BOULIZ ETHERAL.rar
- SHA256 d2146c4f6065b77d8265c116b30c8b4d5fd4395fc70dfa54f6404687e8754d8a
Overview
overview
7Static
static
3BOULIZ ETH...VI.exe
windows10-2004-x64
7BOULIZ ETH...VI.exe
windows11-ltsc_2024-x64
7BOULIZ ETH...EN.exe
windows10-2004-x64
7BOULIZ ETH...EN.exe
windows11-ltsc_2024-x64
7BOULIZ ETH...liz.py
ubuntu-18.04-amd64
6BOULIZ ETH...liz.py
debian-9-armhf
1BOULIZ ETH...liz.py
debian-9-mips
1BOULIZ ETH...liz.py
debian-9-mipsel
1Behavioral task
behavioral1
Sample
BOULIZ ETHERAL/BOULIZ VI.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
BOULIZ ETHERAL/BOULIZ VI.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
Behavioral task
behavioral3
Sample
BOULIZ ETHERAL/ETHERAL KEYGEN.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral4
Sample
BOULIZ ETHERAL/ETHERAL KEYGEN.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral5
Sample
BOULIZ ETHERAL/crack_bouliz.py
Resource
ubuntu1804-amd64-20261019-en
ubuntu-18.04-amd64
4 signatures
150 seconds
Behavioral task
behavioral6
Sample
BOULIZ ETHERAL/crack_bouliz.py
Resource
debian9-armhf-20260513-en
debian-9-armhf
0 signatures
150 seconds
Behavioral task
behavioral7
Sample
BOULIZ ETHERAL/crack_bouliz.py
Resource
debian9-mipsbe-20260513-en
debian-9-mips
0 signatures
150 seconds
Behavioral task
behavioral8
Sample
BOULIZ ETHERAL/crack_bouliz.py
Resource
debian9-mipsel-20260513-en
debian-9-mipsel
0 signatures
150 seconds
General
- Target BOULIZ ETHERAL.rar
- Size 29.3MB
- Sample261102-ty2tzsdw8j
- SHA256 d2146c4f6065b77d8265c116b30c8b4d5fd4395fc70dfa54f6404687e8754d8a
- MD5 ad7d99618bce1ecd24c0e6e595fecd6e
- SHA1 14153ea52d02ca06e8199e491e586d5336089b67
- SHA512 8d0a4fa37029e46978a94eeb1f2456520e034df3b26d148d167168350b476586556b2fdf6fcd1e518bd13d735fe1b56dace978f162b5a7126aff07f61a978a80
- SSDEEP 786432:dbctN7iCvpqWtAXCG6AOUJ5UGrPGv0ldByBwHzAgP29:dbctN7iCvpqWrGx5UGxSW1Pw
- TLSH T1786733A2FD02C5F0B9F5445B2E2F350C7876C92E675E59864F8083CB6BA1509BE9E0D3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Detects Pyinstaller 1 IoCs
resource yara_rule static1/unpack001/BOULIZ ETHERAL/ETHERAL KEYGEN.exe pyinstaller - Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/BOULIZ ETHERAL/BOULIZ VI.exe unpack001/BOULIZ ETHERAL/ETHERAL KEYGEN.exe
File Explorer
-
BOULIZ ETHERAL.rar.rar 29.3MB
-
BOULIZ ETHERAL/BOULIZ VI.exe.exe 21.3MB
-
BOULIZ ETHERAL/ETHERAL KEYGEN.exe.exe 8.4MB
-
etheral_keygen.pyc7KB
-
BOULIZ ETHERAL/Launcher.bat.bat 1KB
-
BOULIZ ETHERAL/crack_bouliz.py.py .sh 4KB
BOULIZ ETHERAL/BOULIZ VI.exe
- IMPHASH 476e6a48b25dbee1eff7b5d0a4cd4b15
- SHA256 7b1e1b707c218c4847d2d987d0fa0e6c22f06f107eb5dfc8fed6cdcd52ff3db8
- MD5 7501e03627d148ac34e75acc999ac372
- SHA1 63ffa6da525e9863e5d0252806fdf3e7c1a78842
- SHA512 dbbe91e9f9cff400b392ccb262b30b61fbac319289e08cc00f921344cd77453540575019e77e5b4924e6ac17a9857c0be5a44ab5475c37edf45a645e7f648893
- SSDEEP 393216:7AZ4GpwzqnLZ3gEz7KiIOVfwZi4c+14Unbu+dXq0qXmBRd3G0IA1n0Z:7mpwzqnfKq2Zi4c761VqW/3bF
- TLSH T17D2733B4B932888DD2B397735898F33259406E41FA24D4BB43B4B615FCA38E97F205D6
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4166
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
kernel32
AddDllDirectory
CloseHandle
CopyFileW
CreateDirectoryW
CreateFileMappingW
CreateFileW
CreateProcessW
DeleteCriticalSection
DeleteFileW
EnterCriticalSection
FormatMessageA
FreeLibrary
GenerateConsoleCtrlEvent
GetCommandLineW
GetCurrentProcessId
GetEnvironmentVariableW
GetExitCodeProcess
GetFileAttributesW
GetFileSize
GetFullPathNameW
GetLastError
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleExA
GetProcAddress
GetProcessId
GetShortPathNameW
GetStdHandle
GetSystemTimeAsFileTime
GetTempPathW
InitializeCriticalSection
IsDBCSLeadByteEx
K32GetModuleFileNameExW
LeaveCriticalSection
LoadLibraryA
LoadLibraryExW
MapViewOfFile
MultiByteToWideChar
OpenProcess
QueryPerformanceCounter
ReadFile
SetConsoleCtrlHandler
SetDllDirectoryW
SetEnvironmentVariableW
SetUnhandledExceptionFilter
Sleep
TerminateProcess
TlsGetValue
UnmapViewOfFile
VirtualProtect
VirtualQuery
WaitForSingleObject
WideCharToMultiByte
WriteFile
msvcrt
__C_specific_handler
___lc_codepage_func
___mb_cur_max_func
__iob_func
__set_app_type
__setusermatherr
__wargv
__wgetmainargs
__winitenv
_amsg_exit
_cexit
_commode
_errno
_fmode
_initterm
_lock
_unlock
_wcsicmp
_wcsdup
_wrename
abort
atexit
calloc
exit
fprintf
fputc
fputwc
free
fwprintf
iswctype
localeconv
malloc
mbstowcs
memcpy
memmove
memset
puts
signal
strerror
strlen
strncmp
vfprintf
wcschr
wcscmp
wcslen
wcsncmp
wcstol
shell32
CommandLineToArgvW
SHFileOperationW
SHGetFolderPathW
Name
.text
Size
127KB
Virtual Size
127KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
352B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
20.9MB
Virtual Size
20.9MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.eh_fram
Size
512B
Virtual Size
4B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.xdata
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
165KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.tls
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
266KB
Virtual Size
265KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
144B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
BOULIZ ETHERAL/ETHERAL KEYGEN.exe
- IMPHASH f0d05c1dd5ba1ed096c85a04a8275fec
- SHA256 544ccf61e8aa237236eb0d1648dd3683f52c954c9498d3bac979419626d1fda3
- MD5 be79e5d37f1ea35c4553062d8ba4906d
- SHA1 a20099ad90d446b9be489965cab1b5b087a160cb
- SHA512 c38a72d08ca94d6720815e80fc034c541ee42aa679bfb7e0d42f68c8ec5a67ffcdace461704653da3b9b5f64f8139315e92aa50d7fac5a30cb22abbefb9daf87
- SSDEEP 196608:Y2e2e9bIturHQ/uhHToAUPNfGU5vXvE4L7dIOZ+:5KbKu0mhHTodRGkXs4XPA
- TLSH T1599633A5B3D449F5F9B3E53CDA125224A7767C510720C5EB02E48A537E3B6F02A363A3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects Pyinstaller
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
56560
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
user32
GetCursorPos
ShutdownBlockReasonCreate
GetWindowThreadProcessId
SetWindowLongPtrW
GetWindowLongPtrW
MsgWaitForMultipleObjects
ShowWindow
DestroyWindow
CreateWindowExW
RegisterClassW
DefWindowProcW
PeekMessageW
DispatchMessageW
TranslateMessage
GetMessageW
GetMonitorInfoW
MonitorFromPoint
GetSystemMetrics
kernel32
GetTimeZoneInformation
GetProcessHeap
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
GetStringTypeW
GetFileAttributesExW
SetEnvironmentVariableW
FlushFileBuffers
GetLastError
FreeLibrary
GetProcAddress
LoadLibraryExW
FormatMessageW
CloseHandle
GetCurrentProcess
GetModuleFileNameW
SetDllDirectoryW
CreateSymbolicLinkW
SetErrorMode
GetCurrentProcessId
OpenProcess
QueryFullProcessImageNameW
CreateToolhelp32Snapshot
Process32FirstW
HeapSize
CreateDirectoryW
GetCommandLineW
GetEnvironmentVariableW
ExpandEnvironmentStringsW
DeleteFileW
FindClose
FindFirstFileW
FindNextFileW
GetDriveTypeW
RemoveDirectoryW
GetTempPathW
QueryPerformanceCounter
QueryPerformanceFrequency
WaitForSingleObject
Sleep
TerminateProcess
GetExitCodeProcess
CreateProcessW
GetStartupInfoW
LocalFree
SetConsoleCtrlHandler
GetConsoleWindow
K32EnumProcessModules
K32GetModuleFileNameExW
CreateFileW
FindFirstFileExW
GetFinalPathNameByHandleW
MultiByteToWideChar
WideCharToMultiByte
HeapReAlloc
WriteConsoleW
SetEndOfFile
Process32NextW
SetUnhandledExceptionFilter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
GetModuleHandleW
RtlUnwindEx
SetLastError
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
RtlLookupFunctionEntry
EncodePointer
RaiseException
RtlPcToFileHeader
GetFileInformationByHandle
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
ReadFile
GetFullPathNameW
SetStdHandle
GetStdHandle
WriteFile
ExitProcess
GetModuleHandleExW
GetCommandLineA
IsProcessorFeaturePresent
HeapFree
RtlCaptureContext
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
GetConsoleMode
ReadConsoleW
SetFilePointerEx
GetConsoleOutputCP
GetFileSizeEx
HeapAlloc
GetCurrentDirectoryW
VirtualProtect
CompareStringW
LCMapStringW
advapi32
ConvertSidToStringSidW
GetTokenInformation
OpenProcessToken
ConvertStringSecurityDescriptorToSecurityDescriptorW
Name
.text
Size
205KB
Virtual Size
205KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
82KB
Virtual Size
81KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
10KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
61KB
Virtual Size
60KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=188, id=261, version=33145,
count=12, id=260, version=33145,
count=11, id=259, version=33145,
count=3, id=253, version=35721,
count=9, id=259, version=35721,
count=17, id=260, version=35721,
count=39, id=261, version=35721,
count=7, id=257, version=33145,
count=145, id=1, productName=Unmarked objects,
count=30, id=260, version=36246,
count=1, id=258, version=36246,
etheral_keygen.pyc
- SHA256 305dbbb80193ebe7c266719f332cbc096618773f0576bd6b7a58b1fcdc7222a4
- MD5 2f040460dc2154f8fabc8681f3885cbf
- SHA1 dc49c52bbcd4ad85b5531387d9e7107afc5deade
- SHA512 a707186156d18aa6d78b3a760a4a3674535ebb2ef35b4b7e0ef5b1ab62dc805481f30fbc9814a8535ad7aa8478aee486802c24e5472bc2eed5fc0db19230e5a5
- SSDEEP 96:5TDw2r0PmQUrH03g1EgFqDeAyUFCXfEO8dAn+HnUc:RAk1EgcDeARyf8i+HnUc
- TLSH T1FAF1F58536C2D833FED0F1B9F423232F73259175B4558323B1A701A51D4A7A85EB12BC
- MD5 SHA1 SHA512 SSDEEP TLSH
BOULIZ ETHERAL/Launcher.bat
- SHA256 5a348bc748a6b2bd4dd99c5b76d74c7c16f52f5dec88c330c969a9fc7dc627d5
- MD5 a55d99b5c47637ea6bd3ee50c785127d
- SHA1 cc36a08420cb89dd3289bd63570db482c5f18e42
- SHA512 9e325efc5c035b210731803fce5d1e9e7ed8d459e28fe036832ba3f82ad5a1223026cbc019760a28db51b644beb19a4bc70d35a3b1e9a0755b24df7bc591f83a
- TLSH T1B121617835A252D4A3B00259CFB80D01B90E008362123A8E72A623391F6E7DDB4EA9D8
- MD5 SHA1 SHA512 TLSH
BOULIZ ETHERAL/crack_bouliz.py
- SHA256 b72d2f188751ba8cd194530196c1fb20cf73a0239d75e1c1bb8b9a53ae76e534
- MD5 32cc0c6e2a6ccbcc2f8fc817ab685d37
- SHA1 89d183d96d633c586be35c0261f68bb43f73de25
- SHA512 4dfe3a7e32923a23e4e467728c5523e94de954f9042551508d6d4dc01bad2daba193fd33cce17ad65525e374b2d30841a00661e7220f57f67a49f757b54bfa48
- SSDEEP 96:uKkw2rKK+4Z1NX4VxznwGe0WG+i3OoOf4gO9G+ryA:Xk1+4Z1NX4XjwGe5GZ3HM4gafryA
- TLSH T14B81D746A8C12D87EBCBC0A9EA4240A3732C7D1F99292435BE5D03101F95B76C1F617C
- MD5 SHA1 SHA512 SSDEEP TLSH