svcready | 7938116178[.]zip

General

Target
7938116178.zip
Size 425KB
Sample220906-rpte5secc5
SHA256 9a023260b3534ed87d0a5cf9860a48327d53fdb9cc052a7fee7e7fcf363a59dd
MD5 a27827ff2edf4b9306fdd3e391c5b6d4
SHA1 72c9753d7baa9b589295b0eea5cd59260b4a3097
SHA512 7155435c3e5cdd600ac9e960b7fd55d13b45eb1a8534bebfc9931de37252f5b110a61cd8c47a9050e347e4d617887a36f1ddb8b6a89d2d14adfa5e05e9e57118
SSDEEP 12288:PWgyyEPGAP/MbEtACJhTk7gycI5MO7YEfLZE0GFigGv7nS:PWgyyEZ/MbE2+G0zI7YoG8gGv7nS
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

svcready

Malware Config

Signatures

Detects SVCReady loader 1 IoCs

resource	yara_rule
static1/unpack001/b9bf1da1f7f1393bf0cd52d114695948966cca6d96ba7ea75ef93dea869b1c48	family_svcready

Svcready family
svcready

File Explorer

7938116178.zip

.zip 425KB
b9bf1da1f7f1393bf0cd52d114695948966cca6d96ba7ea75ef93dea869b1c48

.dll 580KB

7938116178.zip

SHA256 9a023260b3534ed87d0a5cf9860a48327d53fdb9cc052a7fee7e7fcf363a59dd
MD5 a27827ff2edf4b9306fdd3e391c5b6d4
SHA1 72c9753d7baa9b589295b0eea5cd59260b4a3097
SHA512 7155435c3e5cdd600ac9e960b7fd55d13b45eb1a8534bebfc9931de37252f5b110a61cd8c47a9050e347e4d617887a36f1ddb8b6a89d2d14adfa5e05e9e57118
SSDEEP 12288:PWgyyEPGAP/MbEtACJhTk7gycI5MO7YEfLZE0GFigGv7nS:PWgyyEZ/MbE2+G0zI7YoG8gGv7nS
MD5 SHA1 SHA512 SSDEEP

Password

infected

b9bf1da1f7f1393bf0cd52d114695948966cca6d96ba7ea75ef93dea869b1c48

IMPHASH 4661689ad648304cfad7c2267b96734a
SHA256 b9bf1da1f7f1393bf0cd52d114695948966cca6d96ba7ea75ef93dea869b1c48
MD5 4996d66bbab56a876179ee55dde4fc7e
SHA1 290925abbd06a5c78b7250fee1cc21ca7bbab547
SHA512 315bb61bd78f31441e4184daf6fac4cf347604c3d2da54776ffce52a893e1f3cc7484f667eeb1afe01380713749b273776c72cc9cf8bddc50b7d03bf7997d719
SSDEEP 12288:I+hod2fxvHcQhUwUSCfZBmAZgTWkUJXzh7f6H:I+hrv8Q0S2ZBX1kUJF7f6
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows x86

Detects SVCReady loader

Minor OS version

Major OS version

Entry point

4560

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

LocalFree GetFileSize ExitProcess WriteFile MultiByteToWideChar GetModuleHandleExA GetModuleHandleW WideCharToMultiByte FormatMessageA UnmapViewOfFile CreateFileMappingA MapViewOfFile VirtualFree VirtualAlloc FreeLibrary GetProcAddress IsBadReadPtr VirtualProtectEx HeapSize WriteConsoleW SetStdHandle GetProcessHeap FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetOEMCP IsValidCodePage FindNextFileA FindFirstFileExA FindClose SetFilePointerEx ReadConsoleW GetConsoleMode GetConsoleCP FlushFileBuffers EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocalTime CreateThread CloseHandle CreateFileA GetLastError Sleep GetCommandLineA GetModuleHandleA LocalAlloc WaitForSingleObject SetFilePointer OutputDebugStringA SetLastError GetFileType GetStdHandle GetACP GetModuleFileNameA GetModuleHandleExW CreateFileW ReadFile LoadLibraryExW RaiseException InterlockedFlushSList EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount SwitchToThread TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime EncodePointer DecodePointer LCMapStringW GetLocaleInfoW GetStringTypeW GetCPInfo InitializeSListHead IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetCurrentProcess TerminateProcess HeapAlloc HeapReAlloc HeapFree RtlUnwind

user32

KillTimer UpdateWindow GetCursorPos wsprintfA EndPaint GetMessageA DispatchMessageA LoadCursorA FillRect CreateWindowExW RegisterClassExW LoadStringW GetClientRect ShowWindow GetAsyncKeyState TranslateAcceleratorA SetTimer LoadAcceleratorsA DefWindowProcA SetLayeredWindowAttributes TranslateMessage SendMessageA LoadIconA BeginPaint

gdi32

Ellipse GetStockObject SelectObject

Sharing