Static task
static1
Behavioral task
behavioral1
Sample
d496f178f6400d703c1bc434b7694369d94c68a5756f811bb5ded09ff78b1158.exe
Resource
win7-en-20211208
General
-
Target
d496f178f6400d703c1bc434b7694369d94c68a5756f811bb5ded09ff78b1158.bin
-
Size
120KB
-
MD5
031d9264f4c5fb68ab00e9b820a5a869
-
SHA1
268c830c713756bd60a33f765f49e6207ab3d2e5
-
SHA256
d496f178f6400d703c1bc434b7694369d94c68a5756f811bb5ded09ff78b1158
-
SHA512
0bce0870090603f68c7f5e5902accaaf1b79afc5d13d983ac28881a3f4ce268fb3ea50594609333de96801b0400f8bea4cae25d8c9b2f364b55d8b06d2bc4c72
-
SSDEEP
3072:M5vUIjgiKb54RAYC5B5mAwCEOaIx91R6CW454DOeMpSXc:MdRgvb5wAN5mAFaIaRMpSX
Malware Config
Extracted
allcome
http://dba692117be7b6d3480fe5220fdd58b38bf.xyz/exp.php?usr=Rachel
DCbpjBAroXBj3jrvq8HRPAKd8wYPnBwwi7
rKewCaU4Q6gqJnb5nJqkDY69QoxHKXAJZi
Xiem2Rw5LULbzv6rM49FqKAKD1nHSxpjxb
TZ3Pn82NBECik8ujtc3Wu5AVsQLCdt7cG1
t1Pxn7QZPAVhrsd2cdPHDEjDR1jtwpoUvbT
GDKPOPZWADWVDB2B743X7Q5QIMXIFJTIJ3K3JTR5P2EKO22GJQRAZRKC
497qdSyfY8t9dYnAGTnk8UigUbUPL4MXTFAxobWPDZ5rReSiVNL22GEGt9ptgNbDbTe3qyj3oRq2LfEYbws8yGqnSjBWHR6
qra53qtr5kvaye7gvf5algrre5h0w6harqxluum6kp
bc1q79xgc502sqzt4qz0jhr7lr7qdxkf2z006gym0l
0x9bd5f03363CA0231A32b3B36ae2cf01623E2D1fE
LcPqsR8yyzukNBgoKrq3pKEXV4rpuMeF91
ronin:09864801afc2b70c960366f4c8ad806fe9d6965d
Signatures
-
Allcome family
Files
-
d496f178f6400d703c1bc434b7694369d94c68a5756f811bb5ded09ff78b1158.bin.exe windows x86
277bb5bca79f7661398975c7af5ce7ba
Code Sign
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GlobalAlloc
GlobalFree
GlobalLock
GlobalUnlock
GetModuleFileNameA
CopyFileA
SetFileAttributesA
CreateDirectoryA
CreateMutexA
WaitForSingleObject
GetModuleHandleA
Sleep
MultiByteToWideChar
CreateFileW
DecodePointer
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
HeapReAlloc
HeapSize
SetFilePointerEx
GetProcessHeap
GetStringTypeW
SetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
WideCharToMultiByte
GetCommandLineW
GetCommandLineA
GetCPInfo
GetOEMCP
GetACP
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
QueryPerformanceFrequency
CloseHandle
WaitForSingleObjectEx
GetExitCodeThread
InitializeCriticalSectionEx
GetProcAddress
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
RtlUnwind
RaiseException
GetLastError
SetLastError
EncodePointer
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
ExitProcess
GetModuleHandleExW
CreateThread
ExitThread
FreeLibraryAndExitThread
GetStdHandle
WriteFile
GetModuleFileNameW
HeapFree
HeapAlloc
GetFileType
LCMapStringW
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
WriteConsoleW
user32
SetClipboardData
GetClipboardData
EmptyClipboard
CloseClipboard
OpenClipboard
LoadStringA
GetKeyState
shell32
SHGetFolderPathA
ShellExecuteA
wtsapi32
WTSEnumerateProcessesA
WTSFreeMemory
urlmon
IsValidURL
wininet
InternetReadFile
InternetCloseHandle
InternetOpenUrlA
InternetOpenA
shlwapi
PathFindFileNameA
Sections
.text Size: 75KB - Virtual size: 74KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 34KB - Virtual size: 33KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ