Overview
overview
8Static
static
8WIS WLS WA...ty.exe
windows7-x64
8WIS WLS WA...ty.exe
windows10-2004-x64
8WIS WLS WA...xe.xml
windows7-x64
1WIS WLS WA...xe.xml
windows10-2004-x64
1WIS WLS WA...Me.rtf
windows7-x64
4WIS WLS WA...Me.rtf
windows10-2004-x64
1WIS WLS WA...UH.dll
windows7-x64
8WIS WLS WA...UH.dll
windows10-2004-x64
8WIS WLS WA...er.dll
windows7-x64
8WIS WLS WA...er.dll
windows10-2004-x64
8Behavioral task
behavioral1
Sample
WIS WLS WAS WTS Private Uber Hack ~ September 3 Update/ConfigUtility.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
WIS WLS WAS WTS Private Uber Hack ~ September 3 Update/ConfigUtility.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral3
Sample
WIS WLS WAS WTS Private Uber Hack ~ September 3 Update/ConfigUtility.exe.xml
Resource
win7-20220812-en
Behavioral task
behavioral4
Sample
WIS WLS WAS WTS Private Uber Hack ~ September 3 Update/ConfigUtility.exe.xml
Resource
win10v2004-20221111-en
Behavioral task
behavioral5
Sample
WIS WLS WAS WTS Private Uber Hack ~ September 3 Update/Read Me.rtf
Resource
win7-20220812-en
Behavioral task
behavioral6
Sample
WIS WLS WAS WTS Private Uber Hack ~ September 3 Update/Read Me.rtf
Resource
win10v2004-20220901-en
Behavioral task
behavioral7
Sample
WIS WLS WAS WTS Private Uber Hack ~ September 3 Update/UH.dll
Resource
win7-20220901-en
Behavioral task
behavioral8
Sample
WIS WLS WAS WTS Private Uber Hack ~ September 3 Update/UH.dll
Resource
win10v2004-20221111-en
Behavioral task
behavioral9
Sample
WIS WLS WAS WTS Private Uber Hack ~ September 3 Update/UHLoader.dll
Resource
win7-20221111-en
Behavioral task
behavioral10
Sample
WIS WLS WAS WTS Private Uber Hack ~ September 3 Update/UHLoader.dll
Resource
win10v2004-20221111-en
General
-
Target
f507d0013f1be10cd42f8e091f37614c2b343f042fecf96f4568d54dfe982f84
-
Size
69KB
-
MD5
b3918d31c0c0b6bb769456ce6c688be9
-
SHA1
cfeafc7d741c5d2b14d31e265d23267598e19f05
-
SHA256
f507d0013f1be10cd42f8e091f37614c2b343f042fecf96f4568d54dfe982f84
-
SHA512
6a69a3288d0bd45840000f008e5ed3fc64b4b3dd7fba355a54f8fc4449f022df491a6f9cbd84b357cc95fd20270326df72ee5f78822e78f77a4e9b519518be6f
-
SSDEEP
1536:M/ZbE2kaqTH5asi7SLewNrscr4FzG+zhHs22tr+BuDGN19+I:M/ZbHqN9i7EhKckVZtUR0KO9n
Malware Config
Signatures
-
resource yara_rule static1/unpack001/WIS WLS WAS WTS Private Uber Hack ~ September 3 Update/ConfigUtility.exe upx static1/unpack001/WIS WLS WAS WTS Private Uber Hack ~ September 3 Update/UH.dll upx static1/unpack001/WIS WLS WAS WTS Private Uber Hack ~ September 3 Update/UHLoader.flt upx
Files
-
f507d0013f1be10cd42f8e091f37614c2b343f042fecf96f4568d54dfe982f84.rar
-
WIS WLS WAS WTS Private Uber Hack ~ September 3 Update/ConfigUtility.exe.exe windows x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.UPX1 Size: 512B - Virtual size: 48KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.UPX1 Size: 19KB - Virtual size: 35KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
WIS WLS WAS WTS Private Uber Hack ~ September 3 Update/ConfigUtility.exe.manifest.xml
-
WIS WLS WAS WTS Private Uber Hack ~ September 3 Update/READ - How to change DLL names.txt
-
WIS WLS WAS WTS Private Uber Hack ~ September 3 Update/Read Me.rtf.rtf
-
WIS WLS WAS WTS Private Uber Hack ~ September 3 Update/UH.dll.dll windows x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.UPX1 Size: - Virtual size: 176KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.UPX1 Size: 23KB - Virtual size: 39KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
WIS WLS WAS WTS Private Uber Hack ~ September 3 Update/UHLoader.flt.dll windows x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.UPX1 Size: - Virtual size: 20KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.UPX1 Size: 8KB - Virtual size: 22KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
WIS WLS WAS WTS Private Uber Hack ~ September 3 Update/WTConfig.cfg