targetcompany | 2009bfc16bdd591b2bacd8a9893887acab0068c5ecf8d8486b889c4ba6fe4edd

Sharing

Copy URL Twitter E-mail

General

Target
2009bfc16bdd591b2bacd8a9893887acab0068c5ecf8d8486b889c4ba6fe4edd
Size 159KB
Sample221022-csjb1sabc4
SHA256 2009bfc16bdd591b2bacd8a9893887acab0068c5ecf8d8486b889c4ba6fe4edd
MD5 ddce5db099bab8bc56d5ac70d83842a0
SHA1 7cd97f3e7a64cf10727ffff9634b9f2f0ed69c9d
SHA512 859801169bd7f26f6918ecea0aee1c9473ac25dc74c861642efd428f6c2d3644d5f64d7113da1d96120b8eca4ee0dcfb26f082c2c8d1a63a8252713ab3fb9c23
SSDEEP 3072:HfCpcDozERHWkC1rd3CC5UB5KvSS0+9Pzo9p04/t9LU5Uht9e8A+BVfRbixvJ+L:HfCpc/RHcQC50e0QPCiEtVvthAJg
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

targetcompany

Malware Config

Signatures

TargetCompany payload 1 IoCs

resource	yara_rule
sample	family_targetcompany

Targetcompany family
targetcompany

File Explorer

2009bfc16bdd591b2bacd8a9893887acab0068c5ecf8d8486b889c4ba6fe4edd

.exe 159KB

2009bfc16bdd591b2bacd8a9893887acab0068c5ecf8d8486b889c4ba6fe4edd

IMPHASH 316c31c8d4295cfeadc2f8aa6f8fe4f7
SHA256 2009bfc16bdd591b2bacd8a9893887acab0068c5ecf8d8486b889c4ba6fe4edd
MD5 ddce5db099bab8bc56d5ac70d83842a0
SHA1 7cd97f3e7a64cf10727ffff9634b9f2f0ed69c9d
SHA512 859801169bd7f26f6918ecea0aee1c9473ac25dc74c861642efd428f6c2d3644d5f64d7113da1d96120b8eca4ee0dcfb26f082c2c8d1a63a8252713ab3fb9c23
SSDEEP 3072:HfCpcDozERHWkC1rd3CC5UB5KvSS0+9Pzo9p04/t9LU5Uht9e8A+BVfRbixvJ+L:HfCpc/RHcQC50e0QPCiEtVvthAJg
MD5 SHA1 SHA512 SSDEEP

windows x86

TargetCompany payload

Minor OS version

Major OS version

Entry point

35562

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

WaitForSingleObject CreateFileW GetCurrentThreadId lstrcatA GetModuleHandleA OpenProcess PostQueuedCompletionStatus CreateToolhelp32Snapshot MultiByteToWideChar Sleep GetLastError Process32NextW GetDiskFreeSpaceExW GetCurrentThread LoadLibraryA lstrcatW CloseHandle GetSystemInfo CreateThread GetWindowsDirectoryW GetProcAddress SetFilePointerEx LocalFree DeleteCriticalSection ExitProcess GetCurrentProcessId GetModuleHandleW CopyFileW WideCharToMultiByte lstrcpyW lstrcmpiW CreateIoCompletionPort GetTickCount FindClose MoveFileW GetDriveTypeW GetComputerNameA QueryDosDeviceW FindFirstVolumeW DuplicateHandle CreateEventW SetEvent TerminateThread FindVolumeClose GetVolumePathNamesForVolumeNameW GetFileType FindNextVolumeW WriteConsoleW SetEndOfFile ReadConsoleW lstrlenA GetQueuedCompletionStatus SetErrorMode InitializeCriticalSection LeaveCriticalSection WaitForMultipleObjects GetModuleFileNameW GetUserDefaultLangID TerminateProcess WriteFile GetCurrentProcess FindNextFileW GetCommandLineW EnterCriticalSection FindFirstFileExW GetFileSizeEx lstrlenW GetLogicalDrives ReadFile HeapSize GetConsoleMode GetConsoleCP FlushFileBuffers GetStringTypeW SetStdHandle GetProcessHeap FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetCPInfo GetOEMCP GetACP QueryPerformanceCounter lstrcmpW IsValidCodePage LCMapStringW HeapAlloc HeapFree HeapReAlloc GetStdHandle UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent InitializeCriticalSectionAndSpinCount ResetEvent WaitForSingleObjectEx IsDebuggerPresent GetStartupInfoW GetSystemTimeAsFileTime InitializeSListHead RtlUnwind RaiseException SetLastError EncodePointer TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW GetModuleHandleExW DecodePointer

user32

GetCursorPos

advapi32

AdjustTokenPrivileges OpenThreadToken LsaClose LookupPrivilegeValueW CreateServiceW CryptAcquireContextW LsaFreeMemory CloseServiceHandle CryptGenRandom OpenSCManagerW AllocateAndInitializeSid SetEntriesInAclW SetNamedSecurityInfoW OpenProcessToken FreeSid StartServiceW LsaQueryInformationPolicy LsaOpenPolicy CryptReleaseContext

shell32

CommandLineToArgvW ShellExecuteW ShellExecuteA

netapi32

NetShareEnum NetApiBufferFree

shlwapi

wnsprintfA StrCmpNIW StrCmpNW StrDupW StrStrIW SHDeleteKeyW wnsprintfW

iphlpapi

GetIpNetTable

ws2_32

inet_ntoa

wininet

HttpOpenRequestW InternetQueryOptionW InternetQueryDataAvailable InternetReadFile InternetCrackUrlW HttpSendRequestW InternetCloseHandle InternetConnectW InternetSetOptionW InternetOpenW