Rool
ServiceMain
whm
Behavioral task
behavioral1
Sample
e1685a57c2a7be3d157300a981cb31227051bed0fdca0de74eef9944a855c29e.dll
Resource
win7-20220812-en
Target
e1685a57c2a7be3d157300a981cb31227051bed0fdca0de74eef9944a855c29e
Size
113KB
MD5
8e2badc212ee33d8494b93f75c5c8ae3
SHA1
9bafc75f1aa57ea6d350f6d5c8659b7b6b099df5
SHA256
e1685a57c2a7be3d157300a981cb31227051bed0fdca0de74eef9944a855c29e
SHA512
cd0655bb5c26a5572fbc3891a1937298b8df0be949c97d0ae64a560c5e8ef525f5521238b5562798128a69930aa2ad6b56ccebf9040bc654c2ad6b6cafe1eb32
SSDEEP
3072:cEPx9N0UlGnzrlfymXC8TykNZvzSttnqEFap:rPx9h+3omyAzZbiqEi
resource | yara_rule |
---|---|
sample | family_gh0strat |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
VirtualAllocEx
OpenProcess
MoveFileExA
ExpandEnvironmentStringsA
HeapFree
MapViewOfFile
CreateFileMappingA
UnmapViewOfFile
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
GlobalSize
GetStartupInfoA
CreatePipe
DisconnectNamedPipe
TerminateProcess
FindNextFileA
WaitForMultipleObjects
GlobalMemoryStatusEx
GetSystemInfo
ReleaseMutex
OpenEventA
SetErrorMode
CreateMutexA
SetUnhandledExceptionFilter
FreeConsole
LocalSize
Process32Next
Process32First
CreateToolhelp32Snapshot
lstrcmpiA
GetCurrentThreadId
CreateRemoteThread
GetCurrentProcess
GetSystemDirectoryA
SetLastError
GetModuleFileNameA
MoveFileA
LocalReAlloc
LocalFree
FindClose
GetLogicalDriveStringsA
GetVolumeInformationA
GetDiskFreeSpaceExA
GetDriveTypeA
CreateProcessA
GetFileAttributesA
CreateDirectoryA
GetLastError
DeleteFileA
GetVersionExA
GetPrivateProfileStringA
lstrcmpA
WideCharToMultiByte
MultiByteToWideChar
GetWindowsDirectoryA
lstrcatA
GetPrivateProfileSectionNamesA
lstrlenA
GetProcessHeap
HeapAlloc
GetCurrentProcessId
LoadLibraryA
GetProcAddress
FreeLibrary
GetLocalTime
GetTickCount
Sleep
CancelIo
InterlockedExchange
lstrcpyA
ResetEvent
VirtualAlloc
EnterCriticalSection
LeaveCriticalSection
VirtualFree
DeleteCriticalSection
InitializeCriticalSection
CreateEventA
CreateThread
ResumeThread
SetEvent
WaitForSingleObject
TerminateThread
WriteFile
SetFilePointer
ReadFile
CreateFileA
GetFileSize
RemoveDirectoryA
LocalAlloc
FindFirstFileA
WriteProcessMemory
CloseHandle
PeekNamedPipe
mouse_event
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
GetClipboardData
GetSystemMetrics
SetRect
GetDC
GetDesktopWindow
ReleaseDC
GetCursorInfo
GetCursorPos
SetProcessWindowStation
OpenWindowStationA
GetProcessWindowStation
SetCapture
IsWindowVisible
EnumWindows
SetCursorPos
MapVirtualKeyA
keybd_event
SendMessageA
SystemParametersInfoA
DispatchMessageA
BlockInput
DestroyCursor
LoadCursorA
UnhookWindowsHookEx
SetWindowsHookExA
CallNextHookEx
GetKeyNameTextA
TranslateMessage
GetMessageA
wsprintfA
CharNextA
ExitWindowsEx
GetWindowTextA
GetActiveWindow
WindowFromPoint
CloseDesktop
SetThreadDesktop
OpenInputDesktop
GetUserObjectInformationA
GetThreadDesktop
OpenDesktopA
PostMessageA
CreateWindowExA
CloseWindow
IsWindow
GetWindowThreadProcessId
DeleteDC
GetDIBits
CreateCompatibleDC
CreateDIBSection
SelectObject
CreateCompatibleBitmap
DeleteObject
BitBlt
LsaOpenPolicy
RegCloseKey
RegOpenKeyExA
IsValidSid
LookupAccountNameA
LsaClose
LsaRetrievePrivateData
LsaFreeMemory
RegQueryValueA
CloseServiceHandle
DeleteService
ControlService
QueryServiceStatus
OpenServiceA
OpenSCManagerA
RegSetValueExA
RegCreateKeyA
RegOpenKeyA
RegCreateKeyExA
CloseEventLog
ClearEventLogA
OpenEventLogA
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
FreeSid
SetSecurityDescriptorDacl
AddAccessAllowedAce
InitializeAcl
GetLengthSid
AllocateAndInitializeSid
InitializeSecurityDescriptor
RegEnumValueA
RegEnumKeyExA
RegDeleteValueA
RegDeleteKeyA
RegisterServiceCtrlHandlerA
SetServiceStatus
LookupAccountSidA
GetTokenInformation
RegQueryValueExA
SHGetSpecialFolderPathA
SHGetFileInfoA
SHDeleteKeyA
_strnicmp
_adjust_fdiv
_initterm
??1type_info@@UAE@XZ
calloc
_beginthreadex
wcstombs
realloc
strncat
_snprintf
wcscpy
_errno
strncmp
atoi
strrchr
_except_handler3
free
malloc
strchr
strncpy
sprintf
puts
putchar
rand
_CxxThrowException
strstr
_ftol
ceil
memmove
__CxxFrameHandler
??3@YAXPAX@Z
??2@YAPAXI@Z
_strcmpi
waveInStop
waveOutWrite
waveInReset
waveInAddBuffer
waveInPrepareHeader
waveInOpen
waveInUnprepareHeader
waveInClose
waveOutReset
waveInStart
waveOutUnprepareHeader
waveInGetNumDevs
waveOutPrepareHeader
waveOutOpen
waveOutGetNumDevs
waveOutClose
closesocket
recv
select
socket
gethostbyname
htons
connect
setsockopt
WSAIoctl
WSACleanup
WSAStartup
send
inet_addr
sendto
WSASocketA
htonl
gethostname
ioctlsocket
__WSAFDIsSet
recvfrom
listen
accept
getpeername
bind
getsockname
ntohs
inet_ntoa
InternetOpenUrlA
InternetReadFile
InternetCloseHandle
InternetOpenA
?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z
?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
?_Grow@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAE_NI_N@Z
?_Refcnt@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEAAEPBD@Z
?_Eos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXI@Z
?_Split@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXXZ
?_Xran@std@@YAXXZ
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
NetLocalGroupAddMembers
NetUserAdd
ImmGetCompositionStringA
ImmGetContext
ImmReleaseContext
capCreateCaptureWindowA
capGetDriverDescriptionA
ICSeqCompressFrameEnd
ICCompressorFree
ICClose
ICOpen
ICSeqCompressFrame
ICSeqCompressFrameStart
ICSendMessage
EnumProcessModules
GetModuleFileNameExA
WTSFreeMemory
WTSQuerySessionInformationA
Rool
ServiceMain
whm
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ