Static task
static1
Behavioral task
behavioral1
Sample
srvcp(2)/gus.decrypted.txt
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
srvcp(2)/gus.ini
Resource
win7-20220901-en
Behavioral task
behavioral3
Sample
srvcp(2)/srvcp.exe
Resource
win7-20220812-en
General
-
Target
srvcp.7z
-
Size
14KB
-
MD5
ab65f8346c4b0e61ca261cd7d0619f00
-
SHA1
79f1d0b320455ec35ab1cf68b1cfd00679b46c4f
-
SHA256
4f11e1d6cdaf2c9c77b162f7718b2a97fe259622e87520077cda8df69f7d6428
-
SHA512
c2e0d08c627587ca257480670ad370f2f7d2662043aa4d7e5cae274e594221ff4093683fcf6676796ad9b64890513cb17985afee9959322f07778a9bc55653f0
-
SSDEEP
384:k3oK8zfaDIG3rfDXwFf6XBnjp+XiSQNwr4T+kJeSLNf7I3O:k6yDIOf7wV6xN+babJeSLNf7L
Malware Config
Signatures
Files
-
srvcp.7z.7z
Password: malware
-
srvcp(2)/gus.decrypted.txt
-
srvcp(2)/gus.ini
-
srvcp(2)/srvcp.exe.exe windows x86
Password: malware
2d829b5c9f62f6971dd80406f4fc7f84
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ws2_32
WSACleanup
WSAStartup
wsock32
accept
bind
closesocket
connect
gethostbyname
htons
inet_addr
inet_ntoa
ioctlsocket
listen
recv
send
sendto
socket
kernel32
ExitProcess
ExitThread
GetExitCodeThread
CloseHandle
GetSystemDirectoryA
GetTickCount
ResumeThread
RtlUnwind
Sleep
SuspendThread
TerminateThread
CreateProcessA
CreateThread
advapi32
RegCloseKey
RegOpenKeyExA
RegSetValueExA
crtdll
__GetMainArgs
remove
_strcmpi
atoi
exit
fclose
fopen
fprintf
free
fscanf
fwrite
malloc
memset
raise
rand
signal
sprintf
srand
sscanf
strcat
strchr
strncmp
strncpy
strstr
strtoul
Sections
.text Size: 18KB - Virtual size: 18KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.bss Size: - Virtual size: 1KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 88B - Virtual size: 88B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE