Malicious
cd43a6913acedce67511e5f1118eeb93
Rar Archive
MD5: cd43a6913acedce67511e5f1118eeb93
Size: 11.27 MB
application/vnd.rar
This sample is a 10.8 MB Rar Archive for which Malva.RE's static analysis did not establish a malicious verdict. Static analysis extracted 808 embedded or derived files. It matches 11 YARA rules. Observed behaviours map to MITRE ATT&CK T1027, T1059.001 and T1059.005. The file was analysed statically: it was parsed and decompiled, never executed.
- SHA256
- 2fcb530e9fc950da8f43f38beb90beb63b26730f53b7e954b3813fe213ccd060
- MD5
- cd43a6913acedce67511e5f1118eeb93
- Verdict
- Malicious
- File type
- Rar Archive · 10.8 MB
Cite this report: https://app.malva.re/sha256/2fcb530e9fc950da8f43f38beb90beb63b26730f53b7e954b3813fe213ccd060
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
Rar archive
Size
11.27 MB · 11,273,475 B
First seen
2026-10-16 04:45 · 9 days ago
Last seen
2026-10-16 04:45 · 9 days ago
Last analysis
2026-10-16 04:46 · 9 days ago
Hashes
MD5
cd43a6913acedce67511e5f1118eeb93
Sha1
bdb50571a445bb5cc3d0526b99c2d2f8a4fe9fd4
Sha256
2fcb530e9fc950da8f43f38beb90beb63b26730f53b7e954b3813fe213ccd060
Sha384
91d3fef37fc99bd795c577d4ee9eec46c671f9543b0e56df22d7690a1eacad20df816da088741f972e8c4de9a64bf860
Sha512
0af780c525537a349c912369d5fc7537dbe03aba7dc1cf925aea80ec412d6dc982892a7907cc2597c07a44eff0186ce7b4b2aa0bb91583f5bb82710797eaee9b
SSDeep
196608:JNat5ZGfGOSMKFP9QDk/CKC5NqOxd4/9rt6BSQ1Fd4EyVm:Jct5Z6G1MKFP+I//C5N34FroSQf+Eyc
TLSH
E2B633B7E07BC1D84AEC1A04F25995A040A01DA9D0731C26F317AB59BBE0BF70D6677E
6 malicious · 809 files
RARcd43a6913acedce67511e5f1118eeb93T1027 · T1059.001 · T1059.005
JSONconfig.json
PYconfig.py
PYmain.py
TXTrequirements.txt
PS1run.batT1027 · T1059.001
PS1[Deobfuscated PS]T1059.001
SHrun.sh
BIN__pycache__
PYCbot_actions.cpython-311.pyc
PYCconfig.cpython-311.pyc
PYCmain.cpython-311.pyc
BINactions
PYabout.py
PYinstall.py
PYsettings.py
PY__init__.py
BIN__pycache__
PYCabout.cpython-311.pyc
PYCinstall.cpython-311.pyc
PYCsettings.cpython-311.pyc
PYC__init__.cpython-311.pyc
BINrelease
MDREADME.md
BINruntime
BINdata
ZIPcache.dbT1059.005
BIN.build_id
TXTLICENSE.txt
EXE_asyncio.pyd
Structure
P7B[Authenticode]_c058aa65.p7b
BINResources
BINRT_VERSION
BINID:0001
BINID:1033
EXE_bz2.pyd
Structure
P7B[Authenticode]_11ed969b.p7b
BINResources
BINRT_VERSION
BINID:0001
BINID:1033
EXE_ctypes.pyd
Structure
P7B[Authenticode]_a22f0392.p7b
BINResources
BINRT_VERSION
BINID:0001
BINID:1033
EXE_decimal.pyd
Structure
P7B[Authenticode]_86b72964.p7b
BINResources
BINRT_VERSION
BINID:0001
BINID:1033
EXE_elementtree.pyd
Structure
P7B[Authenticode]_4d4ef854.p7b
BINResources
BINRT_VERSION
BINID:0001
BINID:1033
EXE_hashlib.pyd
Structure
P7B[Authenticode]_623bccf1.p7b
BINResources
BINRT_VERSION
BINID:0001
BINID:1033
EXE_lzma.pyd
Structure
P7B[Authenticode]_ecf09868.p7b
BINResources
BINRT_VERSION
BINID:0001
BINID:1033
EXE_msi.pyd
Structure
P7B[Authenticode]_08ab8fc0.p7b
BINResources
BINRT_VERSION
BINID:0001
BINID:1033
EXE_multiprocessing.pyd
Structure
P7B[Authenticode]_223b8f1e.p7b
BINResources
BINRT_VERSION
BINID:0001
BINID:1033
EXE_overlapped.pyd
Structure
P7B[Authenticode]_2d321fe6.p7b
BINResources
BINRT_VERSION
BINID:0001
BINID:1033
EXE_queue.pyd
Structure
P7B[Authenticode]_3ef43cec.p7b
BINResources
BINRT_VERSION
BINID:0001
BINID:1033
EXE_socket.pyd
Structure
P7B[Authenticode]_306207e9.p7b
BINResources
BINRT_VERSION
BINID:0001
BINID:1033
EXE_sqlite3.pyd
Structure
P7B[Authenticode]_9b0aa6f1.p7b
BINResources
BINRT_VERSION
BINID:0001
BINID:1033
EXE_ssl.pyd
Structure
P7B[Authenticode]_257b8ade.p7b
BINResources
BINRT_VERSION
BINID:0001
BINID:1033
EXE_uuid.pyd
Structure
P7B[Authenticode]_aab45761.p7b
BINResources
BINRT_VERSION
BINID:0001
BINID:1033
EXE_zoneinfo.pyd
Structure
P7B[Authenticode]_94e1d6b7.p7b
BINResources
BINRT_VERSION
BINID:0001
BINID:1033
DLLlibcrypto-3.dll
Structure
P7B[Authenticode]_7e9a762b.p7b
BINResources
BINRT_VERSION
BINID:0001
BINID:1033
DLLlibffi-8.dll
Structure
P7B[Authenticode]_398cf2a2.p7b
DLLlibssl-3.dll
Structure
P7B[Authenticode]_9e4f851c.p7b
BINResources
BINRT_VERSION
BINID:0001
BINID:1033
EXEpyexpat.pyd
Structure
P7B[Authenticode]_b091a69b.p7b
BINResources
BINRT_VERSION
BINID:0001
BINID:1033
CATpython.cat
EXEpython.exe
Structure
P7B[Authenticode]_88b70014.p7b
BINResources
BINRT_ICON
BINID:0001
IMGID:1033
IMGID:1033-preview.png
BINID:0002
BINID:1033
BINID:0003
BINID:1033
BINID:0004
BINID:1033
BINID:0005
BINID:1033
BINID:0006
BINID:1033
BINID:0007
IMGID:1033
IMGID:1033-preview.png
BINID:0008
BINID:1033
BINID:0009
BINID:1033
BINID:000A
BINID:1033
BINID:000B
BINID:1033
BINID:000C
BINID:1033
BINRT_GROUP_CURSOR4
BINID:0001
BINID:1033
BINRT_VERSION
BINID:0001
BINID:1033
DLLpython3.dll
Structure
P7B[Authenticode]_7e393803.p7b
BINResources
BINRT_VERSION
BINID:0001
BINID:1033
_PTHpython311._pth
DLLpython311.dll
Structure
P7B[Authenticode]_b8352173.p7b
BINResources
BINRT_VERSION
BINID:0001
BINID:1033
ZIPpython311.zipT1059.005
PYCabc.pyc
PYCaifc.pyc
PYCantigravity.pyc
PYCargparse.pyc
PYCast.pyc
PYCasynchat.pyc
PYCasyncore.pyc
PYCbase64.pyc
PYCbdb.pyc
PYCbisect.pyc
PYCbz2.pyc
PYCcalendar.pyc
PYCcgi.pyc
PYCcgitb.pyc
PYCchunk.pyc
PYCcmd.pyc
PYCcode.pyc
PYCcodecs.pyc
PYCcodeop.pyc
PYCcolorsys.pyc
PYCcompileall.pyc
PYCconfigparser.pyc
PYCcontextlib.pyc
PYCcontextvars.pyc
PYCcopy.pyc
PYCcopyreg.pyc
PYCcProfile.pyc
PYCcrypt.pyc
PYCcsv.pyc
PYCdataclasses.pyc
PYCdatetime.pyc
PYCdecimal.pyc
PYCdifflib.pyc
PYCdis.pyc
PYCdoctest.pyc
PYCenum.pyc
PYCfilecmp.pyc
PYCfileinput.pyc
PYCfnmatch.pyc
PYCfractions.pyc
PYCftplib.pyc
PYCfunctools.pyc
PYCgenericpath.pyc
PYCgetopt.pyc
PYCgetpass.pyc
PYCgettext.pyc
PYCglob.pyc
PYCgraphlib.pyc
PYCgzip.pyc
PYChashlib.pyc
PYCheapq.pyc
PYChmac.pyc
PYCimaplib.pyc
PYCimghdr.pyc
PYCimp.pyc
PYCinspect.pyc
PYCio.pyc
PYCipaddress.pyc
PYCkeyword.pyc
PYClinecache.pyc
PYClocale.pyc
PYClzma.pyc
PYCmailbox.pyc
PYCmailcap.pyc
PYCmimetypes.pyc
PYCmodulefinder.pyc
PYCnetrc.pyc
PYCnntplib.pyc
PYCntpath.pyc
PYCnturl2path.pyc
PYCnumbers.pyc
PYCopcode.pyc
PYCoperator.pyc
PYCoptparse.pyc
PYCos.pyc
PYCpathlib.pyc
PYCpdb.pyc
PYCpickle.pyc
PYCpickletools.pyc
PYCpipes.pyc
PYCpkgutil.pyc
PYCplatform.pyc
PYCplistlib.pyc
PYCpoplib.pyc
PYCposixpath.pyc
PYCpprint.pyc
PYCprofile.pyc
PYCpstats.pyc
PYCpty.pyc
PYCpyclbr.pyc
PYCpydoc.pyc
PYCpy_compile.pyc
PYCqueue.pyc
PYCquopri.pyc
PYCrandom.pyc
PYCreprlib.pyc
PYCrlcompleter.pyc
PYCrunpy.pyc
PYCsched.pyc
PYCsecrets.pyc
PYCselectors.pyc
PYCshelve.pyc
PYCshlex.pyc
PYCshutil.pyc
PYCsignal.pyc
PYCsite.pyc
PYCsmtpd.pyc
PYCsmtplib.pyc
PYCsndhdr.pyc
PYCsocket.pyc
PYCsocketserver.pyc
PYCsre_compile.pyc
PYCsre_constants.pyc
PYCsre_parse.pyc
PYCssl.pyc
PYCstat.pyc
PYCstatistics.pyc
PYCstring.pyc
PYCstringprep.pyc
PYCstruct.pyc
PYCsubprocess.pyc
PYCsunau.pyc
PYCsymtable.pyc
PYCsysconfig.pyc
PYCtabnanny.pyc
PYCtarfile.pyc
PYCtelnetlib.pyc
PYCtempfile.pyc
PYCtextwrap.pyc
PYCthis.pyc
PYCthreading.pyc
PYCtimeit.pyc
PYCtoken.pyc
PYCtokenize.pyc
PYCtrace.pyc
PYCtraceback.pyc
PYCtracemalloc.pyc
PYCtty.pyc
PYCtypes.pyc
PYCtyping.pyc
PYCuu.pyc
PYCuuid.pyc
PYCwarnings.pyc
PYCwave.pyc
PYCweakref.pyc
PYCwebbrowser.pyc
PYCxdrlib.pyc
PYCzipapp.pyc
PYCzipfile.pyc
PYCzipimport.pyc
PYC_aix_support.pyc
PYC_bootsubprocess.pyc
PYC_collections_abc.pyc
PYC_compat_pickle.pyc
PYC_compression.pyc
PYC_markupbase.pyc
PYC_osx_support.pyc
PYC_pydecimal.pyc
PYC_pyio.pyc
PYC_py_abc.pyc
PYC_sitebuiltins.pyc
PYC_strptime.pyc
PYC_threading_local.pyc
PYC_weakrefset.pyc
PYC__future__.pyc
PYC__hello__.pyc
BINasyncio
VBSbase_events.pyc
PYCbase_futures.pyc
PYCbase_subprocess.pyc
PYCbase_tasks.pyc
PYCconstants.pyc
PYCcoroutines.pyc
PYCevents.pyc
PYCexceptions.pyc
PYCformat_helpers.pyc
PYCfutures.pyc
PYClocks.pyc
PYClog.pyc
PYCmixins.pyc
PYCproactor_events.pyc
PYCprotocols.pyc
PYCqueues.pyc
PYCrunners.pyc
PYCselector_events.pyc
PYCsslproto.pyc
PYCstaggered.pyc
PYCstreams.pyc
PYCsubprocess.pyc
PYCtaskgroups.pyc
PYCtasks.pyc
PYCthreads.pyc
PYCtimeouts.pyc
PYCtransports.pyc
PYCtrsock.pyc
PYCunix_events.pyc
PYCwindows_events.pyc
PYCwindows_utils.pyc
PYC__init__.pyc
PYC__main__.pyc
BINcollections
PYCabc.pyc
PYC__init__.pyc
BINconcurrent
PYC__init__.pyc
BINfutures
PYCprocess.pyc
PYCthread.pyc
PYC_base.pyc
PYC__init__.pyc
BINctypes
PYCutil.pyc
PYCwintypes.pyc
PYC_aix.pyc
PYC_endian.pyc
PYC__init__.pyc
BINmacholib
PYCdyld.pyc
PYCdylib.pyc
BINfetch_macholib
BATfetch_macholib.bat
PYCframework.pyc
BINREADME.ctypes
PYC__init__.pyc
BINcurses
PYCascii.pyc
PYChas_key.pyc
PYCpanel.pyc
PYCtextpad.pyc
PYC__init__.pyc
BINdbm
PYCdumb.pyc
PYCgnu.pyc
PYCndbm.pyc
PYC__init__.pyc
BINdistutils
PYCarchive_util.pyc
PYCbcppcompiler.pyc
PYCccompiler.pyc
PYCcmd.pyc
PYCconfig.pyc
PYCcore.pyc
PYCcygwinccompiler.pyc
PYCdebug.pyc
PYCdep_util.pyc
PYCdir_util.pyc
PYCdist.pyc
PYCerrors.pyc
PYCextension.pyc
PYCfancy_getopt.pyc
PYCfilelist.pyc
PYCfile_util.pyc
PYClog.pyc
PYCmsvc9compiler.pyc
PYCmsvccompiler.pyc
BINREADME
PYCspawn.pyc
PYCsysconfig.pyc
PYCtext_file.pyc
PYCunixccompiler.pyc
PYCutil.pyc
PYCversion.pyc
PYCversionpredicate.pyc
PYC_msvccompiler.pyc
PYC__init__.pyc
BINcommand
PYCbdist.pyc
PYCbdist_dumb.pyc
PYCbdist_rpm.pyc
PYCbuild.pyc
PYCbuild_clib.pyc
PYCbuild_ext.pyc
PYCbuild_py.pyc
PYCbuild_scripts.pyc
PYCcheck.pyc
PYCclean.pyc
BINcommand_template
PYCconfig.pyc
PYCinstall.pyc
PYCinstall_data.pyc
PYCinstall_egg_info.pyc
PYCinstall_headers.pyc
PYCinstall_lib.pyc
PYCinstall_scripts.pyc
PYCregister.pyc
PYCsdist.pyc
PYCupload.pyc
PYC__init__.pyc
BINemail
RSTarchitecture.rst
PYCbase64mime.pyc
PYCcharset.pyc
PYCcontentmanager.pyc
PYCencoders.pyc
PYCerrors.pyc
PYCfeedparser.pyc
PYCgenerator.pyc
PYCheader.pyc
PYCheaderregistry.pyc
PYCiterators.pyc
PYCmessage.pyc
PYCparser.pyc
PYCpolicy.pyc
PYCquoprimime.pyc
PYCutils.pyc
PYC_encoded_words.pyc
PYC_header_value_parser.pyc
PYC_parseaddr.pyc
PYC_policybase.pyc
PYC__init__.pyc
BINmime
PYCapplication.pyc
PYCaudio.pyc
PYCbase.pyc
PYCimage.pyc
PYCmessage.pyc
PYCmultipart.pyc
PYCnonmultipart.pyc
PYCtext.pyc
PYC__init__.pyc
BINencodings
PYCaliases.pyc
PYCascii.pyc
PYCbase64_codec.pyc
PYCbig5.pyc
PYCbig5hkscs.pyc
PYCbz2_codec.pyc
PYCcharmap.pyc
PYCcp037.pyc
PYCcp1006.pyc
PYCcp1026.pyc
PYCcp1125.pyc
PYCcp1140.pyc
PYCcp1250.pyc
PYCcp1251.pyc
PYCcp1252.pyc
PYCcp1253.pyc
PYCcp1254.pyc
PYCcp1255.pyc
PYCcp1256.pyc
PYCcp1257.pyc
PYCcp1258.pyc
PYCcp273.pyc
PYCcp424.pyc
PYCcp437.pyc
PYCcp500.pyc
PYCcp720.pyc
PYCcp737.pyc
PYCcp775.pyc
PYCcp850.pyc
PYCcp852.pyc
PYCcp855.pyc
PYCcp856.pyc
PYCcp857.pyc
PYCcp858.pyc
PYCcp860.pyc
PYCcp861.pyc
PYCcp862.pyc
PYCcp863.pyc
PYCcp864.pyc
PYCcp865.pyc
PYCcp866.pyc
PYCcp869.pyc
PYCcp874.pyc
PYCcp875.pyc
PYCcp932.pyc
PYCcp949.pyc
PYCcp950.pyc
PYCeuc_jisx0213.pyc
PYCeuc_jis_2004.pyc
PYCeuc_jp.pyc
PYCeuc_kr.pyc
PYCgb18030.pyc
PYCgb2312.pyc
PYCgbk.pyc
PYChex_codec.pyc
PYChp_roman8.pyc
PYChz.pyc
PYCidna.pyc
PYCiso2022_jp.pyc
PYCiso2022_jp_1.pyc
PYCiso2022_jp_2.pyc
PYCiso2022_jp_2004.pyc
PYCiso2022_jp_3.pyc
PYCiso2022_jp_ext.pyc
PYCiso2022_kr.pyc
PYCiso8859_1.pyc
PYCiso8859_10.pyc
PYCiso8859_11.pyc
PYCiso8859_13.pyc
PYCiso8859_14.pyc
PYCiso8859_15.pyc
PYCiso8859_16.pyc
PYCiso8859_2.pyc
PYCiso8859_3.pyc
PYCiso8859_4.pyc
PYCiso8859_5.pyc
PYCiso8859_6.pyc
PYCiso8859_7.pyc
PYCiso8859_8.pyc
PYCiso8859_9.pyc
PYCjohab.pyc
PYCkoi8_r.pyc
PYCkoi8_t.pyc
PYCkoi8_u.pyc
PYCkz1048.pyc
PYClatin_1.pyc
PYCmac_arabic.pyc
PYCmac_croatian.pyc
PYCmac_cyrillic.pyc
PYCmac_farsi.pyc
PYCmac_greek.pyc
PYCmac_iceland.pyc
PYCmac_latin2.pyc
PYCmac_roman.pyc
PYCmac_romanian.pyc
PYCmac_turkish.pyc
PYCmbcs.pyc
PYCoem.pyc
PYCpalmos.pyc
PYCptcp154.pyc
PYCpunycode.pyc
PYCquopri_codec.pyc
PYCraw_unicode_escape.pyc
PYCrot_13.pyc
PYCshift_jis.pyc
PYCshift_jisx0213.pyc
PYCshift_jis_2004.pyc
PYCtis_620.pyc
PYCundefined.pyc
PYCunicode_escape.pyc
PYCutf_16.pyc
PYCutf_16_be.pyc
PYCutf_16_le.pyc
PYCutf_32.pyc
PYCutf_32_be.pyc
PYCutf_32_le.pyc
PYCutf_7.pyc
PYCutf_8.pyc
PYCutf_8_sig.pyc
PYCuu_codec.pyc
PYCzlib_codec.pyc
PYC__init__.pyc
BINhtml
PYCentities.pyc
PYCparser.pyc
PYC__init__.pyc
BINhttp
PYCclient.pyc
PYCcookiejar.pyc
HTMcookies.pyc
PYCserver.pyc
PYC__init__.pyc
BINimportlib
PYCabc.pyc
PYCmachinery.pyc
PYCreaders.pyc
PYCsimple.pyc
PYCutil.pyc
PYC_abc.pyc
PYC_bootstrap.pyc
PYC_bootstrap_external.pyc
PYC__init__.pyc
BINmetadata
PYC_adapters.pyc
PYC_collections.pyc
PYC_functools.pyc
PYC_itertools.pyc
PYC_meta.pyc
PYC_text.pyc
PYC__init__.pyc
BINresources
PYCabc.pyc
PYCreaders.pyc
PYCsimple.pyc
PYC_adapters.pyc
PYC_common.pyc
PYC_itertools.pyc
PYC_legacy.pyc
PYC__init__.pyc
BINjson
PYCdecoder.pyc
PYCencoder.pyc
PYCscanner.pyc
PYCtool.pyc
PYC__init__.pyc
BINlib2to3
PYCbtm_matcher.pyc
PYCbtm_utils.pyc
PYCfixer_base.pyc
PYCfixer_util.pyc
BINGrammar3.11.9.final.0.pickle
TXTGrammar.txt
PYCmain.pyc
PYCpatcomp.pyc
BINPatternGrammar3.11.9.final.0.pickle
TXTPatternGrammar.txt
PYCpygram.pyc
PYCpytree.pyc
PYCrefactor.pyc
PYC__init__.pyc
PYC__main__.pyc
BINfixes
PYCfix_apply.pyc
PYCfix_asserts.pyc
PYCfix_basestring.pyc
PYCfix_buffer.pyc
PYCfix_dict.pyc
PYCfix_except.pyc
PYCfix_exec.pyc
PYCfix_execfile.pyc
PYCfix_exitfunc.pyc
PYCfix_filter.pyc
PYCfix_funcattrs.pyc
PYCfix_future.pyc
PYCfix_getcwdu.pyc
PYCfix_has_key.pyc
PYCfix_idioms.pyc
PYCfix_import.pyc
PYCfix_imports.pyc
PYCfix_imports2.pyc
PYCfix_input.pyc
PYCfix_intern.pyc
PYCfix_isinstance.pyc
PYCfix_itertools.pyc
PYCfix_itertools_imports.pyc
PYCfix_long.pyc
PYCfix_map.pyc
PYCfix_metaclass.pyc
PYCfix_methodattrs.pyc
PYCfix_ne.pyc
PYCfix_next.pyc
PYCfix_nonzero.pyc
PYCfix_numliterals.pyc
PYCfix_operator.pyc
PYCfix_paren.pyc
PYCfix_print.pyc
PYCfix_raise.pyc
PYCfix_raw_input.pyc
PYCfix_reduce.pyc
PYCfix_reload.pyc
PYCfix_renames.pyc
PYCfix_repr.pyc
PYCfix_set_literal.pyc
PYCfix_standarderror.pyc
PYCfix_sys_exc.pyc
PYCfix_throw.pyc
PYCfix_tuple_params.pyc
PYCfix_types.pyc
PYCfix_unicode.pyc
PYCfix_urllib.pyc
PYCfix_ws_comma.pyc
PYCfix_xrange.pyc
PYCfix_xreadlines.pyc
PYCfix_zip.pyc
PYC__init__.pyc
BINpgen2
PYCconv.pyc
PYCdriver.pyc
PYCgrammar.pyc
PYCliterals.pyc
PYCparse.pyc
PYCpgen.pyc
PYCtoken.pyc
PYCtokenize.pyc
PYC__init__.pyc
BINlogging
PYCconfig.pyc
PYChandlers.pyc
PYC__init__.pyc
BINmsilib
PYCschema.pyc
PYCsequence.pyc
PYCtext.pyc
PYC__init__.pyc
BINmultiprocessing
PYCconnection.pyc
PYCcontext.pyc
PYCforkserver.pyc
PYCheap.pyc
PYCmanagers.pyc
PYCpool.pyc
PYCpopen_fork.pyc
PYCpopen_forkserver.pyc
PYCpopen_spawn_posix.pyc
PYCpopen_spawn_win32.pyc
PYCprocess.pyc
PYCqueues.pyc
PYCreduction.pyc
PYCresource_sharer.pyc
PYCresource_tracker.pyc
PYCsharedctypes.pyc
PYCshared_memory.pyc
PYCspawn.pyc
PYCsynchronize.pyc
PYCutil.pyc
PYC__init__.pyc
BINdummy
PYCconnection.pyc
PYC__init__.pyc
BINpydoc_data
VBStopics.pycT1059.005
CSS_pydoc.css
PYC__init__.pyc
BINre
PYC_casefix.pyc
PYC_compiler.pyc
PYC_constants.pyc
PYC_parser.pyc
PYC__init__.pyc
BINsite-packages
TXTREADME.txt
BINsqlite3
PYCdbapi2.pyc
PYCdump.pyc
PYC__init__.pyc
BINtomllib
PYC_parser.pyc
PYC_re.pyc
PYC_types.pyc
PYC__init__.pyc
BINunittest
PYCasync_case.pyc
PYCcase.pyc
PYCloader.pyc
PYCmain.pyc
PYCmock.pyc
PYCresult.pyc
PYCrunner.pyc
PYCsignals.pyc
PYCsuite.pyc
PYCutil.pyc
PYC_log.pyc
PYC__init__.pyc
PYC__main__.pyc
BINurllib
PYCerror.pyc
PYCparse.pyc
PYCrequest.pyc
PYCresponse.pyc
PYCrobotparser.pyc
PYC__init__.pyc
BINwsgiref
PYChandlers.pyc
PYCheaders.pyc
PYCsimple_server.pyc
PYCtypes.pyc
PYCutil.pyc
PYCvalidate.pyc
PYC__init__.pyc
BINxml
PYC__init__.pyc
BINdom
PYCdomreg.pyc
PYCexpatbuilder.pyc
PYCminicompat.pyc
PYCminidom.pyc
PYCNodeFilter.pyc
PYCpulldom.pyc
PYCxmlbuilder.pyc
PYC__init__.pyc
BINetree
PYCcElementTree.pyc
PYCElementInclude.pyc
PYCElementPath.pyc
PYCElementTree.pyc
PYC__init__.pyc
BINparsers
PYCexpat.pyc
PYC__init__.pyc
BINsax
PYCexpatreader.pyc
PYChandler.pyc
PYCsaxutils.pyc
PYCxmlreader.pyc
PYC_exceptions.pyc
PYC__init__.pyc
BINxmlrpc
PYCclient.pyc
PYCserver.pyc
PYC__init__.pyc
BINzoneinfo
PYC_common.pyc
PYC_tzpath.pyc
PYC_zoneinfo.pyc
PYC__init__.pyc
BIN__phello__
PYCspam.pyc
PYC__init__.pyc
BINham
PYCeggs.pyc
PYC__init__.pyc
EXEpythonw.exe
Structure
P7B[Authenticode]_243e2828.p7b
BINResources
BINRT_ICON
BINID:0001
IMGID:1033
IMGID:1033-preview.png
BINID:0002
BINID:1033
BINID:0003
BINID:1033
BINID:0004
BINID:1033
BINID:0005
BINID:1033
BINID:0006
BINID:1033
BINID:0007
IMGID:1033
IMGID:1033-preview.png
BINID:0008
BINID:1033
BINID:0009
BINID:1033
BINID:000A
BINID:1033
BINID:000B
BINID:1033
BINID:000C
BINID:1033
BINRT_GROUP_CURSOR4
BINID:0001
BINID:1033
BINRT_VERSION
BINID:0001
BINID:1033
EXEselect.pyd
Structure
P7B[Authenticode]_2dfb67a1.p7b
BINResources
BINRT_VERSION
BINID:0001
BINID:1033
DLLsqlite3.dll
Structure
P7B[Authenticode]_5610b577.p7b
BINResources
BINRT_VERSION
BINID:0001
BINID:1033
EXEunicodedata.pyd
Structure
P7B[Authenticode]_46c6384a.p7b
BINResources
BINRT_VERSION
BINID:0001
BINID:1033
DLLvcruntime140.dll
Structure
P7B[Authenticode]_16b2e28b.p7b
BINResources
BINRT_VERSION
BINID:0001
BINID:1033
DLLvcruntime140_1.dll
Structure
P7B[Authenticode]_51e7d6ef.p7b
BINResources
BINRT_VERSION
BINID:0001
BINID:1033
EXEwinsound.pyd
Structure
P7B[Authenticode]_09a6b81e.p7b
BINResources
BINRT_VERSION
BINID:0001
BINID:1033
BINRT_MANIFEST
BINID:0002
BINID:1033
PYenv.py
PYexecutor.py
PYsecurity.py
PYsession.py
PYui.py
PS1__init__.pyT1059.001
BIN__pycache__
PYCenv.cpython-311.pyc
PYCexecutor.cpython-311.pyc
PYCsecurity.cpython-311.pyc
PYCsession.cpython-311.pyc
PYCui.cpython-311.pyc
PYC__init__.cpython-311.pyc
BIN.gitignore
PYbot_actions.py
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
Structural branches: 13
STICH kept: 5secondary ignored: 8
bin
7img
1Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
5 / 5
Path
arc:rar>scr:ps1~T1027~T1059.001
Shape
arc:rar>scr:ps1
malicious
2 nodes
Path
arc:rar>arc:zip>arc:zip>scr:vbs~T1059.005
Shape
arc:rar>arc:zip>arc:zip>scr:vbs
technique4 nodes
Deobfuscated PowerShell
UNKNWOWNmalicious
@echo
huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #1
URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #2
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #3
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential6 malicious · 809 files
RARcd43a6913acedce67511e5f1118eeb93T1027 · T1059.001 · T1059.005
JSONconfig.json
PYconfig.py
PYmain.py
TXTrequirements.txt
PS1run.batT1027 · T1059.001
PS1[Deobfuscated PS]T1059.001
SHrun.sh
BIN__pycache__
BINactions
BINrelease
BINruntime
BINdata
ZIPcache.dbT1059.005
BIN.build_id
TXTLICENSE.txt
EXE_asyncio.pyd
EXE_bz2.pyd
EXE_ctypes.pyd
EXE_decimal.pyd
EXE_elementtree.pyd
EXE_hashlib.pyd
EXE_lzma.pyd
EXE_msi.pyd
EXE_multiprocessing.pyd
EXE_overlapped.pyd
EXE_queue.pyd
EXE_socket.pyd
EXE_sqlite3.pyd
EXE_ssl.pyd
EXE_uuid.pyd
EXE_zoneinfo.pyd
DLLlibcrypto-3.dll
DLLlibffi-8.dll
DLLlibssl-3.dll
EXEpyexpat.pyd
CATpython.cat
EXEpython.exe
DLLpython3.dll
_PTHpython311._pth
DLLpython311.dll
ZIPpython311.zipT1059.005
PYCabc.pyc
PYCaifc.pyc
PYCantigravity.pyc
PYCargparse.pyc
PYCast.pyc
PYCasynchat.pyc
PYCasyncore.pyc
PYCbase64.pyc
PYCbdb.pyc
PYCbisect.pyc
PYCbz2.pyc
PYCcalendar.pyc
PYCcgi.pyc
PYCcgitb.pyc
PYCchunk.pyc
PYCcmd.pyc
PYCcode.pyc
PYCcodecs.pyc
PYCcodeop.pyc
PYCcolorsys.pyc
PYCcompileall.pyc
PYCconfigparser.pyc
PYCcontextlib.pyc
PYCcontextvars.pyc
PYCcopy.pyc
PYCcopyreg.pyc
PYCcProfile.pyc
PYCcrypt.pyc
PYCcsv.pyc
PYCdataclasses.pyc
PYCdatetime.pyc
PYCdecimal.pyc
PYCdifflib.pyc
PYCdis.pyc
PYCdoctest.pyc
PYCenum.pyc
PYCfilecmp.pyc
PYCfileinput.pyc
PYCfnmatch.pyc
PYCfractions.pyc
PYCftplib.pyc
PYCfunctools.pyc
PYCgenericpath.pyc
PYCgetopt.pyc
PYCgetpass.pyc
PYCgettext.pyc
PYCglob.pyc
PYCgraphlib.pyc
PYCgzip.pyc
PYChashlib.pyc
PYCheapq.pyc
PYChmac.pyc
PYCimaplib.pyc
PYCimghdr.pyc
PYCimp.pyc
PYCinspect.pyc
PYCio.pyc
PYCipaddress.pyc
PYCkeyword.pyc
PYClinecache.pyc
PYClocale.pyc
PYClzma.pyc
PYCmailbox.pyc
PYCmailcap.pyc
PYCmimetypes.pyc
PYCmodulefinder.pyc
PYCnetrc.pyc
PYCnntplib.pyc
PYCntpath.pyc
PYCnturl2path.pyc
PYCnumbers.pyc
PYCopcode.pyc
PYCoperator.pyc
PYCoptparse.pyc
PYCos.pyc
PYCpathlib.pyc
PYCpdb.pyc
PYCpickle.pyc
PYCpickletools.pyc
PYCpipes.pyc
PYCpkgutil.pyc
PYCplatform.pyc
PYCplistlib.pyc
PYCpoplib.pyc
PYCposixpath.pyc
PYCpprint.pyc
PYCprofile.pyc
PYCpstats.pyc
PYCpty.pyc
PYCpyclbr.pyc
PYCpydoc.pyc
PYCpy_compile.pyc
PYCqueue.pyc
PYCquopri.pyc
PYCrandom.pyc
PYCreprlib.pyc
PYCrlcompleter.pyc
PYCrunpy.pyc
PYCsched.pyc
PYCsecrets.pyc
PYCselectors.pyc
PYCshelve.pyc
PYCshlex.pyc
PYCshutil.pyc
PYCsignal.pyc
PYCsite.pyc
PYCsmtpd.pyc
PYCsmtplib.pyc
PYCsndhdr.pyc
PYCsocket.pyc
PYCsocketserver.pyc
PYCsre_compile.pyc
PYCsre_constants.pyc
PYCsre_parse.pyc
PYCssl.pyc
PYCstat.pyc
PYCstatistics.pyc
PYCstring.pyc
PYCstringprep.pyc
PYCstruct.pyc
PYCsubprocess.pyc
PYCsunau.pyc
PYCsymtable.pyc
PYCsysconfig.pyc
PYCtabnanny.pyc
PYCtarfile.pyc
PYCtelnetlib.pyc
PYCtempfile.pyc
PYCtextwrap.pyc
PYCthis.pyc
PYCthreading.pyc
PYCtimeit.pyc
PYCtoken.pyc
PYCtokenize.pyc
PYCtrace.pyc
PYCtraceback.pyc
PYCtracemalloc.pyc
PYCtty.pyc
PYCtypes.pyc
PYCtyping.pyc
PYCuu.pyc
PYCuuid.pyc
PYCwarnings.pyc
PYCwave.pyc
PYCweakref.pyc
PYCwebbrowser.pyc
PYCxdrlib.pyc
PYCzipapp.pyc
PYCzipfile.pyc
PYCzipimport.pyc
PYC_aix_support.pyc
PYC_bootsubprocess.pyc
PYC_collections_abc.pyc
PYC_compat_pickle.pyc
PYC_compression.pyc
PYC_markupbase.pyc
PYC_osx_support.pyc
PYC_pydecimal.pyc
PYC_pyio.pyc
PYC_py_abc.pyc
PYC_sitebuiltins.pyc
PYC_strptime.pyc
PYC_threading_local.pyc
PYC_weakrefset.pyc
PYC__future__.pyc
PYC__hello__.pyc
BINasyncio
BINcollections
BINconcurrent
BINctypes
BINcurses
BINdbm
BINdistutils
BINemail
BINencodings
BINhtml
BINhttp
BINimportlib
BINjson
BINlib2to3
BINlogging
BINmsilib
BINmultiprocessing
BINpydoc_data
VBStopics.pycT1059.005
CSS_pydoc.css
PYC__init__.pyc
BINre
BINsite-packages
BINsqlite3
BINtomllib
BINunittest
BINurllib
BINwsgiref
BINxml
BINxmlrpc
BINzoneinfo
BIN__phello__
EXEpythonw.exe
EXEselect.pyd
DLLsqlite3.dll
EXEunicodedata.pyd
DLLvcruntime140.dll
DLLvcruntime140_1.dll
EXEwinsound.pyd
PYenv.py
PYexecutor.py
PYsecurity.py
PYsession.py
PYui.py
PS1__init__.pyT1059.001
BIN__pycache__
BIN.gitignore
PYbot_actions.py
No malware configuration was found at this point.
Deobfuscated PowerShell
UNKNWOWNmalicious
@echo
huhuhuhuhuhuhuhuhuhuhu
cd43a6913acedce67511e5f1118eeb93 › run.bat
URLs in VB Code - #1
URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
cd43a6913acedce67511e5f1118eeb93 › runtime › data › cache.db › python311.zip › pydoc_data › topics.pyc
URLs in VB Code - #2
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
cd43a6913acedce67511e5f1118eeb93 › runtime › data › cache.db › python311.zip › pydoc_data › topics.pyc
URLs in VB Code - #3
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
cd43a6913acedce67511e5f1118eeb93 › runtime › data › cache.db › python311.zip › pydoc_data › topics.pyc
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with EssentialSign in or create a free account to view the matching YARA rules.
Create a free account