���(�Ҹ�����`���&5�����P�nCӳ����*9�!�X��@��C��� ��������W��|��>��α�ε�O"7�<�/��" �����Z��_���^���R(o2�ch�1J ,�B�� ��n3�}�5���@�2��Y��R�� S����P/��y�W�B.[��W<�1���$�� ��� ��v���j�"ߘ�sЩڣDP"���TXj��2-��˿�fǒF��qhS�ʂJ�\��HQ�>�+�ҭ�oU�_'��@EWL���q9,ԟ�@��vjo,q�^5�O^�G��R���9 ������p�$�7|:�aF�����yOQ����wq�T�ǟ,td�OG����f��8m4�P߫k��a��D1>����`� ����t�MUki�_o� N&Ɛ��0z�.���ўG�ϩm݁��0�Ȯ<��[<p���lb�6<槂��4Z��T���Y����b��"�T�pB��I$���¨$[��O�'qV�{Q��N~���>`�P��b�lςs>�N��'��C]8&�ݜJZ��ɥ�q�YB�x�h$�?a���+i���}y�y[5�D�|(��l�D�K^�1:lY [�<�,�{'搘�&����~��~\.J ��Ҭ3���=x���.^�P����: Fv�pd<3� *����۬+��R�� ��8s�)�H��F�ZH��Z�M�o�'�����{|�F���������-R������]I�����Ή^�͌ga)�Q�WF��Ct�A����C��\�DŽ́�����\�C,��l�p�� �f��m!D��%-���^,b�C�rT�1WN���]�8*M�`7��Er�E٪�� =\,?��q��z�q�/v7�n��0��s�1�o5pl��19h�fM�� ������}aYT�Wɫ:��z rk2�Jƭl��iz2}W��w���"� �JON0���K�V2�#YK�OH����w��g�lj�~͞�;����G�����\=UӀE�yA椻�����,��gE�� �����g�W��V�6t6"�&M�E���d�N��d�Xx]O{��]a�����㶁Vo�q�Qm�".����ԥK����h��6HP��8�k&a/ g����k�D����}�J���T��û� ��l��g � \��:�ѡI�k��`��3�IX���YwLב �q��(c�2�CӧhNI/�1tO4d�-%1�,UB;��tc�G��zg�3���3����p͙2�]Z**T�p���}�$�H���U>��t�c���Q��K����*0,k�ţ��`"����*6ǖ�wք���.�oj�����;�.�������<�o�h�%:U�Ki,�y�1F�ᶋ�$e�N`�"�:2�ذ��5jsՃ[X4���Ѹ�N���!W,�t�?6��f�+���2)_�"���e����z�h2�y�����jk��j������[�=������g�ھB*��OS��%k��.ӝS`�_�r����<?�4�#��,�M���/X�p��1������rs$E�x��L�.��ې�ݸꢆ��8iW���nPx��s�]����$v�XgӲ�L���Eړ/6�+=�]��Dj�?�NؘA���c�P걌��/l����"�n4w@�r�&w�d6���>��"��AK2�*8�2�w�����\0�7��N��m.�a2�>l!]���R� /O�Ra �:b�Zj����m{r �b�4�ԑ��(W���qr�0���8����#R۟}������� ##�{?�f�ڌC|��Z�a5�q�ҟp�WF;`�6���J�<YpL2�A��Xk�~a�=�*|anf�dZ�5;'m8���QS *T���$L����y��R�"e�g��K@@F�9��ME�kH�Ş�yǿr��#��K�Q\�(��d��vgdKؐj��%�.|�����$�q��ۘbخ�����(�tS r �t!��X�l�B��"_�F��p�zr��\��"9z*]Q�95�q��v�+�B�}��$�g����3�Ce�ӹ�N����[%M��18[��@}v�2�V~��D)&�!�%�V����С��ǀa �OC�ڎ��<r�#���� �с��� IO����=zBܠ��۩���� ��鴻=�aA �.��&�<+�8*�m�����*i��n�Q07r����G��QǾ3Ytk��}�� ��'_t�_�v�+(�[(�k��:��7��Cr؇M�n�� �,� �G��J�EGH�������/b�o]���;I$��j�K#ig��� vw21���@N�]P]z�P�%�N�bb�Q��6&s�������2���`�ş��tN�!�̲0����n�0�t��Ա����:��:h�:��B���jS�O�se���]4Ԩi�<A�f�8�nx������}-����m����O����oN/���+R!�)����q�\.S�Z9`W.�����'���O~���Ԟ���>���}�\A�%a ��˽��w�Ai��.�܌w�L�]�� [M���:qj����&��@����_�jdGe��`��w��Y�Š�Z�������>f�F{����]����\�s܆ �W��2�xWP���~�!P̃�����@��z�A_��X����G�捰�a�����%|a�M�_Lì������~��c�8���d��T��ˌ�=��lG���fV�0N�T� L$�~�|�� ���B1~���ƞ�z�ؿ��H�E}�Փ^�.� ���af�vĞ�e�a�����OH����l�T�k0��+���9˶T�Í��#;�Q�8�RT� �.�(� �Z����h,���h����LH�d�We�]�ʻI��f��W54F��|�;��e$3��*@%l?p.։�|HȬ����*W�,u��n�п(�с�%�m�\��~@�����E&��f�A]�w�I���f���)Cz�WHUx�FP��agU��D�'���E��SYi�=����vu'M2����N��Iy�Ɇ�a�o�����F�,��x k�(o7��a�g]@�
Static task
static1
Behavioral task
behavioral1
Sample
Reset_cln.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
Reset_cln.exe
Resource
win10v2004-20221111-en
General
-
Target
Reset_cln.exe
-
Size
9.4MB
-
MD5
61c98e80e70b0f3e3951dccff351644c
-
SHA1
541c48539d943c6bd261127829f1e29904a5b945
-
SHA256
14541883dc05d0e8e954b1de4d5c717ab7a215fa2472332971c6695038324371
-
SHA512
fba3db8b8c9be2a5e2646bcb313e947d5634989ffee31501f40f1d0c14f6633e39161d2c35393c3a33fedf65674cab2fcd55f817e03a803216db6d94ad5183ca
-
SSDEEP
196608:anzwdq6YMOwsdK+kVylAou8uuYV0Jui6cCVIAKdG1PT:AkUMOwoKvVypLUVNn7KdaT
Malware Config
Signatures
Files
-
Reset_cln.exe.exe windows x64
1b2324c097913513bef0f7e95aeec8b2
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
Imports
kernel32
CreateSemaphoreW
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
msvcrt
__C_specific_handler
user32
CharUpperBuffW
Exports
Exports
Sections
.text Size: - Virtual size: 44KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 3.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.pdata Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.xdata Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.bss Size: - Virtual size: 3KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.CRT Size: - Virtual size: 104B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.15 Size: - Virtual size: 3.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.[OT Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.o-u Size: 9.4MB - Virtual size: 9.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 192B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 904B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE