core.zip
- SHA256 fb029e39bbf3947d7931be4dcc28a02050c878d2e8f34534c49587259f191f00
Password
infected
Static task
static1
Behavioral task
behavioral1
Sample
cmd.bat
Resource
win7-20220715-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
cmd.bat
Resource
win10v2004-20220721-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral3
Sample
minute_x64.dll
Resource
win7-20220715-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral4
Sample
minute_x64.dll
Resource
win10v2004-20220721-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral5
Sample
teach-x64.dll
Resource
win7-20220718-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral6
Sample
teach-x64.dll
Resource
win10v2004-20220721-en
windows10-2004-x64
1 signatures
150 seconds
General
- Target core.zip
- Size 960KB
- Sample220725-vd25pabbbr
- SHA256 fb029e39bbf3947d7931be4dcc28a02050c878d2e8f34534c49587259f191f00
- MD5 fddcec4cc389a931f1dde8419708bf0f
- SHA1 73d5aafdb73c21aaafb9423418b86897777f8bea
- SHA512 d3b6c9a6097986bff985a5d04a51f10821b7987a5c57d56a20c1d797d30902e5c31ea853b92fe508c5a10b0a2d67a3a8d5655e6888fc4da7434428ba889f41b8
- SSDEEP 24576:oGcF7cAq2l6ncIJGGY7NuRFItQLW0CZ3xH2rma9a6oAq2l6ncIJGGY7NuRa:oGQq2l6ndJGGY7NuRFItcWThunq2l6ns
- MD5 SHA1 SHA512 SSDEEP
Score
N/A
Malware Config
Signatures
File Explorer
-
core.zip.zip 960KB
-
cmd.bat186B
-
license.dat334KB
-
minute_x64.dat.dll 312KB
-
teach-x64.dat.dll 313KB
cmd.bat
- SHA256 52c0668bcfb04f64e27200554413f0e8b46f24782bfbbf61ef202d7a45577010
- MD5 31a5126fa2f08ad99c65545649e9e40f
- SHA1 2bdb65324cf44411ae837c7782a8d7a3efb5d3cf
- SHA512 46ee74cd9b7849b15fb3f6119e27f819bb944d49867cca4dc1d738d16cf36895a403300c2b937c5ff99d80e829d38a496506705e30612468ce262b11df352504
- MD5 SHA1 SHA512
license.dat
- SHA256 1de8b101cf9f0fabc9f086bddb662c89d92c903c5db107910b3898537d4aa8e7
- MD5 d79b38f4eeec42a014c9337f48ba3f2b
- SHA1 287f00b634c2d24a9731ebb52c4d1c1067abf864
- SHA512 32fa3bb6ab5c0ea1585fedcfbbfd803a394a5d792a90e4b7794b1234c40af19f2d3339b3e7253eb0b4e4256e024289d72f97af25587cced704a41a2ef3b5b5ad
- SSDEEP 6144:yOanrw8uZ+iZN1CCtDRiDwqIC5QpzXEYbvC2NFnIuJxCJiSRNDTdsHB2eT:yOkw8R5CtDMEuW0UvC23nIuJx2iKpu
- MD5 SHA1 SHA512 SSDEEP
minute_x64.dat
- IMPHASH 3628171fbbc6ca15bbd661fecbe7411d
- SHA256 c15d6721460460d177b7e68f4b991b0b8b17ded6bd098399c76c87b0982b7ca1
- MD5 d0c13e99f8b74352cdb845aa3a72fd52
- SHA1 2b44c301d4567a9d631ec19f38e349b424eaa850
- SHA512 799152ed8a9fd050877631ec9e99c4bd8eb42ef96845234411f27c48aac106668974370677b2d64650300393ea9ac46c708e08309c6ff1730cf5e7904f99253f
- SSDEEP 6144:fGAT94ZoFEqj7czcq2l6ncjhqrJGGY7NuR:fGy9JF7czcq2l6ncIJGGY7NuR
- MD5 SHA1 SHA512 SSDEEP
Password
infected
Minor OS version
Major OS version
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
user32
CheckMenuRadioItem
GetTabbedTextExtentA
gdi32
GetCharWidthA
GetSystemPaletteUse
GetEnhMetaFileW
usp10
ScriptTextOut
ScriptGetFontAlternateGlyphs
ScriptRecordDigitSubstitution
rasapi32
RasEnumEntriesA
RasSetEntryPropertiesA
RasCreatePhonebookEntryA
RasCreatePhonebookEntryW
AIaNYUFfUoP
CJjqvagyU
DhxWww
Ghbasfjknbyhjajkas
JGRKKkjZCM
NCIuyg
NEHVcBIkeIV
PgiLSR
UfKzAPmSDtz
ZIPRfDLffVg
bpqKCGRhxg
fBFhclARG
iNafRraEErl
lIekDNLSR
pfKTAMMrBTN
tWhcuqfvi
ylxPqUBk
zHfPRRwMqT
Name
.text
Size
45KB
Virtual Size
44KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
pht
Size
19KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
cdr
Size
245KB
Virtual Size
245KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
teach-x64.dat
- IMPHASH f913e789b8d3f5c23291bdf8b0f70218
- SHA256 5a95cacaac143486a7330700a717c645f297bc007d0c4c054deb41ff6273669b
- MD5 40d316a38ba7f843b2c9e1b0948b4f1f
- SHA1 9c6491e6b64d5fe22322989b348227a37e68ff88
- SHA512 7d9e55e2cd9fc5fef1940f39f51d801e47386234e0c311b59bb5b833b67dce110a05e8ca56cda1277522c9974a6c9f014d42edcbf5f386a5d3ff0c2baa536a96
- SSDEEP 3072:p5VCNnEJVW8Q9+vbXD6OCS8aU80K2miQ44sNJN71Pxszcq2l6ncjhq575T/NGGYQ:t3q9aF4pN/wzcq2l6ncjhqrJGGY7NuR
- MD5 SHA1 SHA512 SSDEEP
Password
infected
Minor OS version
Major OS version
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
usp10
ScriptStringOut
ScriptItemize
msvfw32
DrawDibRealize
ord2
rasapi32
RasSetAutodialParamA
RasDeleteSubEntryW
RasGetErrorStringW
RasGetConnectStatusA
RasSetEntryPropertiesA
RasEditPhonebookEntryA
RasGetEntryPropertiesA
RasValidateEntryNameA
BFsKVq
BgGEPS
FvhnrhEFV
Ghnjhbdagbhiasdlksa
NAnZKEv
OAWhhnRKAFJ
RQFOlA
VGgPzNohm
XcLijZZwb
aLZAYMZvQ
kdxbGhd
koXFTir
pycgUFtyBbh
qSwkiQtRql
qzexCgkW
smLuMrTKMnH
teaDgK
xchzlmKDhyq
Name
.text
Size
46KB
Virtual Size
45KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
pht
Size
19KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
cdr
Size
245KB
Virtual Size
245KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE