Tailbound_v1.1.5_ITCH.zip
- SHA256 91d856d27dcf4d3d4229a7e74e247d0aa9569b576cc6a70e8089f8ed1db97011
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Tailbound.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
Tailbound.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
General
- Target Tailbound_v1.1.5_ITCH.zip
- Size 202.8MB
- Sample261024-enn3tastgs
- SHA256 91d856d27dcf4d3d4229a7e74e247d0aa9569b576cc6a70e8089f8ed1db97011
- MD5 9e6cfa4e1ebf55b14406a2214f80871e
- SHA1 5dd1bf5c7773d041aa1ea1969c5271c6be021db1
- SHA512 13931d92028a96f90ea1f3c2361362459320c85d64800219e2b6cc1303326caf1c9f51779d35707beed091df70c096275b644e51e9c080a048261d738ca26999
- SSDEEP 6291456:4/PJlcfi2KIyDRZohhBDNpJkffrrQC/+WQDkbDSFnq:4/BB+y1ZofpNWrrQCmRQ
- TLSH T162A8338DD0B9BA0E1A37852CDBF15A0506F8821549879C2FB73F17CA8CD7B9673AD184
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Tailbound.exe
File Explorer
-
Tailbound_v1.1.5_ITCH.zip.zip 202.8MB
-
README.txt1KB
-
Tailbound.exe.exe 5.5MB
-
changelog.txt17KB
-
data.win243.7MB
-
music credits.txt1KB
-
options.ini27B
README.txt
- SHA256 c19c91f8df49514439ac84a9291719af2c8327a363d0c2b67a8fa9bc41404c22
- MD5 edf41bcb3b4c092184ebfe2a4379d994
- SHA1 89312a2b3d199daa223529956d6e303639b0c49f
- SHA512 c6aa15ba6e738ee527bf8f8e8e5e9a4fa9a2dbb00fc22aa15ffaec00f967a21d2dff08006eeebe5231722fab4f73fed0d6390369ad4a8c317434c5d731a7ae44
- TLSH T1C8311007E647269306B170B5528B71DFE766B8BAD7319410640D160922F2C13B339CDA
- MD5 SHA1 SHA512 TLSH
Tailbound.exe
- IMPHASH c17b24cb8326c8001ecfcf47c81faba4
- SHA256 2a280ddcbf52b78eee0a68c304f29c13a008b106fea83a1f5afe761bc1ac1342
- MD5 1412a853fc16d9a899e4b046196b3116
- SHA1 eb2d7b75e07b96e5f857e5a42bca5b092e3d5f02
- SHA512 5af2ecd61a6a956a10bf68a72e94be6f94e7bb4e0d485268609fc14582a0df92d5588ae46bda01f44a6c6f8b59fde40dfa113345d6b9f8da2826fbf8319a97bc
- SSDEEP 98304:zvkmYxVr+NzDNll5WLsrLtBCiJV8aZUJW0TI/8uNng0mGQGGawMdByJjRWL+9RW3:btYxVr+NzDNll5WLsrLtBCiJVcJnI8sl
- TLSH T1AC468D80BA52C162E0422574F4AE76FB69382D04CF18C6E7F3E43E2D79705DC6AB715A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
2828205
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
c:\hudson\ZeusBase\ZeusGreen\GameMaker\Runner\VC_Runner\Win32\Release-Zeus\Runner.pdb
wininet
InternetReadFile
InternetCloseHandle
HttpOpenRequestA
HttpSendRequestA
InternetOpenA
InternetCanonicalizeUrlA
InternetWriteFile
InternetConnectA
InternetCrackUrlA
HttpEndRequestW
HttpQueryInfoA
InternetGetConnectedState
dxgi
CreateDXGIFactory1
d3d11
D3D11CreateDevice
dbghelp
MiniDumpWriteDump
SymInitialize
SymFromAddr
winmm
mciSendStringA
joyGetPosEx
joyGetPos
joyGetDevCapsA
mciGetErrorStringA
ws2_32
gethostname
socket
shutdown
setsockopt
send
recvfrom
recv
listen
inet_ntoa
inet_addr
WSAStartup
ioctlsocket
connect
closesocket
bind
accept
getpeername
select
__WSAFDIsSet
ntohs
ntohl
htons
htonl
WSACleanup
WSAGetLastError
WSAAddressToStringA
getaddrinfo
getsockopt
freeaddrinfo
sendto
gdiplus
GdiplusStartup
GdiplusShutdown
comctl32
InitCommonControlsEx
version
GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW
kernel32
FindFirstFileExA
GetFullPathNameA
SetCurrentDirectoryW
HeapReAlloc
GetTimeZoneInformation
MoveFileExW
SetFilePointerEx
SetStdHandle
ReadConsoleW
GetConsoleMode
GetConsoleCP
FlushFileBuffers
EnumSystemLocalesW
IsValidLocale
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
DecodePointer
EncodePointer
GetStringTypeW
GetACP
WriteFile
GetStdHandle
GetModuleFileNameA
PeekNamedPipe
GetFileType
GetDriveTypeW
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
FindFirstFileExW
ReadFile
SetFileAttributesW
GetFileAttributesExW
GetModuleHandleExW
HeapWalk
HeapValidate
RtlUnwind
LoadLibraryExW
InterlockedFlushSList
InterlockedPushEntrySList
VirtualQuery
GetProcessHeap
HeapFree
HeapAlloc
FindNextFileA
IsValidCodePage
InitializeSListHead
GetSystemTimeAsFileTime
RaiseException
GetStartupInfoW
GetProcAddress
LoadLibraryW
WideCharToMultiByte
CloseHandle
WaitForSingleObjectEx
CreateEventExW
OutputDebugStringA
MultiByteToWideChar
GetConsoleWindow
GetLastError
GetOEMCP
DeleteFileW
GetFullPathNameW
SetLastError
CreateThread
GetExitCodeThread
GetModuleHandleW
LocalFree
FormatMessageW
SetCurrentDirectoryA
GetCurrentDirectoryA
FreeLibrary
GetEnvironmentVariableW
CreateDirectoryW
FindClose
FindFirstFileW
FindNextFileW
GetFileAttributesW
RemoveDirectoryW
Sleep
GetExitCodeProcess
CreateProcessW
QueryPerformanceCounter
QueryPerformanceFrequency
WaitForSingleObject
SetWaitableTimer
GetTickCount
CreateWaitableTimerW
GetCurrentProcess
GetCurrentThread
SetThreadPriority
SetPriorityClass
GlobalAlloc
GlobalLock
GlobalUnlock
GlobalMemoryStatusEx
GetSystemInfo
GetVersionExW
GetLocaleInfoW
GetUserDefaultLCID
ExitProcess
lstrlenA
GetCommandLineW
ExpandEnvironmentStringsW
CreateFileW
SetUnhandledExceptionFilter
SetErrorMode
GetCurrentProcessId
GetCurrentThreadId
GetModuleFileNameW
MoveFileA
LeaveCriticalSection
EnterCriticalSection
RtlCaptureStackBackTrace
DeleteCriticalSection
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
IsProcessorFeaturePresent
UnhandledExceptionFilter
TerminateProcess
IsDebuggerPresent
GetCPInfo
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
SetEnvironmentVariableW
SetConsoleCtrlHandler
OutputDebugStringW
WriteConsoleW
SetEndOfFile
GetCurrentDirectoryW
HeapSize
InitializeCriticalSectionAndSpinCount
user32
GetDlgItem
SetDlgItemTextW
GetDlgItemTextW
DrawTextW
GetDC
ReleaseDC
SetWindowTextW
ScreenToClient
MoveWindow
SetCursorPos
ClientToScreen
MapWindowPoints
GetActiveWindow
GetCursorPos
wsprintfW
GetMessageW
TranslateMessage
DispatchMessageW
GetAsyncKeyState
keybd_event
OpenClipboard
CloseClipboard
SetClipboardData
GetClipboardData
EmptyClipboard
IsClipboardFormatAvailable
EndDialog
SetWindowTextA
MessageBoxA
SetDlgItemTextA
PeekMessageW
IsDialogMessageW
SetProcessDPIAware
GetForegroundWindow
UpdateWindow
SetWindowLongW
ChangeDisplaySettingsW
EnumDisplaySettingsW
MonitorFromWindow
GetMonitorInfoW
LoadCursorW
CallNextHookEx
SetCursor
AdjustWindowRectEx
GetWindowRect
GetClientRect
SetForegroundWindow
GetSystemMetrics
ReleaseCapture
SetCapture
GetKeyState
SetFocus
DialogBoxParamW
CreateDialogParamW
GetFocus
BringWindowToTop
SetWindowPos
ShowWindow
DestroyWindow
CreateWindowExW
RegisterClassExW
DefWindowProcW
PostMessageW
SendMessageW
MessageBoxW
GetRawInputDeviceList
GetRawInputDeviceInfoA
LoadImageW
gdi32
GetDeviceCaps
DeleteObject
SelectObject
CreateFontA
comdlg32
GetSaveFileNameW
GetOpenFileNameW
advapi32
RegOpenKeyExW
RegQueryValueExW
RegCloseKey
shell32
SHGetFolderPathW
ShellExecuteW
ole32
CoInitialize
CoCreateInstance
CoTaskMemFree
CoCreateFreeThreadedMarshaler
dwmapi
DwmGetCompositionTimingInfo
Name
.text
Size
3.1MB
Virtual Size
3.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
921KB
Virtual Size
921KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
553KB
Virtual Size
2.9MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
minATL
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.mydata
Size
512B
Virtual Size
8B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.gfids
Size
512B
Virtual Size
368B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_RDATA
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
990KB
Virtual Size
989KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=49, id=241, version=40116,
count=193, id=243, version=40116,
count=42, id=242, version=40116,
count=6, id=199, version=41118,
count=32, id=259, version=24123,
count=32, id=261, version=24123,
count=23, id=260, version=24123,
count=1, id=171, productName=VS2010 build 30319, version=30319,
count=1, id=207, version=65501,
count=4, id=156, version=21202,
count=31, id=203, version=65501,
count=279, id=1, productName=Unmarked objects,
count=175, id=260, productName=VS2015 UPD3.1 build 24215, version=24215,
count=350, id=261, productName=VS2015 UPD3.1 build 24215, version=24215,
count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,
count=1, id=151,
count=1, id=258, productName=VS2015 UPD3.1 build 24215, version=24215,
changelog.txt
- SHA256 076944817d3f00cf4a2ba70622703083d3b3191e3abfcbfefff91e40b1b207cb
- MD5 8bda150bb03f49812778923167de151d
- SHA1 bf70d5f41421aa0e9e401c0a06fcdee2f5fc04cf
- SHA512 ced9abd61db0bf5aef8d006ae307700211e4cf5d35350483988edf52b16a85d84c742db3020e7fd7cf4e5b4e4d85afe14049061c1091322d4e6a3fe55f7bdf06
- SSDEEP 384:bfLuZZTeZVVxcgUASb1BoeSZlsUO8eZqjXQnoW/76J08XePbw:bzuZBe3fcgijoxlsfvZqjAnoz0uePc
- TLSH T11A82D8172257F37B426031B5B64F72EFDB3990E8D3A3135464A8C19D314282D627B9F9
- MD5 SHA1 SHA512 SSDEEP TLSH
data.win
- SHA256 eb61055cd40733099696b079d84c1f4c2e834357486a237ef6ad5c44042d6d8f
- MD5 23768f5cfd12b5a69195f381a65963e4
- SHA1 43bea3b3a480702d5a348617dd6cdf8ad8f5ac81
- SHA512 f0bdc1530afd0d89f79d5acc6d0b0705331a8af0ebda451b9fa3fe6f730943251d6968817a4ac1448fb9a33b7de3688fde02265911606a904647eb9eb68c1f8d
- SSDEEP 6291456:OFwCF/fpZnxmVYYON4cRaZe2x1LIZ1EwNlNYHdzT0UoawcD:OrYg4cRaQ2oOgluHdP7b
- TLSH T1BFC8F051F483CA06E3A7D336CED29D904AB6FC48ED58491F3089BB9D66F3300796935A
- MD5 SHA1 SHA512 SSDEEP TLSH
music credits.txt
- SHA256 670e4dc930780c7001c3deac21bf5ee3ecfc754650b173c548c8aabe80b9603d
- MD5 723a48ebc527085191db2d918d2be793
- SHA1 8bba6df578c1ee603078d4936db8eeb25401b7e9
- SHA512 397291ba080ec1cdd498476337e0ffc1166592da87e8207422038c05fd37b7d69faf6bee9a282257d86126cff0c7b2da472f6bf3cce87867d3bbd0a6961327b0
- TLSH T13131543BCD88020531E7C1C2992478DBD10A50DAE63532019E6EE2B9D5C18DAE731F43
- MD5 SHA1 SHA512 TLSH
options.ini
- SHA256 8a8a8276fdcc014544dc5851bfd7986def326d2b6a5243d55c5da8e32531cafc
- MD5 99c48166b13217332bc5a402e15d27b4
- SHA1 16e6bf7b46f2716b9b105958fbac6e8a3eb9cce5
- SHA512 82c13cdbea9feeae73f5d1e4f5b35512820afab20c1578ffc903e7561861dee4a8bd74efd0941de6aef07b2d6bc2830394446e3991f3276b629c21d3b2442f12
- MD5 SHA1 SHA512