mullakka.exe?ex=670c4027&is=670aeea7&hm=c37458cb8f8dc2985499fcc5dd86600a1dda5f7a724709109a97ae24970f4d65&

First submission 2024-10-13 20:17:02

File details

File type: PE32+ executable (GUI) x86-64, for MS Windows
Mime type: application/x-dosexec
File size: 10061.29 KB (10302756 bytes)
Compile time: 2024-10-12 22:44:58
MD5: 136c7ac634c84ad86c1c7340c9262116
SHA1: bf53f38fa954f4b8d53c638f84b1c265e467441d
SHA256: d8314c701b2197cf610652f662f58e35af03cb6ebc86d9e1e7450ac1f2918d8c
Import Hash : 72c4e339b7af8ab1ed2eb3821c98713a
Sections 6 .text .rdata .data .pdata .rsrc .reloc
Directories 4 import resource debug relocation

File features detected

Is DLL
Packers
Anti Debug
Anti VM
Signed
XOR

OSINT Enrichments

URLs, FQDN and IP indicators 1

URL Host (FQDN/IP) Date Added
hXXps://cdn.discordapp.com/attachments/1293965296419471462/1294778723018608761/mullakka.exe?ex=670c4027&is=670aeea7&hm=c37458cb8f8dc2985499fcc5dd86600a1dda5f7a724709109a97ae24970f4d65& VirusTotal Report cdn.discordapp.com VirusTotal Report 2024-10-13 20:17:02

PE Sections 1 suspicious

Name VAddress VSize Size SHA1 MD5 Suspicious
.text 0x1000 0x29f00 172032 2d9a342b9cea10af36a9defffc2a2fd763e338be a6c3b829cc8eaabb1a474c227e90407f
.rdata 0x2b000 0x12a50 76800 4d1daea4f0be042ce8584d9496bb308c1b1a70a8 de7d33b6b274bb02c863577c3d519af9
.data 0x3e000 0x53f8 3584 069fd3959f91e690643115a296bf21044144de01 dba0caeecab624a0ccc0d577241601d1
.pdata 0x44000 0x2250 9216 09c2a6d5404bc19e11f7eddad07a164b42b01ee6 181312260a85d10a1454ba38901c499b
.rsrc 0x47000 0xf41c 62976 795dba6bc473080415f0d0547e67f1f6a05b9b71 455788c285fcfdcb4008bc77e762818a
.reloc 0x57000 0x764 2048 d73caf6099972c4407ac22954a7454e922084dc0 816c68eeb419ee2c08656c31c06a0fff

PE Resources 3

Name Language Sublanguage Offset Size Data
RT_ICON LANG_NEUTRAL SUBLANG_NEUTRAL 0x55a3c 1128
RT_GROUP_ICON LANG_NEUTRAL SUBLANG_NEUTRAL 0x55ea4 104
RT_MANIFEST LANG_NEUTRAL SUBLANG_NEUTRAL 0x55f0c 1293

Packers detected 2

Microsoft Visual C++ 8.0 (DLL)
Microsoft Visual C++ 8.0

Anti debug functions 6

GetLastError
IsDebuggerPresent
IsProcessorFeaturePresent
RaiseException
TerminateProcess
UnhandledExceptionFilter

Strings analysis - File found

Compressed
base_library.zip
bbase_library.zip
Library
mscoree.dll
vcruntime140.dll
ADVAPI32.dll
btcl86t.dll
KERNEL32.dll
8python312.dll
COMCTL32.dll
ucrtbase.dll
btk86t.dll
blibcrypto-3.dll
bpython312.dll
USER32.dll
bzlib1.dll
bVCRUNTIME140.dll
GDI32.dll

Strings analysis - Possible IPs found 2

3.0.2.1
3.6.1.5

Strings analysis - Possible URLs found 1

http://schemas.microsoft.com/SMI/2016/WindowsSettings

Import functions

Name Latest seen MD5
discordnitrogen.exe 2024-08-26 11:31:14 2db515aa4c8ba2b4e6878e7e0b550c8f
tac.exe 2024-09-23 16:57:06 8a35be4e0576e642603dc78f07f32a93
Software.exe 2024-09-24 15:24:04 66c1d33fa2373f9f734336b87f123e31
st3amBYluxy.exe?ex=670cd923&is=670b87a3&hm=9d7dba21c2a8ad22d47f3edba77c4617ddfb3d025ff473df74bdf2b60f0c68d1& 2024-10-13 17:33:03 23f733d217275847ffb11bf97827dae8
freenitro.exe?ex=670c1355&is=670ac1d5&hm=fe431b2f20f8cc958563e6e904e1c828290ba1470a54a6f82725608fa4784485& 2024-10-13 19:34:02 8c9efd9a2d9d55aad11203cc4e3c816d
nitrobuyer.exe?ex=670c445a&is=670af2da&hm=1f281fd80c98af4f9fd87d76a7cd35a3e597b77693d1a804430d0000615d585a& 2024-10-13 19:38:03 32554d2f5dcd9927b21b43dda85359c2
FreakyBrowse.exe?ex=670c18f3&is=670ac773&hm=3a26c3c7751649dfe642708c7308021483cb3a3e840a9d7ffd5fdf0ed02746be& 2024-10-13 20:39:02 a2728dfccca75072dd2f6c6a02617ee6
distribution.exe 2024-10-14 12:45:31 2cf67f645897af37ea483ed1aa3b2790
Wahiy_swapper.exe?ex=670e299f&is=670cd81f&hm=d668cc4432184523e29c1a622634c90477a431b1b18691a624773cd7989420a9& 2024-10-14 16:52:04 8e77547b14323977331594025634d90a
worker.exe 2024-10-14 23:10:06 5f08961671234960517cefb9df7a8c41
Rv2_Nuker.exe?ex=670f7931&is=670e27b1&hm=22265025fa8bb5baf986ff9795b8348e2c4fa24d4f6cced287e52fcfb45bf1e7& 2024-10-15 20:10:02 b459e3a71f72a9ac8a725144d56d1168
hydra.exe?ex=670ef165&is=670d9fe5&hm=d1114b65b18c8fc6ac378cf57169ad9d4f23499ced8ea6fe3b1fe96461e38a98& 2024-10-15 20:12:05 d446fa000d260aa78513d383874d82e5
Exela.exe 2024-10-15 21:10:21 83154f0731104f82b198eb13465dfa57