Malicious
Malicious

a1271541c0098606fb05741ea2dd2ae5

ZIP Archive
MD5: a1271541c0098606fb05741ea2dd2ae5
Size: 7.44 MB
application/zip
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 a1271541c0098606fb05741ea2dd2ae5
Sha1 055f7ecee82eb03a61442384610fba4fe6d2914f
Sha256 9d64e52708ab78bf5e93b06d40cb08392ef8918987c2ce9ac2f0511ede89d4aa
Sha384 f599f7da3f6345c4cff1f0a88d76d7048dea6cc9e9c47bcbdc2e74733b14f771cdae86bf201af1ef3c609dc0673681f8
Sha512 e778523c47d35274313947e54c7eb359ccf41d4c7dd13ab3dde8a3e3669fc0b43944e0bde5b5510896796e60ba8ac6c8b765386321cdb49f841395b2c4f666fb
SSDeep 98304:3+jZsqnTTx1AhxC+TOh5OsM5wij6UU/UYqDTV8Krp3nZdty4GbS8cWHNbfE2BCPk:QNTTYXGMVj6UU/UYoJ/7GbBZpfErPMl
TLSH 1F76335DECAE86EED92CE473735BA48721C845E59A84D102DF3202EABFD40CE411F56B
a1271541c0098606fb05741ea2dd2ae5
Malicious
zapret.1.10.3d
Malicious
bin
cygwin1.dll
Overlay_eba38089.bin
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.data
.rdata
.buildid
.pdata
.xdata
.bss
.edata
.reloc
.idata
.rsrc
4
19
38
Resources
RT_VERSION
ID:0001
ID:1033
quic_initial_www_google_com.bin
tls_clienthello_4pda_to.bin
tls_clienthello_max_ru.bin
tls_clienthello_www_google_com.bin
WinDivert.dll
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.data
.rdata
.pdata
.xdata
.bss
.edata
.idata
.reloc
WinDivert64.sys
[Authenticode]_f668fc99.p7b
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rdata
.data
.pdata
.gfids
INIT
.rsrc
.reloc
Resources
RT_MESSAGETABLE
ID:0001
ID:1033
RT_VERSION
ID:0001
ID:1033
winws.exe
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.data
.rdata
.buildid
.pdata
.xdata
.bss
.idata
.rsrc
.reloc
Resources
RT_ICON
ID:0001
ID:1033
RT_GROUP_CURSOR4
ID:0000
ID:1033
RT_MANIFEST
ID:0001
ID:0
DiscordFix.exe
Malicious
[Authenticode]_c7fcbc99.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rdata
.data
.idata
.reloc
.symtab
.rsrc
Resources
RT_VERSION
ID:0001
ID:1033
general (ALT).bat
lists
ipset-all.txt
ipset-all.txt.backup
ipset-exclude.txt
list-exclude.txt
list-general.txt
list-google.txt
utils
game_filter.enabled
targets.txt
test zapret.ps1
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

Structural branches: 9 STICH kept: 4secondary ignored: 5
bin 5

Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
4 / 4
Path arc:zip>pe:exe~T1027~T1055>pe:rsrc>bin
Shape arc:zip>pe:exe>pe:rsrc>bin
malicious 4 nodes
Path arc:zip>pe:exe~T1027~T1055>bin
Shape arc:zip>pe:exe>bin
malicious 3 nodes
Config. Field Value
URL in PowerShell #1 https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #2 https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #3 https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #4 https:huhuhuhuhuhuhu
URL in PowerShell #5 https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #6 https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #7 https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #8 https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #9 https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #10 https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #11 https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #12 https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #13 https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #14 https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #15 https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #16 https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #17 https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #18 https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #19 https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #20 https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #21 https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #22 https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #23 https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #24 http:/huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #25 https:huhuhuhuhuhuhu
URL in PowerShell #26 https:huhuhuhuhuhuhu
URL in PowerShell #27 https:huhuhuhuhuhuhu
URL in PowerShell #28 https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #29 https:huhuhuhuhuhuhu
URL in PowerShell #30 httpshuhuhuhuhuhuhu
URL in PowerShell #31 https:huhuhuhuhuhuhu
URL in PowerShell #32 https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #33 https:huhuhuhuhuhuhu
URL in PowerShell #34 https:huhuhuhuhuhuhu
URL in PowerShell #35 https:huhuhuhuhuhuhu
URL in PowerShell #36 https:huhuhuhuhuhuhuhuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
URL in PowerShell #1 URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #2 URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #3 URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #4 URImalicious
https:huhuhuhuhuhuhu
URL in PowerShell #5 URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #6 URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #7 URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #8 URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #9 URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #10 URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #11 URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #12 URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #13 URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #14 URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #15 URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #16 URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #17 URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #18 URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #19 URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #20 URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #21 URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #22 URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #23 URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #24 URImalicious
http:/huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #25 URImalicious
https:huhuhuhuhuhuhu
URL in PowerShell #26 URImalicious
https:huhuhuhuhuhuhu
URL in PowerShell #27 URImalicious
https:huhuhuhuhuhuhu
URL in PowerShell #28 URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #29 URImalicious
https:huhuhuhuhuhuhu
URL in PowerShell #30 URImalicious
httpshuhuhuhuhuhuhu
URL in PowerShell #31 URImalicious
https:huhuhuhuhuhuhu
URL in PowerShell #32 URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #33 URImalicious
https:huhuhuhuhuhuhu
URL in PowerShell #34 URImalicious
https:huhuhuhuhuhuhu
URL in PowerShell #35 URImalicious
https:huhuhuhuhuhuhu
URL in PowerShell #36 URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
a1271541c0098606fb05741ea2dd2ae5
Malicious
zapret.1.10.3d
Malicious
bin
cygwin1.dll
Overlay_eba38089.bin
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.data
.rdata
.buildid
.pdata
.xdata
.bss
.edata
.reloc
.idata
.rsrc
4
19
38
Resources
RT_VERSION
ID:0001
ID:1033
quic_initial_www_google_com.bin
tls_clienthello_4pda_to.bin
tls_clienthello_max_ru.bin
tls_clienthello_www_google_com.bin
WinDivert.dll
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.data
.rdata
.pdata
.xdata
.bss
.edata
.idata
.reloc
WinDivert64.sys
[Authenticode]_f668fc99.p7b
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rdata
.data
.pdata
.gfids
INIT
.rsrc
.reloc
Resources
RT_MESSAGETABLE
ID:0001
ID:1033
RT_VERSION
ID:0001
ID:1033
winws.exe
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.data
.rdata
.buildid
.pdata
.xdata
.bss
.idata
.rsrc
.reloc
Resources
RT_ICON
ID:0001
ID:1033
RT_GROUP_CURSOR4
ID:0000
ID:1033
RT_MANIFEST
ID:0001
ID:0
DiscordFix.exe
Malicious
[Authenticode]_c7fcbc99.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rdata
.data
.idata
.reloc
.symtab
.rsrc
Resources
RT_VERSION
ID:0001
ID:1033
general (ALT).bat
lists
ipset-all.txt
ipset-all.txt.backup
ipset-exclude.txt
list-exclude.txt
list-general.txt
list-google.txt
utils
game_filter.enabled
targets.txt
test zapret.ps1
Config. Field Value
URL in PowerShell #1 https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #2 https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #3 https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #4 https:huhuhuhuhuhuhu
URL in PowerShell #5 https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #6 https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #7 https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #8 https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #9 https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #10 https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #11 https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #12 https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #13 https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #14 https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #15 https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #16 https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #17 https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #18 https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #19 https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #20 https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #21 https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #22 https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #23 https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #24 http:/huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #25 https:huhuhuhuhuhuhu
URL in PowerShell #26 https:huhuhuhuhuhuhu
URL in PowerShell #27 https:huhuhuhuhuhuhu
URL in PowerShell #28 https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #29 https:huhuhuhuhuhuhu
URL in PowerShell #30 httpshuhuhuhuhuhuhu
URL in PowerShell #31 https:huhuhuhuhuhuhu
URL in PowerShell #32 https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #33 https:huhuhuhuhuhuhu
URL in PowerShell #34 https:huhuhuhuhuhuhu
URL in PowerShell #35 https:huhuhuhuhuhuhu
URL in PowerShell #36 https:huhuhuhuhuhuhuhuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
URL in PowerShell #1 URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
a1271541c0098606fb05741ea2dd2ae5 › zapret.1.10.3d › utils › test zapret.ps1
URL in PowerShell #2 URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
a1271541c0098606fb05741ea2dd2ae5 › zapret.1.10.3d › utils › test zapret.ps1
URL in PowerShell #3 URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
a1271541c0098606fb05741ea2dd2ae5 › zapret.1.10.3d › utils › test zapret.ps1
URL in PowerShell #4 URImalicious
https:huhuhuhuhuhuhu
a1271541c0098606fb05741ea2dd2ae5 › zapret.1.10.3d › utils › test zapret.ps1
URL in PowerShell #5 URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
a1271541c0098606fb05741ea2dd2ae5 › zapret.1.10.3d › utils › test zapret.ps1
URL in PowerShell #6 URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
a1271541c0098606fb05741ea2dd2ae5 › zapret.1.10.3d › utils › test zapret.ps1
URL in PowerShell #7 URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
a1271541c0098606fb05741ea2dd2ae5 › zapret.1.10.3d › utils › test zapret.ps1
URL in PowerShell #8 URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
a1271541c0098606fb05741ea2dd2ae5 › zapret.1.10.3d › utils › test zapret.ps1
URL in PowerShell #9 URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
a1271541c0098606fb05741ea2dd2ae5 › zapret.1.10.3d › utils › test zapret.ps1
URL in PowerShell #10 URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
a1271541c0098606fb05741ea2dd2ae5 › zapret.1.10.3d › utils › test zapret.ps1
URL in PowerShell #11 URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
a1271541c0098606fb05741ea2dd2ae5 › zapret.1.10.3d › utils › test zapret.ps1
URL in PowerShell #12 URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
a1271541c0098606fb05741ea2dd2ae5 › zapret.1.10.3d › utils › test zapret.ps1
URL in PowerShell #13 URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
a1271541c0098606fb05741ea2dd2ae5 › zapret.1.10.3d › utils › test zapret.ps1
URL in PowerShell #14 URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
a1271541c0098606fb05741ea2dd2ae5 › zapret.1.10.3d › utils › test zapret.ps1
URL in PowerShell #15 URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
a1271541c0098606fb05741ea2dd2ae5 › zapret.1.10.3d › utils › test zapret.ps1
URL in PowerShell #16 URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
a1271541c0098606fb05741ea2dd2ae5 › zapret.1.10.3d › utils › test zapret.ps1
URL in PowerShell #17 URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
a1271541c0098606fb05741ea2dd2ae5 › zapret.1.10.3d › utils › test zapret.ps1
URL in PowerShell #18 URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
a1271541c0098606fb05741ea2dd2ae5 › zapret.1.10.3d › utils › test zapret.ps1
URL in PowerShell #19 URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
a1271541c0098606fb05741ea2dd2ae5 › zapret.1.10.3d › utils › test zapret.ps1
URL in PowerShell #20 URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
a1271541c0098606fb05741ea2dd2ae5 › zapret.1.10.3d › utils › test zapret.ps1
URL in PowerShell #21 URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
a1271541c0098606fb05741ea2dd2ae5 › zapret.1.10.3d › utils › test zapret.ps1
URL in PowerShell #22 URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
a1271541c0098606fb05741ea2dd2ae5 › zapret.1.10.3d › utils › test zapret.ps1
URL in PowerShell #23 URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
a1271541c0098606fb05741ea2dd2ae5 › zapret.1.10.3d › utils › test zapret.ps1
URL in PowerShell #24 URImalicious
http:/huhuhuhuhuhuhuhuhuhuhu
a1271541c0098606fb05741ea2dd2ae5 › zapret.1.10.3d › utils › test zapret.ps1
URL in PowerShell #25 URImalicious
https:huhuhuhuhuhuhu
a1271541c0098606fb05741ea2dd2ae5 › zapret.1.10.3d › utils › test zapret.ps1
URL in PowerShell #26 URImalicious
https:huhuhuhuhuhuhu
a1271541c0098606fb05741ea2dd2ae5 › zapret.1.10.3d › utils › test zapret.ps1
URL in PowerShell #27 URImalicious
https:huhuhuhuhuhuhu
a1271541c0098606fb05741ea2dd2ae5 › zapret.1.10.3d › utils › test zapret.ps1
URL in PowerShell #28 URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
a1271541c0098606fb05741ea2dd2ae5 › zapret.1.10.3d › utils › test zapret.ps1
URL in PowerShell #29 URImalicious
https:huhuhuhuhuhuhu
a1271541c0098606fb05741ea2dd2ae5 › zapret.1.10.3d › utils › test zapret.ps1
URL in PowerShell #30 URImalicious
httpshuhuhuhuhuhuhu
a1271541c0098606fb05741ea2dd2ae5 › zapret.1.10.3d › utils › test zapret.ps1
URL in PowerShell #31 URImalicious
https:huhuhuhuhuhuhu
a1271541c0098606fb05741ea2dd2ae5 › zapret.1.10.3d › utils › test zapret.ps1
URL in PowerShell #32 URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
a1271541c0098606fb05741ea2dd2ae5 › zapret.1.10.3d › utils › test zapret.ps1
URL in PowerShell #33 URImalicious
https:huhuhuhuhuhuhu
a1271541c0098606fb05741ea2dd2ae5 › zapret.1.10.3d › utils › test zapret.ps1
URL in PowerShell #34 URImalicious
https:huhuhuhuhuhuhu
a1271541c0098606fb05741ea2dd2ae5 › zapret.1.10.3d › utils › test zapret.ps1
URL in PowerShell #35 URImalicious
https:huhuhuhuhuhuhu
a1271541c0098606fb05741ea2dd2ae5 › zapret.1.10.3d › utils › test zapret.ps1
URL in PowerShell #36 URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
a1271541c0098606fb05741ea2dd2ae5 › zapret.1.10.3d › utils › test zapret.ps1
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙