Static task
static1
Behavioral task
behavioral1
Sample
f234b6d1801e1d4105de18a74ecd99f64cbdd7c47d6079bb2994d38ed7b0de44.exe
Resource
win7-en-20211208
General
-
Target
f234b6d1801e1d4105de18a74ecd99f64cbdd7c47d6079bb2994d38ed7b0de44.bin
-
Size
120KB
-
MD5
b3fc46850b5a965b6c042fdb9b8a928d
-
SHA1
48de02bb71a3434675d767114692c2741e374fd9
-
SHA256
f234b6d1801e1d4105de18a74ecd99f64cbdd7c47d6079bb2994d38ed7b0de44
-
SHA512
905cb59bd5d0e0f7d523e50c16b804c23d000d6d501b84abecc13e2d79f40879f9e4455dd969e25d33cc493d041b985cebccaa332704839f2170459539c8d7ee
-
SSDEEP
3072:A5vUIjgiKb54RAYC5B5mAwCEOaIx91R6CW454DOeMxSXc:AdRgvb5wAN5mAFaIaRMxSX
Malware Config
Extracted
allcome
http://dba692117be7b6d3480fe5220fdd58b38bf.xyz/exp.php?usr=ssska
rGWRCDTnxm6PbeTquXpfGaJUCdJPQa9YCU
THd43QUSXYv3uuHuvg1TtnDx1LZghcxoEW
GCQ3W4M3FC7JQ7XS5QVUFJATPPRP7XOBJOBCQLQVHG5WHISN4HKJRZZG
47hVDokEdB8HbH7eKR7DLgeDXm7m6q3JmWRzBAgNq5jHEZecWrdzp1sTE1EXRU5rAj2roRSYnzvTxaxq4nDdVdGdTQAsH1y
qq6qmn7hewgsnesl2xjh7vjqf2cg2ysdhusx5jjygs
bc1qqpuu63gd8v87yvkjw6zgwr7u5plx5hs5z4khje
0xfaCC30908F531Badecb2e8B21E182520484Fb66B
Ldh6yphmCg3gLkigDchATQN9Wbj7K6Zdzy
Signatures
-
Allcome family
Files
-
f234b6d1801e1d4105de18a74ecd99f64cbdd7c47d6079bb2994d38ed7b0de44.bin.exe windows x86
277bb5bca79f7661398975c7af5ce7ba
Code Sign
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GlobalAlloc
GlobalFree
GlobalLock
GlobalUnlock
GetModuleFileNameA
CopyFileA
SetFileAttributesA
CreateDirectoryA
CreateMutexA
WaitForSingleObject
GetModuleHandleA
Sleep
MultiByteToWideChar
CreateFileW
DecodePointer
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
HeapReAlloc
HeapSize
SetFilePointerEx
GetProcessHeap
GetStringTypeW
SetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
WideCharToMultiByte
GetCommandLineW
GetCommandLineA
GetCPInfo
GetOEMCP
GetACP
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
QueryPerformanceFrequency
CloseHandle
WaitForSingleObjectEx
GetExitCodeThread
InitializeCriticalSectionEx
GetProcAddress
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
RtlUnwind
RaiseException
GetLastError
SetLastError
EncodePointer
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
ExitProcess
GetModuleHandleExW
CreateThread
ExitThread
FreeLibraryAndExitThread
GetStdHandle
WriteFile
GetModuleFileNameW
HeapFree
HeapAlloc
GetFileType
LCMapStringW
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
WriteConsoleW
user32
SetClipboardData
GetClipboardData
EmptyClipboard
CloseClipboard
OpenClipboard
LoadStringA
GetKeyState
shell32
SHGetFolderPathA
ShellExecuteA
wtsapi32
WTSEnumerateProcessesA
WTSFreeMemory
urlmon
IsValidURL
wininet
InternetReadFile
InternetCloseHandle
InternetOpenUrlA
InternetOpenA
shlwapi
PathFindFileNameA
Sections
.text Size: 75KB - Virtual size: 74KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 34KB - Virtual size: 33KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ