26215bc56dc31d2466d72f1f4e1b6388e62606e9949bc41c28968fcb9a9d60a6

General

Target
26215bc56dc31d2466d72f1f4e1b6388e62606e9949bc41c28968fcb9a9d60a6
Size 55KB
Sample220129-2kfzcsbcg4
SHA256 26215bc56dc31d2466d72f1f4e1b6388e62606e9949bc41c28968fcb9a9d60a6
MD5 74de13b5ea68b3da24addc009f84baee
SHA1 26e787997a338d8111d96c9a4c103cf8ff0201ce
SHA512 370c9e89fd9a031a1e654aca710be97c590d1e6b9e7126f0f6dc4c17c75c8b0d2da117b17264155c1443a81cea5baabd7dcb41d727015cbcfcd3ba6cd756c572
SSDEEP 768:ZhKIHl+sT4u0igKAsjdTBJcSROgzLayozgU3ppiD+FPHcLHXkW9FELwUqQ/o:LhJsu0itszld5mBU1q
MD5 SHA1 SHA512 SSDEEP

Score

N/A

Malware Config

Signatures

File Explorer

26215bc56dc31d2466d72f1f4e1b6388e62606e9949bc41c28968fcb9a9d60a6

.exe 55KB

26215bc56dc31d2466d72f1f4e1b6388e62606e9949bc41c28968fcb9a9d60a6

IMPHASH 9ab142abb692f6df617e0254f1c41663
SHA256 26215bc56dc31d2466d72f1f4e1b6388e62606e9949bc41c28968fcb9a9d60a6
MD5 74de13b5ea68b3da24addc009f84baee
SHA1 26e787997a338d8111d96c9a4c103cf8ff0201ce
SHA512 370c9e89fd9a031a1e654aca710be97c590d1e6b9e7126f0f6dc4c17c75c8b0d2da117b17264155c1443a81cea5baabd7dcb41d727015cbcfcd3ba6cd756c572
SSDEEP 768:ZhKIHl+sT4u0igKAsjdTBJcSROgzLayozgU3ppiD+FPHcLHXkW9FELwUqQ/o:LhJsu0itszld5mBU1q
MD5 SHA1 SHA512 SSDEEP

windows x86

Minor OS version

Major OS version

Entry point

18150

Magic Number

267

Subsystem

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

ntoskrnl.exe

ExfInterlockedInsertTailList ExfInterlockedInsertHeadList ExfInterlockedRemoveHeadList PsGetVersion ZwQueryValueKey ZwOpenKey KeWaitForSingleObject InterlockedExchange InterlockedCompareExchange ExQueueWorkItem IoFreeMdl IoBuildPartialMdl MmBuildMdlForNonPagedPool IoAllocateMdl PsCreateSystemThread KeWaitForMultipleObjects PsTerminateSystemThread RtlAppendUnicodeStringToString RtlCopyUnicodeString memmove ZwCreateKey ZwDeleteKey ZwEnumerateKey ZwQueryKey ZwSetValueKey RtlUnwind MmMapLockedPagesSpecifyCache InterlockedDecrement InterlockedIncrement swprintf ObReferenceObjectByHandle ObfDereferenceObject IoDeleteSymbolicLink IofCompleteRequest IoCreateDevice IoDeleteDevice ZwClose ExAllocatePool wcslen RtlAnsiStringToUnicodeString RtlCompareUnicodeString RtlFreeUnicodeString RtlInitAnsiString RtlUnicodeStringToAnsiString RtlFreeAnsiString strncpy KeInitializeSpinLock RtlDeleteRegistryValue _strnicmp ZwQuerySystemInformation NtBuildNumber PsInitialSystemProcess ZwQueryInformationProcess ZwOpenProcess PsLookupProcessByProcessId strchr strrchr MmIsAddressValid KeDetachProcess ZwFreeVirtualMemory ZwAllocateVirtualMemory KeAttachProcess KeDelayExecutionThread KeInsertQueueApc KeInitializeApc ZwCreateFile _snwprintf ZwFsControlFile ZwQueryInformationFile ZwWriteFile RtlConvertUlongToLargeInteger KeTickCount ZwQueryVolumeInformationFile RtlRandom ZwSetInformationFile KeReleaseSemaphore MmUnlockPages MmUnmapLockedPages KeInitializeEvent KeInitializeSemaphore MmProbeAndLockPages KeQuerySystemTime ExAllocatePoolWithTag RtlInitUnicodeString ExFreePool

hal

KeQueryPerformanceCounter ExAcquireFastMutex ExReleaseFastMutex KfAcquireSpinLock KfReleaseSpinLock

ndis.sys

NdisFreePacket NdisAllocateBufferPool NdisAllocatePacketPool NdisFreeBufferPool NdisCloseAdapter NdisAllocatePacket NdisOpenAdapter NdisWaitEvent NdisDeregisterProtocol NdisInitializeEvent NdisResetEvent NdisSetEvent NdisRegisterProtocol NdisAllocateBuffer NdisUnchainBufferAtFront NdisFreePacketPool

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

26215bc56dc31d2466d72f1f4e1b6388e62606e9949bc41c28968fcb9a9d60a6

ntoskrnl.exe

hal

ndis.sys