q�)ry�d�{�}�nH�ch�I3�u�$������U�ْ�Wj�+��t�p�gw/��>[��}(�j\Qr�0�$������kIg�7M��ί���5>�2��e�E��$zc�F�YD�S#���,�ǘ��;">�{�%0��o��$�7����!��u�-.%��Q����l��/5ڢ7�i1�4Z/D�^%�%�����MX���ϳ�E�|�����R��2�0<E���5�M�*θNP�`�8�G��1H[xw qV���Q�r$��@P ��3{�69*mL;b���H9���������L�I/�4.��]ӊ`�x�.�YsŒ����@(�s�n�*:5���ɚ%x���`�&���о>:���A�8�p̱%^aВ5^���bOJ۪�S���?Y>���������lU#L2����(��콕^��e��rp�|1N`Xb0���(���ПJR*���xzM��b0V���%�(�K�@�v�s;|��},]CגP�Z[7����]��֚g�A�3{�/����֚�DN�5V�0x��d��ɺ��D�{�]��P�l�Z�|��Ŧ��w�Yy�����$˺& :2����Ԕ���~Ҭ��zz�^�ߪY���6���:�[��Ge.�E���2T�����lF�+TU� �#�� ��@��n�*v��OLz�i�F�F��Jn�F;��`"����-����Ƈs��� ��h��O ̾k�É@s²{{�Q�43?d� >,��J �U3B��t��d�{}w9+�z�$� ��:ME�-���2����В���W������2�Yzc<,\���y�M� !����S�U��C�簗(Ag ̉\���Мf�O~7~�i����d*?0��K��'U� y2�'|X��Bi�a:�r1�&H�J�����jii��$�O��>�O��lI��;���ZD�~Z�B�]r��b�;����.�5�����^p��(��X1�O��f�W�6Z�=�}����H���}n�.j{Z'���X1ܒ��_u~��Y�&�������k�z�r�n�)X�|'����q$jŕDm�4ĘE932'\�pi �����mۏ�<͔�1���q P���7�������59����~�Hέ{Ɓ� W�����!,, u� �gܛ�T���c���xi���!��R�J�=k�4.�]��S�+ �"_� }���(]� �X!S �n�-J}*��l����o���-�Vn٧1h)dG}���E����I�)�!���}&�ƚ��k�K$h�_��d;���|��a_��ŹP+c�V��UA�����J�����x�S5�*�y+ϟΧ�c��-��δ�BW������f�w�:��3Jq��S5N��禊@��*���|[T"��l�3c|�B�2��2d@��^^F{�H�f��C��EL��` �J�ڵ������`B�җҡ5�Vby\��<���0����7U�R\�E���z�B\u�����1��O�˃�iӈ�1#�}t�r|B%K��ͱ�O��@N}z�D�L�$84��ȑ��M~�-y��@{�W��;Wd�cQwa��Ƽ?(�� ���l�� �{:� ���F�֩_;�,�2}�=O�rZe|��B�-����s�#��؞��5��1g�����������e2a����ьoq�@�lLF6E��µr�u��pz��A:i2�dE|�%��q�2�N��8��T�@Tc7�k�*��~��I�(��U���2�9y)������&Z������=v_>W� �t����ͧȜ��>$QjP�'����vy���>���2���A���tQ؊�><�Af�ӏ��>���p�F����4 0*vi k�,S���+4cܩ��d�آ�4�:�H�T$eE~�?��|�������[�f�@��Ғd^�e�,�9ܼU2�>{a���;��� m��dW��ߣީ�hj�-՟��:rU �}9�?IXSw[$� %W���E��^^�}��� k�,�;rE`�G��[tA;��x4�~�V>�}e����'K�(W�͜��uݠ�*������,�rlB�=�� !�gF�%:p�`I�6��{�a�PD�� ��$zx`F���Z�a� ���,#}�hOյ���ǣ<�&~�����.����V�j2������{��I"I���a���db����z��d4E�P�0���+ACKIm� 4��8�����v/���o[�p ���ՙz��F�%l\O`u�W��le :a�j�a���D8��⚙��Z�^�k�Msz�E�O��,?��� [B.����s�&E�06I"~�y\+��L��p����b��G��J��8�����˩tk|D���'�gR<Ϯ)0�8`E�������h?85��[��G�������duRE��$�T����[:-�ut�7��-H�' �Z�č��g)��/\bI�vY!"<�� 4�v�r';>3�K����]��ө�x�ǧ~kD�����#X#����Ul�=��O�0m:�y���BpՓ��9�@��[0(H�2/�@���-&x���(b�◽n��q3>N6���s���>�ٵͅ���3p��}1��wDͻ|����K�`y$�(�Dw�u�;���rn,cF����$��@�Ex�o�^n�Nz�����9&�z�@���= �-L;�����(0SO[�K� ����8Ë𫝈iة�eXaX�G�_�>N�������ݹ�qz��o��1;�/���)9�ܴp�->"/2����ev�x d�r�B��p���|��\�=���zm .������r�N;+�TK^*��������'�֥�z�@<(�˗w��C�Y�37O�0���)z7 "�^�ͦe`��8��I.ZD�&���:�:��z���Bc�d�P��G�V�6�H˰X��b��k0��bo�����u&:ҖGg�ԝ���"P�����J��JLj�V�y8z�fO���^3%A���\0o�w�Z��/`ʇ6J���ޞֶ~�.�_��� �T)���1�5�6���XY���Q%�^U�j��R��F�
Overview
overview
8Static
static
8�...��.exe
windows7-x64
8�...��.exe
windows10-2004-x64
8�...��.exe
windows7-x64
5�...��.exe
windows10-2004-x64
�....0.exe
windows7-x64
7�....0.exe
windows10-2004-x64
7�...��.doc
windows7-x64
4�...��.doc
windows10-2004-x64
1�...��.url
windows7-x64
1�...��.url
windows10-2004-x64
1Behavioral task
behavioral1
Sample
ļ/KLD_ļ.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
ļ/KLD_ļ.exe
Resource
win10v2004-20221111-en
Behavioral task
behavioral3
Sample
ļ/°汾鿴.exe
Resource
win7-20221111-en
Behavioral task
behavioral4
Sample
ļ/°汾鿴.exe
Resource
win10v2004-20221111-en
Behavioral task
behavioral5
Sample
ļ/C-CAR V4.0.exe
Resource
win7-20221111-en
Behavioral task
behavioral6
Sample
ļ/C-CAR V4.0.exe
Resource
win10v2004-20221111-en
Behavioral task
behavioral7
Sample
ļ/ļϸ˵.doc
Resource
win7-20221111-en
Behavioral task
behavioral8
Sample
ļ/ļϸ˵.doc
Resource
win10v2004-20221111-en
Behavioral task
behavioral9
Sample
ļ .url
Resource
win7-20221111-en
Behavioral task
behavioral10
Sample
ļ .url
Resource
win10v2004-20221111-en
General
-
Target
3a14c783fb9bc53d2dbb1e424b1cdc4c815c98f194f72ab84d07824b249bb9ea
-
Size
1.9MB
-
MD5
ec62d7b126fd07d3d2000323ffa5ee40
-
SHA1
d4f9d8a4aeab87e558b1570ef2dda3292d84dea3
-
SHA256
3a14c783fb9bc53d2dbb1e424b1cdc4c815c98f194f72ab84d07824b249bb9ea
-
SHA512
95c95e6cd6c7219dbd5ef27a0ce2d30a5601e5f8b7318bee5ea67a73643a80903cbd67c130fa3b890b79ba530ef2721756778077832e093dda32277042583722
-
SSDEEP
49152:s2Rvun8tGDf4FaJ5VO0P3wbLjrd9Id170wTcL3AbR3APBDmEtf51V:DG84L4FaJ5823wbHIHIwe3AbRhI51V
Malware Config
Signatures
-
resource yara_rule static1/unpack001/ļ/KLD_ļ.exe upx
Files
-
3a14c783fb9bc53d2dbb1e424b1cdc4c815c98f194f72ab84d07824b249bb9ea.zip
-
ļ/KLD_ļ.exe.exe windows x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 572KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 303KB - Virtual size: 304KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 6KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
out.upx.exe windows x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 550KB - Virtual size: 549KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 96KB - Virtual size: 95KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 76KB - Virtual size: 189KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 21KB - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
ļ/°汾鿴.exe.exe windows x86
091aaef57ce32f7c334d8003210272ce
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
DeleteCriticalSection
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
GetKeyboardType
MessageBoxA
advapi32
RegQueryValueExA
oleaut32
SysFreeString
version
VerQueryValueA
gdi32
UnrealizeObject
ole32
CoTaskMemAlloc
comctl32
ImageList_SetIconSize
shell32
DragQueryFileA
Exports
Exports
Sections
CODE Size: - Virtual size: 789KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 3KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 20B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 50KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 5KB - Virtual size: 36KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp2 Size: - Virtual size: 234KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp3 Size: 774KB - Virtual size: 773KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 36KB - Virtual size: 35KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
ļ/C-CAR V4.0.exe.exe windows x86
baa93d47220682c04d92f7797d9224ce
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
lstrcpy
comctl32
InitCommonControls
Sections
Size: 32KB - Virtual size: 116KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 4KB - Virtual size: 1.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
hdhgmcgd Size: 832KB - Virtual size: 832KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
jndlxnuj Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
ļ/C-CAR V4.0˵.txt
-
ļ/ļϸ˵.doc.doc windows office2003
-
ļ/Ǽٲ.rar.rar
-
ļ V4.0 - PC6 - ͼ.url.url