Static task
static1
Behavioral task
behavioral1
Sample
fb2aef6ff28eda5f75ec0c5c330251303587b6bccdec299042b0c922b490d11a.exe
Resource
win7-en-20211208
General
-
Target
fb2aef6ff28eda5f75ec0c5c330251303587b6bccdec299042b0c922b490d11a.bin
-
Size
120KB
-
MD5
8950fcf3617883788286cc40cc8665f5
-
SHA1
b169be225703daefcf7d236893ae55b5cc774dbd
-
SHA256
fb2aef6ff28eda5f75ec0c5c330251303587b6bccdec299042b0c922b490d11a
-
SHA512
ecbbce4372a7f597f9f2497160e05e61c8ebd7f44d528297f7d151d56a9a27c7faa9f3fdf7afab45c9b67fa02afe108cf5891a3061c2eba4647d931b1a2b5cb3
-
SSDEEP
3072:w5vUIjgiKb54RAYC5B5mAwCEOaIx91R6CW454DOeM8SXc:wdRgvb5wAN5mAFaIaRM8SX
Malware Config
Extracted
allcome
http://dba692117be7b6d3480fe5220fdd58b38bf.xyz/exp.php?usr=infected
DJTEj1dHbvRbzRMFswkBbEoVtYyDX4utrm
r9ZdXujmStGh4xJ45FXAYiz6vLeF12ft4H
GBPA3M5TJHPBUY33MFFNTSFHGQEV27P2SP7NCGK5ZZXINCNMXFYO4C5L
48J7NrfRFCPFfwyHaywQUSKuyn56or1kRByicvx2ZCFMRboGDmvxH9y4kQz6T2Hhv8AREnZE4dS43JoVcrkc4kShNTkXbv8
qp4cn8t095hphpy6qraafmtsfskjnnxevcvvug8e87
bc1q2phs6h42kfecv9eu2vm9qjspmtw8w0256eg8cc
0x7942b7173F1557F285666009006Bff1AEe1339B3
LdCE37gd4AgqxAyjMjc4NYdZNT2nn1qpen
Signatures
-
Allcome family
Files
-
fb2aef6ff28eda5f75ec0c5c330251303587b6bccdec299042b0c922b490d11a.bin.exe windows x86
277bb5bca79f7661398975c7af5ce7ba
Code Sign
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GlobalAlloc
GlobalFree
GlobalLock
GlobalUnlock
GetModuleFileNameA
CopyFileA
SetFileAttributesA
CreateDirectoryA
CreateMutexA
WaitForSingleObject
GetModuleHandleA
Sleep
MultiByteToWideChar
CreateFileW
DecodePointer
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
HeapReAlloc
HeapSize
SetFilePointerEx
GetProcessHeap
GetStringTypeW
SetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
WideCharToMultiByte
GetCommandLineW
GetCommandLineA
GetCPInfo
GetOEMCP
GetACP
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
QueryPerformanceFrequency
CloseHandle
WaitForSingleObjectEx
GetExitCodeThread
InitializeCriticalSectionEx
GetProcAddress
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
RtlUnwind
RaiseException
GetLastError
SetLastError
EncodePointer
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
ExitProcess
GetModuleHandleExW
CreateThread
ExitThread
FreeLibraryAndExitThread
GetStdHandle
WriteFile
GetModuleFileNameW
HeapFree
HeapAlloc
GetFileType
LCMapStringW
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
WriteConsoleW
user32
SetClipboardData
GetClipboardData
EmptyClipboard
CloseClipboard
OpenClipboard
LoadStringA
GetKeyState
shell32
SHGetFolderPathA
ShellExecuteA
wtsapi32
WTSEnumerateProcessesA
WTSFreeMemory
urlmon
IsValidURL
wininet
InternetReadFile
InternetCloseHandle
InternetOpenUrlA
InternetOpenA
shlwapi
PathFindFileNameA
Sections
.text Size: 75KB - Virtual size: 74KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 34KB - Virtual size: 33KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ