Malicious ZIP Archive analysis – 4a95a44c9b5e | Malva.RE

Malicious

Share on LinkedIn

ZIP Archive

MD5:

Size: 0 B

application/zip

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

File

Type

ZIP archive

2 malicious · 1635 files

ZIP4a95a44c9b5ecb7c094fef7ee839b01bCVE-2019-9674

DLLpython312.dll

DLLvcruntime140.dll

DLLvcruntime140_1.dll

BINDLLs

BINLib

PYabc.py

PYaifc.py

PYantigravity.py

PYargparse.py

PYast.py

PYbase64.py

PYbdb.py

PYbisect.py

PYbz2.py

PYcalendar.py

PYcgi.py

PYcgitb.py

PYchunk.py

PYcmd.py

PYcode.py

PYcodecs.py

PYcodeop.py

BINcollections

PYcolorsys.py

PYcompileall.py

PYconfigparser.py

PYcontextlib.py

PYcontextvars.py

PYcopy.py

PYcopyreg.py

PYcProfile.py

PYcrypt.py

PYcsv.py

BINctypes

PYdataclasses.py

PYdatetime.py

PYdecimal.py

PYdifflib.py

PYdis.py

PYdoctest.py

BINemail

BINencodings

PYenum.py

PYfilecmp.py

PYfileinput.py

PYfnmatch.py

PYfractions.py

PYftplib.py

PYfunctools.py

PYgenericpath.py

PYgetopt.py

PYgetpass.py

PYgettext.py

PYglob.py

PYgraphlib.py

PYgzip.py

PYhashlib.py

PYheapq.py

PYhmac.py

BINhttp

PYimaplib.py

PYimghdr.py

BINimportlib

PYinspect.py

PYio.py

PYipaddress.py

BINjson

PYkeyword.py

PYlinecache.py

PYlocale.py

BINlogging

PYlzma.py

PYmailbox.py

PYmailcap.py

PYmimetypes.py

PYmodulefinder.py

PYnetrc.py

PYnntplib.py

PYntpath.py

PYnturl2path.py

PYnumbers.py

PYopcode.py

PYoperator.py

PYoptparse.py

PYos.py

PYpathlib.py

PYpdb.py

PYpickle.py

PYpickletools.py

PYpipes.py

PYpkgutil.py

PYplatform.py

PYplistlib.py

PYpoplib.py

PYposixpath.py

PYpprint.py

PYprofile.py

PYpstats.py

PYpty.py

PYpyclbr.py

PYpydoc.py

PYpy_compile.py

PYqueue.py

PYquopri.py

PYrandom.py

BINre

PYreprlib.py

PYrlcompleter.py

PYrunpy.py

PYsched.py

PYsecrets.py

PYselectors.py

PYshelve.py

PYshlex.py

PYshutil.py

PYsignal.py

PYsim.py

BINsite-packages

PYsite.py

PYsmtplib.py

PYsndhdr.py

PYsocket.py

PYsocketserver.py

BINsqlite3

PYsre_compile.py

PYsre_constants.py

PYsre_parse.py

PYssl.py

PYstat.py

PYstatistics.py

PYstring.py

PYstringprep.py

PYstruct.py

PYsubprocess.py

PYsunau.py

PYsymtable.py

PYsysconfig.py

PYtabnanny.py

PYtarfile.py

PYtelnetlib.py

PYtempfile.py

PYtextwrap.py

PYthis.py

PYthreading.py

PYtimeit.py

PYtoken.py

PYtokenize.py

PYtrace.py

PYtraceback.py

PYtracemalloc.py

PYtty.py

PYturtle.py

PYtypes.py

PYtyping.py

BINurllib

PYuu.py

PYuuid.py

PYwarnings.py

PYwave.py

PYweakref.py

PYwebbrowser.py

PYxdrlib.py

PYzipapp.py

BINzipfile

PYzipimport.py

PY_aix_support.py

PY_collections_abc.py

PY_compat_pickle.py

PY_compression.py

PY_markupbase.py

PY_osx_support.py

PY_pydatetime.py

PY_pydecimal.py

PY_pyio.py

PY_pylong.py

PY_py_abc.py

PY_sitebuiltins.py

PY_strptime.py

PY_threading_local.py

PY_weakrefset.py

PY__future__.py

PY__hello__.py

BIN__pycache__

EXEpython.exe

DLLpython3.dll

Config. Field	Value
URL #1	http:/huhuhuhuhuhuhuhuhuhuhu
URL #2	http:/huhuhuhuhuhuhu
URL #3	http:/huhuhuhuhuhuhuhuhuhuhu
URL #4	http:/huhuhuhuhuhuhuhuhuhuhu
URL #5	http:/huhuhuhuhuhuhuhuhuhuhu
URL #6	http:/huhuhuhuhuhuhuhuhuhuhu
URL #7	http:/huhuhuhuhuhuhuhuhuhuhu
URL #8	http:/huhuhuhuhuhuhu
URL #9	http:/huhuhuhuhuhuhuhuhuhuhu
URL #10	http:/huhuhuhuhuhuhuhuhuhuhu
URL #11	http:/huhuhuhuhuhuhu
URL #12	http:/huhuhuhuhuhuhuhuhuhuhu
URL #13	http:/huhuhuhuhuhuhu
URL #14	http:/huhuhuhuhuhuhuhuhuhuhu
URL #15	http:/huhuhuhuhuhuhuhuhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

An error has occurred. This application may no longer respond until reloaded. Reload 🗙