Static task
static1
Behavioral task
behavioral1
Sample
d62c1f65b0ad9427fa41e32951526435e372d2f09bb81e6079dabdad915f84b4.exe
Resource
win7-en-20211208
General
-
Target
d62c1f65b0ad9427fa41e32951526435e372d2f09bb81e6079dabdad915f84b4.bin
-
Size
120KB
-
MD5
e5d69699bde3b15ff93d21c5b673bd8a
-
SHA1
7407968eb3d942ebabee4b432df4c4a9ac96c3e3
-
SHA256
d62c1f65b0ad9427fa41e32951526435e372d2f09bb81e6079dabdad915f84b4
-
SHA512
46312be3e25e994e56e92869ea93a2452a149d0c04fb9067f13412f5d5f527597ec1c62a2c682d93a6d84f8b9065c21713177056f6853427853bdf9aa4038121
-
SSDEEP
3072:A5vUIjgiKb54RAYC5B5mAwCEOaIx91R6CW454DOeMxSXc:AdRgvb5wAN5mAFaIaRMxSX
Malware Config
Extracted
allcome
http://dba692117be7b6d3480fe5220fdd58b38bf.xyz/exp.php?usr=Class1c228
D92TTxkBTyJfavHWmAJfHpZRLeUY9ReHvf
rEtKYAu1Pwa9ydAB9YfXrTgVTtwB7QAghY
0x4aab8F9FFFE07459b1365A10405a4Fe7Aa7F1f81
XeZnNrJyBV3NimCP61bnJK8EYEqe984rn8
t1Vrj6CU9hHRwiuoSWDhgwtRhmPxRu9MqXs
GBEARLBYJHWXMY7AFAGF7VGMRMRK2D5HSRADSABSPMRIW6XPDQBRQSMI
0x43B091611E359447bAC8b2aE1619424A8417De38
qqvqg5fjmjjkd6egvwxv5et63jpakdqvuq3ye335x0
bc1qrzlvgv39ynr32vzacpg8y4y4yklmr370sxwqj3
0x4aab8F9FFFE07459b1365A10405a4Fe7Aa7F1f81
ltc1qef2n5uu37e34nvtrfhnurdj9lc574h90grpa0e
380990138409
Signatures
-
Allcome family
Files
-
d62c1f65b0ad9427fa41e32951526435e372d2f09bb81e6079dabdad915f84b4.bin.exe windows x86
277bb5bca79f7661398975c7af5ce7ba
Code Sign
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GlobalAlloc
GlobalFree
GlobalLock
GlobalUnlock
GetModuleFileNameA
CopyFileA
SetFileAttributesA
CreateDirectoryA
CreateMutexA
WaitForSingleObject
GetModuleHandleA
Sleep
MultiByteToWideChar
CreateFileW
DecodePointer
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
HeapReAlloc
HeapSize
SetFilePointerEx
GetProcessHeap
GetStringTypeW
SetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
WideCharToMultiByte
GetCommandLineW
GetCommandLineA
GetCPInfo
GetOEMCP
GetACP
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
QueryPerformanceFrequency
CloseHandle
WaitForSingleObjectEx
GetExitCodeThread
InitializeCriticalSectionEx
GetProcAddress
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
RtlUnwind
RaiseException
GetLastError
SetLastError
EncodePointer
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
ExitProcess
GetModuleHandleExW
CreateThread
ExitThread
FreeLibraryAndExitThread
GetStdHandle
WriteFile
GetModuleFileNameW
HeapFree
HeapAlloc
GetFileType
LCMapStringW
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
WriteConsoleW
user32
SetClipboardData
GetClipboardData
EmptyClipboard
CloseClipboard
OpenClipboard
LoadStringA
GetKeyState
shell32
SHGetFolderPathA
ShellExecuteA
wtsapi32
WTSEnumerateProcessesA
WTSFreeMemory
urlmon
IsValidURL
wininet
InternetReadFile
InternetCloseHandle
InternetOpenUrlA
InternetOpenA
shlwapi
PathFindFileNameA
Sections
.text Size: 75KB - Virtual size: 74KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 34KB - Virtual size: 33KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ