b574aabf02a65aa3b6f7bfff0a574873ce96429d3f708a10f87bc1f6518f14aa
- MD5 3e19341a940638536b4a7891d5b2b777
- SHA1 ca6f5b28e2e54f3f86fd9f45a792a868c82e35b5
- SHA512 06639892ea4a27c8840872b0de450ae1a0dac61e1dcb64523973c629580323b723c0e9074ff2ddf9a67a8a6d45473432ffc4a1736c0ddc74e054ae13b774f3e2
- SSDEEP 12288:Ws6T2x75lFR/RG+BUKPqnwoCMYKIUTJE:WEB+4+1C0IU
- TLSH T1CA947D107FE0C63BF6AF97F1C16641568BF4E05AB79AEBCE6D8418E9284235089173D3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
415342
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
398KB
Virtual Size
397KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
932B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm V5.6/Plugins/Options.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 5c34aee5196e0f8615b8d1d9017dd710ea28d2b7ac99295d46046d12eea58d78
- MD5 97193fc4c016c228ae0535772a01051d
- SHA1 f2f6d56d468329b1e9a91a3503376e4a6a4d5541
- SHA512 9f6d7da779e8c9d7307f716d4a4453982bb7f090c35947850f13ec3c9472f058fc11e1120a9641326970b9846d3c691e0c2afd430c12e5e8f30abadb5dcf5ed2
- SSDEEP 768:ULxkuz7dDWH839iybgkf/sGRNW9S9dhjcI:ULNHqUPbgQsGRNW9S9
- TLSH T1B2D219017BE84629F5FF6F31EDF622158A36BC4BAD22EA1D08D0101D6C73694CA61F76
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Contains code to disable Windows Defender
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
36546
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
28KB
Virtual Size
27KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
872B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm V5.6/Plugins/Pastime.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 a46787527ac34cd71d96226ddfc0a06370b61e4ad0267105be2aec8d82e984c1
- MD5 6430ab4458a703fb97be77d6bea74f5b
- SHA1 59786b619243d4e00d82b0a3b7e9deb6c71b283c
- SHA512 7b6cf7a613671826330e7f8daddc4c7c37b4d191cf4938c1f5b0fb7b467b28a23fb56e412dc82192595cfa9d5b552668ef0aaa938c8ae166029a610b246d3ecc
- SSDEEP 384:WK9Y5jI8MYODPqeivepi5zOY7//fNCsA8/h5U:WK9YNI8MVDZiWwr/TA8/hC
- TLSH T1B8820A256BE48371C6FD5EB248B3731003B4E241EE12FF1E49D86156AD73A85C760BEA
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
23794
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
15KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
872B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm V5.6/Plugins/Performance.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 043b6a0284468934582819996dbaa70b863ab4caa4f968c81c39a33b2ac81735
- MD5 1841c479da7efd24521579053efcf440
- SHA1 0aacfd06c7223b988584a381cb10d6c3f462fc6a
- SHA512 3005e45728162cc04914e40a3b87a1c6fc7ffde5988d9ff382d388e9de4862899b3390567c6b7d54f0ec02283bf64bcd5529319ca32295c109a7420848fa3487
- SSDEEP 384:LtpW2/E3mawGD1XTgOw2QxHN7yVppy6+:JY2ImYRDKHxV
- TLSH T1A7723A09F3E54336C6FD0EB24972A21113B1DB039D13FB6E5CC870A64AA3A988B11B57
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
22034
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
14KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
904B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm V5.6/Plugins/ProcessManager.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 7cf1921a5f8429b2b9e8197de195cfae2353fe0d8cb98e563bdf1e782fe2ee4e
- MD5 3d4ec14005a25a4cb05b1aa679cf22bf
- SHA1 6f4a827d94ad020bc23fbd04b7d8ca2995267094
- SHA512 0ee72d345d5431c7a6ffc71cf5e37938b93fd346e5a4746f5967f1aa2b69c34ca4ba0d0abd867778d8ca60b56f01e2d7fc5e7cf7c5a39a92015d4df2d68e382e
- SSDEEP 384:2dqZXY/oSd1PTQLvLELadRtZa/rnRvDSQUT5S97/Y5bLOEYQfwrpn45rDhUn1kAO:2dqZXWrQPQQtZqrRrlU+cYv1kAvZc
- TLSH T110920859E7E8C3B1C2AC0E72587252510770DB018D23FB1E5CE8B0676EB37E98B21766
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
25286
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
17KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
936B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm V5.6/Plugins/Programs.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 953a8276faa4a18685d09cd9187ed3e409e3cccd7daf34b6097f1eb8d96125a4
- MD5 a6734a047b0b57055807a4f33a80d4dd
- SHA1 0b3a78b2362b0fd3817770fdc6dd070e3305615c
- SHA512 7292eab25f0e340e78063f32961eff16bb51895ad46cfd09933c0c30e3315129945d111a877a191fc261ad690ad6b02e1f2cabc4ff2fdac962ee272b41dd6dfa
- SSDEEP 192:Z3eKcfO/TCOAOG+uCno9SFwN4O4FgkT8zr1P9YD6IW1GX/V3wd0yzSLWVb:8PG/TCXF1SamdnTu5lYTX/NwKyNVb
- TLSH T1AE522A59B7E48379CAFE0EB21C33A2422B35DA04CC03FF2E29D851569D776948751BB2
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
19822
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
11KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
888B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm V5.6/Plugins/Ransomware.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 14c2bbccdabb8408395d636b44b99de4b16db2e6bf35181cb71e7be516d83ad9
- MD5 ccc9ea43ead4aa754b91e2039fe0ac1c
- SHA1 f382635559045ac1aeb1368d74e6b5c6e98e6a48
- SHA512 5d05254ba5cd7b1967a84d5b0e6fd23c54766474fb8660a001bf3d21a3f5c8c20fcdb830fb8659a90da96655e6ee818ceefb6afa610cc853b7fba84bb9db4413
- SSDEEP 384:DVSO27QJHvpebFn0LC9Tk7ff2ji+ZMuqI+sHY4k7E7eEDuQZh:DVm7Q1vpebF0LC9TqH2Mj7qtqg
- TLSH T12B92F62D67E0E171DCBF19F364B3D2510371DD35A821F62C3ACDB0AA1FB21494295E66
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
26282
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
18KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
904B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm V5.6/Plugins/Recovery.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 66dbe3b90371fe58caa957e83c1c1f0acce941a36cf140a0f07e64403dd13303
- MD5 776193701a2ed869b5f1b6e71970a0ac
- SHA1 2f973458531aaa283cdc835af4e24f5f709cbad1
- SHA512 a41f981c861e8d40487a9cd0863f9055165427e10580548e972a47ef47cf3e777aab2df70dc6f464cc3077860e86eda7462e9754f9047a1ecc0ed9721663aeb9
- SSDEEP 12288:LaoFeouLUFNFfcaFeFOFwcGF6cmFWc0FWc8cIcKcUFJFpcNcHc7cbchFFc5cbc1a:pFetLic805jbibGATp/j5T
- TLSH T1B2355B507BE8D617E1BF23B2E4B20A551BB9F841B362E74F644821E90C62344AE517FF
- MD5 SHA1 SHA512 SSDEEP TLSH
-
StormKitty payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1157618
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
1.1MB
Virtual Size
1.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
884B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm V5.6/Plugins/Regedit.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 2f73dc0f3074848575c0408e02079fd32b7497f8816222ae3ce8c63725a62fe6
- MD5 53a2cfe273c311b64cf5eaca62f8c2fd
- SHA1 4ec95ec4777a0c5b4acde57a3490e1c139a8f648
- SHA512 992b37d92157ae70a106a9835de46a4ac156341208cfe7fb0477dc5fc3bc9ddae71b35e2336fc5c181630bac165267b7229f97be436912dfd9526a020d012948
- SSDEEP 384:0ZMOBwQbGwAspmewuYvpYr3fgr9A8/VjceZ:0ZMOykGRzYwA8/Vl
- TLSH T187621A5BABD08332C6EE1BB20C73A2405772EA05DD07EF5F9EDC10A65E532ED8341669
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
21678
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
13KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
872B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm V5.6/Plugins/RemoteDesktop.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 cc52384910cee944ddbcc575a8e0177bfa6b16e3032438b207797164d5c94b34
- MD5 e6367d31cf5d16b1439b86ae6b7b31c3
- SHA1 f52f1e73614f2cec66dab6af862bdcb5d4d9cf35
- SHA512 8bc78a9b62f4226be146144684dc7fcd085bcf4d3d0558cb662aacc143d1438b7454e8ac70ca83ebeedc2a0fcea38ad8e77a5d926a85254b5a7d420a5605538a
- SSDEEP 384:nKr81F+CoNFZpeg7qX+mK3sxjt9l/C6I5YxBXWKeVFjyJ:KTvZY4gTPXBojG
- TLSH T1C9824C1D7BE44379D6AE0E7548B363011738C2099C43FB1E4CD8A1A55DA37C98B717B5
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
24586
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
16KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
920B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm V5.6/Plugins/ReverseProxy.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 8c4efe2c8702141ffa8ff8f55d248dc4220231ae8d12ecea1f22906a9285b32b
- MD5 a22d11379e413cf832b3943ce46f2463
- SHA1 99b9552e8a25bff29678aff828901edbc23eaba5
- SHA512 cc1eccb29135acd35804b44f73447bd8dedc8ea085dee3670cf49120baa905aa7ca512c14a3f4df6aeb5a70347bd214865f9dc8b709a00abbb0c745164d87074
- SSDEEP 384:sNsDP97BkZ3pBkHEk8G1QxFUzTNnrYFXoMZlS9yPCn:sNuR+ZZ+mScWfEoMZQ9yPg
- TLSH T1B67229AC67F08371C6BD0BB24872A2016B71D605D853FF5E5CDC70960EA7689CB84BA7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
22862
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
14KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
920B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm V5.6/Plugins/RunPE.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 7adfe849345edd76aa975b0647fed2ccaa5f4a6aaf7d55f488af939c0dbef153
- MD5 224be01635cff2dca827fbdeaddb983c
- SHA1 11fa00c5e172c9cd1c81acaef52934f785f91374
- SHA512 1a4915b7b21e8166a6ddb6460c77e02c306a460c08fc7ee574832b0576c827db343eda9533959298819ee443790769328ad580fc67fe4817110b63d49248c736
- SSDEEP 192:vbfqh94qP9XFw3l+JNGGOueq1JtSnIW1fUse2po7SLOYN:vbChWqPj5jJtGUse2poHYN
- TLSH T17132091D93D4C679C9EE0EF24CB222811BB2DA448E57FF3F55E4A0261CE33864AA1731
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
17334
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
856B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm V5.6/Plugins/ServiceManager.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 c552d11db168a4f64db584283a617a6ec51ab6095c20ba4b706c3138beb68a22
- MD5 2e5f127cb0a69cdd46aa4fd9e603f982
- SHA1 994a6ab276c417301ed9208aaaf6719bf9594bc6
- SHA512 4455cb3b9d4a9c69abec7180e9a60e16e6be0ae2290f48aa09c5d926370de5512ced4d37b6e6e49515d5f51999211eff6f751c4594db936882fb7f40ee5bf97e
- SSDEEP 192:D6FAiNLB2n5QnRBiMcs/XAaICPczrOFsgXTZr106Yq6IW1yShrM7+WAMLuO1Jjm:Ziq5QRBiMn/wpDUtTZ5nYsShY3AgJjm
- TLSH T172623B6A73D4873EC5FD0EB24CB393011B70DA08DD12FF2F1DC8605A5D63A998B52A66
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
20534
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
936B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm V5.6/Plugins/Shell.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 6c69b4d45638097e31169d94914e4acb6a8cc7f46788ffa4f241e4c1efb213bb
- MD5 04609b39e656e297db73be0d02c7e35e
- SHA1 f8abd484e7703a4d9629b033e8ec39c82eaf4654
- SHA512 11a88d55497fedeeb05b146ebd3135755aeb08c4596e9379eec83501e734aa6ba926d9bbda1c5f50e361836d65ea88d2c018f0b4b4b668c82ff2163730eaaf27
- SSDEEP 192:TDXwH3m0L3G33Kkw720sM76ODzKOFBLggT051i9Yd6IW1OU1YoWPbs5cLWT:oH3m0GqHT76OSUXT0HoYpU1XWoxT
- TLSH T1A2623915A7D18336C7BC0AB61C73A24157B2DB05CE07FF6E6ECCB0970E672858E12261
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
20966
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
856B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm V5.6/Plugins/StartupManager.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 1802e16379d96021fee05f583633c8091bb669350b7d32064179a8944d45a5a6
- MD5 3d76ef15ab712b93eabd4b68ea0111d5
- SHA1 0f309663fae17c4ccae983e1fabb16a1e5f77d9b
- SHA512 6c0d0291abb696bee33b6e42392b07028c82bcffc8fb7934ba234f178f011ab14fde38cdccb322c8dba058ae66fc023349de5db1c587d3417709bf263cfd28f3
- SSDEEP 3072:7ITmgSRcBHAt+yM1KlUKEHBAnpK37nXnF8KBOQv174Syoh2sKdm/vl7bQcX1Okta:7MmgSRcBHAt+yM1KlU18g1xNYVc
- TLSH T175143A5067E4C92BEB7F13B8E47216146774F44BA622EB8A38CC15FA5B2334059163BF
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
199114
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
186KB
Virtual Size
186KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
932B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm V5.6/Plugins/Stealer.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 018e06f57725563e4525700edffafb1b062bf5d4b0e9fee498507f0f8200fcdf
- MD5 ade4edd66bc695c9465816fa2538d0cb
- SHA1 e4351a2531307c848c60b20ffb50bcc04156fdbc
- SHA512 e2bf3962787366d7a975eb55d2edd1fe35935205febc00f720dc0efff0c62b5df7f0207fd569f692205e8a227c059eea596904995855458e9c02306842e88a6f
- SSDEEP 49152:eVbwgxmbsO2B7wKOfpUL6GbriHeGAb4TkyNejjWSqE08:eVbFxmbsO2B7wKOxTSf
- TLSH T156F548047BF8CB37E06FA7F295A105155BF8E45AF3A3E74B2A8067A80C12B006D5577B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
3453418
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
3.3MB
Virtual Size
3.3MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
868B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm V5.6/Plugins/TCPConnections.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 27e17a43478448f64107df786a170753dbd116eafca7c027f6d357f11e6a4def
- MD5 9cae90969d14ab4d686c56bae19e041e
- SHA1 0359e8eeed993bbbc6f141b115bd533eeb52533d
- SHA512 04a9dc16299d866af7f56ff2ef355310d9437c909ec0dd3549d2f142e71149b09822106e254970f00801fe2f0df6b6d2670cf6a8256d85cd35b963c028f6202d
- SSDEEP 192:VsFaPxrfOKHEWS3/tQ6v/Lvyrq6gNZOtyEox0GTeA19Z/J6IW1Gz/yyY8RKIxLuM:/9GKkWuv/LyvSwyzTeej/Zz/IHUv
- TLSH T1C772181C67B44339CFEE1AB218B3B20113B5DB09DD27FB6D15C8606A5D63B884B607A7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
22454
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
14KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
936B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm V5.6/Plugins/UACBypass.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 ebd51f1e33673cb8e55f10aa890a04027d62b1c1c0b0ae9b1d6f83f1602f53a2
- MD5 158e789d0b6cbc52fcb6653fefca38f9
- SHA1 4e913315dc3d69abe2be5e5b3a5d37b5f49f7deb
- SHA512 23243daadbad2f68b6ed6720d5792226f9c2aeb0b14cf3bf24ac54dcb7a2aa4aff9d26a5633d3add0d871e4ec65c230752c7c173cc4a4374f9263e2c46f9977a
- SSDEEP 192:kcq0WYKDFxDviOGOko8bZfmgyOYkIW1UZ/Xvjljw2ugiSL20V:kntNFxOrE8bLyOYBZ/XTugU0V
- TLSH T14322E82967E08335DDBE1E315C63621107B6EF05CE33EB6E4CD4A0495CA365487A2BAB
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
15954
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
888B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm V5.6/Plugins/VB.NET Compiler.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 1940d563046c67dbbeaf5f2a2417aaccdae587c1eb97b79c263994896805bece
- MD5 2401bee633ea4032a758ffc6d729deac
- SHA1 3040e0e27f48eacf45860be4ece6f94db7bc1c4e
- SHA512 af016b5d2bf8c08e16b593d72a25284f31d6de7300ef98a226db8ce4f2a9dd512ec793adf0730b40dc0a37e9dc5a9d6ef0a50354a697aa5816b3cbe440655692
- SSDEEP 192:TGESp/+S2SoW+O4A083xaU12HeZOCeJyxlTer1c9gotlF6IW1oXxvZLY4cGSLOBL:w3+O4aADifeyTe5agIXxvNccZ
- TLSH T160621B1BA7E483B2C7EE0FF11C72A2001775D615AD53FB1D1DCCA0464E63AAC8B51766
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
20918
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
936B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm V5.6/Plugins/VoiceChat.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 1a2da0a66c7771962d525b8fe9491052efbd5f87b97d935c267fd96519b5a35e
- MD5 56a8b030ade4736915e5b601a4bf39f8
- SHA1 ab03e7948c4604fbd15d285f674ea879082a8e7c
- SHA512 d0f2990adb10221c88bbe04b4f2b702f99c046ae9ce5e713e2d26f73f9353dfe5fd983cd37c7b712341a58cfc4f833e590ff1e449c66fd5de98604d58a92dbd9
- SSDEEP 6144:TkcVpiCslfiJOBvKbfaIKlEZfb78+SmmCENCT/7CbRNid2/c2Co+5CJfSp7Of:4Zjp8fIlE9bg/AgBcRCcp7O
- TLSH T1D2C45C11BBD48527C06F33B2F4E20B2E67B1E486B256EB4F49D09BA95D837464C41BB3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
557686
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
537KB
Virtual Size
536KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
884B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm V5.6/Plugins/WSound.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 4bea01b7d691d1f59ca0bb5149e5baf71cde71019da3d352141b1d4921e70bc2
- MD5 f0d8beccffd6a4831c0712a4da4a0c2d
- SHA1 238a2878f1bef8f002ba501c1f65862ed384cc75
- SHA512 1c5244736aa53d5dda52b65a26facda8334bc7f98ce2eb6356c51fcae03b183623d0c3bb7f45993b8bab0c65d261a23164f987aa5f6a47f2f307380567367904
- SSDEEP 12288:Ayw8KX3HOt3qqDQkoJBBg3bgtP1TviDH6MJyKwYalFEYU:1w7qDQkocbgttGzTa
- TLSH T15EC46E12BFD49527D06F33B2E4F60B2A57B5E44AB226FB4F05D096A85EC37815C40BA3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
558162
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
537KB
Virtual Size
537KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
860B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm V5.6/Plugins/WebCam.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 8d413b40aef41e53557d91f3b3ac64cfc13adb0f8c3edc364e7b8501170e2657
- MD5 71a9109ccafa90550c1c879a304d27f5
- SHA1 c77ce45aaf8b2d8aaaa2a41833275f3eda78046d
- SHA512 fc92190d8a889fb088b2e8c2e4ea4751fcda59eff076b205da7c420b2f26564c1835d6ff1af470b583ec2ec92c0fcfb472e443e29d33f538572e6edd36c8c47e
- SSDEEP 3072:pA0VnWR/jKGR5BfF/g50PBgakLA3LC2FY+EdzYZHAx+dqRN51hdJFxtZV9l5hhJz:pBn+22fFcgBgakL320zYZHpMXM/I/
- TLSH T131247D06B3E5807AD5BE4A3588335A199779F8118B71DF9F1B94026E0F633C18E39F26
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
220286
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
207KB
Virtual Size
207KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
860B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm V5.6/RES/U40957361f7481084776e6aedU9f0U1
- SHA256 294f977ce530e3d471a9e2bb09305b6ad4516f42e3c2ce5c6c715f7dddb18991
- MD5 13f3948fa620d58ed6242262b575c784
- SHA1 8d8e32815bba106ba7452c7dd80bf6012d88def7
- SHA512 a74d3d704a075b390cb555864d531a49ce9e8ecf1e4314eb53c3f11a9486473160c02a9c03bdf6057d466f34aa87e3a53b50764bf2d493dd0dafedbc0fe22df1
- SSDEEP 1536:IuX+Mqm083ykKjsbDt1+PLCgmCZVLsDTvNIW97tXm6LSDfUW3jTzBHk1mTl0tNap:ut8Hv+P2JDhZvEcMzpl0P0bQnUBzt
- TLSH T17AA3125C52106FED60B915C352E2D5D47ECA645AEB9B34C31CF7E2A8293B7B4A2C0F01
- MD5 SHA1 SHA512 SSDEEP TLSH
XWorm V5.6/RES/XWorm.ACT.resources
- SHA256 b7ab18c6ddc022a4018d576dcafda0352984dee3a7cd0e4d4f45cbe0f4df2b85
- MD5 7b9622f29c461e36d8a4c3e27dffb741
- SHA1 5f6204efc91e64f42978f7c8c293346e27fb533a
- SHA512 49736fa0a285f837ba12a7067b803e918b2a39c21d408cbbb39ee42efebbf64a4a19549ac2b7d7ca1e4524dc85d38c1a025ae41b947f40a36d18767fd12a4889
- SSDEEP 1536:67ETH1QatyHkrVOceYM/pjq9bTQPmbYakBxBW/7jpYaGs:6YLe7HkrVOiqyTaxw7jpY7s
- TLSH T13D63D014F64CCB21DE2546B1002D4EF243B52DBE692C7BDA2D8DB29AD450F99FA10FD2
- MD5 SHA1 SHA512 SSDEEP TLSH
XWorm V5.6/RES/XWorm.About.resources
- SHA256 c403d852d1d8693c70b23199af2db9e70dd7d540e62c95bb8ee295022ccb9ba1
- MD5 dba99ce51cb7cf664617714d7c5d0664
- SHA1 79bb6210c1a5d3e37c93143d39c385445e167aac
- SHA512 1e09bf3bf45dbf4e8b7ca9b7e222f0382305d73ef1ec9626b5bc6414b6e1709265da1e4995cec56e187df251b18ecea9778e52850ff8c33385632ed395dc439d
- SSDEEP 98304:J5F/i9sHzcTiT38Ed4ihzD3w38dXdvinSh8q:l/BAe1d4ihvy85JP
- TLSH T1E3F53329D6658287C83471343892C1B47A81286C67F8FA3E66C0BF4850FE559FED1B6F
- MD5 SHA1 SHA512 SSDEEP TLSH
XWorm V5.6/RES/XWorm.Builder.resources
- SHA256 2cd4edf6e3fcc6465e393ecc856a6f5ddff29ccd38da3c784dbb5eeab6c3d3e1
- MD5 fced32c3b698eb4204689d5ab088caba
- SHA1 fff555f9eb79f9226221d1116776e2ac4dd45d3c
- SHA512 53ad5d2b03e3f561ac55f3274d8a2d1a552490a577e4f44076be8e395981f25b6142b218fbc019a5bd19f32d6a57a196be8fa6ec9d453966f398d2feabf57aca
- SSDEEP 768:6YkB9omkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkfFakkkkkkkkkkkkkkkkkkkkkA:6r9oNnJHyh/HOL
- TLSH T1A6B3DE24BA15C41BC6FA35F0E055C999B3EA5EA43BC0FC2A7D42B30C14B70BC925F5A5
- MD5 SHA1 SHA512 SSDEEP TLSH
XWorm V5.6/RES/XWorm.Chat.resources
- SHA256 9388906dced6dafbf91726771e55b4d07f870790ca6a7e5ded930d812cd13374
- MD5 8dca4f7300e5fe396ef7401b5ac9b450
- SHA1 fb91f139fcae116bf834292c47757312162bcdcf
- SHA512 f355ac08e80d1b513aa40a9b1bacbdd4d2ddea2c645156fa55521a93c759a4cf4e6a605254bac02fb9c1b7eb43ad72b75fb293720bbd2d114d77e407236a07f2
- SSDEEP 768:r/Xxu2kkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkF:TkE316
- TLSH T199A344C5AF74A007C93812B06463AAAAF8E32E157F90F14BEF0AF39D04754AD42D7D16
- MD5 SHA1 SHA512 SSDEEP TLSH
XWorm V5.6/RES/XWorm.Clipboard.resources
- SHA256 18b66195ef662a04125191fc381e1181350ad081667c6437e708d29573c3822c
- MD5 98d7b91bac73c075f30116b9bd3c67f9
- SHA1 b9e705565a4ff351fe36486f12fca717915707af
- SHA512 23e542a75c1c546343c7ab236b103b47fcace224791eaeacd4fa7fe376e69b4b84773a30d7f13991f0d0b3e5b245b00252089c0c89125cef55034a06048011eb
- SSDEEP 768:mPFvvvmjF2/2KZeQ46XhNcEqnKqaglXXI:mtvvvmjILp4KNcEq8gt4
- TLSH T103B3E379E581908AE9B12EF9040AB2EC5508BE624E8D1D1DBCC5B6BEC47400D7C6FB77
- MD5 SHA1 SHA512 SSDEEP TLSH
XWorm V5.6/RES/XWorm.Clipper.resources
- SHA256 fb95146658664f1a39e459d914dd6de69b3b946cc433e9927998b2e6eca2e185
- MD5 38d4e87d0095a63194c0cad81bc211f1
- SHA1 a15531063c6c341094a05d325a32808eb06d1f65
- SHA512 93589625ddf9979d348bf252bcfed5039241ca1860a8d647761220b6b6343161bff73294af80600aa525b251b7e2881985c2c939be672ded827a9071437d50c8
- SSDEEP 768:1QinR1KLCUAgc9h6RVTqSXFbnPHHWygDHS0Zvq3Sa+OGapJ:++vKLOsVZX9PH2ygbNvq3SazxD
- TLSH T1B8B3C54725E5D053F91A1BBACB51FDB8091B2DFEFF120A5A40C2BBE91231246DA13673
- MD5 SHA1 SHA512 SSDEEP TLSH
XWorm V5.6/RES/XWorm.CustomOpen.resources
- SHA256 598558968242dea51f96c5733c13bb430ef5444364acd72c7e47300ab760547b
- MD5 3c655ef71e0f2b716ed5a89c9b11ae2e
- SHA1 433e4a0b3a074e8df88989b31297ee38d83a98c1
- SHA512 03e457011d933cd4c4514a8c144fea2458efdedfa1ad4f3b28e963682f3c0b71f456bae40cbe15864dd527ef0dc22e0f141b7b3a5b8f02353514b26a861bc70b
- SSDEEP 768:pUUiy7kkkkkkkkkkkkkkwJ2zcrq+5kkkkkkkkknpmU0GDkdz2EapJ:LwJ3qR0oD
- TLSH T149A33110E62488AFC43BE431D482C59B79D6AC577B68F3466AC4B218283E13E5E7771F
- MD5 SHA1 SHA512 SSDEEP TLSH
XWorm V5.6/RES/XWorm.DDosAttack.resources
- SHA256 f5d6acd85a0c639a1488802afd8494c712df2925276217f71fa3540bf11e9f4e
- MD5 c84ccb00cc3e74c2aebcf95d31d72b08
- SHA1 67e30f0f0c3472ae96898e18002a8332ece8509d
- SHA512 a27090fe6877fc6df3ea0164b80d337871e2c1ac9aaa8718e2575aae1cb0533dd158a26d3c42ef73770c6fba78b41d1f1bdfa1259c7eb9c042a1253a9fe2e330
- SSDEEP 192:rkvwKwq6k94PfBMao1p1/Z+NhAaOSgG59A888Tf6Z:rkvwKwq6u4PfBO1p1faONG7A888Tfs
- TLSH T1ACA3CB39BC25AC8CF88636346924F3D21B717E4AE9C84507F15D729EDEBE02872CD196
- MD5 SHA1 SHA512 SSDEEP TLSH
XWorm V5.6/RES/XWorm.EditReg.resources
- SHA256 d1e026edbe1d06e58073bca992133a94cc495fe8958d7de0c229e9f6a4a23253
- MD5 5fec710a19fe099ac9928ea500ab63b0
- SHA1 5f539bd8383c61470b2839bce6c8e6a9eb966e55
- SHA512 f91027078a3b6384ad9db49962d7c398204d48f632a77c3f423e5cb5034d71012fbbf1d6bbdf9b56968861f34ad2e5e74bf9efb3dde1736e23b0dc29a7b880bb
- SSDEEP 3072:0TTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTLD8:a8
- TLSH T123B3AACCE4A6919BD07E58761FAC8EB66E449DD534F334BA2D8CB39D023628C9D071B4
- MD5 SHA1 SHA512 SSDEEP TLSH
XWorm V5.6/RES/XWorm.FM.resources
- SHA256 697350ca911bb5af342a5485dfb5787bef0541526f053f7cb559fbf005e66333
- MD5 16f2d71e8e805a3d8678576532e45cb3
- SHA1 69116054f7a15e73b51bb0145d3cba80ec362297
- SHA512 f327d1fbfeaabed971d2255da64ab4875aaa2b8923113e62cfed68b4dc5643c07a33eadb473361a7ad30647470b744ebfffd8d806c28dd35c1681158504bc8ee
- SSDEEP 1536:Fikp4KNcEq88sXgAHWOIcK7ETH1QatyHkrVOceYM2mX:FixF8JjHVKYLe7HkrVOiVS
- TLSH T1F104D3A036C15488CAA40E38C5AFA78051363F6A5A55950FF0CD3E4EBFF7107561ABBE
- MD5 SHA1 SHA512 SSDEEP TLSH
XWorm V5.6/RES/XWorm.FilesSearcher.resources
- SHA256 8f6b3e617286b240c1117bf6cda40a11bd6d59d2a94ea9b9817730fec7cd3d70
- MD5 95818cf2184044335cdfb896b28843ff
- SHA1 037e53ddd857c9dcc49ba02810179d7ce8437069
- SHA512 a63e479aae870b623d1dd057b6814f10510b54e74e232a16b269acc2435fc36f7a7a19341d2b1de79bdab0603ff7b0cddc698c6b9e73fed52cd4c6e3e955e289
- SSDEEP 1536:fqZScK4323F5VLx9WXjbR2H8fsKFBT2L0RjpY6WjvhY:ffRWXjN2asKFBZxpYxvhY
- TLSH T11FE382E2E1084685F9341E71F670BA6DD21DFC5E9A8CA851138E71488D7EF8A6C3BCD1
- MD5 SHA1 SHA512 SSDEEP TLSH
XWorm V5.6/RES/XWorm.Ftp.resources
- SHA256 c497bcd280f3f33d1b49d4e7dcac03434c20bfadf435a71b0eb501cb74eba68e
- MD5 7c65f0d2d6700ea2011d8cf8698ce129
- SHA1 b1af1045a19306cd397ef3f87ecd26b7060fa778
- SHA512 d76e7470f5c2f152c699714837d8d6d046edb0953e016af3719b48f9155771e47b3a8a160f0074f96287fe2cc26f38cf9ef581b1c2dbaa4a4b579c7ac48a1e3a
- SSDEEP 3072:9BMaTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTLD8:9BMo8
- TLSH T1A2B322406A00F549E4BC743F58E747D391387BE48AE1866A6BA0BFDE51BD46BC2E0334
- MD5 SHA1 SHA512 SSDEEP TLSH
XWorm V5.6/RES/XWorm.Fun.resources
- SHA256 d1e2cde8706b7574139a8d0843121fe4b469e191c64bee885b16f53c398c0634
- MD5 03ed9f7cfdc4c4022748d28866ab8392
- SHA1 14c6e19f536fe87b36ca19af03ef6808a27eca42
- SHA512 37ca143122078e3412eaf01e3120b36c43c0acc5e4a0f3b625fe8c661fa5e07a9579565a29854f80b9e510da6bc52ebd041c6ac543e32796e74b4ba338e47ea9
- SSDEEP 384:rkvwKwq6udiHHHC3P3P3P3zXqvbvQYmkvbv:m3P3P3P32vbvQVkDv
- TLSH T10DA3C12BA91FDD28FC503379DE45B1D5611C2E2E9CFA44FBE688FE0E743A10594E18A4
- MD5 SHA1 SHA512 SSDEEP TLSH
XWorm V5.6/RES/XWorm.HApps.resources
- SHA256 d7fdbbfacc23d6cb577df5908678ea33a458f5ba0b96359efb5ca1839bfd086b
- MD5 60f80d71c8d9986035368b61a80ec39c
- SHA1 9336b5bbda4b1eb92d8b5f7cb99d482ea74964e9
- SHA512 3411e36495e958706e1bd9f37551daa76e2bacfb5bca242ff8a20921437c443f1b91aa28c25526115ad7248358d2e29d62f0de3da6aa63e7cca6aa39517d8f29
- SSDEEP 3072:OUjCDfWaFnj2tpyTaxw7jpY7kESYLe7HkrVOik9C9R:OsQW7kEubq9kwX
- TLSH T168D3D0E8B68D491BCE681635002179C519BABEC48EE1B52E7D8DBB4C1C3498F0616FF7
- MD5 SHA1 SHA512 SSDEEP TLSH
XWorm V5.6/RES/XWorm.HBrowser.resources
- SHA256 3ff03acd8bda3bba40e14064dcedcf188b5c5d9b1c899920a0ba49238812ad03
- MD5 1b4955c4d297f43c89a4db73f0054346
- SHA1 d90fa8dbb8897ff4a565b8b019186fd13e0807a0
- SHA512 ada52944b61e64d28b3ca7f8eb75601a287b6d5c90b51d0707bb00ca697638589dce8469eadc738b45ac5d541908143b9c3a02b5c6d0f51b1f3df1fc2914e8c2
- SSDEEP 1536:opx1pWvE2lPpjq9bTQPmbYakBxBW/7jpYaGlVf01NiPu7ETH1QatyHkrVOceYMs:opDpW86pyTaxw7jpY7lELYLe7HkrVOih
- TLSH T1E9930219B78F0936DEA14A33153559C6A2BE25C66C36762E379FC22E590160E3720FB3
- MD5 SHA1 SHA512 SSDEEP TLSH
XWorm V5.6/RES/XWorm.HRDP.resources
- SHA256 f8d74378cb9be4608271a4d4994ef57ebbdfeab037c90c913c39ae3d89c9fb57
- MD5 fa9343a592c72c5624ee76c157265bb3
- SHA1 570197edaccd2c58f1c1d6a96a92d031933b6c71
- SHA512 a5e99e9645be0d6ce506635eebedf1307615d44c3bd85ad91f29a45f86685c1a9833df150d7bc27a19182fa73b52da2ca97c33c0337faf18052bc4f3be457640
- SSDEEP 3072:c4jEWtQbQEm/Q+NQMQSQ5QnQ+QYQQfQQuQQJQQzQCQlQbQQzQAQxZsgBTYUwmfJX:z
- TLSH T18DA32160A951D3CDCC3854B5E45F82A31C45383EDEA9D420AFAFA3EE40FE061497B963
- MD5 SHA1 SHA512 SSDEEP TLSH
XWorm V5.6/RES/XWorm.HVNC.resources
- SHA256 c1eccd021db7b1d686e10cc6aa14505a21386723fa85d2e7eea6adf361a92335
- MD5 cbd7e355e5a99120d510874ea6dc5c83
- SHA1 90e324eaced544ec96e4f773ee8f65687b2e7661
- SHA512 1e3accd3b979dec6268acd56ec9fd30f4ebdbd6fac3090e9af13f9f39dc437ad69abee431747597408ed1ae3a402bf795ba06ddd892c5897796d45b6e4aa98a8
- SSDEEP 384:rkvwKwq6uqWHMDzelakhLZS3UrjTgwE/9xxNTT0TTbo/t+H1wLzzWySGjqu9epXY:QselVg6n89zNTT0TTe9jeXWzSg
- TLSH T1C9B397621A6AAF93C5F9047EC13D6D479983DF94A21CD009A1C53A0D4BEF457FBF022A
- MD5 SHA1 SHA512 SSDEEP TLSH
XWorm V5.6/RES/XWorm.Hash.resources
- SHA256 f5d054da5630a8fb711ec674feaf8597d1219a72cdfc6d4ca4d7e3806c84812c
- MD5 cb331a72ba58813e6b3924749bcd6390
- SHA1 18009c5eca68ae32598c3200fca3782c5b1e443d
- SHA512 98777f7558a4af46b2469d4ab4dfa4e92496e3bc1fe74401da758c902a59701ff8fd00268395e5c8a511c9d64af82af812c195b23d77d4d5b4f0a592594fa8ca
- SSDEEP 192:rkvwKwq6k9TCvWkGIlL9h1yhq9nZoWA/m7iP8Gp:rkvwKwq6uTCXpOsZob/m2
- TLSH T10FA3A5C03281A6D5DC32D2B10A49DAF12115BECD7B23A54634A87F2E79FD31ABD98F41
- MD5 SHA1 SHA512 SSDEEP TLSH
XWorm V5.6/RES/XWorm.Hosts.resources
- SHA256 3439ac9f2377613b6b499844fc39cb8c2e0958ffb22014409b5cea95c626e91d
- MD5 83793c37782eb28178b2196b51681877
- SHA1 88749fcbf6382cd36e1c94009ed7ae1404a07d00
- SHA512 c03434cf2cfe85b30a4526afee6a158b77420d2bf1350b73e3c02e9dc6febc5d9a7debb5287607dae9992467ecc49573d92ccc50a2334e0e93786936e92eb9f0
- SSDEEP 384:r0vwtokwbwq6u84ELf8Yo1TFE02rVaM3/2ptMx1bU2o07zwAWV:9j8N0Rxi2op
- TLSH T132A3FEA37043F401DD443BB1DE809996896C3CAEADBC48673544FE8D393A4AE391773A
- MD5 SHA1 SHA512 SSDEEP TLSH
XWorm V5.6/RES/XWorm.INFO.resources
- SHA256 501e089e1db08562e14f2750e406b0533d7b3aae3705e1973b29849cbbda6fb1
- MD5 5ee5eb03c4d8e504b7a996fd5410666e
- SHA1 dddcc286a7fa6cf82cbca91e1d9b67bdf9b2581c
- SHA512 e2f7acb328edf79899d8774ca9cc94574d12defcaf2ff9047b201a009d27ee7044cdfa0b761b11c1c8a12d3bf514f21bdbd35a538c52ce8b53d43a586a968027
- SSDEEP 1536:ZU4VmTTyTTRTTPTTdpgiCiCiCiiTExaFlM7ETH1QatyHkrVOceYMs:j/cFqYLe7HkrVOih
- TLSH T1C404E516B2C8A504E57498F0169C8B505036FF1FA8E95AB6F5CC39A6C8F59833E21FF1
- MD5 SHA1 SHA512 SSDEEP TLSH
XWorm V5.6/RES/XWorm.Keylogger.resources
- SHA256 89f3a42141b619bfd652c9825bcba07b91475997bac48e001e74dcd90bef754c
- MD5 a1778b17ac5f0f62b3771e9886e0acba
- SHA1 0a0d5f1a4fec5c677ebf29e0dbbe0ab7032fef38
- SHA512 1669aa46676ab5f03ced3463a84e2a99be0789e7649f50e6d33cbe6934a058ac1088660c457caafdf42d7bc4342fcd844c9811bd2d2a02efa7cad5ecd10b7a98
- SSDEEP 3072:S6F8jWZcccccccccccccccccccccccccccccccccccccN:E
- TLSH T1B5C3CBDAA366885BCC1E2C34CE659DA4DF877F5982E0B02C5343723E163D94684BA737
- MD5 SHA1 SHA512 SSDEEP TLSH
XWorm V5.6/RES/XWorm.MBox.resources
- SHA256 a2a724d05f289fe51f6a3639937c460764ee42935c6eddbd5f7cc7ab6d26954a
- MD5 ffbc6e01f688097960937446350eb01d
- SHA1 6753b872c838f2439e91fbab20671cdcd7bc3d1e
- SHA512 2cfa07a45ed9b8547a9ca303d66a71c943f1723fcd692d9d8f5f20f6ce9671e5e5f11bbb2ba7d6e41a27806bbbb7ecfd2f7e7d37af5420aa3c68b0f64dc9c6fa
- SSDEEP 768:hFGla/np/wpRGZPdKOqoJLTapjappD+2f:jDfd3ckHjf
- TLSH T115B30C2A71F1443BE8E8B4B1080595E68F7A7E73EB805E163198BF5ED6F5064E30B1D2
- MD5 SHA1 SHA512 SSDEEP TLSH
XWorm V5.6/RES/XWorm.MIC.resources
- SHA256 aa4f13af48d1d3b3735a732e90163e6d302fe33a8f0041933dc76427f099aece
- MD5 d079b64991e7ae90dcb355f1036831cf
- SHA1 980f639c4e3db7cea44ab28e40ccdd2c728ee179
- SHA512 e6e5e21438d7b60eb9f7b6d8cc9e2a672e15dd5af2cecdfbc63dfce8e371982abbb951ce052e731daec9c86f356af54e81623dc7e72ff36a802907345d52f6b1
- SSDEEP 768:moZmmittmc9ik83EavHr/QS99wkwcMPliv+j4bctbK:5etYOC3lvHr/39Kcki2jAMbK
- TLSH T101C3B13D77418880E4D80FF34B8493DD252EDD33AA8E0E77FDC866BAE6611154FA0685
- MD5 SHA1 SHA512 SSDEEP TLSH
XWorm V5.6/RES/XWorm.Main.resources
- SHA256 35a6f657c6d1db902ff3fbb3149e629acbf926c7c244bbce502c0b65cd2c536d
- MD5 8d7f5438261b974eaf34287253799b87
- SHA1 086e994fa1ce12ebeba3c134ec9af69244e8c2e0
- SHA512 2e33671bf500e8a3727181e14cea8be2d4f77d4422720710056676ce4f8e6b4b2b3a9f38a0713750e7363c52af097ebb5c489c45d46c5627236d6afc81e67f67
- SSDEEP 24576:nm8179dddddNjYkDTFKlDy/Y3BZabuwVAeNgFfWN:nm815ddddde+MlDyg3BZaSI
- TLSH T1ED95F52B3756F92CDF3806F63A914FD2659A0B5F64304DF9204223BA35DA6CC71A93C9
- MD5 SHA1 SHA512 SSDEEP TLSH
XWorm V5.6/RES/XWorm.Maps.resources
- SHA256 f690fd15ad3c3150a48fd33962b44ec118bb3f9b210f0d0b27e3ee83420c73f4
- MD5 ed0eb94f77f681a3600539bb9a6cb6f5
- SHA1 b176e3455cd0224448e9d9b4b015789c794d8b06
- SHA512 8e097d3d8617043419154821d9721bd4f7e16f12a19f7e8873c8086872540c61e4d932e43515573eac08372a243c0ead855ebfe5488a1e6e53142c44cbb5eebb
- SSDEEP 1536:jjbwDfOmcgfteiMWWZoSp9wmLZoSp9wmT:nSfO0tkZAMZAA
- TLSH T1F8E3F2C47E4AACB4C4E6A170F75590B21318682EEB61C0C577C47E8969EF0538ADFE4B
- MD5 SHA1 SHA512 SSDEEP TLSH
XWorm V5.6/RES/XWorm.Performance.resources
- SHA256 16ea3b81c6f9ad74d27c621f0b8485929dcbe293435b151124c388aa66f09c52
- MD5 4c7233c83c2f749762fa0e000021e5e3
- SHA1 9b1a4826da8279f52aae9cf29570dd2679ada1bb
- SHA512 0f9b830fb139173f321a78b32b3166271cd5345df85b63b2a797e38cf3fa441715cc648e89768bf12bcdfcdb621273eb53b62d6fd66f5cabf6b8c40d3474174f
- SSDEEP 1536:LcP/zyxY/FVGJ+j+chraMRNPnLRhtAN4RRH9nl85gi:yyu/FVG8jbraMRDA
- TLSH T139B3602C7002E7A5DD143A705DCB867805292EE9A54AF32DA2A77F2C6FFC329D513235
- MD5 SHA1 SHA512 SSDEEP TLSH
XWorm V5.6/RES/XWorm.Port.resources
- SHA256 bd3da4a9c29cb564c774bd8b8c0b79078f09b037cf2f3a8fa2566648f68a012c
- MD5 faf23924f3c859e9d570109d930928e1
- SHA1 6003549ef256bac573ff809a9a5d967b8106f9ab
- SHA512 227f0c0245ff48955a1ba95fcae513237c1d4f548ccba955c4b26a633e7330a312fcdea474dc87f2847b51a3694427f5227f60a77dd5168760cf28b770ee3fd3
- SSDEEP 1536:wi2AP+ew+ksEvCwVwLM+uvpIVyXJyozbGyMqmyVttdGFQeOPigp3dIHyYNSL:2A2ewhLapuvpAsZOyMqmyBeYVYi
- TLSH T1F5D359A5ADCBDDE7C25B25B48C429575203D9C6F5DFB001722813B9DEBBE8AE0395803
- MD5 SHA1 SHA512 SSDEEP TLSH
XWorm V5.6/RES/XWorm.ProcessV.resources
- SHA256 1e1b3bd4c4dfe056edf30fba8d6bbf94665e9bcf936ab06db79213e8b400b61f
- MD5 abfd25fb3ace375c63f8e9cd4ecff32c
- SHA1 d7b7f30bd62e17e1da6bad889b9f77d93c795039
- SHA512 d8c0546d1ee9a35a7b8a3b9304ad63794b1e71d014f8c45145b60343f8140457a8711065f7a2aa87e68e1d564a45171425adab9b83adbe9491afe065d990fe0a
- SSDEEP 1536:io7ETH1QatyHkrVOceYM4pjq9bTQPmbYakBxBW/7jpYaGs:VYLe7HkrVOilyTaxw7jpY7s
- TLSH T1EE63D117B74A0EA9DE195F3304A5CCBDA26925C7BE3B542F3B8F515E64202062734EB3
- MD5 SHA1 SHA512 SSDEEP TLSH
XWorm V5.6/RES/XWorm.Programs.resources
- SHA256 55c19900015145bee8c83f27ca58032550871a92047abf6166dbf547b6afa505
- MD5 9f05c761cba903361771cea155ede6fb
- SHA1 af0311816e6f1315bf29e5a42ac3d75adf71d115
- SHA512 d4e049c341deeb7376e7def96e071808c9e04e085171b46af7f7096f52cf4288df19d3c2aa2c87816a6eaf5feb3f2257bd58e93f582498ad8e4fd4bcc652859c
- SSDEEP 3072:XfH6ZxP8NJAceI82I98CBCYLe7HkrVOiqyTaxw7jpY7s:XfH6ZxP8NJAceI82I98CBebq9TW7s
- TLSH T109F3F79F67DA5050C8AC0AFAC223E54186233E6D5E3A36E61BD8779C8F7B0C0D146677
- MD5 SHA1 SHA512 SSDEEP TLSH
XWorm V5.6/RES/XWorm.Proxy.resources
- SHA256 ee84fb0146a0a7e6bb8506159eaf12fc2888ae87b0553e1cb031e044830584dc
- MD5 d6e648329cd1473e66a01a9402e907d7
- SHA1 ebe34259546be5638bde8ae75f96d6f70e3da62b
- SHA512 0d44e33084f163b0d56798ace44294825fd76478acf303ca03bbdf6dfa286cf8cd0677c50fc1a422073ec7498d13aeeaebfb89b1a4eefd55dd010c6c23c1a7ec
- SSDEEP 768:+SEnnnXXXXHXXX/fffbyuyuyuyonnny/vXH/zLHvEppicZXvZZHf+m:+SEnnnHXXX/fff3nnny///zLHv6JZ/D
- TLSH T18BB3CA622D25AC5BF74501B26876FFF8167DCE4C8EBB59B26A50FA3DCC3092CA1091D1
- MD5 SHA1 SHA512 SSDEEP TLSH
XWorm V5.6/RES/XWorm.Ransomware.resources
- SHA256 bcea581804fc0d0e1d66c76a47f9b7bd40b81578bff0241bb4155a0c67486a46
- MD5 c653b8b3f18eb2a2882c2f3905b2380a
- SHA1 62235a88bc833fe7a41c9da2e5766306a026e144
- SHA512 a01927f5a4f3b1d838919074c42125d60d6e50af3e876bf614f0dd264627234973ba4b642f30040332c328587340be82f6057a5130baa0d79851fede67069a4c
- SSDEEP 384:r0vwtokwOdwq6upS9LvgUuYkYezHbMTb7+JZf5NXJAdDzMwA6jp:Y9XuYkYez67+JZ58zf
- TLSH T17FA32318FCA35E5CEFA47F361E9361FDCE1118E42506C71668AB279A0F3C09765233A6
- MD5 SHA1 SHA512 SSDEEP TLSH
XWorm V5.6/RES/XWorm.Registry.resources
- SHA256 ce34680ff2984c6c4766889684a358358711d2cdf3171813ff768d7f1c9c53de
- MD5 d098b950169502933b9ef1f417f25172
- SHA1 8f40b86fa8a986588788676ecdcad5bf55c586d7
- SHA512 4a38f88db6a585d6a47e6da36ac8aceb15825453e5ff4804b2943be9e4053fb85206e473115e72a86c4b0c2d13fa9a1ae18ed7d96b52edd050e7e918fed33317
- SSDEEP 1536:6s67ETH1QatyHkrVOceYMa7ETH1QatyHkrVOceYMJ:6NYLe7HkrVOipYLe7HkrVOi8
- TLSH T1C404A2CCE8A6919BD07D48B51FAD8EB61E445DD934F330BA2D8CB39C123628CAD071B4
- MD5 SHA1 SHA512 SSDEEP TLSH
XWorm V5.6/RES/XWorm.RemoteDesktop.resources
- SHA256 1dc136b225528fe4ee8020f46aa549e4bbdd76493d0579b6c1837d10acc3ba13
- MD5 0f5fc0694c9d76a6fd5b7e4158fd03e3
- SHA1 aa7eb852f5743e456e5737ca25e7b75ca7349b42
- SHA512 af3c1ff80a247ac8ee6440ff4410460603430f24557dce392b90961b77a2d978b6b75a9a606ca433ce16cc565d07c2b5fc41413c1229147194b24bbc1869c67a
- SSDEEP 384:rkvwKwq6uD0hAAAgAAAgAAAgAAAliIGzl8nnnJP5JJJJRetmJJJJ5gCnnnsjBy:rDnzly
- TLSH T158A34707C4CEE666D138593B14BFACB361B9EC09C551EC0E8834FA7E68F64E24C89576
- MD5 SHA1 SHA512 SSDEEP TLSH
XWorm V5.6/RES/XWorm.Resources.resources
- SHA256 557058bd29a5eb55ef073ea9c4dec0baea1fd3f3f4bf2cdd5ee3dfd33735e93a
- MD5 34986e38b463873af40f694874c1f6d3
- SHA1 8fa89cdb7a394cf8093d548ca9db4652c703ee72
- SHA512 c1b0278e8c21e5c28204f692a5cf5ed16c8ada0c6022d7d38e70905255f3aeb5d2c0fd4549f0ed19ead52aa0ced891a8f9372123bf5e1710be004958750874e4
- SSDEEP 49152:OsP2WTJcLsk9Pk6gAK6BN2NQUe+ErnuVqjNhHXH:zuWTGLP9Pk6gAK6n4ldyNh3
- TLSH T1A0859E11F7B1C074C98A85318E29ABB591F5B71FCE10588733CCAE6E6F728D5C329A49
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detect Xworm Payload
XWorm V5.6/RES/XWorm.RunPE.resources
- SHA256 823554153d20aabf65c8635b7727dd6f26f14f79da929de9af8131314ec2c347
- MD5 147c16f102addfdd7b756b8ee1558b82
- SHA1 e9aa9624bb96d369aa905d14e03db625d17d00f6
- SHA512 2df2784f5284e0808224a58fec6e12f02a5e09001c77991bf643b4304d99b633a3511551ef42e2e64f1ad6e5de0a44ff2c3b358413dd6ea6a9b08c0dfc592c38
- SSDEEP 384:rkvwKwq6u29Ax59IWzT9DfLtFbm44XdZcGe5Eas1gMVuM:D9Ax5x9vtFbm44XdZNeG3
- TLSH T15BA33E35F623D887C5488870DA4F9C690B566F5C68A0518EE0FFF39BE931B524B2325B
- MD5 SHA1 SHA512 SSDEEP TLSH
XWorm V5.6/RES/XWorm.ServiceManager.resources
- SHA256 fc7906c147eb0066e6cee2a528ab531b6d0ad1eb0b0a4d2a32a1be422809ecb9
- MD5 776d31cf63f902ede47ccd1e09c463cd
- SHA1 a45e4761bc40019d6e5b72ece5d731c520d91303
- SHA512 f8f099d291b0ecab01d84d0c4f4480c7ea266cc79f1071d71c71ca3113f6c8594d82f192feb3b136be0e007542da1cc6a7b28b860bb3ee2e0e7747b75222bf0e
- SSDEEP 3072:VqR3kbym/bBGIgEJjHbD1yLHpkv+GhSx7BQFgfMyd9tbYLe7HkrVOih:lbJGcJj7D1cJkPhCprxbq9h
- TLSH T1E624CE292D4991C1E99A3473DC8DA58718B53E869BD0AF15B6487B2EC4F443CC32CB6F
- MD5 SHA1 SHA512 SSDEEP TLSH
XWorm V5.6/RES/XWorm.Shell.resources
- SHA256 7f71160fb4d68eda2e6af07f2b89416cd5668ffa5260dfbeb69391dfc5508586
- MD5 a3fea8391774bbb0376e1f69eb6ee9d2
- SHA1 96032202ca3dee1983d1990ae856112f8c832173
- SHA512 10a3c77631a0d1ee80198ffe430a0a389897201ef60a8f3e9beff5125545477d8ce6ea8fa5d186ef31dc4681b62048d71fcbb3106a88f22aaa08ee75de2c842c
- SSDEEP 768:aoR1HiAxeglYAQ8BXIHDiJ9zUQI0xV3PrEiv/ewrmTIgdEM7XoSxSdL5NCc+Y:ayheg/Q8B59zUQISXnFmV+Ib81NJ+Y
- TLSH T13FD3C8915181EE49D9238F3E501C95EC663C5E4258CBDDC03269BDBEEA72706DC821FB
- MD5 SHA1 SHA512 SSDEEP TLSH
XWorm V5.6/RES/XWorm.Sound.resources
- SHA256 7d7ca0ead2e362c4b2b4e5e7799b0bd115eff66abe9f7bb184734444142bfd9a
- MD5 d867ec78d12cbf85eca15722c1ffcca3
- SHA1 90dc339c7ad81447758eadd2535298cfc2eb1bcf
- SHA512 5bcbbccad3f71207e6c28784fa27e38d8c24c4d2edcdf3b55d5937974c63c9a8fe6ce311d6946ea13b669ade3c262f0c3bba82a330fbbb08a00bf066734ea638
- SSDEEP 3072:njXXX////ePrLaPp5+SRqRN1SMLVivg1AGA8JlT6rZQnmmQo:RPp5jyNQMLAvkAl8JlmNV2
- TLSH T1FC143895E457B0B7C8EC94BC78850AC1DE7C2CA66064598E73923B3C24FE40EF6CB569
- MD5 SHA1 SHA512 SSDEEP TLSH
XWorm V5.6/RES/XWorm.StartupManager.resources
- SHA256 73d138786a5f08114204491631867e44f5d1d60a683890509c7f69a78198c60e
- MD5 3e7ce35b2e085ba831d417d582b249b9
- SHA1 63926a8d61ef3eb1e9408e9c531ce35adba66886
- SHA512 27a6de57b2c88a8d1119232ef123e728b4f1bf9aedaae8caa026bdce9541ef61c4c3d5a59fb4c7613febbae5f5e19ae754c51a4ae9176f2eca5dc03d938048ac
- SSDEEP 1536:LasebR3b313F3F3goXjmtt32325JT8J8pjq9bTQPmbYakBxBW/7jpYaGS7ETH1Q0:L9eS5JyTaxw7jpY7SYLe7HkrVOih
- TLSH T11BF3AFE679440563E8F819B15881A18B3A7C1DC9EE401E96BD0CFB1D78F717CE709E8A
- MD5 SHA1 SHA512 SSDEEP TLSH
XWorm V5.6/RES/XWorm.TBotNotify.resources
- SHA256 6ec33992edc80f131e4a9f7f89fe9c9dba233f7c3bda8ce6e06711021e8645fb
- MD5 b219d1ee4ae25f781e5bc88165839987
- SHA1 bcb30240b697493fd238c0d611081200a0abc3a0
- SHA512 e4d013c746ca857a135484d908fd2fca6257236b8b3cba8bc10209fdbb5f7cb3b595da15618f4713eb5cdeb7033772f72c22eb9ef5022c337d1dc3ebba67c746
- SSDEEP 384:r0vwtokwswq6uTq4fffjfff+7f75ArrqWKwA+apJ:dfffjfff+7f78rqWnapJ
- TLSH T135A38D1AB19BA81AC72C4838ED53989850C1BC56DC5E9E06B4E4FF7D06B58CCBE23375
- MD5 SHA1 SHA512 SSDEEP TLSH
XWorm V5.6/RES/XWorm.TXT.resources
- SHA256 1ec2de5a4bb61ecb3a2e57da228d3c9f278853b21ead5553643bbaf6c6706b50
- MD5 9cddc18b39b043d9542e5f0989faabf8
- SHA1 afe5c5b7d6a978ac504ec272c1e8dcaaae1d5b34
- SHA512 b9da58a39c39cfa665e63af0ea206ccbdeaf7452f801b3d2d9bd89e643c3c729de172ff6f86b8389d94f2f0ae92153275f4cb1a30fc60fa93e5fdb717cfa4a8a
- SSDEEP 384:r0vwtokwzwq6uCoAf+q7xVsFoSNDUSh+w6HvQdBeQanPw9h+w6HvQdBeQRzrh7ji:2iB7bsnWfffJFB
- TLSH T186A394636903A053D07476B2CA8084A07AD87D9DBF7CF8676260FE5C34714AEB923779
- MD5 SHA1 SHA512 SSDEEP TLSH
XWorm V5.6/RES/XWorm.TcpConnectionForm.resources
- SHA256 5d1dcb82a528c97aa161d0ffa742032abdc3e911125d2171768ceeacf8fb9285
- MD5 84f1c4ac6a6d9b44bc830ab1129da3ee
- SHA1 55b207a19d11950267ce10e914c0b4adcad52f1c
- SHA512 4faaff764f6074216c5d9a5493e949ffa6e0cf32a74181d8141d0e3d5b5795d3afd3dbf79f9bd2890d37f420205cd75328d8e488424e139ea1aa7fc9898c0aa2
- SSDEEP 1536:ZLnTGFCnE2TeaHXvSQ7ETH1QatyHkrVOceYM/pjq9bTQPmbYakBxBW/7jpYaGs:ZTUEeM/hYLe7HkrVOiqyTaxw7jpY7s
- TLSH T1BE04E4D1E93B84B0CBD24DF29A1B778B12B91E668F1F501228B4B1E90791FCE143F566
- MD5 SHA1 SHA512 SSDEEP TLSH
XWorm V5.6/RES/XWorm.ToolsBox.resources
- SHA256 f6a8d146ab66f03723e3ab551b1579f695947cbed073727af9fc396b2613f62c
- MD5 73bda4b934275a61f1ca27e88299a29c
- SHA1 63cb4ac6a9b0dcac53dfc35bcc817ddf46e5e399
- SHA512 9f2b82b1971a195eea9401084edf15f33694b3ff757b3c1b71d80315425c6942a3e924b9fb2681419f256128257682565ad13d78570db41fcb3e9095269cfdd0
- SSDEEP 6144:626twOOCanAtwOOCantAHzfadhIVBfVBd:62iwO7wOf0I3F
- TLSH T167345822E390934BC43642B0F8A5C26C31F99E407B78FA9620D3791E21B995F9D1B75F
- MD5 SHA1 SHA512 SSDEEP TLSH
XWorm V5.6/RES/XWorm.VBCode.resources
- SHA256 0a8d6cdc13ff8387d4216b31384339e56fbe205ebbbdf1dc3f8f4d8587007ffa
- MD5 76d53ae7107963acbfcd4597019c7f06
- SHA1 6d01fa4b76be5007a5e1b6a7068ef32e8c09b258
- SHA512 8c5a7fae83626de3f87b0b6ab382e2b2d60e002a701c87d7ede28fd976d34e7d88d664a72c22c956c2f54e0b93150634e8ed535d4b04b2d65f2516d6cbe4a270
- SSDEEP 1536:fYWQm2zLGIBhvbXetsYOIw1AVLx9WXjbR2H8fsSp4KNcEq8YnFBT2L0RjpY6Wjvb:zQ1mInYW1jXjN2asvF8YnFBZxpYxvh5
- TLSH T11604E69374DE322FEC270936911FFAF15A75099007D68DAA6CA4221F406550B84FFEEB
- MD5 SHA1 SHA512 SSDEEP TLSH
XWorm V5.6/RES/XWorm.VoiceChat.resources
- SHA256 1e5b9f16f88c4de8c4a3ad03cb318815f92c40f89eabcfdd1ad0483a41113527
- MD5 9b4613ca9da1999c6b521410d75e417e
- SHA1 4671b2d8ce2280fefd6bd7aafbbf709ee0f554c2
- SHA512 a107f4d40581c2380b745a54640fd1ae5aa6ebde04310077074de22444b5adf3e64206c078cffc10725a77add0d023e52c2d763920e2e8941fd2f3ec58ec3e0c
- SSDEEP 768:V2bS6Pq2Ykkk+p/C+5hKf9wkwcMPliv+j4bctbK:4up2SFl5huKcki2jAMbK
- TLSH T18BC33B7EA2529002DC346EF1B95483DD2DDEEED82B61FD16FDE1BA79E97111900322C2
- MD5 SHA1 SHA512 SSDEEP TLSH
XWorm V5.6/RES/XWorm.WebCam.resources
- SHA256 0ff62be2bcacad7ddda3b3cc32fee9c0a1c3bb5d72d81318728c1805204b2433
- MD5 0a82ee1d886148e7b149c3b4745ab653
- SHA1 a6b3e0127fa58c4479d5cdc4bcaadd9b6e666424
- SHA512 6a13d2e45d710d80970dfdf0bc09ec0709fc88e62d22c4aa2cfe6c8dab18bee14e134d613b1fcf8204b70cd9950c82d040eaf718a97a8f64502d05e3ec9f6c0c
- SSDEEP 768:LVLgN8K///iee8xxpe7ee8xxpe7ee8xxpe7ee8xxpeTD28g806Pj8ql:a1xxzxxzxxzxx2n0Tql
- TLSH T1F1A35EBEE5638538E26C9EFC89795BEEDC3DE84A1819CD52FCC56A3ED12C84254B3404
- MD5 SHA1 SHA512 SSDEEP TLSH
XWorm V5.6/RES/XWorm.ngrok.resources
- SHA256 b7e3e334ae48421bd3cd08679d94614e3f5c2d5847aff6eb7e06532966a43013
- MD5 b776cefaa200763a77bf55211c838b3e
- SHA1 4296aecaec1f77623dafb7e34a76c8b25ef6bff3
- SHA512 19fbaa3369ff3424bcd6fdcd35c677b686bc465bb558e8933a93ce0997bf782929f4cb5c1e2022d0d3ce3f54d4fb6bff25b11444760972919d3ba0fc00aae7b0
- SSDEEP 384:r0vwtokwPwq6ub5wAlec7vxohnxNQI5EOyK/WdpcN6Y9F/2KWowAglB:JMKyqNri9B
- TLSH T16BA3393CF297E858C11C9EF94A0987EECE3CED5469628D49FCC27E3EE52181B944B251
- MD5 SHA1 SHA512 SSDEEP TLSH
XWorm V5.6/SimpleObfuscator.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 b7a6eea19188b987dad97b32d774107e9a1beb4f461a654a00197d73f7fad54c
- MD5 9043d712208178c33ba8e942834ce457
- SHA1 e0fa5c730bf127a33348f5d2a5673260ae3719d1
- SHA512 dd6fa02ab70c58cde75fd4d4714e0ed0df5d3b18f737c68c93dba40c30376cc93957f8eef69fea86041489546ce4239b35a3b5d639472fd54b80f2f7260c8f65
- SSDEEP 24576:FDy7cKOfkiRrXP5WtJvW1mpjSWr7uoZme1V86:+8/AtJes1LJ
- TLSH T149654A01AFE6C72BD69F97F6D87206142BF4D049B3ABF79F161863A91C837425C06227
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1456282
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
1.4MB
Virtual Size
1.4MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
948B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm V5.6/Sounds/Chat.wav
- SHA256 45f4136e58a5f749d125d2ab54308f81954d2c5b364b66013660a6c358845d1e
- MD5 832a3652fd780edcdb2439ec33532c0d
- SHA1 f0754ee6519d77700f5ee5b744b8c99386d7b577
- SHA512 3b3b55afcdfa00d9b7085b20ed52a7b4d8b7d403f5d0d1c539781db1a20257efd8c856e19b8f32ea33766a580690b498ff063849519691a9a4cbbcd3e9447cd4
- SSDEEP 768:QVPqefmaP5C3KduJn13jSHYHzIcr6DPW75Pvi3Fy5NQbIbhuJLA+LhDclY3Rp6:yP1mU5GlJnBS4TIQ6o163ofQ8b4Pfm
- TLSH T1B9235CD0E142DE00C4829D6ECE16E5E047337A95EF4B67173004BF6A39E35C2AA6E7D9
- MD5 SHA1 SHA512 SSDEEP TLSH
XWorm V5.6/Sounds/Intro.wav
- SHA256 e3e5029bf5f29fa32d2f6cdda35697cd8e6035d5c78615f64d0b305d1bd926cf
- MD5 ad3b4fae17bcabc254df49f5e76b87a6
- SHA1 1683ff029eebaffdc7a4827827da7bb361c8747e
- SHA512 3d6ecc9040b5079402229c214cb5f9354315131a630c43d1da95248edc1b97627fb9ba032d006380a67409619763fb91976295f8d22ca91894c88f38bb610cd3
- SSDEEP 3072:FU3hYG9X9JzhaLL5+QYKHZDa6D+4LT92KEpcP+b8FGUt0Ybs5e9jXjubLtNmBNs9:GjVsLL5lva6D+4P9llWvaGe9CHeBNm
- TLSH T177347CD2E104A690D83989329D1669954B233AEFFF8A33353084F73674E3442DB6D6DB
- MD5 SHA1 SHA512 SSDEEP TLSH
XWorm V5.6/XWorm V5.6.exe.config
- SHA256 7ea08548c23bd7fd7c75ca720ac5a0e8ca94cb51d06cd45ebf5f412e4bbdd7d7
- MD5 66f09a3993dcae94acfe39d45b553f58
- SHA1 9d09f8e22d464f7021d7f713269b8169aed98682
- SHA512 c8ea53ab187a720080bd8d879704e035f7e632afe1ee93e7637fad6bb7e40d33a5fe7e5c3d69134209487d225e72d8d944a43a28dc32922e946023e89abc93ed
- TLSH T171C0122940A8BD269D328A279252C962FFB022A2A024000CF02FAA670B3105D4257326
- MD5 SHA1 SHA512 TLSH
XWorm V5.6/Xworm V5.6.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 90f58865f265722ab007abb25074b3fc4916e927402552c6be17ef9afac96405
- MD5 56ccb739926a725e78a7acf9af52c4bb
- SHA1 5b01b90137871c3c8f0d04f510c4d56b23932cbc
- SHA512 2fee662bc4a1a36ce7328b23f991fa4a383b628839e403d6eb6a9533084b17699a6c939509867a86e803aafef2f9def98fa9305b576dad754aa7f599920c19a1
- SSDEEP 196608:P4/BAe1d4ihvy85JhhYc3BSL1kehn4inje:PuyIhhkRka4i
- TLSH T10EF69D107BD68006E47269B00A946AE199BEBEAF2B15D8AD30C4335C17F64CCF953BF5
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
15469470
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
14.7MB
Virtual Size
14.7MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
137KB
Virtual Size
136KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/Background.png
- SHA256 2f691caff7e1980cfb069d2608b6470b3a06cdb90467ce47820e8602115a0c5b
- MD5 c93ee3abeff4ac24936471f80b36ec7a
- SHA1 0120649571a4b692ff5d10aae8dd87dffd3a0f81
- SHA512 dd319d1eea708284588ff67268cb23bd7b5cde505f3a8a1e7a27a587920ee5877efa4c1d8264cae48de343cabbf11bbe457b49f348b46288765eeff45d20cab5
- SSDEEP 24576:raWlRrTw9AK8jrGL+sUGBcD1MoEX1r/HXKIIfnbY:r/3w/8jzG+OomB/HXKa
- TLSH T1041523D6478670A5AECAC71881C71F777696DFA0AE64436DA6031BCCC3C0D525CE2BB8
- MD5 SHA1 SHA512 SSDEEP TLSH
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/FastColoredTextBox.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 3701b19ccdac79b880b197756a972027e2ac609ebed36753bd989367ea4ef519
- MD5 b746707265772b362c0ba18d8d630061
- SHA1 4b185e5f68c00bef441adb737d0955646d4e569a
- SHA512 fd67f6c55940509e8060da53693cb5fbac574eb1e79d5bd8f9bbd43edbd05f68d5f73994798a0eed676d3e583e1c6cde608b54c03604b3818520fa18ad19aec8
- SSDEEP 6144:4FErOIif3RzSHh+20lXs1TzCeBcQeDbNlz7:eEeR52bmeh0n
- TLSH T1D274292422F84665E27F47BCD4B5A000D3FAB53699DFDB4E8B64A0DA2F63340D526633
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
346910
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
C:\Projects_CSharp\FastColoredTextBox\FastColoredTextBox\obj\Debug\FastColoredTextBox.pdb
mscoree
_CorDllMain
Name
.text
Size
331KB
Virtual Size
330KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/Fixer.bat
- SHA256 a11703fd47d16020fa099a95bb4e46247d32cf8821dc1826e77a971cdd3c4c55
- MD5 2dabc46ce85aaff29f22cd74ec074f86
- SHA1 208ae3e48d67b94cc8be7bbfd9341d373fa8a730
- SHA512 6a50b525bc5d8eb008b1b0d704f9942f72f1413e65751e3de83d2e16ef3cf02ef171b9da3fff0d2d92a81daac7f61b379fcf7a393f46e914435f6261965a53b3
- TLSH T10DB02B177482E290838004430271224D39FDA002C291F2C375224530CD84CF0C333795
- MD5 SHA1 SHA512 TLSH
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/GMap.NET.Core.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 58c755fcfc65cddea561023d736e8991f0ad69da5e1378dea59e98c5db901b86
- MD5 819352ea9e832d24fc4cebb2757a462b
- SHA1 aba7e1b29bdcd0c5a307087b55c2ec0c7ca81f11
- SHA512 6a5b0e1553616ea29ec72c12072ae05bdd709468a173e8adbdfe391b072c001ecacb3dd879845f8d599c6152eca2530cdaa2c069b1f94294f778158eaaebe45a
- SSDEEP 49152:ot12Gb/hz7ZsK9qY5uyUW57VC4IB1+fXhQ1hyCzMw/22fSg7gjxhUE/nbTC0xemh:oLbteKb57W1+PhQ1HM1gmJ/SZmh
- TLSH T152D5234D77FC068BF5BFDBBD7870069A8331F106AA37E30E15A154A91D23B818851BA7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
3002430
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
2.9MB
Virtual Size
2.9MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1016B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/GMap.NET.WindowsForms.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 741e1a8f05863856a25d101bd35bf97cba0b637f0c04ecb432c1d85a78ef1365
- MD5 32a8742009ffdfd68b46fe8fd4794386
- SHA1 de18190d77ae094b03d357abfa4a465058cd54e3
- SHA512 22418d5e887a6022abe8a7cbb0b6917a7478d468d211eecd03a95b8fb6452fc59db5178573e25d5d449968ead26bb0b2bfbfada7043c9a7a1796baca5235a82b
- SSDEEP 3072:k1GmgYqIY/0YSDBRGlDUqL63budipxj64m8HWYh3vHbFwMhLJSb+:lIO6rGloqL63qW62lJ
- TLSH T1DCE3BF6173A58D2FD6BF4BBFA46240C1A371E603F602C38D6D8820ED2897F5587523A7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
155790
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
144KB
Virtual Size
144KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/GeoIP.dat
- SHA256 bc07ff22d4ee0b6fafcc12482ecf2981c172a672194c647cedf9b4d215ad9740
- MD5 8ef41798df108ce9bd41382c9721b1c9
- SHA1 1e6227635a12039f4d380531b032bf773f0e6de0
- SHA512 4c62af04d4a141b94eb3e1b0dbf3669cb53fe9b942072ed7bea6a848d87d8994cff5a5f639ab70f424eb79a4b7adabdde4da6d2f02f995bd8d55db23ce99f01b
- SSDEEP 24576:0L/59ah0USm3uwl00odi9AnW1fUmdbxv6bA3wOzRAc3InsZLONMrZb:+/59a6USdi9Ues6bV6boLO6rZ
- TLSH T10C457B47FF0A85DB5845B91EF9019EDC5810EE76BD0A1335226E37ACA0B8360ECD71A7
- MD5 SHA1 SHA512 SSDEEP TLSH
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/Guna.UI2.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 c6264665a882e73eb2262a74fea2c29b1921a9af33180126325fb67a851310ef
- MD5 bcc0fe2b28edd2da651388f84599059b
- SHA1 44d7756708aafa08730ca9dbdc01091790940a4f
- SHA512 3bfc3d27c095dde988f779021d0479c8c1de80a404454813c6cae663e3fe63dc636bffa7de1094e18594c9d608fa7420a0651509544722f2a00288f0b7719cc8
- SSDEEP 24576:FIVZLRYIVQd9INo3FDbWX7SsOobBTEAjg+m+ZFNwaxwGoHQ/jzK+:+oWodbi9XFEAjg+m+ZFKaxw
- TLSH T1EE9508007ED0DB26D16B4E33D5E75010D3F2B4A26BB2E70F72D5A77C145378AA88A366
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
eb:22:ce:41:1a:e8:9c:9e:92:46:cc:c0:c9:06:fc:f3:4b:8d:c1:21
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Sobatdata Software
Chains
Feb 21, 2023
CN=Sobatdata Software
Subject
CN=Sobatdata Software
Serial Number
7a:98:1b:7d:3e:b4:86:bb:45:84:c4:3c:c9:a8:3f:db
Issuer
CN=Sobatdata Root CA
Timespan
Oct 23, 2019 - Oct 22, 2025
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 1, 2022 - Nov 9, 2031
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US
Serial Number
0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Sep 21, 2022 - Nov 21, 2033
Minor OS version
0
Major OS version
4
Entry point
2031518
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
1.9MB
Virtual Size
1.9MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/IconExtractor.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 440912d85d2f98bb4f508ab82847067c18e1e15be0d8ecdcff0cc19327527fc2
- MD5 640d8ffa779c6dd5252a262e440c66c0
- SHA1 3252d8a70a18d5d4e0cc84791d587dd12a394c2a
- SHA512 e12084f87bd46010aded22be30e902c5269a6f6bc88286d3bef17c71d070b17beada0fe9e691a2b2f76202b5f9265329f6444575f89aff8551c486eafe4d5f32
- SSDEEP 192:7f77J4cGYyfQknxLvIgyLY5xJeU5pPpZlEAs:HS2yINgyLYLJR5wl
- TLSH T179223809E7EA4B37DEB7873654134656E334BA10994FEF5B05CA50642CA73A00B12FBA
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
16170
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\HMJ\Desktop\IconExtractor-master\IconExtractor\obj\Release\IconExtractor.pdb
mscoree
_CorDllMain
Name
.text
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
940B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/Icons/icon (1).ico
- SHA256 115f0db669b624d0a7782a7cfaf6e7c17282d88de3a287855dbd6fe0f8551a8f
- MD5 4f409511e9f93f175cd18187379e94cb
- SHA1 598893866d60cd3a070279cc80fda49ee8c06c9b
- SHA512 0d1f50243a3959968174aa3fd8f1a163946e9f7e743cbb2c9ef2492073f20da97949bf7d02c229096b97482ff725c08406e2e9aa72c820489535758470cf604f
- SSDEEP 1536:RBrn6a7/Zu/M615kfNOfEK3EpQkGhD94TtcmeVQU71qiLSeznFkKeUqvllR/t6c1:RBz65/M6If+3Js+3JFkKeTn1
- TLSH T1DFA39283B511D2E1E5308A33E15BE9F10F227C5EEB5A281B7684FF173873151AE2791A
- MD5 SHA1 SHA512 SSDEEP TLSH
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/Icons/icon (10).ico
- SHA256 7a97547954aaad629b0563cc78bca75e3339e8408b70da2ed67fa73b4935d878
- MD5 ad1740cb3317527aa1acae6e7440311e
- SHA1 7a0f8669ed1950db65632b01c489ed4d9aba434e
- SHA512 eee7807b78d4dd27b51cee07a6567e0d022180e007e1241266f4c53f1192c389be97332fcd9f0b8fda50627b40b8cf53027872304a68a210f4d754aa0243b0c2
- SSDEEP 768:VDRRKECMsn3H2GkmPe3KUDlGEJ57ukb8rJXAtnvWrpLDvZ8EZN:tjls3WGkoe6Uso9T8r9AtnertLFN
- TLSH T1B9C31747A1281C21DBB0EE39A2DCC8BB594F5E79F1A6464C7CB5FC6864F68F1053AC06
- MD5 SHA1 SHA512 SSDEEP TLSH
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/Icons/icon (11).ico
- SHA256 3b64b79e4092251ebf090164cd2c4815390f34849bbd76fb51085b6a13301b6d
- MD5 1c2cea154deedc5a39daec2f1dadf991
- SHA1 6b130d79f314fa9e4015758dea5f331bbe1e8997
- SHA512 dceebc1e6fdfe67afebaef1aff11dd23eda6fae79eb6b222de16edebdfebd8e45de896e501608254fb041824080cb41c81ac972032638407efc6bfeb930bfd00
- SSDEEP 96:hc4i1w+DSf0RxO/Csg9nL2CupMqM4pSg36IfgT9A+QdwhFKQfkIvxIm3sW88H:qa+DSf0RxOQnLjoSg3hfG5/X8cOO88H
- TLSH T122123AC826B0CF07E6591B36C8B27FB5142D4DD0DAAA262B94CCFF4471A0FF87585994
- MD5 SHA1 SHA512 SSDEEP TLSH
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/Icons/icon (12).ico
- SHA256 84b48ca52dfcd7c74171cf291d2ef1247c3c7591a56b538083834d82857fee50
- MD5 4ea9ab789f5ae96766e3f64c8a4e2480
- SHA1 423cb762ce81fab3b2b4c9066fe6ea197d691770
- SHA512 f917059b6f85e4a25909a27cad38b1ef0659161c32df54860226ff3d858127d8da592ea9072ad41d5a9986dd8c04a37e9ad34e2251883a8c2f0933e6aa201414
- SSDEEP 192:8mEKEEjOjzSId77Fe0ggzSXlYtAMXa77gieRHw9S1IId:HUNdsgzS1EAEaHB8IId
- TLSH T13312C764B449D511C83A4139CC2BC9AD03250EF5C5340C1BA89AFF6736DBAC5131B56E
- MD5 SHA1 SHA512 SSDEEP TLSH
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/Icons/icon (13).ico
- SHA256 2e2f17b7dd15007192e7cbbd0019355f8be58068dc5042323123724b99ae4b44
- MD5 e6fec4185b607e01a938fa405e0a6c6c
- SHA1 565e72809586e46700b74931e490e2dc1e7e3db1
- SHA512 13daeb2bf124e573590359f18a1d962157dc635a88319c9ed1a2e8ccad6322fb081579e1e8fbe62ffe55c8286c2bc8acb251d572a4beb00641ad5009a380e513
- SSDEEP 384:AyIh9xb9bexqcmOg1/JuiiiiiilllllioiiiilllliiiiiuGxbu:9Ih9Z91hJy
- TLSH T1B674056F7E12B9BAC77856BF0810B18D59586C2696DCF103791FFB2CAC3DD076A09242
- MD5 SHA1 SHA512 SSDEEP TLSH
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/Icons/icon (14).ico
- SHA256 8fc693238afc49a8098dac1762bfae891e818bb84749c6eef5f1b0c6c8ffddb2
- MD5 0c24edec606abda7c6570b7dcf439298
- SHA1 4478a102892e5eb4bb1da8e9c62d17724965691a
- SHA512 f8de3ffb8f9fe1394b3626ae5616213d4612b43f0635fa9053d74ac6fe536657e796289487f245b8abff74f1de8368c0df8e56bf21f540366ed86a378649ea24
- SSDEEP 384:FY9tDXICTUj6Q+CUsn2JiAAA/////////A+AA////////AAAiA////kujYYFsG3I:+PMXT0
- TLSH T13574D45560B2F99CE512CAF714F0D5005DF2AC68AE6CA65EB9317FBE4E7708230867B0
- MD5 SHA1 SHA512 SSDEEP TLSH
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/Icons/icon (15).ico
- SHA256 b2f57a23ecc789c1bbf6037ac0825bf98babc7bf0c5d438af5e2767a27a79188
- MD5 e3143e8c70427a56dac73a808cba0c79
- SHA1 63556c7ad9e778d5bd9092f834b5cc751e419d16
- SHA512 74e0f4b55625df86a87b9315e4007be8e05bbecca4346a6ea06ef5b1528acb5a8bb636ef3e599a3820dbddcf69563a0a22e2c1062c965544fd75ec96fd9803fc
- SSDEEP 768:0nnnnnnnnnnnnnnnnnnnnnnnQInU2/gohN/yRUZZZZZZZZZZZaaa0KaaILjeuFgZ:Rkccckccccct
- TLSH T18E74051CB53AFC87E85A9E727E42E77588BE2C135F608841F604FFBE9639505A3D8811
- MD5 SHA1 SHA512 SSDEEP TLSH
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/Icons/icon (16).ico
- SHA256 3f3c5ce486e5b9fa88dc60b60916053e8808c69167df1a11287fd3cd6db1ca6e
- MD5 14465d8d0f4688a4366c3bf163ba0a17
- SHA1 9f1fa68a285db742e4834f7d670cae415ce6b3b6
- SHA512 01db4fac75136baf9c162265785877b21fba9c4b8d9dbe4e495191f15aa9c914e3d5baf1c4606041279a7138c7e5c8f4ccf6e64689354fc3fb3fa66ab3b1da2d
- SSDEEP 768:5As1Fd6jrW6QKysmsolxc4nvPQIfjRuw+mqbz9j1MWLQes2aXS5Cjr:5AMwflmsolaTIrRuw+mqbz9j1MWLQs2
- TLSH T15DA3D2F1A740C465D8A796B9883BDAA7A423A24DDC6C490D3D92FF0B7D723474027C9B
- MD5 SHA1 SHA512 SSDEEP TLSH
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/Icons/icon (17).ico
- SHA256 12f600b09c0db00877684a950fc14936ecc28df8f0ddc6821d68e4b82077ad92
- MD5 167425a3fa7114b1800aa903adc35b2a
- SHA1 601e8bd872ea31aff03721a0361e65a57b299cad
- SHA512 586ce1360eb06f1df8e95ad178abfae7c9d41cba1be55276b3d3947d0504ca09185e543b7dbf1ba72dde4942ff626859a6d2e8a1faaaf6c5daaebd8740dcf538
- SSDEEP 384:keGRHCUZYDikdQarfw8lGqMtxoYDQqrp0KR1QCOICdu2kkyPgE+zi/hScVsUIGVN:8fY/lVoTlR1vCU/he6H
- TLSH T10163C4D2F200C5A8FC398B75D53B4A7411137CBEDDB4A56F78887E2236B72A2402B957
- MD5 SHA1 SHA512 SSDEEP TLSH
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/Icons/icon (2).ico
- SHA256 142b529799268a753f5214265c53a26a7a6f8833b31640c90a69a4ff94cee5ec
- MD5 f1463f4e1a6ef6cc6e290d46830d2da1
- SHA1 bda0d74a53c3f7aaf0da0f375d0c1b5aca2a7aaf
- SHA512 0fa93d009cc2f007d19e6fdda7ebe44c7ed77f30b49a6ef65c319133c0570ab84f2d86e8282b5069d7f2e238547722ac3966d2fa2fae4504133f0001a0387ae2
- SSDEEP 1536:WE4NpLpq8Bb7RFRz8nqF+o2Hc0cccwccyccxcccMcccNmccdccccTccccncccNJ+:j4NpVq8BxFRzaqF+o2GQJ7/JzqVfGv2
- TLSH T186B30F6A8EEBB642C5425474797363814A3D1F78A4CE35518EF33FED5AF3CA521230A2
- MD5 SHA1 SHA512 SSDEEP TLSH
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/Icons/icon (3).ico
- SHA256 b2f7fb22cd5b935cf19a2f58f7fef9db99db40772ff4bb331a73c345161c2574
- MD5 a512719efc9e6ecc5e2375abceb1669a
- SHA1 51fae98edfab7cd6b6baac6df5ecbda082eeb1db
- SHA512 e0153dbc8f3fdda8d1a7082bc30a3895d7f4b3bc2982b4b4ece55653d1b4c293eba3ba6d4a0a581f0f7db95ab287d6616ef7bf03af4485904111798bf9d9e625
- SSDEEP 1536:Ms6se7llqn17KineXd2wwKtivEYoNRh8RX9EIKhI49NT:MsgbcUieNJHKoPC5+Ld
- TLSH T1C5D36CFF29A9491FC2052D78C249F735044EFD6278C6CA03B5A57E9FF23996A1C20993
- MD5 SHA1 SHA512 SSDEEP TLSH
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/Icons/icon (4).ico
- SHA256 5bb21d6c04ed64a1368dace8f44aff855860e69f235492a5dc8b642a9ea88e41
- MD5 9c053bef57c4a7b575a0726af0e26dae
- SHA1 47148d30bc9a6120a1d92617bf1f3e1ba6ca1a2c
- SHA512 482d639ba60f57827d8a343f807f4f914289c45643307efaa666b584a085fe01ac7892252f41b7756fde93d215b4f3fed16e608bc45102d320d77239fa93146a
- SSDEEP 1536:zVRUhw3TWxcZss+SP21wH7QOK/PPLr8zdYpizfgMRHGuTRLJHPxDsPsx3CXhRcVN:ZRUGKXs+S++7KFSbxeY+qDDrMY
- TLSH T1BAC32C2D5E4BB8DBE42449B558A6EBD10A6CEFA4F4E1169834E8FE3CB7D1474C500F90
- MD5 SHA1 SHA512 SSDEEP TLSH
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/Icons/icon (5).ico
- SHA256 45c85bdaaf0e0c30678d8d77e2585871ea6d1298ee0d30037745bacea6338484
- MD5 9dbdd6972e129d31568661a89c81d8f9
- SHA1 747399af62062598120214cef29761c367cfd28a
- SHA512 e52572de3f0d57d24a24d65eca4ff638890ccc9c5aca3f213ff885eda3c40de115849eb64c341f557d601f566ce21f8fc0df25cc4b13aaad5e941449a6b7f87d
- SSDEEP 192:sVLDqC6ot/2AlVx1qa6mgIwEk4w00wILxuudXCnadwyHXZ:EH/6A/9d1qDIwEk4w00wsuuXdwyHJ
- TLSH T112A379CB6E1486B7CB4CF63054A7B33C032BA83D6BD38E0EE55B3E59AB3265C9945105
- MD5 SHA1 SHA512 SSDEEP TLSH
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/Icons/icon (6).ico
- SHA256 6ea04cf08751a2f6bb2f0e994258a44d5183b6cdb1471a0ee285659eada045b5
- MD5 d7c9666d30936e29ce156a2e04807863
- SHA1 845e805d55156372232e0110e5dc80380e2cb1e5
- SHA512 3cfd7a41f65c5a0dc23a90c6af358179efb3ae771f50534c3d76c486fe2d432ea3128a46b4b367c4714e86e8c0862a7385bd80662fe6ea82d7048f453570ed56
- SSDEEP 768:LZe7enyslZ87gUcXmEHNBFNJC5jWb2NM2:Npysa7iAM2
- TLSH T1E1B3EEA41820C65DD5C4A776CD17B37D37882E5C14319B8A9270B8EEB23710D297EAFE
- MD5 SHA1 SHA512 SSDEEP TLSH
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/Icons/icon (7).ico
- SHA256 29d38c75af79aa0554f34cdfecb311f88f8dd02b02facaa299b9700841806ab8
- MD5 7891c91d1761dc8a8846d362e6e31869
- SHA1 0229bb01b7b4a0fca305eb521ec5dfbaa53674ea
- SHA512 ed14614a706da985566853dc13df0d1128a718f39ec9957320813803fe07e59de337d51033970e2f57d9f56da3546c506f5f0f3becfa91ce741576855be14ba7
- SSDEEP 3072:Y8SKfbzxcwg7es6/Vsb8VKTu549oJMfF/H9N3Ky9NzLn+:YUhcX7elbKTua9bfF/H9d9n+
- TLSH T1A6F3BF6D2E55CD46E9854C7544B7D3BCE66C4DB32E4C8912E72C7EA41B3AE483E22323
- MD5 SHA1 SHA512 SSDEEP TLSH
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/Icons/icon (8).ico
- SHA256 a65cbbdc2ca671a9edd7edac0c6737b3b116e357727e003e5fdeff163c6c21ab
- MD5 af1739a9b1a1bf72e7072ad9551c6eea
- SHA1 8da0a34c3a8040c4b7c67d7143c853c71b3d208d
- SHA512 eeeac307371c38b75e256083c55a3fe4ab096c1c7520a4b7acb40fad3af5a0d6c88aaf85f2c3e418034abee422c2a3ba13731adf7ee6078016da4dd2e989b120
- SSDEEP 768:ygjWAisCkoAbhMDB8dfO944J+IiIxzAILEhmtkW9iVHD:yOybBYfOS4J+1oEhyiHD
- TLSH T168B3A69A1D055BF7E70CF43480F3732D637ECE3A3E961E4DE9AE7EA862708491598811
- MD5 SHA1 SHA512 SSDEEP TLSH
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/Icons/icon (9).ico
- SHA256 bd1c33a67244801e828035904882ec53bd2ea8a1db9265a06d1aa08cf444ca80
- MD5 3e24e40b41ecc59750c9231d8f8da40b
- SHA1 91a701cf25aea2984f75846b6c83865d668ccad6
- SHA512 fe62edddb62dd4b695f1ef40ffb7a0119d480d1c176f0254acee19a45d6433ef6c308acbe567c721018390626c71f7a0f7bcd195d59d54c19cf019f13c4f7572
- SSDEEP 3072:HAZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZ+ZZZZZZZZZZZZZZZZZZZZZZvZZZ+:H+GIIIIIIIhIIIIIIIIIIIIIIIUP
- TLSH T13344EE606A050EBCEFE0BA78EBDD536513A52E91017B54CF13D03F8A3537E53BA9A052
- MD5 SHA1 SHA512 SSDEEP TLSH
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/Logs/ErrorLogs.txt
- SHA256 633eef2d5302c0c224cd71aeb7d29901564f30e5a9b3d31cc0a55c1c6eeb3d5c
- MD5 f77f4fb386c891a5640cf26473cebea4
- SHA1 db2fc673ed4b895561caf8670d1e40204a3d6fa6
- SHA512 47fe461ccb295c95d951c0499d943febdc7b9b41923bd03b9b0876e52abc220cde47dd4a3ff13e98f991636fc21b6ef5297b679dde8dcd38b51cd0648eea38f9
- TLSH T120D0A73C04B8D135F117E568761855724239603E61D782A829BBA2183AD6E36C13D92C
- MD5 SHA1 SHA512 TLSH
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/NAudio.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 81b3f1dc3f1eac9762b8a292751a44b64b87d0d4c3982debfdd2621012186451
- MD5 3b87d1363a45ce9368e9baec32c69466
- SHA1 70a9f4df01d17060ec17df9528fca7026cc42935
- SHA512 1f07d3b041763b4bc31f6bd7b181deb8d34ff66ec666193932ffc460371adbcd4451483a99009b9b0b71f3864ed5c15c6c3b3777fabeb76f9918c726c35eb7d7
- SSDEEP 6144:96/i10SZtfzWctj98vZcE0wmLlaIZs5eku2sX2hrjAzvgmXa6W9FwsT9idwktQZG:9yrSKMJR9aGs55T1X9Fwspi2tGpmS
- TLSH T156B45C2237E4962BD1AF5775E4E1191B8BB1F8423237D78F8684BB6E1D837924C407A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
d0:94:af:d7:9f:51:16:9c:c5:1a:e7:ea:23:e5:08:16:11:ae:03:76:1d:25:05:ee:5f:c2:9d:59:4a:68:c8:54
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Razer USA Ltd.,O=Razer USA Ltd.,L=Irvine,ST=California,C=US
Chains
Jun 3, 2020
CN=Razer USA Ltd.,O=Razer USA Ltd.,L=Irvine,ST=California,C=US
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Subject
CN=Razer USA Ltd.,O=Razer USA Ltd.,L=Irvine,ST=California,C=US
Serial Number
37:37:aa:de:9f:72:21:81:eb:6e:a4:00:21:65:fb:e1
Issuer
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Jan 22, 2019 - Feb 27, 2022
Subject
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Serial Number
3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Issuer
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Dec 10, 2013 - Dec 9, 2023
Subject
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Serial Number
7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Issuer
CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 21, 2012 - Dec 30, 2020
Subject
CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US
Serial Number
0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Issuer
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Oct 18, 2012 - Dec 29, 2020
Minor OS version
0
Major OS version
4
Entry point
510758
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\code\GitHub\NAudio\NAudio\obj\Release\NAudio.pdb
mscoree
_CorDllMain
Name
.text
Size
494KB
Virtual Size
493KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
952B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/Newtonsoft.Json.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 e1e27af7b07eeedf5ce71a9255f0422816a6fc5849a483c6714e1b472044fa9d
- MD5 195ffb7167db3219b217c4fd439eedd6
- SHA1 1e76e6099570ede620b76ed47cf8d03a936d49f8
- SHA512 56eb7f070929b239642dab729537dde2c2287bdb852ad9e80b5358c74b14bc2b2dded910d0e3b6304ea27eb587e5f19db0a92e1cbae6a70fb20b4ef05057e4ac
- SSDEEP 12288:GBja5bBvR8Q0TE2HB0WLmvXbsVG1Gw03RzxNHgKhwFBkjSHXP36RMGy1NqTUO:GBjk38WuBcAbwoA/BkjSHXP36RMG/
- TLSH T166E4394123F98F2BE1AF6B75B4704E1543F9F917A6B5E78F9A04D9A91C43B408E403A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
38:27:11:d0:35:02:fc:58:64:ae:1e:6c:cb:c5:eb:67:eb:5d:dc:c8:86:9e:e4:59:cc:0d:02:0e:5f:d1:fc:9b
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=Washington,C=US,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Chains
Mar 8, 2023
SERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=Washington,C=US,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
CN=.NET Foundation Projects Code Signing CA2,O=.NET Foundation,C=US
CN=DigiCert CS RSA4096 Root G5,O=DigiCert\, Inc.,C=US
Subject
CN=DigiCert CS RSA4096 Root G5,O=DigiCert\, Inc.,C=US
Serial Number
06:ce:e1:31:be:6d:55:c8:07:f7:c0:c7:fb:44:e6:20
Issuer
CN=DigiCert CS RSA4096 Root G5,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jan 15, 2021 - Jan 14, 2046
Subject
CN=.NET Foundation Projects Code Signing CA2,O=.NET Foundation,C=US
Serial Number
0a:de:32:e9:50:9b:44:aa:34:b1:da:f1:bc:0e:c8:73
Issuer
CN=DigiCert CS RSA4096 Root G5,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Jul 15, 2021 - Jul 14, 2031
Subject
SERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=Washington,C=US,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Serial Number
0c:d1:40:7a:5a:bd:ed:43:d5:c1:73:12:1d:38:c5:29
Issuer
CN=.NET Foundation Projects Code Signing CA2,O=.NET Foundation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Aug 13, 2021 - Oct 29, 2024
Subject
CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US
Serial Number
0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Sep 21, 2022 - Nov 21, 2033
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
0
Major OS version
4
Entry point
704578
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
/_/Src/Newtonsoft.Json/obj/Release/net45/Newtonsoft.Json.pdb
mscoree
_CorDllMain
Name
.text
Size
681KB
Virtual Size
680KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/Plugins/ActiveWindows.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 567b9861026a0dbc5947e7515dc7ab3f496153f6b3db57c27238129ec207fc52
- MD5 5a766a4991515011983ceddf7714b70b
- SHA1 4eb00ae7fe780fa4fe94cedbf6052983f5fd138b
- SHA512 4bd6b24e236387ff58631207ea42cd09293c3664468e72cd887de3b3b912d3795a22a98dcf4548fb339444337722a81f8877abb22177606d765d78e48ec01fd8
- SSDEEP 384:vRt5r7olU5QrGPbMrodT8ptsY7XZ1EDI6:vRtSRrGPb9t0Z1ED7
- TLSH T11F624968E3E44375C6FE1FB25C7363001370C6088C07FBAE1ADCA2569D5BA9D8B5176A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
20742
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
920B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/Plugins/Chat.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 aab20f465955d77d6ec3b5c1c5f64402a925fb565dda5c8e38c296cb7406e492
- MD5 59f75c7ffaccf9878a9d39e224a65adf
- SHA1 46b0f61a07e85e3b54b728d9d7142ddc73c9d74b
- SHA512 80056163b96ce7a8877874eaae559f75217c0a04b3e3d4c1283fe23badfc95fe4d587fd27127db4be459b8a3adf41900135ea12b0eeb4187adbcf796d9505cb8
- SSDEEP 384:4MOna4ifKQtuUvl0BY0iYUsBG/crwTKvh6GIKoIafWUWmfN:vKQtuq2Y0lUUG0r0pIafWXe
- TLSH T185821829939583B3C6FE2AF69D76E19043B1D211CA07FF6F6DDCA0AA4C933528341791
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
24714
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
16KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
856B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/Plugins/Chromium.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 b6d8bccdf123ceac6b9642ad3500d4e0b3d30b9c9dd2d29499d38c02bd8f9982
- MD5 edb2f0d0eb08dcd78b3ddf87a847de01
- SHA1 cc23d101f917cad3664f8c1fa0788a89e03a669c
- SHA512 8f87da834649a21a908c95a9ea8e2d94726bd9f33d4b7786348f6371dfae983cc2b5b5d4f80a17a60ded17d4eb71771ec25a7c82e4f3a90273c46c8ee3b8f2c3
- SSDEEP 768:6SyQlmUmBlEu0FXfjq2sgDrLjfcVJ5sN9aWdMIxbKhJ+GEq3ZsL5f62:3yQltmBlmFXfjq2sgDrLjfcVJ5sNkQOa
- TLSH T1CAE2294873F8C614EEFE0D75983865600372A143AD57F7AD0AC1A0AA1BB3B958D61FD3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
38630
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
30KB
Virtual Size
29KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
888B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/Plugins/Clipboard.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 e31a1c2b1baa2aa2c36cabe3da17cd767c8fec4c206bd506e889341e5e0fa959
- MD5 831eb0de839fc13de0abab64fe1e06e7
- SHA1 53aad63a8b6fc9e35c814c55be9992abc92a1b54
- SHA512 2f61bcf972671d96e036b3c99546cd01e067bef15751a87c00ba6d656decb6b69a628415e5363e650b55610cf9f237585ada7ce51523e6efc0e27d7338966bee
- SSDEEP 192:xh23MTInqHX7qRlrZk1/X7eOFXgNTer149iY6IW1mX/YWMqS7RSLOIU:cTWElV0/X7eUSTe5Wi2X/ShIU
- TLSH T1A0524C5863E4823DC7FD0AB24C73B3801774D705ED82FB2E1DD860A25E97699874276B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
20054
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
888B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/Plugins/Cmstp-Bypass.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 fa420fd3d1a5a2bb813ef8e6063480099f19091e8fa1b3389004c1ac559e806b
- MD5 cf15259e22b58a0dfd1156ab71cbd690
- SHA1 3614f4e469d28d6e65471099e2d45c8e28a7a49e
- SHA512 7302a424ed62ec20be85282ff545a4ca9e1aecfe20c45630b294c1ae72732465d8298537ee923d9e288ae0c48328e52ad8a1a503e549f8f8737fabe2e6e9ad38
- SSDEEP 192:KpXpS1QWlPkiqdE7FNNGGO9mWbpGkjgyaYcIW1vr/8TNU7aL7YiLsO08hdW5:Kp5IfL0mWbEkUyaYir/oNJL7KQ
- TLSH T1EB32F62CA7E182B5C97E0E7248A7E3111770DA049D23FB2F55E4A10A5D7734883A7B7A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
17130
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
920B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/Plugins/FileManager.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 b58ed3ebbcd27c7f4b173819528ff4db562b90475a5e304521ed5c564d39fffd
- MD5 641a8b61cb468359b1346a0891d65b59
- SHA1 2cdc49bcd7428fe778a94cdcd19cabf5ece8c9c0
- SHA512 042702d34664ea6288e891c9f7aa10a5b4b07317f25f82d6c9fa9ba9b98645c14073d0f66637060b416a30c58dec907d9383530320a318523c51f19ebd0a4fee
- SSDEEP 12288:bVnchrRTHcQ3nrn6xtI9qR5WcygA5KeirCDD/:btJQ3nrnMI9MUlr5Kei+DD/
- TLSH T172E418203FE8E01FE4AE73B5D4E1972156B4E6427296FF8F258056E80E833886C555BF
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
700934
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
677KB
Virtual Size
676KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
900B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/Plugins/FilesSearcher.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 e66e1273dc59ee9e05ce3e02f1b760b18dd296a47d92b3ce5b24efb48e5fb21b
- MD5 6f8f1621c16ac0976600146d2217e9d2
- SHA1 b6aa233b93aae0a17ee8787576bf0fbc05cedde4
- SHA512 eb55acdea8648c8cdefee892758d9585ff81502fc7037d5814e1bd01fee0431f4dde0a4b04ccb2b0917e1b11588f2dc9f0bfe750117137a01bbd0c508f43ef6a
- SSDEEP 6144:ZAHdfUpnnBuIbE7SCQeGtSV41QJDsTDDh0Yhe6dwxLV/Quhg08OwR75:yVUpnkZ7slS4Ys50ie6Cfzg0M
- TLSH T170A49E416BE8C657E1BF27B2C0E252A1CBB0E555A62EDFCF6D4025EE1C17340E9107AB
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
495966
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
476KB
Virtual Size
476KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
916B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/Plugins/HBrowser.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 75e8ff57fa6d95cf4d8405bffebb2b9b1c55a0abba0fe345f55b8f0e88be6f3c
- MD5 f0e921f2f850b7ec094036d20ff9be9b
- SHA1 3b2d76d06470580858cc572257491e32d4b021c0
- SHA512 16028ae56cd1d78d5cb63c554155ae02804aac3f15c0d91a771b0dcd5c8df710f39481f6545ca6410b7cd9240ec77090f65e3379dcfe09f161a3dff6aec649f3
- SSDEEP 384:tp33X3L5/QrX8nB9d13+6HcLReMWaFnp9l/1DRVTbg0Ut4xh+TfYMoKAB1R:tR3nL5/QrQ13kRR9bTbz+DYMoFBf
- TLSH T1F6B25B4967F49630E1FD0A75987367148370F6935812EF8F0AC9641A2E3B7E846247EB
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
31318
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
23KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
888B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/Plugins/HRDP.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 4aa18745a5fddf7ec14adaff3ad1b4df1b910f4b6710bf55eb27fb3942bb67de
- MD5 f27b6e8cf5afa8771c679b7a79e11a08
- SHA1 6c3fcf45e35aaf6b747f29a06108093c284100da
- SHA512 0d84966bbc9290b04d2148082563675ec023906d58f5ba6861c20542271bf11be196d6ab24e48372f339438204bd5c198297da98a19fddb25a3df727b5aafa33
- SSDEEP 24576:3rKxoVT2iXc+IZ++6WiaTAsN/3ebTvK+63CWH8iA/iD2hgPjcC8SVdKumYr7:WHZ5pdqYH8ia6GcKuR7
- TLSH T13B851918F6D8423ED857D2359A7153B2D7FAB9482F20738A2928075A7F2B3D02B3575C
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1790470
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
1.7MB
Virtual Size
1.7MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
856B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/Plugins/HVNC.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 3a287acb1c89692f2c18596dd4405089ac998bb9cf44dd225e5211923d421e96
- MD5 30eb33588670191b4e74a0a05eecf191
- SHA1 08760620ef080bb75c253ba80e97322c187a6b9f
- SHA512 820cca77096ff2eea8e459a848f7127dc46af2e5f42f43b2b7375be6f4778c1b0e34e4aa5a97f7fbabe0b53dcd351d09c231bb9afedf7bcec60d949918a06b97
- SSDEEP 768:XsKVHERYe3lgPPTxOEUyP82P6mUrYrthCO7h2ORS9SQdHfiLpmbG8p:8K1ERYe0TEE3P82P1EMS36Kp
- TLSH T1E4434B99A7E98A34E2FE0F79887357144372E15B4513EF0E07C6A0666FB33828551BE3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
23238
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
56KB
Virtual Size
56KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
856B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/Plugins/HVNCMemory.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 285b462e3cd4a5b207315ad33ee6965a8b98ca58abb8d16882e4bc2d758ff1a4
- MD5 065f0830d1e36f8f44702b0f567082e8
- SHA1 724c33558fcc8ecd86ee56335e8f6eb5bfeac0db
- SHA512 bac0148e1b78a8fde242697bff1bbe10a18ffab85fdced062de3dc5017cd77f0d54d8096e273523b8a3910fe17fac111724acffa5bec30e4d81b7b3bd312d545
- SSDEEP 768:EofXMCBlQ6Kms0n6GE30IU1YKtq9oQog1zq/xPP7:EyXTa6hEZU1YKwo8Uj
- TLSH T166032B4937FA0621F1FE0AF5C873A7289331F5935506DB0E2AC960696B736C29610FE7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
46462
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
37KB
Virtual Size
37KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
904B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/Plugins/HiddenApps.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 6a098f5a7f9328b35d73ee232846b13e2d587d47f473cbc9b3f1d74def7086ea
- MD5 ba2141a7aefa1a80e2091bf7c2ca72db
- SHA1 9047b546ce9c0ea2c36d24a10eb31516a24a047d
- SHA512 91e43620e5717b699e34e658d6af49bba200dcf91ac0c9a0f237ec44666b57117a13bc8674895b7a9cac5a17b2f91cdc3daa5bcc52c43edbabd19bc1ed63038c
- SSDEEP 768:aEN0W4dmvWt9VG2LqIvwYGYRpXpWk/x0qqBi3qMG0gpfN3ffiCIT:SdmvWHVGMVwtYRtpl/x5qIXdEdXiCK
- TLSH T1B1233848B7F88620E1FE1B3AA87363149370F4A71A16E74F0AC6A0592F723C45758BD6
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
51742
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
43KB
Virtual Size
42KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
904B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/Plugins/Informations.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 cba453460be46cfa705817abbe181f9bf65dca6b6cea1ad31629aa08dbeaf72b
- MD5 67a884eeb9bd025a1ef69c8964b6d86f
- SHA1 97e00d3687703b1d7cc0939e45f8232016d009d9
- SHA512 52e852021a1639868e61d2bd1e8f14b9c410c16bfca584bf70ae9e71da78829c1cada87d481e55386eec25646f84bb9f3baee3b5009d56bcbb3be4e06ffa0ae7
- SSDEEP 384:SCUEeL4D574MvGjydqXwxDJop0n3TmyxhxJNgSg4PbOFsK:SCXeL4DSjydqXwx1FjfNfwr
- TLSH T1B8A21A4837F986A5D1FE1FB14C32A24543B6E60B8C12FA2F2DD8909E1D63784CA55B73
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
28658
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
20KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
920B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/Plugins/Keylogger.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 acfe5c3aa2a3bae3437ead42e90044d7eee972ead25c1f7486bea4a23c201d3a
- MD5 246f7916c4f21e98f22cb86587acb334
- SHA1 b898523ed4db6612c79aad49fbd74f71ecdbd461
- SHA512 1c256ca9b9857e6d393461b55e53175b7b0d88d8f3566fd457f2b3a4f241cb91c9207d54d8b0867ea0abd3577d127835beb13157c3e5df5c2b2b34b3339bd15d
- SSDEEP 192:rJV/HNfwK5RSpyv3RIw9RtO1Lnq4Ur1XneDN6IW1Y6Uph1KzaA0UbnnSLWqV:fFl5Rp3RntMO4U5uD8Upml0yhqV
- TLSH T17E824B5D77D4837EDEFD1EB25C3263011770E2069903FB2918EC21665EE3E898361AA7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
23606
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
15KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
888B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/Plugins/Maps.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 34b532a4d0560e26b0d5b81407befdc2424aacc9ef56e8b13de8ad0f4b3f1ab6
- MD5 806c3802bfd7a97db07c99a5c2918198
- SHA1 088393a9d96f0491e3e1cf6589f612aa5e1df5f8
- SHA512 ed164822297accd3717b4d8e3927f0c736c060bb7ec5d99d842498b63f74d0400c396575e9fa664ad36ae8d4285cfd91e225423a0c77a612912d66ea9f63356c
- SSDEEP 192:E0XOBqmqKYNg/ymxa07XW5U6chariK8GtnNK7gGteb1/C9T6IW14X/bmjIAd2vLV:mBqmqunYL6thaujK4jtepa9BX/bY1h2
- TLSH T17F623916E3944271C6FE0FF65C7262004776E609CC07FF1E2DCC209A6E6769A8E257B2
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
21794
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
13KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
856B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/Plugins/MessageBox.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 bc09b671894c9a36f4eca45dd6fbf958a967acea9e85b66c38a319387b90dd29
- MD5 7db8b7e15194fa60ffed768b6cf948c2
- SHA1 3de1b56cc550411c58cd1ad7ba845f3269559b5c
- SHA512 e7f5430b0d46f133dc9616f9eeae8fb42f07a8a4a18b927dd7497de29451086629dfc5e63c0b2a60a4603d8421c6570967c5dbde498bb480aef353b3ed8e18a1
- SSDEEP 384:56lIcAn3tURnUKCvUUVT/95gG3UX/NZSQW9:56lIL3tUSvbVa/NZG
- TLSH T11D621AA97BE08379C2FE0FB65CB262405771EA0D9C02FF2E59D810565EA7984C720F67
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
20958
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
904B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/Plugins/Microphone.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 612898afdf9120cfef5843f9b136c66ecc3e0bb6f3d1527d0599a11988b7783c
- MD5 9c3d90ccf5d47f6eef83542bd08d5aeb
- SHA1 0c0aa80c3411f98e8db7a165e39484e8dae424c7
- SHA512 0786f802fbd24d4ab79651298a5ba042c275d7d01c6ac2c9b3ca1e4ee952de7676ec8abf68d226b72696e9480bd4d4615077163efbcda7cff6a5f717736cbdfe
- SSDEEP 12288:+0OeMv3MrIb8CkZKobg3Wi1bRuSvazv+Uro:ROe+WIb8CkZLbg3Wa8Waz2j
- TLSH T14CC46E21BBE0851BD16F33B2E0E60B2A57F1E4467726EB8F548096EA5ED37534C40B93
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
558638
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
538KB
Virtual Size
537KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
868B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/Plugins/Ngrok-Installer.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 b574aabf02a65aa3b6f7bfff0a574873ce96429d3f708a10f87bc1f6518f14aa
- MD5 3e19341a940638536b4a7891d5b2b777
- SHA1 ca6f5b28e2e54f3f86fd9f45a792a868c82e35b5
- SHA512 06639892ea4a27c8840872b0de450ae1a0dac61e1dcb64523973c629580323b723c0e9074ff2ddf9a67a8a6d45473432ffc4a1736c0ddc74e054ae13b774f3e2
- SSDEEP 12288:Ws6T2x75lFR/RG+BUKPqnwoCMYKIUTJE:WEB+4+1C0IU
- TLSH T1CA947D107FE0C63BF6AF97F1C16641568BF4E05AB79AEBCE6D8418E9284235089173D3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
415342
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
398KB
Virtual Size
397KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
932B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/Plugins/Options.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 5c34aee5196e0f8615b8d1d9017dd710ea28d2b7ac99295d46046d12eea58d78
- MD5 97193fc4c016c228ae0535772a01051d
- SHA1 f2f6d56d468329b1e9a91a3503376e4a6a4d5541
- SHA512 9f6d7da779e8c9d7307f716d4a4453982bb7f090c35947850f13ec3c9472f058fc11e1120a9641326970b9846d3c691e0c2afd430c12e5e8f30abadb5dcf5ed2
- SSDEEP 768:ULxkuz7dDWH839iybgkf/sGRNW9S9dhjcI:ULNHqUPbgQsGRNW9S9
- TLSH T1B2D219017BE84629F5FF6F31EDF622158A36BC4BAD22EA1D08D0101D6C73694CA61F76
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Contains code to disable Windows Defender
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
36546
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
28KB
Virtual Size
27KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
872B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/Plugins/Pastime.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 a46787527ac34cd71d96226ddfc0a06370b61e4ad0267105be2aec8d82e984c1
- MD5 6430ab4458a703fb97be77d6bea74f5b
- SHA1 59786b619243d4e00d82b0a3b7e9deb6c71b283c
- SHA512 7b6cf7a613671826330e7f8daddc4c7c37b4d191cf4938c1f5b0fb7b467b28a23fb56e412dc82192595cfa9d5b552668ef0aaa938c8ae166029a610b246d3ecc
- SSDEEP 384:WK9Y5jI8MYODPqeivepi5zOY7//fNCsA8/h5U:WK9YNI8MVDZiWwr/TA8/hC
- TLSH T1B8820A256BE48371C6FD5EB248B3731003B4E241EE12FF1E49D86156AD73A85C760BEA
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
23794
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
15KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
872B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/Plugins/Performance.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 043b6a0284468934582819996dbaa70b863ab4caa4f968c81c39a33b2ac81735
- MD5 1841c479da7efd24521579053efcf440
- SHA1 0aacfd06c7223b988584a381cb10d6c3f462fc6a
- SHA512 3005e45728162cc04914e40a3b87a1c6fc7ffde5988d9ff382d388e9de4862899b3390567c6b7d54f0ec02283bf64bcd5529319ca32295c109a7420848fa3487
- SSDEEP 384:LtpW2/E3mawGD1XTgOw2QxHN7yVppy6+:JY2ImYRDKHxV
- TLSH T1A7723A09F3E54336C6FD0EB24972A21113B1DB039D13FB6E5CC870A64AA3A988B11B57
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
22034
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
14KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
904B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/Plugins/ProcessManager.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 7cf1921a5f8429b2b9e8197de195cfae2353fe0d8cb98e563bdf1e782fe2ee4e
- MD5 3d4ec14005a25a4cb05b1aa679cf22bf
- SHA1 6f4a827d94ad020bc23fbd04b7d8ca2995267094
- SHA512 0ee72d345d5431c7a6ffc71cf5e37938b93fd346e5a4746f5967f1aa2b69c34ca4ba0d0abd867778d8ca60b56f01e2d7fc5e7cf7c5a39a92015d4df2d68e382e
- SSDEEP 384:2dqZXY/oSd1PTQLvLELadRtZa/rnRvDSQUT5S97/Y5bLOEYQfwrpn45rDhUn1kAO:2dqZXWrQPQQtZqrRrlU+cYv1kAvZc
- TLSH T110920859E7E8C3B1C2AC0E72587252510770DB018D23FB1E5CE8B0676EB37E98B21766
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
25286
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
17KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
936B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/Plugins/Programs.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 953a8276faa4a18685d09cd9187ed3e409e3cccd7daf34b6097f1eb8d96125a4
- MD5 a6734a047b0b57055807a4f33a80d4dd
- SHA1 0b3a78b2362b0fd3817770fdc6dd070e3305615c
- SHA512 7292eab25f0e340e78063f32961eff16bb51895ad46cfd09933c0c30e3315129945d111a877a191fc261ad690ad6b02e1f2cabc4ff2fdac962ee272b41dd6dfa
- SSDEEP 192:Z3eKcfO/TCOAOG+uCno9SFwN4O4FgkT8zr1P9YD6IW1GX/V3wd0yzSLWVb:8PG/TCXF1SamdnTu5lYTX/NwKyNVb
- TLSH T1AE522A59B7E48379CAFE0EB21C33A2422B35DA04CC03FF2E29D851569D776948751BB2
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
19822
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
11KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
888B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/Plugins/Ransomware.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 14c2bbccdabb8408395d636b44b99de4b16db2e6bf35181cb71e7be516d83ad9
- MD5 ccc9ea43ead4aa754b91e2039fe0ac1c
- SHA1 f382635559045ac1aeb1368d74e6b5c6e98e6a48
- SHA512 5d05254ba5cd7b1967a84d5b0e6fd23c54766474fb8660a001bf3d21a3f5c8c20fcdb830fb8659a90da96655e6ee818ceefb6afa610cc853b7fba84bb9db4413
- SSDEEP 384:DVSO27QJHvpebFn0LC9Tk7ff2ji+ZMuqI+sHY4k7E7eEDuQZh:DVm7Q1vpebF0LC9TqH2Mj7qtqg
- TLSH T12B92F62D67E0E171DCBF19F364B3D2510371DD35A821F62C3ACDB0AA1FB21494295E66
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
26282
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
18KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
904B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/Plugins/Recovery.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 66dbe3b90371fe58caa957e83c1c1f0acce941a36cf140a0f07e64403dd13303
- MD5 776193701a2ed869b5f1b6e71970a0ac
- SHA1 2f973458531aaa283cdc835af4e24f5f709cbad1
- SHA512 a41f981c861e8d40487a9cd0863f9055165427e10580548e972a47ef47cf3e777aab2df70dc6f464cc3077860e86eda7462e9754f9047a1ecc0ed9721663aeb9
- SSDEEP 12288:LaoFeouLUFNFfcaFeFOFwcGF6cmFWc0FWc8cIcKcUFJFpcNcHc7cbchFFc5cbc1a:pFetLic805jbibGATp/j5T
- TLSH T1B2355B507BE8D617E1BF23B2E4B20A551BB9F841B362E74F644821E90C62344AE517FF
- MD5 SHA1 SHA512 SSDEEP TLSH
-
StormKitty payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1157618
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
1.1MB
Virtual Size
1.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
884B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/Plugins/Regedit.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 2f73dc0f3074848575c0408e02079fd32b7497f8816222ae3ce8c63725a62fe6
- MD5 53a2cfe273c311b64cf5eaca62f8c2fd
- SHA1 4ec95ec4777a0c5b4acde57a3490e1c139a8f648
- SHA512 992b37d92157ae70a106a9835de46a4ac156341208cfe7fb0477dc5fc3bc9ddae71b35e2336fc5c181630bac165267b7229f97be436912dfd9526a020d012948
- SSDEEP 384:0ZMOBwQbGwAspmewuYvpYr3fgr9A8/VjceZ:0ZMOykGRzYwA8/Vl
- TLSH T187621A5BABD08332C6EE1BB20C73A2405772EA05DD07EF5F9EDC10A65E532ED8341669
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
21678
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
13KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
872B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/Plugins/RemoteDesktop.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 cc52384910cee944ddbcc575a8e0177bfa6b16e3032438b207797164d5c94b34
- MD5 e6367d31cf5d16b1439b86ae6b7b31c3
- SHA1 f52f1e73614f2cec66dab6af862bdcb5d4d9cf35
- SHA512 8bc78a9b62f4226be146144684dc7fcd085bcf4d3d0558cb662aacc143d1438b7454e8ac70ca83ebeedc2a0fcea38ad8e77a5d926a85254b5a7d420a5605538a
- SSDEEP 384:nKr81F+CoNFZpeg7qX+mK3sxjt9l/C6I5YxBXWKeVFjyJ:KTvZY4gTPXBojG
- TLSH T1C9824C1D7BE44379D6AE0E7548B363011738C2099C43FB1E4CD8A1A55DA37C98B717B5
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
24586
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
16KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
920B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/Plugins/ReverseProxy.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 8c4efe2c8702141ffa8ff8f55d248dc4220231ae8d12ecea1f22906a9285b32b
- MD5 a22d11379e413cf832b3943ce46f2463
- SHA1 99b9552e8a25bff29678aff828901edbc23eaba5
- SHA512 cc1eccb29135acd35804b44f73447bd8dedc8ea085dee3670cf49120baa905aa7ca512c14a3f4df6aeb5a70347bd214865f9dc8b709a00abbb0c745164d87074
- SSDEEP 384:sNsDP97BkZ3pBkHEk8G1QxFUzTNnrYFXoMZlS9yPCn:sNuR+ZZ+mScWfEoMZQ9yPg
- TLSH T1B67229AC67F08371C6BD0BB24872A2016B71D605D853FF5E5CDC70960EA7689CB84BA7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
22862
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
14KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
920B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/Plugins/RunPE.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 7adfe849345edd76aa975b0647fed2ccaa5f4a6aaf7d55f488af939c0dbef153
- MD5 224be01635cff2dca827fbdeaddb983c
- SHA1 11fa00c5e172c9cd1c81acaef52934f785f91374
- SHA512 1a4915b7b21e8166a6ddb6460c77e02c306a460c08fc7ee574832b0576c827db343eda9533959298819ee443790769328ad580fc67fe4817110b63d49248c736
- SSDEEP 192:vbfqh94qP9XFw3l+JNGGOueq1JtSnIW1fUse2po7SLOYN:vbChWqPj5jJtGUse2poHYN
- TLSH T17132091D93D4C679C9EE0EF24CB222811BB2DA448E57FF3F55E4A0261CE33864AA1731
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
17334
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
856B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/Plugins/ServiceManager.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 c552d11db168a4f64db584283a617a6ec51ab6095c20ba4b706c3138beb68a22
- MD5 2e5f127cb0a69cdd46aa4fd9e603f982
- SHA1 994a6ab276c417301ed9208aaaf6719bf9594bc6
- SHA512 4455cb3b9d4a9c69abec7180e9a60e16e6be0ae2290f48aa09c5d926370de5512ced4d37b6e6e49515d5f51999211eff6f751c4594db936882fb7f40ee5bf97e
- SSDEEP 192:D6FAiNLB2n5QnRBiMcs/XAaICPczrOFsgXTZr106Yq6IW1yShrM7+WAMLuO1Jjm:Ziq5QRBiMn/wpDUtTZ5nYsShY3AgJjm
- TLSH T172623B6A73D4873EC5FD0EB24CB393011B70DA08DD12FF2F1DC8605A5D63A998B52A66
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
20534
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
936B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/Plugins/Shell.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 6c69b4d45638097e31169d94914e4acb6a8cc7f46788ffa4f241e4c1efb213bb
- MD5 04609b39e656e297db73be0d02c7e35e
- SHA1 f8abd484e7703a4d9629b033e8ec39c82eaf4654
- SHA512 11a88d55497fedeeb05b146ebd3135755aeb08c4596e9379eec83501e734aa6ba926d9bbda1c5f50e361836d65ea88d2c018f0b4b4b668c82ff2163730eaaf27
- SSDEEP 192:TDXwH3m0L3G33Kkw720sM76ODzKOFBLggT051i9Yd6IW1OU1YoWPbs5cLWT:oH3m0GqHT76OSUXT0HoYpU1XWoxT
- TLSH T1A2623915A7D18336C7BC0AB61C73A24157B2DB05CE07FF6E6ECCB0970E672858E12261
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
20966
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
856B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/Plugins/StartupManager.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 1802e16379d96021fee05f583633c8091bb669350b7d32064179a8944d45a5a6
- MD5 3d76ef15ab712b93eabd4b68ea0111d5
- SHA1 0f309663fae17c4ccae983e1fabb16a1e5f77d9b
- SHA512 6c0d0291abb696bee33b6e42392b07028c82bcffc8fb7934ba234f178f011ab14fde38cdccb322c8dba058ae66fc023349de5db1c587d3417709bf263cfd28f3
- SSDEEP 3072:7ITmgSRcBHAt+yM1KlUKEHBAnpK37nXnF8KBOQv174Syoh2sKdm/vl7bQcX1Okta:7MmgSRcBHAt+yM1KlU18g1xNYVc
- TLSH T175143A5067E4C92BEB7F13B8E47216146774F44BA622EB8A38CC15FA5B2334059163BF
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
199114
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
186KB
Virtual Size
186KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
932B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/Plugins/Stealer.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 018e06f57725563e4525700edffafb1b062bf5d4b0e9fee498507f0f8200fcdf
- MD5 ade4edd66bc695c9465816fa2538d0cb
- SHA1 e4351a2531307c848c60b20ffb50bcc04156fdbc
- SHA512 e2bf3962787366d7a975eb55d2edd1fe35935205febc00f720dc0efff0c62b5df7f0207fd569f692205e8a227c059eea596904995855458e9c02306842e88a6f
- SSDEEP 49152:eVbwgxmbsO2B7wKOfpUL6GbriHeGAb4TkyNejjWSqE08:eVbFxmbsO2B7wKOxTSf
- TLSH T156F548047BF8CB37E06FA7F295A105155BF8E45AF3A3E74B2A8067A80C12B006D5577B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
3453418
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
3.3MB
Virtual Size
3.3MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
868B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/Plugins/TCPConnections.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 27e17a43478448f64107df786a170753dbd116eafca7c027f6d357f11e6a4def
- MD5 9cae90969d14ab4d686c56bae19e041e
- SHA1 0359e8eeed993bbbc6f141b115bd533eeb52533d
- SHA512 04a9dc16299d866af7f56ff2ef355310d9437c909ec0dd3549d2f142e71149b09822106e254970f00801fe2f0df6b6d2670cf6a8256d85cd35b963c028f6202d
- SSDEEP 192:VsFaPxrfOKHEWS3/tQ6v/Lvyrq6gNZOtyEox0GTeA19Z/J6IW1Gz/yyY8RKIxLuM:/9GKkWuv/LyvSwyzTeej/Zz/IHUv
- TLSH T1C772181C67B44339CFEE1AB218B3B20113B5DB09DD27FB6D15C8606A5D63B884B607A7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
22454
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
14KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
936B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/Plugins/UACBypass.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 ebd51f1e33673cb8e55f10aa890a04027d62b1c1c0b0ae9b1d6f83f1602f53a2
- MD5 158e789d0b6cbc52fcb6653fefca38f9
- SHA1 4e913315dc3d69abe2be5e5b3a5d37b5f49f7deb
- SHA512 23243daadbad2f68b6ed6720d5792226f9c2aeb0b14cf3bf24ac54dcb7a2aa4aff9d26a5633d3add0d871e4ec65c230752c7c173cc4a4374f9263e2c46f9977a
- SSDEEP 192:kcq0WYKDFxDviOGOko8bZfmgyOYkIW1UZ/Xvjljw2ugiSL20V:kntNFxOrE8bLyOYBZ/XTugU0V
- TLSH T14322E82967E08335DDBE1E315C63621107B6EF05CE33EB6E4CD4A0495CA365487A2BAB
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
15954
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
888B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/Plugins/VB.NET Compiler.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 1940d563046c67dbbeaf5f2a2417aaccdae587c1eb97b79c263994896805bece
- MD5 2401bee633ea4032a758ffc6d729deac
- SHA1 3040e0e27f48eacf45860be4ece6f94db7bc1c4e
- SHA512 af016b5d2bf8c08e16b593d72a25284f31d6de7300ef98a226db8ce4f2a9dd512ec793adf0730b40dc0a37e9dc5a9d6ef0a50354a697aa5816b3cbe440655692
- SSDEEP 192:TGESp/+S2SoW+O4A083xaU12HeZOCeJyxlTer1c9gotlF6IW1oXxvZLY4cGSLOBL:w3+O4aADifeyTe5agIXxvNccZ
- TLSH T160621B1BA7E483B2C7EE0FF11C72A2001775D615AD53FB1D1DCCA0464E63AAC8B51766
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
20918
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
936B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/Plugins/VoiceChat.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 1a2da0a66c7771962d525b8fe9491052efbd5f87b97d935c267fd96519b5a35e
- MD5 56a8b030ade4736915e5b601a4bf39f8
- SHA1 ab03e7948c4604fbd15d285f674ea879082a8e7c
- SHA512 d0f2990adb10221c88bbe04b4f2b702f99c046ae9ce5e713e2d26f73f9353dfe5fd983cd37c7b712341a58cfc4f833e590ff1e449c66fd5de98604d58a92dbd9
- SSDEEP 6144:TkcVpiCslfiJOBvKbfaIKlEZfb78+SmmCENCT/7CbRNid2/c2Co+5CJfSp7Of:4Zjp8fIlE9bg/AgBcRCcp7O
- TLSH T1D2C45C11BBD48527C06F33B2F4E20B2E67B1E486B256EB4F49D09BA95D837464C41BB3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
557686
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
537KB
Virtual Size
536KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
884B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/Plugins/WSound.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 4bea01b7d691d1f59ca0bb5149e5baf71cde71019da3d352141b1d4921e70bc2
- MD5 f0d8beccffd6a4831c0712a4da4a0c2d
- SHA1 238a2878f1bef8f002ba501c1f65862ed384cc75
- SHA512 1c5244736aa53d5dda52b65a26facda8334bc7f98ce2eb6356c51fcae03b183623d0c3bb7f45993b8bab0c65d261a23164f987aa5f6a47f2f307380567367904
- SSDEEP 12288:Ayw8KX3HOt3qqDQkoJBBg3bgtP1TviDH6MJyKwYalFEYU:1w7qDQkocbgttGzTa
- TLSH T15EC46E12BFD49527D06F33B2E4F60B2A57B5E44AB226FB4F05D096A85EC37815C40BA3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
558162
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
537KB
Virtual Size
537KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
860B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/Plugins/WebCam.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 8d413b40aef41e53557d91f3b3ac64cfc13adb0f8c3edc364e7b8501170e2657
- MD5 71a9109ccafa90550c1c879a304d27f5
- SHA1 c77ce45aaf8b2d8aaaa2a41833275f3eda78046d
- SHA512 fc92190d8a889fb088b2e8c2e4ea4751fcda59eff076b205da7c420b2f26564c1835d6ff1af470b583ec2ec92c0fcfb472e443e29d33f538572e6edd36c8c47e
- SSDEEP 3072:pA0VnWR/jKGR5BfF/g50PBgakLA3LC2FY+EdzYZHAx+dqRN51hdJFxtZV9l5hhJz:pBn+22fFcgBgakL320zYZHpMXM/I/
- TLSH T131247D06B3E5807AD5BE4A3588335A199779F8118B71DF9F1B94026E0F633C18E39F26
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
220286
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
207KB
Virtual Size
207KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
860B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/RES/U40957361f7481084776e6aedU9f0U1
- SHA256 294f977ce530e3d471a9e2bb09305b6ad4516f42e3c2ce5c6c715f7dddb18991
- MD5 13f3948fa620d58ed6242262b575c784
- SHA1 8d8e32815bba106ba7452c7dd80bf6012d88def7
- SHA512 a74d3d704a075b390cb555864d531a49ce9e8ecf1e4314eb53c3f11a9486473160c02a9c03bdf6057d466f34aa87e3a53b50764bf2d493dd0dafedbc0fe22df1
- SSDEEP 1536:IuX+Mqm083ykKjsbDt1+PLCgmCZVLsDTvNIW97tXm6LSDfUW3jTzBHk1mTl0tNap:ut8Hv+P2JDhZvEcMzpl0P0bQnUBzt
- TLSH T17AA3125C52106FED60B915C352E2D5D47ECA645AEB9B34C31CF7E2A8293B7B4A2C0F01
- MD5 SHA1 SHA512 SSDEEP TLSH
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/RES/XWorm.ACT.resources
- SHA256 b7ab18c6ddc022a4018d576dcafda0352984dee3a7cd0e4d4f45cbe0f4df2b85
- MD5 7b9622f29c461e36d8a4c3e27dffb741
- SHA1 5f6204efc91e64f42978f7c8c293346e27fb533a
- SHA512 49736fa0a285f837ba12a7067b803e918b2a39c21d408cbbb39ee42efebbf64a4a19549ac2b7d7ca1e4524dc85d38c1a025ae41b947f40a36d18767fd12a4889
- SSDEEP 1536:67ETH1QatyHkrVOceYM/pjq9bTQPmbYakBxBW/7jpYaGs:6YLe7HkrVOiqyTaxw7jpY7s
- TLSH T13D63D014F64CCB21DE2546B1002D4EF243B52DBE692C7BDA2D8DB29AD450F99FA10FD2
- MD5 SHA1 SHA512 SSDEEP TLSH
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/RES/XWorm.About.resources
- SHA256 c403d852d1d8693c70b23199af2db9e70dd7d540e62c95bb8ee295022ccb9ba1
- MD5 dba99ce51cb7cf664617714d7c5d0664
- SHA1 79bb6210c1a5d3e37c93143d39c385445e167aac
- SHA512 1e09bf3bf45dbf4e8b7ca9b7e222f0382305d73ef1ec9626b5bc6414b6e1709265da1e4995cec56e187df251b18ecea9778e52850ff8c33385632ed395dc439d
- SSDEEP 98304:J5F/i9sHzcTiT38Ed4ihzD3w38dXdvinSh8q:l/BAe1d4ihvy85JP
- TLSH T1E3F53329D6658287C83471343892C1B47A81286C67F8FA3E66C0BF4850FE559FED1B6F
- MD5 SHA1 SHA512 SSDEEP TLSH
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/RES/XWorm.Builder.resources
- SHA256 2cd4edf6e3fcc6465e393ecc856a6f5ddff29ccd38da3c784dbb5eeab6c3d3e1
- MD5 fced32c3b698eb4204689d5ab088caba
- SHA1 fff555f9eb79f9226221d1116776e2ac4dd45d3c
- SHA512 53ad5d2b03e3f561ac55f3274d8a2d1a552490a577e4f44076be8e395981f25b6142b218fbc019a5bd19f32d6a57a196be8fa6ec9d453966f398d2feabf57aca
- SSDEEP 768:6YkB9omkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkfFakkkkkkkkkkkkkkkkkkkkkA:6r9oNnJHyh/HOL
- TLSH T1A6B3DE24BA15C41BC6FA35F0E055C999B3EA5EA43BC0FC2A7D42B30C14B70BC925F5A5
- MD5 SHA1 SHA512 SSDEEP TLSH
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/RES/XWorm.Chat.resources
- SHA256 9388906dced6dafbf91726771e55b4d07f870790ca6a7e5ded930d812cd13374
- MD5 8dca4f7300e5fe396ef7401b5ac9b450
- SHA1 fb91f139fcae116bf834292c47757312162bcdcf
- SHA512 f355ac08e80d1b513aa40a9b1bacbdd4d2ddea2c645156fa55521a93c759a4cf4e6a605254bac02fb9c1b7eb43ad72b75fb293720bbd2d114d77e407236a07f2
- SSDEEP 768:r/Xxu2kkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkF:TkE316
- TLSH T199A344C5AF74A007C93812B06463AAAAF8E32E157F90F14BEF0AF39D04754AD42D7D16
- MD5 SHA1 SHA512 SSDEEP TLSH
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/RES/XWorm.Clipboard.resources
- SHA256 18b66195ef662a04125191fc381e1181350ad081667c6437e708d29573c3822c
- MD5 98d7b91bac73c075f30116b9bd3c67f9
- SHA1 b9e705565a4ff351fe36486f12fca717915707af
- SHA512 23e542a75c1c546343c7ab236b103b47fcace224791eaeacd4fa7fe376e69b4b84773a30d7f13991f0d0b3e5b245b00252089c0c89125cef55034a06048011eb
- SSDEEP 768:mPFvvvmjF2/2KZeQ46XhNcEqnKqaglXXI:mtvvvmjILp4KNcEq8gt4
- TLSH T103B3E379E581908AE9B12EF9040AB2EC5508BE624E8D1D1DBCC5B6BEC47400D7C6FB77
- MD5 SHA1 SHA512 SSDEEP TLSH
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/RES/XWorm.Clipper.resources
- SHA256 fb95146658664f1a39e459d914dd6de69b3b946cc433e9927998b2e6eca2e185
- MD5 38d4e87d0095a63194c0cad81bc211f1
- SHA1 a15531063c6c341094a05d325a32808eb06d1f65
- SHA512 93589625ddf9979d348bf252bcfed5039241ca1860a8d647761220b6b6343161bff73294af80600aa525b251b7e2881985c2c939be672ded827a9071437d50c8
- SSDEEP 768:1QinR1KLCUAgc9h6RVTqSXFbnPHHWygDHS0Zvq3Sa+OGapJ:++vKLOsVZX9PH2ygbNvq3SazxD
- TLSH T1B8B3C54725E5D053F91A1BBACB51FDB8091B2DFEFF120A5A40C2BBE91231246DA13673
- MD5 SHA1 SHA512 SSDEEP TLSH
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/RES/XWorm.CustomOpen.resources
- SHA256 598558968242dea51f96c5733c13bb430ef5444364acd72c7e47300ab760547b
- MD5 3c655ef71e0f2b716ed5a89c9b11ae2e
- SHA1 433e4a0b3a074e8df88989b31297ee38d83a98c1
- SHA512 03e457011d933cd4c4514a8c144fea2458efdedfa1ad4f3b28e963682f3c0b71f456bae40cbe15864dd527ef0dc22e0f141b7b3a5b8f02353514b26a861bc70b
- SSDEEP 768:pUUiy7kkkkkkkkkkkkkkwJ2zcrq+5kkkkkkkkknpmU0GDkdz2EapJ:LwJ3qR0oD
- TLSH T149A33110E62488AFC43BE431D482C59B79D6AC577B68F3466AC4B218283E13E5E7771F
- MD5 SHA1 SHA512 SSDEEP TLSH
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/RES/XWorm.DDosAttack.resources
- SHA256 f5d6acd85a0c639a1488802afd8494c712df2925276217f71fa3540bf11e9f4e
- MD5 c84ccb00cc3e74c2aebcf95d31d72b08
- SHA1 67e30f0f0c3472ae96898e18002a8332ece8509d
- SHA512 a27090fe6877fc6df3ea0164b80d337871e2c1ac9aaa8718e2575aae1cb0533dd158a26d3c42ef73770c6fba78b41d1f1bdfa1259c7eb9c042a1253a9fe2e330
- SSDEEP 192:rkvwKwq6k94PfBMao1p1/Z+NhAaOSgG59A888Tf6Z:rkvwKwq6u4PfBO1p1faONG7A888Tfs
- TLSH T1ACA3CB39BC25AC8CF88636346924F3D21B717E4AE9C84507F15D729EDEBE02872CD196
- MD5 SHA1 SHA512 SSDEEP TLSH
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/RES/XWorm.EditReg.resources
- SHA256 d1e026edbe1d06e58073bca992133a94cc495fe8958d7de0c229e9f6a4a23253
- MD5 5fec710a19fe099ac9928ea500ab63b0
- SHA1 5f539bd8383c61470b2839bce6c8e6a9eb966e55
- SHA512 f91027078a3b6384ad9db49962d7c398204d48f632a77c3f423e5cb5034d71012fbbf1d6bbdf9b56968861f34ad2e5e74bf9efb3dde1736e23b0dc29a7b880bb
- SSDEEP 3072:0TTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTLD8:a8
- TLSH T123B3AACCE4A6919BD07E58761FAC8EB66E449DD534F334BA2D8CB39D023628C9D071B4
- MD5 SHA1 SHA512 SSDEEP TLSH
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/RES/XWorm.FM.resources
- SHA256 697350ca911bb5af342a5485dfb5787bef0541526f053f7cb559fbf005e66333
- MD5 16f2d71e8e805a3d8678576532e45cb3
- SHA1 69116054f7a15e73b51bb0145d3cba80ec362297
- SHA512 f327d1fbfeaabed971d2255da64ab4875aaa2b8923113e62cfed68b4dc5643c07a33eadb473361a7ad30647470b744ebfffd8d806c28dd35c1681158504bc8ee
- SSDEEP 1536:Fikp4KNcEq88sXgAHWOIcK7ETH1QatyHkrVOceYM2mX:FixF8JjHVKYLe7HkrVOiVS
- TLSH T1F104D3A036C15488CAA40E38C5AFA78051363F6A5A55950FF0CD3E4EBFF7107561ABBE
- MD5 SHA1 SHA512 SSDEEP TLSH
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/RES/XWorm.FilesSearcher.resources
- SHA256 8f6b3e617286b240c1117bf6cda40a11bd6d59d2a94ea9b9817730fec7cd3d70
- MD5 95818cf2184044335cdfb896b28843ff
- SHA1 037e53ddd857c9dcc49ba02810179d7ce8437069
- SHA512 a63e479aae870b623d1dd057b6814f10510b54e74e232a16b269acc2435fc36f7a7a19341d2b1de79bdab0603ff7b0cddc698c6b9e73fed52cd4c6e3e955e289
- SSDEEP 1536:fqZScK4323F5VLx9WXjbR2H8fsKFBT2L0RjpY6WjvhY:ffRWXjN2asKFBZxpYxvhY
- TLSH T11FE382E2E1084685F9341E71F670BA6DD21DFC5E9A8CA851138E71488D7EF8A6C3BCD1
- MD5 SHA1 SHA512 SSDEEP TLSH
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/RES/XWorm.Ftp.resources
- SHA256 c497bcd280f3f33d1b49d4e7dcac03434c20bfadf435a71b0eb501cb74eba68e
- MD5 7c65f0d2d6700ea2011d8cf8698ce129
- SHA1 b1af1045a19306cd397ef3f87ecd26b7060fa778
- SHA512 d76e7470f5c2f152c699714837d8d6d046edb0953e016af3719b48f9155771e47b3a8a160f0074f96287fe2cc26f38cf9ef581b1c2dbaa4a4b579c7ac48a1e3a
- SSDEEP 3072:9BMaTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTLD8:9BMo8
- TLSH T1A2B322406A00F549E4BC743F58E747D391387BE48AE1866A6BA0BFDE51BD46BC2E0334
- MD5 SHA1 SHA512 SSDEEP TLSH
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/RES/XWorm.Fun.resources
- SHA256 d1e2cde8706b7574139a8d0843121fe4b469e191c64bee885b16f53c398c0634
- MD5 03ed9f7cfdc4c4022748d28866ab8392
- SHA1 14c6e19f536fe87b36ca19af03ef6808a27eca42
- SHA512 37ca143122078e3412eaf01e3120b36c43c0acc5e4a0f3b625fe8c661fa5e07a9579565a29854f80b9e510da6bc52ebd041c6ac543e32796e74b4ba338e47ea9
- SSDEEP 384:rkvwKwq6udiHHHC3P3P3P3zXqvbvQYmkvbv:m3P3P3P32vbvQVkDv
- TLSH T10DA3C12BA91FDD28FC503379DE45B1D5611C2E2E9CFA44FBE688FE0E743A10594E18A4
- MD5 SHA1 SHA512 SSDEEP TLSH
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/RES/XWorm.HApps.resources
- SHA256 d7fdbbfacc23d6cb577df5908678ea33a458f5ba0b96359efb5ca1839bfd086b
- MD5 60f80d71c8d9986035368b61a80ec39c
- SHA1 9336b5bbda4b1eb92d8b5f7cb99d482ea74964e9
- SHA512 3411e36495e958706e1bd9f37551daa76e2bacfb5bca242ff8a20921437c443f1b91aa28c25526115ad7248358d2e29d62f0de3da6aa63e7cca6aa39517d8f29
- SSDEEP 3072:OUjCDfWaFnj2tpyTaxw7jpY7kESYLe7HkrVOik9C9R:OsQW7kEubq9kwX
- TLSH T168D3D0E8B68D491BCE681635002179C519BABEC48EE1B52E7D8DBB4C1C3498F0616FF7
- MD5 SHA1 SHA512 SSDEEP TLSH
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/RES/XWorm.HBrowser.resources
- SHA256 3ff03acd8bda3bba40e14064dcedcf188b5c5d9b1c899920a0ba49238812ad03
- MD5 1b4955c4d297f43c89a4db73f0054346
- SHA1 d90fa8dbb8897ff4a565b8b019186fd13e0807a0
- SHA512 ada52944b61e64d28b3ca7f8eb75601a287b6d5c90b51d0707bb00ca697638589dce8469eadc738b45ac5d541908143b9c3a02b5c6d0f51b1f3df1fc2914e8c2
- SSDEEP 1536:opx1pWvE2lPpjq9bTQPmbYakBxBW/7jpYaGlVf01NiPu7ETH1QatyHkrVOceYMs:opDpW86pyTaxw7jpY7lELYLe7HkrVOih
- TLSH T1E9930219B78F0936DEA14A33153559C6A2BE25C66C36762E379FC22E590160E3720FB3
- MD5 SHA1 SHA512 SSDEEP TLSH
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/RES/XWorm.HRDP.resources
- SHA256 f8d74378cb9be4608271a4d4994ef57ebbdfeab037c90c913c39ae3d89c9fb57
- MD5 fa9343a592c72c5624ee76c157265bb3
- SHA1 570197edaccd2c58f1c1d6a96a92d031933b6c71
- SHA512 a5e99e9645be0d6ce506635eebedf1307615d44c3bd85ad91f29a45f86685c1a9833df150d7bc27a19182fa73b52da2ca97c33c0337faf18052bc4f3be457640
- SSDEEP 3072:c4jEWtQbQEm/Q+NQMQSQ5QnQ+QYQQfQQuQQJQQzQCQlQbQQzQAQxZsgBTYUwmfJX:z
- TLSH T18DA32160A951D3CDCC3854B5E45F82A31C45383EDEA9D420AFAFA3EE40FE061497B963
- MD5 SHA1 SHA512 SSDEEP TLSH
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/RES/XWorm.HVNC.resources
- SHA256 c1eccd021db7b1d686e10cc6aa14505a21386723fa85d2e7eea6adf361a92335
- MD5 cbd7e355e5a99120d510874ea6dc5c83
- SHA1 90e324eaced544ec96e4f773ee8f65687b2e7661
- SHA512 1e3accd3b979dec6268acd56ec9fd30f4ebdbd6fac3090e9af13f9f39dc437ad69abee431747597408ed1ae3a402bf795ba06ddd892c5897796d45b6e4aa98a8
- SSDEEP 384:rkvwKwq6uqWHMDzelakhLZS3UrjTgwE/9xxNTT0TTbo/t+H1wLzzWySGjqu9epXY:QselVg6n89zNTT0TTe9jeXWzSg
- TLSH T1C9B397621A6AAF93C5F9047EC13D6D479983DF94A21CD009A1C53A0D4BEF457FBF022A
- MD5 SHA1 SHA512 SSDEEP TLSH
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/RES/XWorm.Hash.resources
- SHA256 f5d054da5630a8fb711ec674feaf8597d1219a72cdfc6d4ca4d7e3806c84812c
- MD5 cb331a72ba58813e6b3924749bcd6390
- SHA1 18009c5eca68ae32598c3200fca3782c5b1e443d
- SHA512 98777f7558a4af46b2469d4ab4dfa4e92496e3bc1fe74401da758c902a59701ff8fd00268395e5c8a511c9d64af82af812c195b23d77d4d5b4f0a592594fa8ca
- SSDEEP 192:rkvwKwq6k9TCvWkGIlL9h1yhq9nZoWA/m7iP8Gp:rkvwKwq6uTCXpOsZob/m2
- TLSH T10FA3A5C03281A6D5DC32D2B10A49DAF12115BECD7B23A54634A87F2E79FD31ABD98F41
- MD5 SHA1 SHA512 SSDEEP TLSH
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/RES/XWorm.Hosts.resources
- SHA256 3439ac9f2377613b6b499844fc39cb8c2e0958ffb22014409b5cea95c626e91d
- MD5 83793c37782eb28178b2196b51681877
- SHA1 88749fcbf6382cd36e1c94009ed7ae1404a07d00
- SHA512 c03434cf2cfe85b30a4526afee6a158b77420d2bf1350b73e3c02e9dc6febc5d9a7debb5287607dae9992467ecc49573d92ccc50a2334e0e93786936e92eb9f0
- SSDEEP 384:r0vwtokwbwq6u84ELf8Yo1TFE02rVaM3/2ptMx1bU2o07zwAWV:9j8N0Rxi2op
- TLSH T132A3FEA37043F401DD443BB1DE809996896C3CAEADBC48673544FE8D393A4AE391773A
- MD5 SHA1 SHA512 SSDEEP TLSH
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/RES/XWorm.INFO.resources
- SHA256 501e089e1db08562e14f2750e406b0533d7b3aae3705e1973b29849cbbda6fb1
- MD5 5ee5eb03c4d8e504b7a996fd5410666e
- SHA1 dddcc286a7fa6cf82cbca91e1d9b67bdf9b2581c
- SHA512 e2f7acb328edf79899d8774ca9cc94574d12defcaf2ff9047b201a009d27ee7044cdfa0b761b11c1c8a12d3bf514f21bdbd35a538c52ce8b53d43a586a968027
- SSDEEP 1536:ZU4VmTTyTTRTTPTTdpgiCiCiCiiTExaFlM7ETH1QatyHkrVOceYMs:j/cFqYLe7HkrVOih
- TLSH T1C404E516B2C8A504E57498F0169C8B505036FF1FA8E95AB6F5CC39A6C8F59833E21FF1
- MD5 SHA1 SHA512 SSDEEP TLSH
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/RES/XWorm.Keylogger.resources
- SHA256 89f3a42141b619bfd652c9825bcba07b91475997bac48e001e74dcd90bef754c
- MD5 a1778b17ac5f0f62b3771e9886e0acba
- SHA1 0a0d5f1a4fec5c677ebf29e0dbbe0ab7032fef38
- SHA512 1669aa46676ab5f03ced3463a84e2a99be0789e7649f50e6d33cbe6934a058ac1088660c457caafdf42d7bc4342fcd844c9811bd2d2a02efa7cad5ecd10b7a98
- SSDEEP 3072:S6F8jWZcccccccccccccccccccccccccccccccccccccN:E
- TLSH T1B5C3CBDAA366885BCC1E2C34CE659DA4DF877F5982E0B02C5343723E163D94684BA737
- MD5 SHA1 SHA512 SSDEEP TLSH
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/RES/XWorm.MBox.resources
- SHA256 a2a724d05f289fe51f6a3639937c460764ee42935c6eddbd5f7cc7ab6d26954a
- MD5 ffbc6e01f688097960937446350eb01d
- SHA1 6753b872c838f2439e91fbab20671cdcd7bc3d1e
- SHA512 2cfa07a45ed9b8547a9ca303d66a71c943f1723fcd692d9d8f5f20f6ce9671e5e5f11bbb2ba7d6e41a27806bbbb7ecfd2f7e7d37af5420aa3c68b0f64dc9c6fa
- SSDEEP 768:hFGla/np/wpRGZPdKOqoJLTapjappD+2f:jDfd3ckHjf
- TLSH T115B30C2A71F1443BE8E8B4B1080595E68F7A7E73EB805E163198BF5ED6F5064E30B1D2
- MD5 SHA1 SHA512 SSDEEP TLSH
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/RES/XWorm.MIC.resources
- SHA256 aa4f13af48d1d3b3735a732e90163e6d302fe33a8f0041933dc76427f099aece
- MD5 d079b64991e7ae90dcb355f1036831cf
- SHA1 980f639c4e3db7cea44ab28e40ccdd2c728ee179
- SHA512 e6e5e21438d7b60eb9f7b6d8cc9e2a672e15dd5af2cecdfbc63dfce8e371982abbb951ce052e731daec9c86f356af54e81623dc7e72ff36a802907345d52f6b1
- SSDEEP 768:moZmmittmc9ik83EavHr/QS99wkwcMPliv+j4bctbK:5etYOC3lvHr/39Kcki2jAMbK
- TLSH T101C3B13D77418880E4D80FF34B8493DD252EDD33AA8E0E77FDC866BAE6611154FA0685
- MD5 SHA1 SHA512 SSDEEP TLSH
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/RES/XWorm.Main.resources
- SHA256 35a6f657c6d1db902ff3fbb3149e629acbf926c7c244bbce502c0b65cd2c536d
- MD5 8d7f5438261b974eaf34287253799b87
- SHA1 086e994fa1ce12ebeba3c134ec9af69244e8c2e0
- SHA512 2e33671bf500e8a3727181e14cea8be2d4f77d4422720710056676ce4f8e6b4b2b3a9f38a0713750e7363c52af097ebb5c489c45d46c5627236d6afc81e67f67
- SSDEEP 24576:nm8179dddddNjYkDTFKlDy/Y3BZabuwVAeNgFfWN:nm815ddddde+MlDyg3BZaSI
- TLSH T1ED95F52B3756F92CDF3806F63A914FD2659A0B5F64304DF9204223BA35DA6CC71A93C9
- MD5 SHA1 SHA512 SSDEEP TLSH
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/RES/XWorm.Maps.resources
- SHA256 f690fd15ad3c3150a48fd33962b44ec118bb3f9b210f0d0b27e3ee83420c73f4
- MD5 ed0eb94f77f681a3600539bb9a6cb6f5
- SHA1 b176e3455cd0224448e9d9b4b015789c794d8b06
- SHA512 8e097d3d8617043419154821d9721bd4f7e16f12a19f7e8873c8086872540c61e4d932e43515573eac08372a243c0ead855ebfe5488a1e6e53142c44cbb5eebb
- SSDEEP 1536:jjbwDfOmcgfteiMWWZoSp9wmLZoSp9wmT:nSfO0tkZAMZAA
- TLSH T1F8E3F2C47E4AACB4C4E6A170F75590B21318682EEB61C0C577C47E8969EF0538ADFE4B
- MD5 SHA1 SHA512 SSDEEP TLSH
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/RES/XWorm.Performance.resources
- SHA256 16ea3b81c6f9ad74d27c621f0b8485929dcbe293435b151124c388aa66f09c52
- MD5 4c7233c83c2f749762fa0e000021e5e3
- SHA1 9b1a4826da8279f52aae9cf29570dd2679ada1bb
- SHA512 0f9b830fb139173f321a78b32b3166271cd5345df85b63b2a797e38cf3fa441715cc648e89768bf12bcdfcdb621273eb53b62d6fd66f5cabf6b8c40d3474174f
- SSDEEP 1536:LcP/zyxY/FVGJ+j+chraMRNPnLRhtAN4RRH9nl85gi:yyu/FVG8jbraMRDA
- TLSH T139B3602C7002E7A5DD143A705DCB867805292EE9A54AF32DA2A77F2C6FFC329D513235
- MD5 SHA1 SHA512 SSDEEP TLSH
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/RES/XWorm.Port.resources
- SHA256 bd3da4a9c29cb564c774bd8b8c0b79078f09b037cf2f3a8fa2566648f68a012c
- MD5 faf23924f3c859e9d570109d930928e1
- SHA1 6003549ef256bac573ff809a9a5d967b8106f9ab
- SHA512 227f0c0245ff48955a1ba95fcae513237c1d4f548ccba955c4b26a633e7330a312fcdea474dc87f2847b51a3694427f5227f60a77dd5168760cf28b770ee3fd3
- SSDEEP 1536:wi2AP+ew+ksEvCwVwLM+uvpIVyXJyozbGyMqmyVttdGFQeOPigp3dIHyYNSL:2A2ewhLapuvpAsZOyMqmyBeYVYi
- TLSH T1F5D359A5ADCBDDE7C25B25B48C429575203D9C6F5DFB001722813B9DEBBE8AE0395803
- MD5 SHA1 SHA512 SSDEEP TLSH
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/RES/XWorm.ProcessV.resources
- SHA256 1e1b3bd4c4dfe056edf30fba8d6bbf94665e9bcf936ab06db79213e8b400b61f
- MD5 abfd25fb3ace375c63f8e9cd4ecff32c
- SHA1 d7b7f30bd62e17e1da6bad889b9f77d93c795039
- SHA512 d8c0546d1ee9a35a7b8a3b9304ad63794b1e71d014f8c45145b60343f8140457a8711065f7a2aa87e68e1d564a45171425adab9b83adbe9491afe065d990fe0a
- SSDEEP 1536:io7ETH1QatyHkrVOceYM4pjq9bTQPmbYakBxBW/7jpYaGs:VYLe7HkrVOilyTaxw7jpY7s
- TLSH T1EE63D117B74A0EA9DE195F3304A5CCBDA26925C7BE3B542F3B8F515E64202062734EB3
- MD5 SHA1 SHA512 SSDEEP TLSH
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/RES/XWorm.Programs.resources
- SHA256 55c19900015145bee8c83f27ca58032550871a92047abf6166dbf547b6afa505
- MD5 9f05c761cba903361771cea155ede6fb
- SHA1 af0311816e6f1315bf29e5a42ac3d75adf71d115
- SHA512 d4e049c341deeb7376e7def96e071808c9e04e085171b46af7f7096f52cf4288df19d3c2aa2c87816a6eaf5feb3f2257bd58e93f582498ad8e4fd4bcc652859c
- SSDEEP 3072:XfH6ZxP8NJAceI82I98CBCYLe7HkrVOiqyTaxw7jpY7s:XfH6ZxP8NJAceI82I98CBebq9TW7s
- TLSH T109F3F79F67DA5050C8AC0AFAC223E54186233E6D5E3A36E61BD8779C8F7B0C0D146677
- MD5 SHA1 SHA512 SSDEEP TLSH
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/RES/XWorm.Proxy.resources
- SHA256 ee84fb0146a0a7e6bb8506159eaf12fc2888ae87b0553e1cb031e044830584dc
- MD5 d6e648329cd1473e66a01a9402e907d7
- SHA1 ebe34259546be5638bde8ae75f96d6f70e3da62b
- SHA512 0d44e33084f163b0d56798ace44294825fd76478acf303ca03bbdf6dfa286cf8cd0677c50fc1a422073ec7498d13aeeaebfb89b1a4eefd55dd010c6c23c1a7ec
- SSDEEP 768:+SEnnnXXXXHXXX/fffbyuyuyuyonnny/vXH/zLHvEppicZXvZZHf+m:+SEnnnHXXX/fff3nnny///zLHv6JZ/D
- TLSH T18BB3CA622D25AC5BF74501B26876FFF8167DCE4C8EBB59B26A50FA3DCC3092CA1091D1
- MD5 SHA1 SHA512 SSDEEP TLSH
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/RES/XWorm.Ransomware.resources
- SHA256 bcea581804fc0d0e1d66c76a47f9b7bd40b81578bff0241bb4155a0c67486a46
- MD5 c653b8b3f18eb2a2882c2f3905b2380a
- SHA1 62235a88bc833fe7a41c9da2e5766306a026e144
- SHA512 a01927f5a4f3b1d838919074c42125d60d6e50af3e876bf614f0dd264627234973ba4b642f30040332c328587340be82f6057a5130baa0d79851fede67069a4c
- SSDEEP 384:r0vwtokwOdwq6upS9LvgUuYkYezHbMTb7+JZf5NXJAdDzMwA6jp:Y9XuYkYez67+JZ58zf
- TLSH T17FA32318FCA35E5CEFA47F361E9361FDCE1118E42506C71668AB279A0F3C09765233A6
- MD5 SHA1 SHA512 SSDEEP TLSH
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/RES/XWorm.Registry.resources
- SHA256 ce34680ff2984c6c4766889684a358358711d2cdf3171813ff768d7f1c9c53de
- MD5 d098b950169502933b9ef1f417f25172
- SHA1 8f40b86fa8a986588788676ecdcad5bf55c586d7
- SHA512 4a38f88db6a585d6a47e6da36ac8aceb15825453e5ff4804b2943be9e4053fb85206e473115e72a86c4b0c2d13fa9a1ae18ed7d96b52edd050e7e918fed33317
- SSDEEP 1536:6s67ETH1QatyHkrVOceYMa7ETH1QatyHkrVOceYMJ:6NYLe7HkrVOipYLe7HkrVOi8
- TLSH T1C404A2CCE8A6919BD07D48B51FAD8EB61E445DD934F330BA2D8CB39C123628CAD071B4
- MD5 SHA1 SHA512 SSDEEP TLSH
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/RES/XWorm.RemoteDesktop.resources
- SHA256 1dc136b225528fe4ee8020f46aa549e4bbdd76493d0579b6c1837d10acc3ba13
- MD5 0f5fc0694c9d76a6fd5b7e4158fd03e3
- SHA1 aa7eb852f5743e456e5737ca25e7b75ca7349b42
- SHA512 af3c1ff80a247ac8ee6440ff4410460603430f24557dce392b90961b77a2d978b6b75a9a606ca433ce16cc565d07c2b5fc41413c1229147194b24bbc1869c67a
- SSDEEP 384:rkvwKwq6uD0hAAAgAAAgAAAgAAAliIGzl8nnnJP5JJJJRetmJJJJ5gCnnnsjBy:rDnzly
- TLSH T158A34707C4CEE666D138593B14BFACB361B9EC09C551EC0E8834FA7E68F64E24C89576
- MD5 SHA1 SHA512 SSDEEP TLSH
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/RES/XWorm.Resources.resources
- SHA256 557058bd29a5eb55ef073ea9c4dec0baea1fd3f3f4bf2cdd5ee3dfd33735e93a
- MD5 34986e38b463873af40f694874c1f6d3
- SHA1 8fa89cdb7a394cf8093d548ca9db4652c703ee72
- SHA512 c1b0278e8c21e5c28204f692a5cf5ed16c8ada0c6022d7d38e70905255f3aeb5d2c0fd4549f0ed19ead52aa0ced891a8f9372123bf5e1710be004958750874e4
- SSDEEP 49152:OsP2WTJcLsk9Pk6gAK6BN2NQUe+ErnuVqjNhHXH:zuWTGLP9Pk6gAK6n4ldyNh3
- TLSH T1A0859E11F7B1C074C98A85318E29ABB591F5B71FCE10588733CCAE6E6F728D5C329A49
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detect Xworm Payload
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/RES/XWorm.RunPE.resources
- SHA256 823554153d20aabf65c8635b7727dd6f26f14f79da929de9af8131314ec2c347
- MD5 147c16f102addfdd7b756b8ee1558b82
- SHA1 e9aa9624bb96d369aa905d14e03db625d17d00f6
- SHA512 2df2784f5284e0808224a58fec6e12f02a5e09001c77991bf643b4304d99b633a3511551ef42e2e64f1ad6e5de0a44ff2c3b358413dd6ea6a9b08c0dfc592c38
- SSDEEP 384:rkvwKwq6u29Ax59IWzT9DfLtFbm44XdZcGe5Eas1gMVuM:D9Ax5x9vtFbm44XdZNeG3
- TLSH T15BA33E35F623D887C5488870DA4F9C690B566F5C68A0518EE0FFF39BE931B524B2325B
- MD5 SHA1 SHA512 SSDEEP TLSH
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/RES/XWorm.ServiceManager.resources
- SHA256 fc7906c147eb0066e6cee2a528ab531b6d0ad1eb0b0a4d2a32a1be422809ecb9
- MD5 776d31cf63f902ede47ccd1e09c463cd
- SHA1 a45e4761bc40019d6e5b72ece5d731c520d91303
- SHA512 f8f099d291b0ecab01d84d0c4f4480c7ea266cc79f1071d71c71ca3113f6c8594d82f192feb3b136be0e007542da1cc6a7b28b860bb3ee2e0e7747b75222bf0e
- SSDEEP 3072:VqR3kbym/bBGIgEJjHbD1yLHpkv+GhSx7BQFgfMyd9tbYLe7HkrVOih:lbJGcJj7D1cJkPhCprxbq9h
- TLSH T1E624CE292D4991C1E99A3473DC8DA58718B53E869BD0AF15B6487B2EC4F443CC32CB6F
- MD5 SHA1 SHA512 SSDEEP TLSH
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/RES/XWorm.Shell.resources
- SHA256 7f71160fb4d68eda2e6af07f2b89416cd5668ffa5260dfbeb69391dfc5508586
- MD5 a3fea8391774bbb0376e1f69eb6ee9d2
- SHA1 96032202ca3dee1983d1990ae856112f8c832173
- SHA512 10a3c77631a0d1ee80198ffe430a0a389897201ef60a8f3e9beff5125545477d8ce6ea8fa5d186ef31dc4681b62048d71fcbb3106a88f22aaa08ee75de2c842c
- SSDEEP 768:aoR1HiAxeglYAQ8BXIHDiJ9zUQI0xV3PrEiv/ewrmTIgdEM7XoSxSdL5NCc+Y:ayheg/Q8B59zUQISXnFmV+Ib81NJ+Y
- TLSH T13FD3C8915181EE49D9238F3E501C95EC663C5E4258CBDDC03269BDBEEA72706DC821FB
- MD5 SHA1 SHA512 SSDEEP TLSH
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/RES/XWorm.Sound.resources
- SHA256 7d7ca0ead2e362c4b2b4e5e7799b0bd115eff66abe9f7bb184734444142bfd9a
- MD5 d867ec78d12cbf85eca15722c1ffcca3
- SHA1 90dc339c7ad81447758eadd2535298cfc2eb1bcf
- SHA512 5bcbbccad3f71207e6c28784fa27e38d8c24c4d2edcdf3b55d5937974c63c9a8fe6ce311d6946ea13b669ade3c262f0c3bba82a330fbbb08a00bf066734ea638
- SSDEEP 3072:njXXX////ePrLaPp5+SRqRN1SMLVivg1AGA8JlT6rZQnmmQo:RPp5jyNQMLAvkAl8JlmNV2
- TLSH T1FC143895E457B0B7C8EC94BC78850AC1DE7C2CA66064598E73923B3C24FE40EF6CB569
- MD5 SHA1 SHA512 SSDEEP TLSH
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/RES/XWorm.StartupManager.resources
- SHA256 73d138786a5f08114204491631867e44f5d1d60a683890509c7f69a78198c60e
- MD5 3e7ce35b2e085ba831d417d582b249b9
- SHA1 63926a8d61ef3eb1e9408e9c531ce35adba66886
- SHA512 27a6de57b2c88a8d1119232ef123e728b4f1bf9aedaae8caa026bdce9541ef61c4c3d5a59fb4c7613febbae5f5e19ae754c51a4ae9176f2eca5dc03d938048ac
- SSDEEP 1536:LasebR3b313F3F3goXjmtt32325JT8J8pjq9bTQPmbYakBxBW/7jpYaGS7ETH1Q0:L9eS5JyTaxw7jpY7SYLe7HkrVOih
- TLSH T11BF3AFE679440563E8F819B15881A18B3A7C1DC9EE401E96BD0CFB1D78F717CE709E8A
- MD5 SHA1 SHA512 SSDEEP TLSH
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/RES/XWorm.TBotNotify.resources
- SHA256 6ec33992edc80f131e4a9f7f89fe9c9dba233f7c3bda8ce6e06711021e8645fb
- MD5 b219d1ee4ae25f781e5bc88165839987
- SHA1 bcb30240b697493fd238c0d611081200a0abc3a0
- SHA512 e4d013c746ca857a135484d908fd2fca6257236b8b3cba8bc10209fdbb5f7cb3b595da15618f4713eb5cdeb7033772f72c22eb9ef5022c337d1dc3ebba67c746
- SSDEEP 384:r0vwtokwswq6uTq4fffjfff+7f75ArrqWKwA+apJ:dfffjfff+7f78rqWnapJ
- TLSH T135A38D1AB19BA81AC72C4838ED53989850C1BC56DC5E9E06B4E4FF7D06B58CCBE23375
- MD5 SHA1 SHA512 SSDEEP TLSH
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/RES/XWorm.TXT.resources
- SHA256 1ec2de5a4bb61ecb3a2e57da228d3c9f278853b21ead5553643bbaf6c6706b50
- MD5 9cddc18b39b043d9542e5f0989faabf8
- SHA1 afe5c5b7d6a978ac504ec272c1e8dcaaae1d5b34
- SHA512 b9da58a39c39cfa665e63af0ea206ccbdeaf7452f801b3d2d9bd89e643c3c729de172ff6f86b8389d94f2f0ae92153275f4cb1a30fc60fa93e5fdb717cfa4a8a
- SSDEEP 384:r0vwtokwzwq6uCoAf+q7xVsFoSNDUSh+w6HvQdBeQanPw9h+w6HvQdBeQRzrh7ji:2iB7bsnWfffJFB
- TLSH T186A394636903A053D07476B2CA8084A07AD87D9DBF7CF8676260FE5C34714AEB923779
- MD5 SHA1 SHA512 SSDEEP TLSH
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/RES/XWorm.TcpConnectionForm.resources
- SHA256 5d1dcb82a528c97aa161d0ffa742032abdc3e911125d2171768ceeacf8fb9285
- MD5 84f1c4ac6a6d9b44bc830ab1129da3ee
- SHA1 55b207a19d11950267ce10e914c0b4adcad52f1c
- SHA512 4faaff764f6074216c5d9a5493e949ffa6e0cf32a74181d8141d0e3d5b5795d3afd3dbf79f9bd2890d37f420205cd75328d8e488424e139ea1aa7fc9898c0aa2
- SSDEEP 1536:ZLnTGFCnE2TeaHXvSQ7ETH1QatyHkrVOceYM/pjq9bTQPmbYakBxBW/7jpYaGs:ZTUEeM/hYLe7HkrVOiqyTaxw7jpY7s
- TLSH T1BE04E4D1E93B84B0CBD24DF29A1B778B12B91E668F1F501228B4B1E90791FCE143F566
- MD5 SHA1 SHA512 SSDEEP TLSH
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/RES/XWorm.ToolsBox.resources
- SHA256 f6a8d146ab66f03723e3ab551b1579f695947cbed073727af9fc396b2613f62c
- MD5 73bda4b934275a61f1ca27e88299a29c
- SHA1 63cb4ac6a9b0dcac53dfc35bcc817ddf46e5e399
- SHA512 9f2b82b1971a195eea9401084edf15f33694b3ff757b3c1b71d80315425c6942a3e924b9fb2681419f256128257682565ad13d78570db41fcb3e9095269cfdd0
- SSDEEP 6144:626twOOCanAtwOOCantAHzfadhIVBfVBd:62iwO7wOf0I3F
- TLSH T167345822E390934BC43642B0F8A5C26C31F99E407B78FA9620D3791E21B995F9D1B75F
- MD5 SHA1 SHA512 SSDEEP TLSH
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/RES/XWorm.VBCode.resources
- SHA256 0a8d6cdc13ff8387d4216b31384339e56fbe205ebbbdf1dc3f8f4d8587007ffa
- MD5 76d53ae7107963acbfcd4597019c7f06
- SHA1 6d01fa4b76be5007a5e1b6a7068ef32e8c09b258
- SHA512 8c5a7fae83626de3f87b0b6ab382e2b2d60e002a701c87d7ede28fd976d34e7d88d664a72c22c956c2f54e0b93150634e8ed535d4b04b2d65f2516d6cbe4a270
- SSDEEP 1536:fYWQm2zLGIBhvbXetsYOIw1AVLx9WXjbR2H8fsSp4KNcEq8YnFBT2L0RjpY6Wjvb:zQ1mInYW1jXjN2asvF8YnFBZxpYxvh5
- TLSH T11604E69374DE322FEC270936911FFAF15A75099007D68DAA6CA4221F406550B84FFEEB
- MD5 SHA1 SHA512 SSDEEP TLSH
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/RES/XWorm.VoiceChat.resources
- SHA256 1e5b9f16f88c4de8c4a3ad03cb318815f92c40f89eabcfdd1ad0483a41113527
- MD5 9b4613ca9da1999c6b521410d75e417e
- SHA1 4671b2d8ce2280fefd6bd7aafbbf709ee0f554c2
- SHA512 a107f4d40581c2380b745a54640fd1ae5aa6ebde04310077074de22444b5adf3e64206c078cffc10725a77add0d023e52c2d763920e2e8941fd2f3ec58ec3e0c
- SSDEEP 768:V2bS6Pq2Ykkk+p/C+5hKf9wkwcMPliv+j4bctbK:4up2SFl5huKcki2jAMbK
- TLSH T18BC33B7EA2529002DC346EF1B95483DD2DDEEED82B61FD16FDE1BA79E97111900322C2
- MD5 SHA1 SHA512 SSDEEP TLSH
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/RES/XWorm.WebCam.resources
- SHA256 0ff62be2bcacad7ddda3b3cc32fee9c0a1c3bb5d72d81318728c1805204b2433
- MD5 0a82ee1d886148e7b149c3b4745ab653
- SHA1 a6b3e0127fa58c4479d5cdc4bcaadd9b6e666424
- SHA512 6a13d2e45d710d80970dfdf0bc09ec0709fc88e62d22c4aa2cfe6c8dab18bee14e134d613b1fcf8204b70cd9950c82d040eaf718a97a8f64502d05e3ec9f6c0c
- SSDEEP 768:LVLgN8K///iee8xxpe7ee8xxpe7ee8xxpe7ee8xxpeTD28g806Pj8ql:a1xxzxxzxxzxx2n0Tql
- TLSH T1F1A35EBEE5638538E26C9EFC89795BEEDC3DE84A1819CD52FCC56A3ED12C84254B3404
- MD5 SHA1 SHA512 SSDEEP TLSH
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/RES/XWorm.ngrok.resources
- SHA256 b7e3e334ae48421bd3cd08679d94614e3f5c2d5847aff6eb7e06532966a43013
- MD5 b776cefaa200763a77bf55211c838b3e
- SHA1 4296aecaec1f77623dafb7e34a76c8b25ef6bff3
- SHA512 19fbaa3369ff3424bcd6fdcd35c677b686bc465bb558e8933a93ce0997bf782929f4cb5c1e2022d0d3ce3f54d4fb6bff25b11444760972919d3ba0fc00aae7b0
- SSDEEP 384:r0vwtokwPwq6ub5wAlec7vxohnxNQI5EOyK/WdpcN6Y9F/2KWowAglB:JMKyqNri9B
- TLSH T16BA3393CF297E858C11C9EF94A0987EECE3CED5469628D49FCC27E3EE52181B944B251
- MD5 SHA1 SHA512 SSDEEP TLSH
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/SimpleObfuscator.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 b7a6eea19188b987dad97b32d774107e9a1beb4f461a654a00197d73f7fad54c
- MD5 9043d712208178c33ba8e942834ce457
- SHA1 e0fa5c730bf127a33348f5d2a5673260ae3719d1
- SHA512 dd6fa02ab70c58cde75fd4d4714e0ed0df5d3b18f737c68c93dba40c30376cc93957f8eef69fea86041489546ce4239b35a3b5d639472fd54b80f2f7260c8f65
- SSDEEP 24576:FDy7cKOfkiRrXP5WtJvW1mpjSWr7uoZme1V86:+8/AtJes1LJ
- TLSH T149654A01AFE6C72BD69F97F6D87206142BF4D049B3ABF79F161863A91C837425C06227
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1456282
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
1.4MB
Virtual Size
1.4MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
948B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/Sounds/Chat.wav
- SHA256 45f4136e58a5f749d125d2ab54308f81954d2c5b364b66013660a6c358845d1e
- MD5 832a3652fd780edcdb2439ec33532c0d
- SHA1 f0754ee6519d77700f5ee5b744b8c99386d7b577
- SHA512 3b3b55afcdfa00d9b7085b20ed52a7b4d8b7d403f5d0d1c539781db1a20257efd8c856e19b8f32ea33766a580690b498ff063849519691a9a4cbbcd3e9447cd4
- SSDEEP 768:QVPqefmaP5C3KduJn13jSHYHzIcr6DPW75Pvi3Fy5NQbIbhuJLA+LhDclY3Rp6:yP1mU5GlJnBS4TIQ6o163ofQ8b4Pfm
- TLSH T1B9235CD0E142DE00C4829D6ECE16E5E047337A95EF4B67173004BF6A39E35C2AA6E7D9
- MD5 SHA1 SHA512 SSDEEP TLSH
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/Sounds/Intro.wav
- SHA256 e3e5029bf5f29fa32d2f6cdda35697cd8e6035d5c78615f64d0b305d1bd926cf
- MD5 ad3b4fae17bcabc254df49f5e76b87a6
- SHA1 1683ff029eebaffdc7a4827827da7bb361c8747e
- SHA512 3d6ecc9040b5079402229c214cb5f9354315131a630c43d1da95248edc1b97627fb9ba032d006380a67409619763fb91976295f8d22ca91894c88f38bb610cd3
- SSDEEP 3072:FU3hYG9X9JzhaLL5+QYKHZDa6D+4LT92KEpcP+b8FGUt0Ybs5e9jXjubLtNmBNs9:GjVsLL5lva6D+4P9llWvaGe9CHeBNm
- TLSH T177347CD2E104A690D83989329D1669954B233AEFFF8A33353084F73674E3442DB6D6DB
- MD5 SHA1 SHA512 SSDEEP TLSH
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/XClient.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 e40c66b12104a176921dbf06e0eb2fa0e4ac5fe82755fe2313fa212fa7cc9f70
- MD5 1ef300f71c6a808bd00d0b7026703c6d
- SHA1 f463331ef336dceb9e9f95b54fb0a4f86e0c8db0
- SHA512 2ed516c21c1efa4929127a418768038551b46c3be2bdede9afe64efb7a487cfa6c03b1c53a283cee88c3d0bfd49ae8855db6c084ff0b6c1d45278a0d26e2a006
- SSDEEP 768:iVa+vNtg+PB93Tw4ppzVFE9j/jOjheb3:svNtgw93U4pjFE9j/jOjYr
- TLSH T128E22A4877D44712DAEEAFF12DF3620612719517E813EF6E0CE485EA2B67AC087407E6
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detect Xworm Payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
38766
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
30KB
Virtual Size
29KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/XWorm V5.6.exe.config
- SHA256 7ea08548c23bd7fd7c75ca720ac5a0e8ca94cb51d06cd45ebf5f412e4bbdd7d7
- MD5 66f09a3993dcae94acfe39d45b553f58
- SHA1 9d09f8e22d464f7021d7f713269b8169aed98682
- SHA512 c8ea53ab187a720080bd8d879704e035f7e632afe1ee93e7637fad6bb7e40d33a5fe7e5c3d69134209487d225e72d8d944a43a28dc32922e946023e89abc93ed
- TLSH T171C0122940A8BD269D328A279252C962FFB022A2A024000CF02FAA670B3105D4257326
- MD5 SHA1 SHA512 TLSH
Ultimate-RAT-Collection-XWorm/XWorm V5.6/XWorm V5.6/XWorm V5.6/Xworm V5.6.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 90f58865f265722ab007abb25074b3fc4916e927402552c6be17ef9afac96405
- MD5 56ccb739926a725e78a7acf9af52c4bb
- SHA1 5b01b90137871c3c8f0d04f510c4d56b23932cbc
- SHA512 2fee662bc4a1a36ce7328b23f991fa4a383b628839e403d6eb6a9533084b17699a6c939509867a86e803aafef2f9def98fa9305b576dad754aa7f599920c19a1
- SSDEEP 196608:P4/BAe1d4ihvy85JhhYc3BSL1kehn4inje:PuyIhhkRka4i
- TLSH T10EF69D107BD68006E47269B00A946AE199BEBEAF2B15D8AD30C4335C17F64CCF953BF5
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
15469470
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
14.7MB
Virtual Size
14.7MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
137KB
Virtual Size
136KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
njRAT v0.7d Platinum Edition - Rus/njRAT-0.7d-Platinum-Edition-RuS/GeoIP.dat
- SHA256 b4bfd1ebc50f0eaab3d3f4c2152feae7aa8efad380b85064153a6bfd006c6210
- MD5 a0a228c187329ad148f33c81ddb430bb
- SHA1 d70ec83d1b15b3156df73802dd1bec024b1b9346
- SHA512 0fe0a62c07f7ade0e6bfac8843c13c055369177935d801488a993bc4bcdb9da220ba1b37df2027dab8af7c15e5cf00b3e8f223b12165d8a1b0b9c30dc9939332
- SSDEEP 24576:WUH7rp/TXKHJBjsN0wjAu6e3akVX7k+k7bKnz+AHxOxaz+hnV647KyMLh:WUH3p/TKpBjs0b+akV4+C0axaz+ZVL7o
- TLSH T129358C22FF0696DBA9413D9EBD189EDC18148DB9FD071339625E379C60B8374CCC26A6
- MD5 SHA1 SHA512 SSDEEP TLSH
njRAT v0.7d Platinum Edition - Rus/njRAT-0.7d-Platinum-Edition-RuS/Mono.Cecil.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 cdadc26c09f869e21053ee1a0acf3b2d11df8edd599fe9c377bd4d3ce1c9cda9
- MD5 851ec9d84343fbd089520d420348a902
- SHA1 f8e2a80130058e4db3cf569cf4297d07d05c93e0
- SHA512 5e1d1b953fda4a905749eff8c4133a164748ba08c4854348539d335cf53c873eae7c653807a2701bf307693a049ae6c523bd1497a8e659bdea0a71085a58a5f1
- SSDEEP 6144:ueMQM/aMOZabe3h1PtRjAqmYVNf3yTXcYBbt6KMBhu:uF/aMDb8BtRjA7XcYNclB
- TLSH T1D46429185AEC5B3ADD6F97BFD0E6581183B0F0126643E30E4BE4B2B22CB3761C95255B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
318190
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
C:\Users\njq8\Desktop\jbevain-cecil-0.9.5-73-ga5ffcc0\jbevain-cecil-a5ffcc0\obj\net_2_0_Debug\Mono.Cecil.pdb
mscoree
_CorDllMain
Name
.text
Size
303KB
Virtual Size
302KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
824B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
njRAT v0.7d Platinum Edition - Rus/njRAT-0.7d-Platinum-Edition-RuS/NjRat Platinum Edition.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 989114eac06b024e0fd631d7d7b6e5435f86ea349cdb59c9b7c4407d1527ae38
- MD5 9ea34bd96a5e4c536787107a532e1bf2
- SHA1 66941b6165076379114b4216ff4f60d9623c407a
- SHA512 e80b6ccd07e4187331085a23fea83acc6fbee611e0af2b4f1c724f2ae5b50688692c8aa917852dca400c705d25b83b95c4201e70c12cf68b35a276ee3a23cabf
- SSDEEP 98304:gPRpwrSEEwml7hCwOtV/QHyXjvlbqyo86RMDoMu2jx1sA6iOGIm1eOVqn:gPTwWeml7hcD5XjkNwfsA6iOdm1eOEn
- TLSH T15586CF037340EE19C5BA66F460528F909175BE0EA138C1FA25B43B68FAF52D2FD913D6
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
8288370
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
7.9MB
Virtual Size
7.9MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
35KB
Virtual Size
35KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
njRAT v0.7d Platinum Edition - Rus/njRAT-0.7d-Platinum-Edition-RuS/NjRat Platinum Edition.exe.config
- SHA256 c45c9d1d30f940289498be2af978d74178a5c24ceb7755c2648f6c7a89353813
- MD5 da15a1d8d770b57356ddd384342b3034
- SHA1 b03d6cb907c139492c7b914147a498b31ef839fd
- SHA512 3cf7dd0d14244c543e3442873ce7e495ade87ad906a42d53f3b38180ffc453bd74ae022b91306445d359475dbee4caa1514c4e913e823d174b8470b45fed7cfc
- TLSH T1FE21CE45A5D08CB5466396636A544EC0FF364B9F724C154CF8DEBA9B8F3342C4707192
- MD5 SHA1 SHA512 TLSH
njRAT v0.7d Platinum Edition - Rus/njRAT-0.7d-Platinum-Edition-RuS/NjRat Platinum Edition.xml
- SHA256 25fdf1bf3806ef92e022c6085f63d44ee314764cb053b9456ad0c8d86abd1301
- MD5 0f2ee4833bfbf61f404bb982c40ba249
- SHA1 b3559917b919bf8dc2067ebc5f72a5b9b45e6ccd
- SHA512 971f5f58e09d49ab4a544146dcda7b2594efaa3531ac9b005edd5c362585912a6c5ab78eec99eecf39b0f4056c155d5918a66eafc7cb11e1c8f758def0b255ee
- SSDEEP 48:3CsG8vgH0cJPcJ6cJFcJ4cJTcJocJzjcJlcJanUycJQc7afgkccJYocJUvBUMmu4:3i0q/o1KlsU1tC+G6Weyn9dIyKqV
- TLSH T11CA166468767EF390D3411BB7EB0B5C024635E22956C280EE8AA1C7347D22DA36FBE54
- MD5 SHA1 SHA512 SSDEEP TLSH
njRAT v0.7d Platinum Edition - Rus/njRAT-0.7d-Platinum-Edition-RuS/Plugin/cam.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 8aeec9c0a673f2043bec795d8430c280392913ac275fbaa3380524ad2148eaf8
- MD5 b0f1130c6da19dbdb8556f910f168420
- SHA1 e09ffdb725dc2ca0bc28a58a4615c0f3bcf08adb
- SHA512 4d97ac1ec120120c22d2fa39c3bcdafbaf6796da4742154323860ede74a56fffadfd3734b2fcd37e60ea0334e951e3c2d7b05c52235db89bde3fa2a1424224fa
- SSDEEP 1536:SwmVRUhn1vP9QJwnXusCEtsIbepigBULPqa:SwmYZ1WJQIEeIbepigBy1
- TLSH T15853392A2B98641BC58E577C90B30F0003F0D65A7623EB8A6F7961BDDD723944B173A7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
70926
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
61KB
Virtual Size
61KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
512B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
njRAT v0.7d Platinum Edition - Rus/njRAT-0.7d-Platinum-Edition-RuS/Plugin/ch.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 47f7c69c4cc4c0feb6a6f1730d697ca95e24d5cedd490c31d8e30cd1fa3b3859
- MD5 9000a99ee61e1c87fb811a77df2e7b91
- SHA1 61a026acdbeea3c8e68a55bce7c4803aa678adbb
- SHA512 d45a1e2530143dab919b892b7e21657a2e6e62533046d75aa787da9ad012b73245aa033de5c169aed08a66fb117be1df1f87253cb4e49cf9b47b89e58d799c15
- SSDEEP 1536:buvVvVdtKqzOR6ergb9hZwh4nXVtn+99p4oG0CEI81:YVvjt1bbA4nX+vp4oo0
- TLSH T15E839D0ABB8AE3E3DA6E0A785021561103B6DD204E33EF677D9D349AD5737540F79360
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
92446
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
82KB
Virtual Size
82KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
njRAT v0.7d Platinum Edition - Rus/njRAT-0.7d-Platinum-Edition-RuS/Plugin/mic.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 7bae6ec2613874287c20ddcbdf75e7cca0ac65132485dfcfd632d0e5f97c1719
- MD5 e9214452435d0e6f782b545ec0123331
- SHA1 1705609d15c0c7cab4ebcb28f082cfcb8e1f80ac
- SHA512 05cbe650b1ed26193128cba8d58fbe4c96ccb5931d877a6937e4a442f74412fd3cdda46b5cff4390a71133cba4c10c778377988c657eebfe5e631ae4f445ebce
- SSDEEP 768:F6YK5hvcdWNbu/GemZgXEFajkt22rB7BJodsx7fuhwWFTxqPbqgmB:F6/xemZgY9V7Jx7fvWFTxqPb7m
- TLSH T16333D6507EA41CBAC16B067DACE61112F6B18D68B227E76B1CFD60F758833DE86406F1
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
56430
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
47KB
Virtual Size
47KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
512B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
njRAT v0.7d Platinum Edition - Rus/njRAT-0.7d-Platinum-Edition-RuS/Plugin/plg.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 bd5a390efa75b9a47077fa1e7558713842563ec5822eb7f1dbf35ad9020012dc
- MD5 4643db3dbf75200efa97e80cfcf2da1d
- SHA1 cd65423fbeb54a82f1312ad96c848a261047ccba
- SHA512 ccacfcf1e9325ee3dba0556cc527eae2b856531a7d963072181549e3e76395d42be27206f0312a5fa30d8d35df75a64382a399fb61c26cef703671fe21fb25e9
- SSDEEP 384:uLPMDSXbwv1qppRt9LmCfvEk/LcEf6snTlC3/b3DP0lpm+x6dzWxQpbiqWz5matX:48tyRt9LmCfD2j3rc+KUbkoa+h
- TLSH T1BED2B40D2BA5C42AC37E47355D6643224AF3421B4915EE2E0CDF8EED1BA37C84B85A5B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
35342
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
27KB
Virtual Size
26KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
512B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
njRAT v0.7d Platinum Edition - Rus/njRAT-0.7d-Platinum-Edition-RuS/Plugin/pw.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 a3e4bee1b6944aa9266bd58de3f534a4c1896df621881a5252a0d355a6e67c70
- MD5 db87daf76c15f3808cec149f639aa64f
- SHA1 d67f84a44ddc25432ce179aeba9cff778af746ee
- SHA512 ad7dc75254180ff7c988b7f394ad76b696384002457d558469d2c6401dd97cba54c532245bb555ab28d2beda3ab504736bb2b89040a21ba6598929392daab473
- SSDEEP 768:fqcFOkBO3jzamnEjt0Wp8em0nktiwRnKSg42+:fvg3jumny0Wp8em08NBgG
- TLSH T10F037D067BC69301EABD8FB51CB281444372D28F5D13E79E1CE988F42B76B900955BEB
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
46542
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
37KB
Virtual Size
37KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
njRAT v0.7d Platinum Edition - Rus/njRAT-0.7d-Platinum-Edition-RuS/Plugin/sc2.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 8e816523110bb2ab5e7611c0322cc4aa2d6c8d2a899b3a03731965ed1644549b
- MD5 801a5d1e272399ca14ff7d6da60315ef
- SHA1 e546ef8f00d96404823a1ed242ed7b56167da2f7
- SHA512 32eeb2302cfe06e996f2d729d440fc2796d16e33fd9d793c5eaf379e8450d67e177d5c254721c6fd5636c92e55439054b982e0820a757ebd5e65584d3f0c739a
- SSDEEP 192:0SDIUapMH4ftIjPPjb3DX8oB2/mZLkM0Lj08Lt21TGzRpy7yNVILDB61d+ZMt2jt:0SDi+4lILL6/IQM0n0881TE3y2QXM1dY
- TLSH T18A42F70DBF18C217E65C0BBD116357259376C05B1303FF2B9EC9A4F7A8AA3C26658399
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
18814
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
10KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
512B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
njRAT v0.7d Platinum Edition - Rus/njRAT-0.7d-Platinum-Edition-RuS/Sound/Sound.wav
- SHA256 9430fec62eb1bfecb35f4a9ceb2ddd5ce6294751cde85fd7169c8def811af49e
- MD5 11ca5b5feba113ccf66d6649b5b3cb40
- SHA1 503f3a2a449b195d6e71237fba623c3a7b5a08fa
- SHA512 2183286132157f0122b1c8cbfbf0ccf49cf59ca033453d983fb4e25850203e1c03beff98bf99580b20c8049180d4afce339680ba70e1bd7c5a95f859afa70da3
- SSDEEP 12288:3435BUAwzT1eE7M9oxyAdP9qc1lHQJg6j4DUZTkznCBtt+doeUnk:3i/UAWkEkoxbl6grUBH3EoeUk
- TLSH T1F7E423E6E031FE10F8FC067769C10D44AB21BA495D172FAD7438D6A929B334339197AE
- MD5 SHA1 SHA512 SSDEEP TLSH
njRAT v0.7d Platinum Edition - Rus/njRAT-0.7d-Platinum-Edition-RuS/Stub/Stub.manifest
- SHA256 835a00d6e7c43db49ae7b3fa12559f23c2920b7530f4d3f960fd285b42b1efb5
- MD5 4d18ac38a92d15a64e2b80447b025b7e
- SHA1 5c34374c2dd5afa92e0489f1d6f86dde616aca6c
- SHA512 72be79acd72366b495e0f625a50c9bdf01047bcf5f9ee1e3bdba10dab7bd721b0126f429a91d8c80c2434e8bc751defdf4c05bdc09d26a871df1bb2e22e923bf
- TLSH T16EF0DCC1D188CA6AD73042A13A66E410A2AD435B19DD49EC74DC2ABB6F0BAC680C30F1
- MD5 SHA1 SHA512 TLSH
njRAT v0.7d Platinum Edition - Rus/njRAT-0.7d-Platinum-Edition-RuS/Stub/stub.il
- SHA256 4eaa0830f3a6b72e6380875b82c28fc48d22d3c14ab2adab87e2deafdbf19ea8
- MD5 8a1ea88a0ce54fbe8a85aedc751e0edc
- SHA1 2e3622edeaa569f4b38f740f593f4bd9f913c97a
- SHA512 e01a5511b9e21610d3e2e325fbf15068432dda6dbc976ca7395ad9c3e2d8a91883be813db75339d51e0bd5ea7c23a9c37c9b7e7384399489b21d15d953397f64
- SSDEEP 12288:kPY73AmnxaCpY4uqmXSxyosK+M8K2J2SzsWBpyP2KGLLGGjVVc0t3L5v7eWcwgZv:8pgT
- TLSH T129E4ED2943289989D5B2601DBE72CB46F77F52270E71AC963CEFC654FF32189427423A
- MD5 SHA1 SHA512 SSDEEP TLSH
njRAT v0.7d Platinum Edition - Rus/njRAT-0.7d-Platinum-Edition-RuS/Terror/01.gif
- SHA256 cbc8a31345ac302681cac85e5347de1ffcbaa12bdc50c679ecf99cda7fc5157e
- MD5 705a10144ffd51597b863af7b6dc6761
- SHA1 68e3ff4a0c5c498e958431cc4379f33042900194
- SHA512 00685116a9471c2f95534932eedf29e70c0486cdb16235770ff3ab8655396ead19378c29f57f298ac2d17e202ed8e75b4ecab282a1be4cb40dd27774568107a3
- SSDEEP 6144:T291eyhNrmabJq3z2MHrM3r5O03HWMofchjgHy5r6vUlxWXPYt5AmvwCPr5Pn9GT:ToJUaGHrMbS1khjgHHOiQHAmvt9n9yuW
- TLSH T1F394230AD248D4B05BD858FC3434E0EB8FE8F3A895BFBA7310461AA1E551053FE96D55
- MD5 SHA1 SHA512 SSDEEP TLSH
njRAT v0.7d Platinum Edition - Rus/njRAT-0.7d-Platinum-Edition-RuS/Terror/02.gif
- SHA256 94333c1e9a0961648a33db91f9e453e65b25e40106db6b639637fbedcc05e2a6
- MD5 830902dd51dad22083b885a7b51ac3cc
- SHA1 a5cfc3391721b40f4c6219f7644628116ef0ae71
- SHA512 9d409da6f1eba7041726df402ae2fb183e320a5bb81fd3837f6f4b67a88b628d4f571f7e1e2df33d0357bea396683036e9af6c2acac1d9e9931f6faf607cdd8b
- SSDEEP 12288:RNvP2rOQiVfaMkS5yKnO8zhk/rJyALyMCnHuqb2kkWy/jdV/OsdQ1:RNXcLMy8ziJyrMAO+nJyP/Osm1
- TLSH T1E2E423C3C7E13378EA1EE1B8494D8754C20BC8B45B701BB9398879AFBFA11392301DA5
- MD5 SHA1 SHA512 SSDEEP TLSH
njRAT v0.7d Platinum Edition - Rus/njRAT-0.7d-Platinum-Edition-RuS/Terror/03.gif
- SHA256 b4bc127b5d66ab018235635fc12fe65d6ce97f9f8350e965213d9dca9264da45
- MD5 5a7b5ec0c06f5cbe1e04dbf070c510fb
- SHA1 8376a1e841035cec698bc1711672e7dba79aaf87
- SHA512 336f830d2ebe82ed782f1a9881a87f2726ef33e26a1659875ca346c8c8b325ec65cbb55ad8fcaaeb5da58865bb79a2d03192cb0fe75fe9be77da41b2537df2df
- SSDEEP 6144:8p3sCQ1AWnK1NOZ2l8iQojWaCZ0pak0l1aNmN4/nzx:4i1Az18YDQ1aq0ok0d+nzx
- TLSH T157341299DE97C513D28C9A767AD3840A4C5E04F02797BD5C7AC88D9CAD4CC232A8F4DE
- MD5 SHA1 SHA512 SSDEEP TLSH
njRAT v0.7d Platinum Edition - Rus/njRAT-0.7d-Platinum-Edition-RuS/Terror/04.gif
- SHA256 8d070d9c04be926f34064e585edc84c8837bc4476eacde6b046e855d213f48fc
- MD5 c29a3be5142c2304ec7b8a6d8a4fe0f1
- SHA1 2df712ce87e022d9c69e3bc9f4e17822840715f0
- SHA512 62166c06c7e340d779670a75654fe4538133d1f0022a9ae4869192375ca6133802c006fabe0f67d1c7f155a13d6e28f70a3f9c199927ad628227e744d454728b
- SSDEEP 6144:PXt50HhZafhJ2zcDk1DeNxwO4xh0bRaFIVYGE9Gt2DcBV:PXeofhLA1DAwOJjVYB4ucBV
- TLSH T1CD5423F11B1D2849C45C6F61B8070AC26E2294E7832A6F590F23E654F4F77B486AE72C
- MD5 SHA1 SHA512 SSDEEP TLSH
njRAT v0.7d Platinum Edition - Rus/njRAT-0.7d-Platinum-Edition-RuS/Terror/05.gif
- SHA256 57f082caa1766e60c46f69300475be4e6dee3e0330ff329e3ceec3d5bce69dda
- MD5 44290f48408be4840de97bed814fe8df
- SHA1 8bfe3baad8cd4fbb6b3a1374a3b1f6123f42706c
- SHA512 3139d77e9e626a45cd7faea5d5fcdfb7d7758b4a940e31e593bc9bceb999426418cfc690c2568776e659abfaf2733e96813470b21838e0a6c0740c07073aeb2e
- SSDEEP 6144:gHzZv+LGCkXOqNzD9EXJoMGNXMOJIABS8U+A7IZAabW0Hu38g5Tqk:4zZvykpDwJoMO861jAaPHuMgp
- TLSH T18D6423C343209ED2ED9225F9B306AD3674271CE3B12E83D286E4285644ADB71DEFDB45
- MD5 SHA1 SHA512 SSDEEP TLSH
njRAT v0.7d Platinum Edition - Rus/njRAT-0.7d-Platinum-Edition-RuS/Terror/Scream.wav
- SHA256 ee9567223d773a67e8797005ba60fa2c1e672a6cff9b210f76240dcd9a16dd49
- MD5 d4a1c2e18d1dcc4c2e71e6297bf5cccb
- SHA1 89143c582be0767a07323813581599de3267b68e
- SHA512 6af431456112867cb840d2e55237b1d7c05161231ec4ae4c8682ad810731ce3a9544966794b3543dbbf499fdbd2c65242febd27ca9938b40047083beb30bcb0a
- SSDEEP 768:DeUJ+CNzdLn5+ZVvjyQu7J/41yQWLZg/dvvD83IzqovOxd9B/0PYoh7N9oFW23rp:DeUJ+CdYHyA1wLZg/dHDgsqovOxd/cPy
- TLSH T18813395FF192F4468D0BCEF9FEFFC428B113D8819D898E88750873596074461AAAF64B
- MD5 SHA1 SHA512 SSDEEP TLSH
njRAT v0.7d Platinum Edition - Rus/njRAT-0.7d-Platinum-Edition-RuS/WinMM.Net.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 59e2ac1b79840274bdfcef412a10058654e42f4285d732d1487e65e60ffbfb46
- MD5 d4b80052c7b4093e10ce1f40ce74f707
- SHA1 2494a38f1c0d3a0aa9b31cf0650337cacc655697
- SHA512 3813b81f741ae3adb07ae370e817597ed2803680841ccc7549babb727910c7bff4f8450670d0ca19a0d09e06f133a1aaefecf5b5620e1b0bdb6bcd409982c450
- SSDEEP 768:LyasDzF2TDSemqD9tGI+ffwj2Au0LVpqmf7KxcOOrYCPTxqPb85:LyaXKemqD9tGI+ffwj2Au0LVpq4KWrlv
- TLSH T1EB13B60479A85CB9CB2F013D6CD61211FAB18D647227B62B1CBE70F318977DE9A41AF1
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
50302
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
41KB
Virtual Size
41KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ