Overview
overview
9Static
static
Signalis/D...l3.dll
windows10-2004_x64
9Signalis/D...ue.dll
windows10-2004_x64
3Signalis/D...40.dll
windows10-2004_x64
3Signalis/DLC/nss3.dll
windows10-2004_x64
3Signalis/D...n3.dll
windows10-2004_x64
3Signalis/D...e3.dll
windows10-2004_x64
3Signalis/D...40.dll
windows10-2004_x64
3Signalis/Signalis.exe
windows10-2004_x64
8General
-
Target
SIGNALIS.rar
-
Size
70.8MB
-
Sample
220305-p7489aabej
-
MD5
07839d6984995c8848b9144e60befd3a
-
SHA1
144a9dce126e8ead62ca0e46922b2b7f95aa88ac
-
SHA256
f422d28bbfd249b233299b1e98706816d23029424646a5f7e8d8ad0e37db76b2
-
SHA512
11e1030e692af7297322695c96ccaf1e5792d740cad61c5c254bdee5a551c11a7c19da384998eba4b08021d0c4adb7933826b836c6ac465f9acedd40cd64d0f3
Static task
static1
Behavioral task
behavioral1
Sample
Signalis/DLC/freebl3.dll
Resource
win10v2004-en-20220113
Behavioral task
behavioral2
Sample
Signalis/DLC/mozglue.dll
Resource
win10v2004-en-20220112
Behavioral task
behavioral3
Sample
Signalis/DLC/msvcp140.dll
Resource
win10v2004-en-20220113
Behavioral task
behavioral4
Sample
Signalis/DLC/nss3.dll
Resource
win10v2004-en-20220112
Behavioral task
behavioral5
Sample
Signalis/DLC/softokn3.dll
Resource
win10v2004-en-20220113
Behavioral task
behavioral6
Sample
Signalis/DLC/sqlite3.dll
Resource
win10v2004-en-20220112
Behavioral task
behavioral7
Sample
Signalis/DLC/vcruntime140.dll
Resource
win10v2004-en-20220113
Behavioral task
behavioral8
Sample
Signalis/Signalis.exe
Resource
win10v2004-en-20220113
Malware Config
Targets
-
-
Target
Signalis/DLC/freebl3.dll
-
Size
326KB
-
MD5
ef2834ac4ee7d6724f255beaf527e635
-
SHA1
5be8c1e73a21b49f353c2ecfa4108e43a883cb7b
-
SHA256
a770ecba3b08bbabd0a567fc978e50615f8b346709f8eb3cfacf3faab24090ba
-
SHA512
c6ea0e4347cbd7ef5e80ae8c0afdca20ea23ac2bdd963361dfaf562a9aed58dcbc43f89dd826692a064d76c3f4b3e92361af7b79a6d16a75d9951591ae3544d2
-
Checks for common network interception software
Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Modifies Windows Firewall
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
-
-
Target
Signalis/DLC/mozglue.dll
-
Size
133KB
-
MD5
8f73c08a9660691143661bf7332c3c27
-
SHA1
37fa65dd737c50fda710fdbde89e51374d0c204a
-
SHA256
3fe6b1c54b8cf28f571e0c5d6636b4069a8ab00b4f11dd842cfec00691d0c9cd
-
SHA512
0042ecf9b3571bb5eba2de893e8b2371df18f7c5a589f52ee66e4bfbaa15a5b8b7cc6a155792aaa8988528c27196896d5e82e1751c998bacea0d92395f66ad89
Score3/10 -
-
-
Target
Signalis/DLC/msvcp140.dll
-
Size
429KB
-
MD5
109f0f02fd37c84bfc7508d4227d7ed5
-
SHA1
ef7420141bb15ac334d3964082361a460bfdb975
-
SHA256
334e69ac9367f708ce601a6f490ff227d6c20636da5222f148b25831d22e13d4
-
SHA512
46eb62b65817365c249b48863d894b4669e20fcb3992e747cd5c9fdd57968e1b2cf7418d1c9340a89865eadda362b8db51947eb4427412eb83b35994f932fd39
Score3/10 -
-
-
Target
Signalis/DLC/nss3.dll
-
Size
1.2MB
-
MD5
bfac4e3c5908856ba17d41edcd455a51
-
SHA1
8eec7e888767aa9e4cca8ff246eb2aacb9170428
-
SHA256
e2935b5b28550d47dc971f456d6961f20d1633b4892998750140e0eaa9ae9d78
-
SHA512
2565bab776c4d732ffb1f9b415992a4c65b81bcd644a9a1df1333a269e322925fc1df4f76913463296efd7c88ef194c3056de2f1ca1357d7b5fe5ff0da877a66
Score3/10 -
-
-
Target
Signalis/DLC/softokn3.dll
-
Size
141KB
-
MD5
a2ee53de9167bf0d6c019303b7ca84e5
-
SHA1
2a3c737fa1157e8483815e98b666408a18c0db42
-
SHA256
43536adef2ddcc811c28d35fa6ce3031029a2424ad393989db36169ff2995083
-
SHA512
45b56432244f86321fa88fbcca6a0d2a2f7f4e0648c1d7d7b1866adc9daa5eddd9f6bb73662149f279c9ab60930dad1113c8337cb5e6ec9eed5048322f65f7d8
Score3/10 -
-
-
Target
Signalis/DLC/sqlite3.dll
-
Size
630KB
-
MD5
e477a96c8f2b18d6b5c27bde49c990bf
-
SHA1
e980c9bf41330d1e5bd04556db4646a0210f7409
-
SHA256
16574f51785b0e2fc29c2c61477eb47bb39f714829999511dc8952b43ab17660
-
SHA512
335a86268e7c0e568b1c30981ec644e6cd332e66f96d2551b58a82515316693c1859d87b4f4b7310cf1ac386cee671580fdd999c3bcb23acf2c2282c01c8798c
Score3/10 -
-
-
Target
Signalis/DLC/vcruntime140.dll
-
Size
81KB
-
MD5
7587bf9cb4147022cd5681b015183046
-
SHA1
f2106306a8f6f0da5afb7fc765cfa0757ad5a628
-
SHA256
c40bb03199a2054dabfc7a8e01d6098e91de7193619effbd0f142a7bf031c14d
-
SHA512
0b63e4979846ceba1b1ed8470432ea6aa18cca66b5f5322d17b14bc0dfa4b2ee09ca300a016e16a01db5123e4e022820698f46d9bad1078bd24675b4b181e91f
Score3/10 -
-
-
Target
Signalis/Signalis.exe
-
Size
69.8MB
-
MD5
33bd053094b7591ca9ae11aa8dd7b8a4
-
SHA1
4b72562246dd98ff3d592bd0a837ce56a06f3dce
-
SHA256
1aa24aaa3e192b52553a16d16cffdb34ca1c30c7ace18f8e4195afaeec738997
-
SHA512
860fa50cc5c62b3c93b7dbabe1d216dbe28bf874887c957181beae61f22716a81f3ec0924fa456ba84a51abb5f083d6cd803fa4bfb1244c87e6e97a889174d68
Score8/10-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-