Malicious
Malicious

ef04575a2fae8de5199cac82a3621e30

Share on LinkedIn
Print
PE Executable
MD5: ef04575a2fae8de5199cac82a3621e30
Size: 5.47 MB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 ef04575a2fae8de5199cac82a3621e30
Sha1 13e747467edc75c07cdcc78e7094e7feced573f9
Sha256 99bd3aa2659a7c95c09be896b06e809c948d089dceb2acbbe53bf576b2370856
Sha384 d91fbb6207bfa4a73415e362c2ee0f1209ac331320024f286a7dba6f2c3d97a85af54887f036807cfd670e0048ef1ce4
Sha512 038dc6c3d25370382dab3aeefab48c49ba0ddf1605e76cd53eb3ef6bfcff102c77d9c2de1b3d52ac2f55e8f1e9a601674d724f637f0b7dcd58383eff83614afe
SSDeep 98304:rKAu43Gt8dy3X8zxRa49EqrHB5EMyQ0VGcK/IYDO6Kgzepk3U6uLGnt:rrWt+R9hrTEMj0n36Kzk3U7LGnt
TLSH C346230AF7E409F9E173D0B5CE914502E772BC8A1762D69F03A1A9B51F272A0DE3D712
PeID
Microsoft Visual C++ 8.0 (DLL)Microsoft Visual C++ v6.0 DLLUPolyX 0.3 -> delikon
ef04575a2fae8de5199cac82a3621e30
Malicious
Overlay_0016fdab.bin
Malicious
zapret-discord-youtube-main.rar
Malicious
zapret-discord-youtube-main
Malicious
.gitattributes
.github
github-bot.yml
ISSUE_TEMPLATE
bug_report.yml
workflows
comment.yml
release.yml
stale.yml
.gitignore
.service
hosts
ipset-service.txt
version.txt
bin
ACTIVE_DISCORD_UDP.bin
ACTIVE_GAME_UDP.bin
cygwin1.dll
Overlay_eba38089.bin
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.data
.rdata
.buildid
.pdata
.xdata
.bss
.edata
.reloc
.idata
.rsrc
4
19
38
Resources
RT_VERSION
ID:0001
ID:1033
quic_initial_5ka_ru.bin
quic_initial_rutube_ru.bin
quic_initial_tencent_com.bin
quic_initial_www_google_com.bin
stun.bin
stun2.bin
tls_clienthello_4pda_to.bin
tls_clienthello_5ka_ru.bin
tls_clienthello_max_ru.bin
tls_clienthello_sochi_park.bin
tls_clienthello_www_google_com.bin
WinDivert.dll
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.data
.rdata
.pdata
.xdata
.bss
.edata
.idata
.reloc
WinDivert64.sys
[Authenticode]_f668fc99.p7b
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rdata
.data
.pdata
.gfids
INIT
.rsrc
.reloc
Resources
RT_MESSAGETABLE
ID:0001
ID:1033
RT_VERSION
ID:0001
ID:1033
winws.exe
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.data
.rdata
.buildid
.pdata
.xdata
.bss
.idata
.rsrc
.reloc
Resources
RT_ICON
ID:0001
ID:1033
RT_GROUP_CURSOR4
ID:0000
ID:1033
RT_MANIFEST
ID:0001
ID:0
general (ALT).bat
general (ALT10).bat
general (ALT11).bat
general (ALT12).bat
general (ALT13).bat
general (ALT2).bat
general (ALT3).bat
general (ALT4).bat
general (ALT5).bat
general (ALT6).bat
general (ALT7).bat
general (ALT8).bat
general (ALT9).bat
general (EXP).bat
general (FAKE TLS AUTO ALT).bat
general (FAKE TLS AUTO ALT2).bat
general (FAKE TLS AUTO ALT3).bat
general (FAKE TLS AUTO).bat
general (SIMPLE FAKE ALT).bat
general (SIMPLE FAKE ALT2).bat
general (SIMPLE FAKE).bat
general.bat
LICENSE.txt
lists
ipset-all.txt
ipset-exclude.txt
list-exclude.txt
list-general.txt
list-google.txt
README.md
service.bat
Malicious
[PowerShell Command]
Malicious
[PowerShell Command]
Malicious
[PowerShell Command]
Malicious
[PowerShell Command]
Malicious
[PowerShell Command]
Malicious
[PowerShell Command]
Malicious
[PowerShell Command]
Malicious
[PowerShell Command]
Malicious
[PowerShell Command]
Malicious
[PowerShell Command]
Malicious
[PowerShell Command]
Malicious
[PowerShell Command]
Malicious
[PowerShell Command]
Malicious
[PowerShell Command]
Malicious
[PowerShell Command]
Malicious
[PowerShell Command]
Malicious
[PowerShell Command]
Malicious
[PowerShell Command]
Malicious
[PowerShell Command]
Malicious
[PowerShell Command]
Malicious
[PowerShell Command]
Malicious
[PowerShell Command]
Malicious
[PowerShell Command]
Malicious
[PowerShell Command]
Malicious
[PowerShell Command]
Malicious
[PowerShell Command]
Malicious
[PowerShell Command]
Malicious
[PowerShell Command]
Malicious
[PowerShell Command]
Malicious
[PowerShell Command]
Malicious
[PowerShell Command]
Malicious
[PowerShell Command]
Malicious
[PowerShell Command]
Malicious
[PowerShell Command]
Malicious
[PowerShell Command]
Malicious
[PowerShell Command]
Malicious
[PowerShell Command]
Malicious
[PowerShell Command]
Malicious
[PowerShell Command]
Malicious
[PowerShell Command]
Malicious
[PowerShell Command]
Malicious
[PowerShell Command]
Malicious
[PowerShell Command]
Malicious
[PowerShell Command]
Malicious
[PowerShell Command]
Malicious
[PowerShell Command]
Malicious
[PowerShell Command]
Malicious
[PowerShell Command]
Malicious
[PowerShell Command]
Malicious
[PowerShell Command]
Malicious
[PowerShell Command]
Malicious
[PowerShell Command]
Malicious
[PowerShell Command]
Malicious
[PowerShell Command]
Malicious
[PowerShell Command]
Malicious
[PowerShell Command]
Malicious
[PowerShell Command]
Malicious
[PowerShell Command]
Malicious
[PowerShell Command]
Malicious
[PowerShell Command]
Malicious
[PowerShell Command]
Malicious
[PowerShell Command]
Malicious
[PowerShell Command]
Malicious
[PowerShell Command]
Malicious
[PowerShell Command]
Malicious
utils
check_updates.enabled
targets.txt
test zapret.ps1
Zapret.exe
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rdata
.data
.pdata
.didat
.fptable
.rsrc
.reloc
Resources
PNG
ID:0065
ID:1033
ID:1033-preview.png
ID:0066
ID:1033
ID:1033-preview.png
RT_ICON
ID:0001
ID:1033
ID:0002
ID:1033
ID:0003
ID:1033
ID:0004
ID:1033
ID:0005
ID:1033
ID:0006
ID:1033
ID:0007
ID:1033
ID:1033-preview.png
RT_DIALOG
ID:0000
ID:1033
RT_STRING
ID:0007
ID:1033
ID:0008
ID:1033
ID:0009
ID:1033
ID:000A
ID:1033
ID:000B
ID:1033
ID:000C
ID:1033
ID:000D
ID:1033
ID:000E
ID:1033
ID:000F
ID:1033
ID:0010
ID:1033
ID:0011
ID:1033
RT_GROUP_CURSOR4
ID:0064
ID:1033
RT_MANIFEST
ID:0001
ID:1033
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

Structural branches: 11 STICH kept: 3secondary ignored: 8
bin 7img 1

Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
3 / 3
Path pe:exe>arc:rar>arc:rar>scr:ps1~T1027~T1059.001~T1105
Shape pe:exe>arc:rar>arc:rar>scr:ps1
malicious 4 nodes
Path pe:exe>arc:rar>arc:rar>scr:ps1~T1059.001~T1105
Shape pe:exe>arc:rar>arc:rar>scr:ps1
technique4 nodes
Config. Field Value
URL in PowerShell #1 https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #2 https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #3 https:huhuhuhuhuhuhu
URL in PowerShell #4 https:huhuhuhuhuhuhu
URL in PowerShell #5 https:huhuhuhuhuhuhu
URL in PowerShell #6 https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #7 https:huhuhuhuhuhuhu
URL in PowerShell #8 httpshuhuhuhuhuhuhu
URL in PowerShell #9 https:huhuhuhuhuhuhu
URL in PowerShell #10 https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #11 https:huhuhuhuhuhuhu
URL in PowerShell #12 https:huhuhuhuhuhuhu
URL in PowerShell #13 https:huhuhuhuhuhuhu
URL in PowerShell #14 https:huhuhuhuhuhuhuhuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Config. Field Value
URL in PowerShell #1 https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #2 https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #3 https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #4 https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #5 https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #6 https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #7 https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #8 https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #9 https:huhuhuhuhuhuhuhuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Config. Field Value
URL in PowerShell #1 https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #2 https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #3 https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #4 https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #5 https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #6 https:huhuhuhuhuhuhuhuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Config. Field Value
URL in PowerShell #1 https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #2 https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #3 https:huhuhuhuhuhuhuhuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Config. Field Value
URL in PowerShell #1 https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #2 https:huhuhuhuhuhuhuhuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Config. Field Value
URL in PowerShell #1 https:huhuhuhuhuhuhuhuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Config. Field Value
URL in PowerShell #1 https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #2 https:huhuhuhuhuhuhuhuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Config. Field Value
URL in PowerShell #1 https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #2 https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #3 https:huhuhuhuhuhuhuhuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Name Value
Info
PE Detect: PeReader OK (file layout)
Info
Overlay extracted: Overlay_0016fdab.bin (4992187 bytes)
Info
PDB Path: D:\Projects\WinRAR\SFX\build\sfxrar64\Release\sfxrar.pdb
URL in PowerShell #1 URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #2 URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #3 URImalicious
https:huhuhuhuhuhuhu
URL in PowerShell #4 URImalicious
https:huhuhuhuhuhuhu
URL in PowerShell #5 URImalicious
https:huhuhuhuhuhuhu
URL in PowerShell #6 URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #7 URImalicious
https:huhuhuhuhuhuhu
URL in PowerShell #8 URImalicious
httpshuhuhuhuhuhuhu
URL in PowerShell #9 URImalicious
https:huhuhuhuhuhuhu
URL in PowerShell #10 URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #11 URImalicious
https:huhuhuhuhuhuhu
URL in PowerShell #12 URImalicious
https:huhuhuhuhuhuhu
URL in PowerShell #13 URImalicious
https:huhuhuhuhuhuhu
URL in PowerShell #14 URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #1 URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #2 URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #3 URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #4 URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #5 URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #6 URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #7 URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #8 URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #9 URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #1 URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
"Writehuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
"Writehuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
write-huhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
"Writehuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
An error has occurred. This application may no longer respond until reloaded. Reload 🗙