raspy.zip
- SHA256 b58a39d1317363ac5484efb984f6568d4d89cd9e629cf6f6f52e850c3461c5c1
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
raspy.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
raspy.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
raspy.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
8 signatures
150 seconds
General
- Target raspy.zip
- Size 2.7MB
- Sample261104-2faxjsvyaw
- SHA256 b58a39d1317363ac5484efb984f6568d4d89cd9e629cf6f6f52e850c3461c5c1
- MD5 b1e54d7f2bc8efc783a2729730924853
- SHA1 a146de79bf038c0868ba613dd64373584d8bc091
- SHA512 39fa748ae19879c325c9476b70d8f8342713945a4f244530c9cda214ee65d866f0a04a7f4b7c5cc7787554961906f020e1c5b32832819317e294b412b4fff110
- SSDEEP 49152:LFIS9FfKq9JFPFvVZrrBuxS7jlw+hrrUcJz44m5DNEofifg0K2:LN9F9FL/BuOxvBkqM2
- TLSH T1D6D5334363A0ADD9066AE7C70693809389DCB721B27CDC57BB4F2099B6079BF7C06E54
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/raspy.dll unpack001/raspy.exe
File Explorer
-
raspy.zip.zip 2.7MB
-
raspy.dll.dll 6.9MB
-
raspy.exe.exe 11.7MB
raspy.dll
- IMPHASH ff6aee96271d11065482dcb3dab75409
- SHA256 132577df174d025baf0a61f22f2c515a7ee349f48db3c7d260033bcdb65b46c2
- MD5 018400fc5cdbde5a5454cac4b7bc8a64
- SHA1 b4c9924a8a2381899cbd52e99aa87f3af6f745dc
- SHA512 388735fb8ffc9130fef7a98993a0c02f2185255f1fc5432f74c48663b4243ffa0d5f88790edfcb1ccb15e3a01140532167673c49deadc11f17f26e0cdde53bc6
- SSDEEP 49152:K1zK0t8CZ0xLgA5YtMBE3gGijKLZ/t074:K1L0xLgA5aZ/t074
- TLSH T10C76B647D59F0C9EDD0B67FCE4C35338AB34BC46CC1968AEAA45D9256D83E813A1EB01
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4912
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
iphlpapi
GetExtendedTcpTable
kernel32
CloseHandle
CreateFileW
DeleteCriticalSection
DisableThreadLibraryCalls
EnterCriticalSection
FormatMessageA
FreeLibrary
GetComputerNameA
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetDiskFreeSpaceExA
GetDynamicTimeZoneInformation
GetEnvironmentVariableA
GetLastError
GetModuleFileNameA
GetModuleHandleA
GetModuleHandleExW
GetModuleHandleW
GetProcAddress
GetSystemInfo
GetSystemTimeAsFileTime
GetTempPathW
GetThreadId
GetTickCount64
GetTimeZoneInformation
GlobalMemoryStatusEx
InitializeConditionVariable
InitializeCriticalSection
IsDBCSLeadByteEx
K32GetProcessMemoryInfo
LeaveCriticalSection
LoadLibraryW
LocalFree
MultiByteToWideChar
OpenProcess
QueryFullProcessImageNameA
RaiseException
RtlCaptureContext
RtlLookupFunctionEntry
RtlUnwindEx
RtlVirtualUnwind
SetLastError
Sleep
SleepConditionVariableCS
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
TryEnterCriticalSection
VirtualProtect
VirtualQuery
WakeAllConditionVariable
WakeConditionVariable
WideCharToMultiByte
WriteFile
msvcrt
___lc_codepage_func
___mb_cur_max_func
__iob_func
_amsg_exit
_assert
_errno
_fsopen
_gmtime64
_initterm
_localtime64
_lock
_mkdir
_stat64
_unlock
_vsnprintf
_vsnwprintf
abort
calloc
fclose
fflush
fgetwc
fputc
fputs
free
fwrite
getc
getenv
iswctype
localeconv
malloc
memchr
memcmp
memcpy
memmove
memset
realloc
setlocale
strchr
strcmp
strcoll
strerror
strftime
strlen
strncmp
strtoul
strxfrm
towlower
towupper
vfprintf
wcscoll
wcsftime
wcslen
wcsxfrm
_read
ws2_32
inet_ntoa
ntohs
PayloadAppendLog
PayloadAppendLogLevel
PayloadGetCapabilities
PayloadGetEnvironmentVariable
PayloadGetLastError
PayloadGetModulePath
PayloadGetRuntimeInfo
PayloadGetVersion
PayloadInitialize
PayloadIsInitialized
PayloadSelfTest
PayloadWriteLog
PayloadWriteLogLevel
Name
.text
Size
1.1MB
Virtual Size
1.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
89KB
Virtual Size
88KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.pdata
Size
110KB
Virtual Size
110KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.xdata
Size
125KB
Virtual Size
124KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.edata
Size
512B
Virtual Size
445B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.tls
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
864B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/4
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/19
Size
122KB
Virtual Size
122KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/31
Size
20KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/45
Size
57KB
Virtual Size
56KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/57
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/70
Size
1024B
Virtual Size
787B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/81
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/97
Size
79KB
Virtual Size
78KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/113
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
raspy.exe
- IMPHASH f4add3dca886cabccb618caec7c24ac1
- SHA256 9b4b8164285b081be18cd12ddddc57659b5d85faba5ff84d66ebfb4d144cbb29
- MD5 7dac5a4274f6309eb853b175259ec833
- SHA1 99e7d84363341e5a63191045fe20d555ceedf6b1
- SHA512 da89fdda642e590ed657adcf9af16ceb495aa523d12c213dd1e206baf806ec98fad7315dbacc87edbfeb0589a1159bda32a158897a4c1b01c04f145242c0a4a1
- SSDEEP 98304:3ACIcMtdK5oZsWKyCdpj6tqW47zhOBCkb9miieIaH8CO5d9u/0YY2o3QwBSHsg5A:tfMtdK5oVFOG0QHo1l+oUvfttq
- TLSH T199C6D697559F5CEEDD8767BCB4C3632CAB34BC16CD29686E9604C835AC83A403E1EB41
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
5104
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
kernel32
CloseHandle
CreateFile2
CreateFileMappingFromApp
CreateFileW
CreateHardLinkW
CreateProcessW
CreateRemoteThread
CreateThread
DeleteCriticalSection
DeleteFileW
DuplicateHandle
EnterCriticalSection
ExitThread
FindFirstVolumeW
FindNextVolumeW
FindVolumeClose
FormatMessageA
FreeLibrary
GetConsoleMode
GetConsoleScreenBufferInfo
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetDiskFreeSpaceExW
GetDynamicTimeZoneInformation
GetExitCodeThread
GetFileAttributesW
GetFileInformationByHandle
GetFileSizeEx
GetFileType
GetFullPathNameW
GetLastError
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleExW
GetModuleHandleW
GetProcAddress
GetStdHandle
GetSystemInfo
GetSystemTimeAsFileTime
GetTempPathW
GetThreadId
GetTimeZoneInformation
GetVolumeInformationW
InitializeConditionVariable
InitializeCriticalSection
IsDBCSLeadByteEx
LeaveCriticalSection
LoadLibraryA
LoadLibraryW
LocalFree
MapViewOfFileFromApp
MoveFileExW
MultiByteToWideChar
RaiseException
RemoveDirectoryW
ResumeThread
RtlCaptureContext
RtlLookupFunctionEntry
RtlUnwindEx
RtlVirtualUnwind
SetConsoleTextAttribute
SetEndOfFile
SetFilePointer
SetLastError
SetUnhandledExceptionFilter
Sleep
SleepConditionVariableCS
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
TryEnterCriticalSection
UnmapViewOfFile
VirtualAllocEx
VirtualFreeEx
VirtualProtect
VirtualQuery
WaitForSingleObject
WakeAllConditionVariable
WakeConditionVariable
WideCharToMultiByte
WriteConsoleA
WriteFile
WriteProcessMemory
msvcrt
__C_specific_handler
___lc_codepage_func
___mb_cur_max_func
__getmainargs
__initenv
__iob_func
__set_app_type
__setusermatherr
_amsg_exit
_assert
_cexit
_close
_commode
_errno
_findclose
_fmode
_fstat64
_get_osfhandle
_gmtime64
_initterm
_localtime64
_lock
_lseeki64
_onexit
_pclose
_popen
_stat64
_telli64
_unlock
_wchdir
_wchmod
_wfindfirst64
_wfindnext64
_wfopen
_wfullpath
_wgetcwd
_wmkdir
_wopen
_wstat64
_wutime64
abort
calloc
exit
fclose
fflush
fgets
fopen
fprintf
fputc
fputs
free
fwrite
getenv
iswctype
localeconv
malloc
memchr
memcmp
memcpy
memmove
memset
realloc
setlocale
setvbuf
signal
strchr
strcmp
strcoll
strerror
strftime
strlen
strncmp
strtol
strtoul
strxfrm
towlower
towupper
vfprintf
wcscat
wcscmp
wcscoll
wcscpy
wcsftime
wcslen
wcsxfrm
_strtoui64
_strtoi64
_write
_read
_fileno
_fdopen
shell32
ShellExecuteExA
ws2_32
WSACleanup
WSAGetLastError
WSASocketW
WSAStartup
__WSAFDIsSet
closesocket
connect
freeaddrinfo
getaddrinfo
getnameinfo
getpeername
getsockname
getsockopt
ioctlsocket
ntohs
recv
select
send
setsockopt
shutdown
socket
Name
.text
Size
1.9MB
Virtual Size
1.9MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
17KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
146KB
Virtual Size
146KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.pdata
Size
179KB
Virtual Size
179KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.xdata
Size
222KB
Virtual Size
222KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.tls
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
848B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
9KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/4
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/19
Size
117KB
Virtual Size
117KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/31
Size
23KB
Virtual Size
23KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/45
Size
46KB
Virtual Size
46KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/57
Size
10KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/70
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/81
Size
10KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/97
Size
54KB
Virtual Size
53KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/113
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ