Behavioral task
behavioral1
Sample
tmpscsa0hng.exe
Resource
win7-20220718-en
Behavioral task
behavioral2
Sample
tmpscsa0hng.exe
Resource
win10v2004-20220721-en
General
-
Target
tmpscsa0hng
-
Size
392KB
-
MD5
d90d0f4d6dad402b5d025987030cc87c
-
SHA1
fad66bdf5c5dc2c050cbc574832c6995dba086a0
-
SHA256
1ffd6559d21470c40dcf9236da51e5823d7ad58c93502279871c3fe7718c901c
-
SHA512
c2faeacfd588585633630ad710f443a72c7617c2d5e37dbfe43570e6ac5904e4b81eb682356a48a93bb794ef5e9d8ad0d673966d57798079b4de62ea61241024
-
SSDEEP
12288:m00VdXicNHeft0d/BiqpD9JD9lusIhAzhM2RdM:mrzXiu+FZqp72iDc
Malware Config
Signatures
-
Detection for the Linux version of Sysjoker cross-platform backdoor 1 IoCs
Processes:
resource yara_rule sample family_linux_sysjoker -
Detection for the macOS version of Sysjoker cross-platform backdoor 1 IoCs
Processes:
resource yara_rule sample family_macos_sysjoker -
Detection for the windows version of Sysjoker cross-platform backdoor 1 IoCs
Processes:
resource yara_rule sample family_sysjoker -
Sysjoker family
Files
-
tmpscsa0hng.exe windows x86
86f89939b4b0c19157649ce986ae170e
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CreateDirectoryW
SizeofResource
HeapFree
GetModuleFileNameW
InitializeCriticalSectionEx
WaitForSingleObject
HeapSize
MultiByteToWideChar
Sleep
GetLastError
LockResource
DeleteFileW
GlobalFree
HeapReAlloc
RaiseException
FindResourceExW
LoadResource
FindResourceW
HeapAlloc
DecodePointer
HeapDestroy
DeleteCriticalSection
GetProcessHeap
WideCharToMultiByte
SleepEx
WriteConsoleW
CreateFileW
SetStdHandle
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
ReadConsoleW
ReadFile
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetConsoleMode
GetConsoleCP
FlushFileBuffers
GetFileType
SetFilePointerEx
CloseHandle
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
GetModuleHandleW
GetProcAddress
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
EncodePointer
SetLastError
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
CompareStringW
LCMapStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
OutputDebugStringW
RtlUnwind
FreeLibrary
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetStdHandle
WriteFile
GetFileSizeEx
SetEndOfFile
shell32
ShellExecuteW
ShellExecuteExW
ole32
CoCreateInstance
CoUninitialize
CoInitialize
oleaut32
SysAllocStringLen
winhttp
WinHttpGetIEProxyConfigForCurrentUser
WinHttpGetProxyForUrl
WinHttpWriteData
WinHttpReadData
WinHttpSetTimeouts
WinHttpCloseHandle
WinHttpCrackUrl
WinHttpQueryDataAvailable
WinHttpQueryHeaders
WinHttpAddRequestHeaders
WinHttpOpen
WinHttpSetOption
WinHttpConnect
WinHttpReceiveResponse
WinHttpOpenRequest
WinHttpSendRequest
Sections
.text Size: 291KB - Virtual size: 291KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 80KB - Virtual size: 79KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 952B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 14KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ