Suspicious
Suspect

f199722d6d41828af2b8749aaa4614bb

Rar Archive
MD5: f199722d6d41828af2b8749aaa4614bb
Size: 9.08 MB
application/vnd.rar

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 f199722d6d41828af2b8749aaa4614bb
Sha1 6e590a596e2932536fc1e463495825b595c7026a
Sha256 b23f88027ee3bf415c59c20b4fc608c858bcf0cdc94ec2434b309352006fb736
Sha384 5e64e9ebf4717750fb2dc544386f27b6a8d185992acff618fd7b80424d2211d4773ca0f8d01c6b9fd63ce980ef4d63b3
Sha512 e270aeb9ebc69ced44f9dc0bb5191d52e6d4eda6e68261d24e661f092c2ed2cd0a5670c9623aeaead06c29bd45b0c751be4c1e90eab3512b8c82d1e7f0c50d6a
SSDeep 98304:OGt8dy3X8zlFMvqbMvqjMvqsMvq0MvqAvo7MvqCMvqGMvqEMvqnMvqVMvqIMvqq2:/tQFbjs0TCGEnVIqM5DFTkdhrOX
TLSH F696235487132B99CEB9ADF4A7E23F8F8C44E47469A6380F7144434F05BA8ABD5EE4D0
SoundCloudZapretFix
zapret
bin
Overlay_eba38089.bin
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.data
.rdata
.buildid
.pdata
.xdata
.bss
.edata
.reloc
.idata
.rsrc
4
19
38
Resources
RT_VERSION
ID:0001
ID:1033
quic_initial_dbankcloud_ru.bin
quic_initial_www_google_com.bin
tls_clienthello_4pda_to.bin
tls_clienthello_max_ru.bin
tls_clienthello_www_google_com.bin
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.data
.rdata
.pdata
.xdata
.bss
.edata
.idata
.reloc
[Authenticode]_f668fc99.p7b
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rdata
.data
.pdata
.gfids
INIT
.rsrc
.reloc
Resources
RT_MESSAGETABLE
ID:0001
ID:1033
RT_VERSION
ID:0001
ID:1033
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.data
.rdata
.buildid
.pdata
.xdata
.bss
.idata
.rsrc
.reloc
Resources
RT_ICON
ID:0001
ID:1033
RT_GROUP_CURSOR4
ID:0000
ID:1033
RT_MANIFEST
ID:0001
ID:0
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rsrc
.Net Resources
iiir7xn2m0
rtuqfvpupjpixz
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rsrc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
tjmfsur4uuhjps41q
zzieodigz40kgj0hph905ydc2qwm
lists
ipset-all.txt
ipset-all.txt.backup
ipset-exclude-user.txt
ipset-exclude.txt
list-exclude-user.txt
list-exclude.txt
list-general.txt
list-google.txt
utils
check_updates.enabled
targets.txt
test results
БЛА БЛА БЛА НЕЧЕГО ДЕЛАТЬ.txt
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

Structural branches: 7 STICH kept: 2secondary ignored: 5
bin 5

Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path arc:rar>scr:ps1~T1059.001
Shape arc:rar>scr:ps1
technique2 nodes
Path arc:rar>pe:dll
Shape arc:rar>pe:dll
2 nodes
SoundCloudZapretFix
zapret
bin
Overlay_eba38089.bin
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.data
.rdata
.buildid
.pdata
.xdata
.bss
.edata
.reloc
.idata
.rsrc
4
19
38
Resources
RT_VERSION
ID:0001
ID:1033
quic_initial_dbankcloud_ru.bin
quic_initial_www_google_com.bin
tls_clienthello_4pda_to.bin
tls_clienthello_max_ru.bin
tls_clienthello_www_google_com.bin
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.data
.rdata
.pdata
.xdata
.bss
.edata
.idata
.reloc
[Authenticode]_f668fc99.p7b
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rdata
.data
.pdata
.gfids
INIT
.rsrc
.reloc
Resources
RT_MESSAGETABLE
ID:0001
ID:1033
RT_VERSION
ID:0001
ID:1033
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.data
.rdata
.buildid
.pdata
.xdata
.bss
.idata
.rsrc
.reloc
Resources
RT_ICON
ID:0001
ID:1033
RT_GROUP_CURSOR4
ID:0000
ID:1033
RT_MANIFEST
ID:0001
ID:0
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rsrc
.Net Resources
iiir7xn2m0
rtuqfvpupjpixz
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rsrc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
tjmfsur4uuhjps41q
zzieodigz40kgj0hph905ydc2qwm
lists
ipset-all.txt
ipset-all.txt.backup
ipset-exclude-user.txt
ipset-exclude.txt
list-exclude-user.txt
list-exclude.txt
list-general.txt
list-google.txt
utils
check_updates.enabled
targets.txt
test results
БЛА БЛА БЛА НЕЧЕГО ДЕЛАТЬ.txt
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙