Overview
overview
1Static
static
ATTRIB.exe
windows7-x64
ATTRIB.exe
windows10-2004-x64
CHKDSK.exe
windows7-x64
CHKDSK.exe
windows10-2004-x64
DELTREE.exe
windows7-x64
DELTREE.exe
windows10-2004-x64
EDIT.com
windows7-x64
EDIT.com
windows10-2004-x64
FDISK.exe
windows7-x64
FDISK.exe
windows10-2004-x64
FIND.exe
windows7-x64
FIND.exe
windows10-2004-x64
FORMAT.com
windows7-x64
FORMAT.com
windows10-2004-x64
IEXTRACT.exe
windows7-x64
IEXTRACT.exe
windows10-2004-x64
LABEL.exe
windows7-x64
LABEL.exe
windows10-2004-x64
MEM.exe
windows7-x64
MEM.exe
windows10-2004-x64
MOVE.exe
windows7-x64
MOVE.exe
windows10-2004-x64
SCANDISK.exe
windows7-x64
SCANDISK.exe
windows10-2004-x64
SEE.com
windows7-x64
SEE.com
windows10-2004-x64
SETUPHD.bat
windows7-x64
1SETUPHD.bat
windows10-2004-x64
1XCOPY.exe
windows7-x64
XCOPY.exe
windows10-2004-x64
XCOPY32.exe
windows7-x64
XCOPY32.exe
windows10-2004-x64
Static task
static1
Behavioral task
behavioral1
Sample
ATTRIB.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
ATTRIB.exe
Resource
win10v2004-20221111-en
Behavioral task
behavioral3
Sample
CHKDSK.exe
Resource
win7-20221111-en
Behavioral task
behavioral4
Sample
CHKDSK.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral5
Sample
DELTREE.exe
Resource
win7-20221111-en
Behavioral task
behavioral6
Sample
DELTREE.exe
Resource
win10v2004-20220901-en
Behavioral task
behavioral7
Sample
EDIT.com
Resource
win7-20221111-en
Behavioral task
behavioral8
Sample
EDIT.com
Resource
win10v2004-20220901-en
Behavioral task
behavioral9
Sample
FDISK.exe
Resource
win7-20221111-en
Behavioral task
behavioral10
Sample
FDISK.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral11
Sample
FIND.exe
Resource
win7-20221111-en
Behavioral task
behavioral12
Sample
FIND.exe
Resource
win10v2004-20221111-en
Behavioral task
behavioral13
Sample
FORMAT.com
Resource
win7-20220812-en
Behavioral task
behavioral14
Sample
FORMAT.com
Resource
win10v2004-20220901-en
Behavioral task
behavioral15
Sample
IEXTRACT.exe
Resource
win7-20220812-en
Behavioral task
behavioral16
Sample
IEXTRACT.exe
Resource
win10v2004-20220901-en
Behavioral task
behavioral17
Sample
LABEL.exe
Resource
win7-20220812-en
Behavioral task
behavioral18
Sample
LABEL.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral19
Sample
MEM.exe
Resource
win7-20220812-en
Behavioral task
behavioral20
Sample
MEM.exe
Resource
win10v2004-20220901-en
Behavioral task
behavioral21
Sample
MOVE.exe
Resource
win7-20220901-en
Behavioral task
behavioral22
Sample
MOVE.exe
Resource
win10v2004-20220901-en
Behavioral task
behavioral23
Sample
SCANDISK.exe
Resource
win7-20220812-en
Behavioral task
behavioral24
Sample
SCANDISK.exe
Resource
win10v2004-20221111-en
Behavioral task
behavioral25
Sample
SEE.com
Resource
win7-20221111-en
Behavioral task
behavioral26
Sample
SEE.com
Resource
win10v2004-20221111-en
Behavioral task
behavioral27
Sample
SETUPHD.bat
Resource
win7-20221111-en
Behavioral task
behavioral28
Sample
SETUPHD.bat
Resource
win10v2004-20221111-en
Behavioral task
behavioral29
Sample
XCOPY.exe
Resource
win7-20221111-en
Behavioral task
behavioral30
Sample
XCOPY.exe
Resource
win10v2004-20221111-en
Behavioral task
behavioral31
Sample
XCOPY32.exe
Resource
win7-20220901-en
Behavioral task
behavioral32
Sample
XCOPY32.exe
Resource
win10v2004-20220901-en
General
-
Target
4500615114a4266d7c1fcddbdc28b7d867ce61bf06ed44fe27e6f3e6b6807596
-
Size
2.8MB
-
MD5
b66a5cbaa316a3f30166ea4825e5df76
-
SHA1
641a38a0d3f1516890cb5f7ed7162a5c29e3f0a3
-
SHA256
4500615114a4266d7c1fcddbdc28b7d867ce61bf06ed44fe27e6f3e6b6807596
-
SHA512
e981a5d92b5225f1ca675244a77c6f64a58d7a1442346a4e41afbd284fe98f8368b001d571dfdd30f063e9de5d2f35a2cbe67e9a7da9c0b722a11178cc4140bc
-
SSDEEP
24576:Y7rMN3DI6Fe+/qpV3YO5AjOm5jI4P0Qj+NEO5Awcaon+xoZvg6Tuv130JZR:7PA+/qpV3e73uo+eZ4D9EJZ
Malware Config
Signatures
Files
-
4500615114a4266d7c1fcddbdc28b7d867ce61bf06ed44fe27e6f3e6b6807596.iso
-
ATTRIB.EXE
-
CHKDSK.EXE
-
DELTREE.EXE
-
DISPLAY.SYS
-
EDIT.COM
-
EDIT.HLP
-
EDIT.INI
-
FDISK.EXE
-
FIND.EXE
-
FORMAT.COM
-
IEXTRACT.EXE
-
LABEL.EXE
-
MEM.EXE
-
MOVE.EXE
-
README.TXT
-
SCANDISK.EXE
-
SCANDISK.INI
-
SEE.COM
-
SETUPHD.BAT
-
XCOPY.EXE
-
XCOPY32.EXE
-
XCOPY32.MOD.exe windows x86
09c801ea9d7dec26a9940759210f8ed6
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
lstrcatA
CopyFileA
InterlockedIncrement
FindClose
SetLastError
GetLastError
CompareFileTime
RtlMoveMemory
lstrlenA
_lwrite
GetStdHandle
FormatMessageA
GetModuleHandleA
_lread
ExitProcess
GetLocaleInfoA
LocalAlloc
GetUserDefaultLCID
LocalFileTimeToFileTime
SystemTimeToFileTime
GetLogicalDrives
lstrcmpiA
GetFullPathNameA
lstrcpyA
WideCharToMultiByte
GetCommandLineW
InterlockedDecrement
InterlockedExchange
SetFileApisToOEM
SetConsoleCtrlHandler
SetConsoleMode
CreateDirectoryA
GetVolumeInformationA
SetFileAttributesA
GetFileAttributesA
FindFirstFileA
FindNextFileA
user32
LoadStringA
CharUpperA
CharToOemA
Sections
.text Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 630B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
[BOOT]/Boot-1.44M.img
-
aefdisk/AEFDISK.EXE
-
aefdisk/AEFDISK.TXT
-
aefdisk/FAQ.TXT
-
aefdisk/FILE_ID.DIZ
-
aefdisk/REGISTER.FRM
-
bootfile/AUTOEXEC.BAT
-
bootfile/CONFIG.SYS
-
delpart/delpart.exe
-
filecopy/LICENSE.TXT
-
filecopy/MANUAL.TXT
-
filecopy/READNTFS.EXE
-
filecopy/UNICODE.EXE.exe windows x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Sections
CODE Size: 11KB - Virtual size: 11KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: 512B - Virtual size: 184B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 1KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 8B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 824B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 512B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
help.bat
-
zerocmos/CLRCMOS.EXE
-
zerocmos/DUMPCMOS.COM
-
zerocmos/DUMPCMOS.TXT
-
zerocmos/KILLCMOS.COM
-
zerocmos/KILLCMOS.TXT
-
zerocmos/README.1ST
-
zerocmos/WIPECMOS.COM
-
zerocmos/WIPECMOS.TXT
-
zerofill/WIPE.COM
-
zerofill/WIPE.TXT
-
zerofill/ZAP.COM
-
zerofill/ZAP.TXT