QuestHider-1.0.0.zip
- SHA256 10a28afcb793d02292778752a6f66194b7d7875ed81f1622213e0715f7d5227a
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
mods/QuestHider/bootstrap.bat
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
mods/QuestHider/bootstrap.bat
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral3
Sample
mods/quest_hider_native.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral4
Sample
mods/quest_hider_native.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
General
- Target QuestHider-1.0.0.zip
- Size 24KB
- Sample261030-mv8d2acy3q
- SHA256 10a28afcb793d02292778752a6f66194b7d7875ed81f1622213e0715f7d5227a
- MD5 2e4ef7f9a44ed2833551df1b102e1e4b
- SHA1 933aab0d95ab58c1e9b541d6098e5b7d20047b04
- SHA512 796d0f45e457bbe047840bfc2889aef855448ea140d6948feb625172d58d2938980048577d293d26802e70534f07f820e9d66cc2195532059b914db6b3b86f81
- SSDEEP 768:DixwGysDk3SAEAxHYl5am9yLp/l4h8Dhqmj83bj:GxesDs3JYl5VEp/eh8DhqmALj
- TLSH T129B2E11BC69A7E63EEA34BB7630B9D3FC50D3A5AB6DC00D030DC2DB124589A453D92E1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/mods/quest_hider_native.dll
File Explorer
-
QuestHider-1.0.0.zip.zip 24KB
-
LICENSE1KB
-
README.md4KB
-
mods/QuestHider/bootstrap.lua.bat 14KB
-
mods/QuestHider/config.lua419B
-
mods/quest_hider.json585B
-
mods/quest_hider_native.dll.dll 41KB
LICENSE
- SHA256 295a4c626ac623484298f8cdc3a358b39f66ca779ee2707213b578701ea9f40d
- MD5 fe9126e6f10d03c071a57f8045e01f09
- SHA1 b8e63ff7a7d16a10f66303fb0365bc1a7377869b
- SHA512 885313ff6339327288f4ca29fa3c62d12d41e0fb2f40853a6e6ec36ce2119e4e18d45082a1c71edb48911a182845380b40d1a4bbe33704cac9ec203dc916bc0c
- TLSH T1D421A56F734407B328A613A05635B8D9B22BB25A7A2F1A45206DF348232B4ACC2FB410
- MD5 SHA1 SHA512 TLSH
README.md
- SHA256 b3849119de26b18cf1235643f81c5daefe1dac2c08a8017c84d0688a0b9c3136
- MD5 493cd623a0c8a7e4015128978dc5938f
- SHA1 5a645b3d6d7b751f050adc810f9c650fa472c98d
- SHA512 af073386641ffa8bc1fd468aad167b6537aaaf69d432b3cf26dcf29140a6748164990d4a048a15c4514a96ce430fbf7353da7d473c942aa4b8de6d8e4523a6b0
- SSDEEP 96:0EmykyF07B8GfT84UvS0ZqXWmtxeMuVq4qtDqv4gvhxikiNt4wrKgwBeZD29:gyW7B8GfT84U60gGmveMuVqrtDhghxiw
- TLSH T16EB1D63B623B2777097341E9710D63FBCE4B60E6B6249072A4EE840C7112562D2FB6F6
- MD5 SHA1 SHA512 SSDEEP TLSH
mods/QuestHider/bootstrap.lua
- SHA256 51fbe271e0d395f56059db03fe3ad05ea479ab3d7cdd8ba283dae48e5a378acd
- MD5 0cc5db5a5fad5a69d92d6c31d565cf9a
- SHA1 9adc5bb2434cd5f132f7596feb47dc90aece3a86
- SHA512 472a70e4e1dbabf9a81198814efbed2d62b41c5d3fe6267872d49b0c4ef7bd6e44000495d1d33cd18dc672b6be8b9a2c30d40b2581d7fdd9762973fbcf1941cf
- SSDEEP 384:9DpkF1pm4ddwljcUFNCkGNgIDDqIwSxcg2CcaEUGVmD9gH:9DpkF1pm4ddijcUFNCkugIDDqIwSxqCC
- TLSH T15852A7CFB343756103A35AB8959789157A27A813114D4864B9DDC2EC3F8262EC3FAF6C
- MD5 SHA1 SHA512 SSDEEP TLSH
mods/QuestHider/config.lua
- SHA256 b911f7da0bba82748da39a0354f01525cdd52442a06fe439e79a7988c9ffe807
- MD5 86294b76b827ed11278159c10f547b82
- SHA1 c5328ddfd1f0e766711479c291bbe96fe6bda0d8
- SHA512 a0cd60c5f6a894ca88aa4f10e9a985560387bb50401692b1a466fb7565020d055c80a525bba45c4b45dc95f101337f56c8ec907ac2255ce939489baa7f378553
- TLSH T145E0AB2A44F7042000698DA670CE1323BD0FD11B2AA2356379DC364C3FA9DAB9172AC2
- MD5 SHA1 SHA512 TLSH
mods/quest_hider.json
- SHA256 f9a5ea129eaf923d5283fe29af4389e3f0c11c77e3dec693211937ef475c888b
- MD5 47a4e3bd66f27c36bab9729ea4bfcd05
- SHA1 ec99c1510349983950ada8d3d2b0c653322c4143
- SHA512 f1d7afdbd2e89ef91bb9115f672cd7de603451cbb9b13cc0048700d0150fc047b5e9e6df5f3ef8c5be496bd4f414562cdbd6519b08727f46bdc945ef1d948f38
- TLSH T1DFF062198EB68D73596C2E65514F0A67B07442AFDCF63E34778CA40CCF1460BDCB1968
- MD5 SHA1 SHA512 TLSH
mods/quest_hider_native.dll
- IMPHASH ee950195f0b3edaf07da33494d113891
- SHA256 0e758535bf08db614f5cd3639569b436482c03fec3e2f194ded1d409d95637fd
- MD5 562746b1295e14443638b29e71e65581
- SHA1 1cd5cb209751860d6546b051de08d6788a82c83f
- SHA512 4f42891d057059afe0d4fb41b484b8dfb841d3c804b69c98945660bf2c28cd2a191bca4a9305ec40448ec01db1222f23889fb0bb89fafd67d395b95625dd8365
- SSDEEP 768:2IXCcg/34AlnQKJBIn5pCaDYioe8jiS3klfuBhZDQKPz1nP1/iDH1xMD:BYv4AlnoCLioe8jillpKPz1nP1/eH
- TLSH T173136148D71E59E4F678E2B4A09F5ABAFC78092A039319FB4F0F6B7429522E04F75503
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
11952
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
bcrypt
BCryptCloseAlgorithmProvider
BCryptCreateHash
BCryptDestroyHash
BCryptFinishHash
BCryptHashData
BCryptOpenAlgorithmProvider
user32
GetAsyncKeyState
GetForegroundWindow
GetWindowThreadProcessId
api-ms-win-crt-private-l1-1-0
memchr
strchr
strrchr
api-ms-win-crt-runtime-l1-1-0
__p___argc
__p___argv
__p___wargv
_configure_narrow_argv
_configure_wide_argv
_crt_at_quick_exit
_crt_atexit
_execute_onexit_table
_exit
_initialize_narrow_environment
_initialize_onexit_table
_initialize_wide_environment
_initterm
_register_onexit_function
abort
api-ms-win-crt-string-l1-1-0
strcmp
strcpy
strlen
strncmp
kernel32
CloseHandle
CreateDirectoryA
CreateFileA
DeleteCriticalSection
DeleteFileA
DisableThreadLibraryCalls
EnterCriticalSection
FlushFileBuffers
FlushInstructionCache
GetCurrentProcess
GetCurrentProcessId
GetFileSize
GetLastError
GetModuleFileNameA
GetModuleHandleA
GetStdHandle
GetTickCount
InitializeCriticalSection
LeaveCriticalSection
MoveFileExA
ReadFile
ReadProcessMemory
Sleep
TlsGetValue
VirtualProtect
VirtualQuery
WriteFile
api-ms-win-crt-stdio-l1-1-0
__acrt_iob_func
__stdio_common_vfprintf
__stdio_common_vfwprintf
__stdio_common_vsprintf
__stdio_common_vsscanf
fwrite
api-ms-win-crt-environment-l1-1-0
__p__environ
__p__wenviron
api-ms-win-crt-heap-l1-1-0
_set_new_mode
calloc
free
api-ms-win-crt-time-l1-1-0
__daylight
__timezone
__tzname
_tzset
luaopen_QuestHiderNative
Name
.text
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.eh_fram
Size
17KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.tls
Size
512B
Virtual Size
8B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ