��v�Qt=<#q��~��c�!�\X,/��hK�����ymG�%o*1��I��)�~%��C�u1� �{����ظJ�e���9�&ޭ���X��^jt��༻����=k��ei��ooP���^��J�g��)��I�[�Up�vu��I�W�|g{ ��A{���4���]�� "�s�q��8j�1��SgT�fn'|1^���F�/��.ٙ�ke��)�t��o �}G��d!g�Ee���b__Z���%A �1���$�D�4&�^R�/��C�����o1%��͋��V�A�i���:M��+�v��E9@�S�S��dɩ�7�?:��:��'�c�T{�����}��xF�(89L�]#���G�U`�9������[mu0\��T ��!��lڠ�'k�Ioz�n+����@Fo��%�EÀ�ҍ�md��# �Āy@c�>�ɋ/|!K�UΉ��cLJ�3*ו�A�hED�����~�� � 9����8��"��\f�Nڗ����`A{z�N�xw���UI;(A��{�� ���=e�EϾ�+�0Su:�m�אj�vT`A���1�����pdB��,7����:�g�W2�w�߹��7b~��o��ޢ���B�6��+|(a������Qt�=����i�*ɤ*FZ_^�P��x���Z*#�0A2~�A�!Di?J��ͱ���<;gv�3���A l�l�3̄�7u�(�7���jW4��]�#���MWK�������>� �z�_�M��ٜ�QP��0m\�� ��8���Q��&��9��~(��%\�����<��:Y˶F��Jp�A!3�K��=�0Ⱥ5�h��_u� H/��f�a��T4�s��h@�I��� BC,A��1A�~�>�|l����iʃr��9\�p��L�MR����Xd!E���jʗ�#kcq �%��5(�Q�]� �a�/Zi@8�c�I�N���AdU����&L�GM(�p�� ���$�ΔOq`sU;�a��+t���co-w] E�J�{r�q������a.�MB��2�}5�)�O.QD�qm؍!( oA��e<���Z�f���k���pT�+��`��ݜ���LpTֶ�$�2�h��]�\+�������T�.��vnZ����[��� Y������n ���0�����c�@�a�E����[��a/��S�C${ٓ�����b%�ڏrU�8r';CQu?�=�P�5���w{�gNY� �&�rʎө&���^H��榟�m����lV1Ue�eHn �d��q��+5ֳ����V�h[� ����Ell�s�`��d�Tq�B�#� Ѝ�.tE�/�w�a��A�iz-��T_�2kQ<�z�|��q|��z�ۮ���H��0?PDǠ�r9�X��̆�T!^��jX�� ���(�rT�>��(�T>F죜��DA��HD�8�$��{g�f��eʊY��=�~bʤ�r�� ؊N��Sj�˭��{7No�=��w����-�Ms����]P�Qm�-����[�A�MBn��H|��UC?g��(��ϣ��;�"��º �XeV!��5��f�a�wz����0 CޓS���"���^���ֽ��~�7:F��?��B�}�`vy�]���t��@��[2���N��36�!(��[�6�6�ߏfQ����*Y屯�o �Hy�m�o�g���y������畞���J)�@+� `j~�O�%z>1�����(�d�<�DשDbI1z]Uu��#��)�]�r�_�E�����6�_����(g�t�p�W�,�� ֢R�n��_���C�5��&���� E�;s{�l���V)ueSa�">y�n��b��"Z�zX9.&�*G��%o��ٿt����v���O�z��I�d��|��M?���J�lZ��4�c��l��I��FK�hQ�3㰏�Ӽ��ߢ��L�or�;"�Ȍ��Ȳ��\%'�D��t��z�`�·A��MX<���Er2�PX��\f{���5��x�LN�Р V�;���! �;d�H��6d|$�*YU3"��җ~פt��a3���β���"�f? �J#���"�L��; ^�SU��9p����l���1�t��E���$ 8��Ȇ_��ry��dX�#�"���8�9G��R�ط�O�Ƀ�Ȯ�,���K�(����;#i��̞�1�^��(\�/���Ij��� ��q*����q��UH�yÓR���]3����G\@t��!ţ��ZN�g�P�-[�<'͵TYx��yf����<�ҐǯP������6eռ�����3\���]��@�V�tw�\Y���BBe! %7*�%o�;�HE��#��4*����Ja�{�ጳ����~�a3�F4��g��gg#4�5��"��'p��/�&]P A?�2���?{O���ĨW���Q�4:�yCN�wR=߁u��E��~����H�0t�+�Q ��F��d@((]�F��{Hٽd|�ce4�����I��%�'��fAز���sM���`�Q�s����\V���+�5"����M>�<ۇ]����!vPҏ��U�V�������7W�]e=���0��r5R"y�����؎pW�2p� �@�B��s풞�@�O_��ªUY��b�y�tk��Py�Ӵ����S���R��oH�W��[�z'��$P�5�t��4Y�������)����'�l�Xݼ��D��e2*@� >v�s�cY�}�C̩<O�Piu�2?�y�v���� q 8q��,UN�1}o���Wo�-K��_��49w�V cLl������C��-��8O�Z}�2oα&`�r�M��,CJָQr7���3i���#�dt���Bd�0��إ��a�"�20�3>9�n{����~�!�~+��jF%�)�ѺqE�GT ����b�l�GA�U�Y�R5��6�ھ.{�w�G��a���C��wbe�d!���������D&ĂQ��V�t�"��W?�A��!e2��x�d|@�¸������Q�~��P2d�� ����w��z��!�.�4�T��Ƭ��~�#F�j�<�ʖ��%������2�
Behavioral task
behavioral1
Sample
SSQANNs.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
SSQANNs.exe
Resource
win10v2004-20221111-en
General
-
Target
e444c39f53befc35771046f91bbdfcb975cf52a7fc25b2569d0526273e3db1bb
-
Size
1.1MB
-
MD5
41f6253663cf3d80060dda59a189c99a
-
SHA1
5bac2597215cd8428be01207e07920c45fb24223
-
SHA256
e444c39f53befc35771046f91bbdfcb975cf52a7fc25b2569d0526273e3db1bb
-
SHA512
7e7831c95563c4e0d7a3f8272904ef9f3c6ba6d2f7233c1d18126130f8cc99979394e8df17df05e39e08ee038172096ea6453d92d393463fe7dc001e96828ea6
-
SSDEEP
24576:D6f/nNY62/HEB3xS7wl8Xtew8C8dmqAwHirbmU8kRViB6O8:DqVN2MB3w7xdqaqAEirNdiBf8
Malware Config
Signatures
-
Processes:
resource yara_rule static1/unpack001/SSQANNs.exe vmprotect
Files
-
e444c39f53befc35771046f91bbdfcb975cf52a7fc25b2569d0526273e3db1bb.rar
-
SSQANNs.exe.exe windows x86
0a05d5ced8a24ac35e119c01e1a19f15
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
ord528
kernel32
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
Exports
Exports
Sections
.text Size: - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 67KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 1.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 1.1MB - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE