c25b5fd542e410aa3c8c38de3fb284eaf7a0b3eb612510a8fe2d70526c96ba07

Sharing

Copy URL Twitter E-mail

General

Target

c25b5fd542e410aa3c8c38de3fb284eaf7a0b3eb612510a8fe2d70526c96ba07
Size

4.1MB
MD5

8e518329f02ce65466d472388348a8d4
SHA1

e66c6c0ee943fa5dc20bd559914f64f9ce711456
SHA256

c25b5fd542e410aa3c8c38de3fb284eaf7a0b3eb612510a8fe2d70526c96ba07
SHA512

bff951c3c89f33f64a7b196315d1fb558622cdd622f2da6feedbc7b9e07627a049e64e4261611b8934256d9de3ed53275e18bbed5add782ca4b5ef3a63924c18
SSDEEP

98304:gfxihpx9OhhxxctmtsfImjW9kG/gHbkip2s:Cihpx9yhwtmtsgaGI4Ch

Score

N/A

Malware Config

Signatures

Files

c25b5fd542e410aa3c8c38de3fb284eaf7a0b3eb612510a8fe2d70526c96ba07
.exe windows x86

c5524ca1be1bee2c17896c8ebd2c84da

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

libzmq-v140-mt-4_3_1

zmq_close

libssl-1_1

SSL_get_fd

libcrypto-1_1

AES_set_decrypt_key

qtsolutions_singleapplication-head

?sendMessage@QtSingleCoreApplication@@QAE_NABVQString@@H@Z

qtsolutions_service-head

?exec@QtServiceBase@@QAEHXZ

qtsolutions_lockedfile-head

?isLocked@QtLockedFile@QtLP_Private@@QBE_NXZ

iphlpapi

GetAdaptersInfo

ws2_32

WSASocketA

rttr_core

??0metadata@detail@rttr@@QAE@$$QAV012@@Z

ole32

CoSetProxyBlanket

oleaut32

SysFreeString

sdplog

?GetInstance@CustomLogger@sangfor@@SAAAV12@XZ

qt5core

?number@QString@@SA?AV1@KH@Z

kernel32

WriteProcessMemory
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess

user32

CharUpperBuffW

advapi32

RegCloseKey

msvcp140

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@I@Z

boost_filesystem-vc140-mt-x32-1_70

?filename@path@filesystem@boost@@QBE?AV123@XZ

wtsapi32

WTSQueryUserToken

userenv

DestroyEnvironmentBlock

crypt32

CertGetNameStringA

shlwapi

StrStrIA

dbghelp

MiniDumpWriteDump

dbgeng

DebugCreate

version

GetFileVersionInfoSizeA

vcruntime140

__vcrt_InitializeCriticalSectionEx

api-ms-win-crt-runtime-l1-1-0

_beginthreadex

api-ms-win-crt-math-l1-1-0

_dtest

api-ms-win-crt-heap-l1-1-0

malloc

api-ms-win-crt-stdio-l1-1-0

fwrite

api-ms-win-crt-filesystem-l1-1-0

_rmdir

api-ms-win-crt-string-l1-1-0

isspace

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-time-l1-1-0

_ctime64

api-ms-win-crt-convert-l1-1-0

atoi

api-ms-win-crt-utility-l1-1-0

rand

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-multibyte-l1-1-0

_mbsnbicmp

Sections

.text
Size: - Virtual size: 1.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 867KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 83KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 17B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: - Virtual size: 96B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vmp0
Size: - Virtual size: 3.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp1
Size: 4.1MB - Virtual size: 4.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 212B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c5524ca1be1bee2c17896c8ebd2c84da

Headers

DLL Characteristics

File Characteristics

Imports

libzmq-v140-mt-4_3_1

libssl-1_1

libcrypto-1_1

qtsolutions_singleapplication-head

qtsolutions_service-head

qtsolutions_lockedfile-head

iphlpapi

ws2_32

rttr_core

ole32

oleaut32

sdplog

qt5core

kernel32

user32

advapi32

msvcp140

boost_filesystem-vc140-mt-x32-1_70

wtsapi32

userenv

crypt32

shlwapi

dbghelp

dbgeng

version

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-multibyte-l1-1-0

Sections

.text Size: - Virtual size: 1.9MB

.rdata Size: - Virtual size: 867KB

.data Size: - Virtual size: 83KB

.tls Size: 512B - Virtual size: 17B

.gfids Size: - Virtual size: 96B

.vmp0 Size: - Virtual size: 3.5MB

.vmp1 Size: 4.1MB - Virtual size: 4.1MB

.reloc Size: 512B - Virtual size: 212B

.rsrc Size: 1KB - Virtual size: 1KB

.text
Size: - Virtual size: 1.9MB

.rdata
Size: - Virtual size: 867KB

.data
Size: - Virtual size: 83KB

.tls
Size: 512B - Virtual size: 17B

.gfids
Size: - Virtual size: 96B

.vmp0
Size: - Virtual size: 3.5MB

.vmp1
Size: 4.1MB - Virtual size: 4.1MB

.reloc
Size: 512B - Virtual size: 212B

.rsrc
Size: 1KB - Virtual size: 1KB