u%��{`��>�������j��r7'�i�#8��L�q���M8w���� rI���\Lh��V��/�U��f�˕R`��:ʣ}v���<A^8�x=Fo��������zYr��'H�� 3�[}���7̎�n"Q��i*b�E>W'��tUe@ߨl�88�������*����ن�����%�eEaO�i���lG�Q�wW�*/g�=k�$^�L����rq����6����O��1����^�2c=����F���C�N���+z�����`�TY&�cG�q���6�jV���ɷBA�$���TÃ1e7��2@)Ù�&������������������!OT��տ�:5�C�n*��e ���GԆF�.�㐊�^ ��n�"R����͏���6���Ft�����A�����-��1�WrBh���<�O����]�7\�=�=rа�y�7O�e����y8M<���К� _��ܨD�S�\ �p=c��J?�s�j?��~���p�����_�W�ɌS3� wu�eo �ݴi�#���H���8w��G;�ߦ�n�ȯ���Hl����6����_����>������S��>����T�,]��I�h�wHWᥡE��kw������[�0Ç�Ǧ�EA���N4(�q>����V��&m��KO6eNɕ/�^��Z�� ��E����ǽ.ٸ5��� ړ7��"P��|_�p#��Y�u| �aC@�R�6I�7o��,qil�U��[O�+j�^LuVՏp������,4�������`��X(��i �^Q��"G���;j���H��q�/��hIy�\~k�J�V�J��Ê��pj� 2J���&{@�i������S�T��^�U�yV���T�{����8��!s�����շah(�&I)�4'�⟁GTj;�~u���^��p�bP0B�]�w�L���G��8���j^����l}�[[-����~/� �Iy�$�9�(Gٶ����d��xJ5FAT6��t���(�瀥Y��!we���S��K���=�ڐ�K7����$�VD[3ُ��;)H�c@o#P�{�֫�U{�7�^�Gv��=[U�@�lx ���TiF�7�����k�2�TxŜ���m�78�&�ϝ�2�3n������qJÍ��\�w K�b��Dj��~��n��ז�(d*� 3Wh�>�������)]npT����7S�^�`4� >���\�tO��#��19�;�6l���-!�c;f����h�>�� X������A_��'�!�wA]B5Z�f��3/0��^���?�i���0�7r�r���g�����W�o���ʹ� s-��ʹ'���}��mm{-Gb��F���N��1m�m�t9���o|Ǎ�(cO: ��#��PNJ�F���W���e�˃����|(�|�_y�Z����������F����Rȇ-�.�/�VC���-g�����u2�#J=��$���,;)~u�<���χ�z%Ɏ��z�xw+q\�ŇӪ��N���+e\���({`\� Q4�a4�������^sޝ��W?�y%/"�t��c`t����\x���uCc����X�� s��.%��pg��ja�U}I(7n�w��ϯ�f��a���0�24vW�ξk��U��J����$�j\���H��HA���D���\�v7�>�lߦ[#�~�0b"�n�f����� x��c���D�/�e`�|�K��x��6�d�!M�܃P �4� ��Nq���|ϖ�K�o��yq���+ʥ����pMb�a�2t��E5����h�9�M5���Ŕ�X���6 SD�k�c�#壑`�L��@�hu�� ��]L��'����XX���F:O���b��/����i�?�$�q�tw��T���F=�����������q=��Qt���#� ,��[�n%��;�cX=������'#�ϱK:R��^g�r��-���,�I��v/']�f/�.�=PA�]����T�d(;��#D_s��������LvV燧�"��j��G!�n��m�vfF�� j}��~���>�e� �_*v2�k3]���Q�w$� @���$rMs�D���7�0]@4@�r�%��]������1Փk �P�ql �Mzj:�TaU�p6*a����#�@�Wa�R���!�n92V���f���B���층��xKvw^X[�=v ^���������9q���YgR�lx( ���A��)�]V/��*a��X��82��ѱi:�l�XA���L"jR��>�����n~r6�~��n/��W�4PA�y�7&<L�0L�HU�o�&�T��w�l����n�Z�&�exT���[������%�+�pʝo�a��k��* �N�4��b����(���T���f}IX���@gZ&p��.<D[�����v`��� L�(QiA�n�'�Ty �P��v3H��m��J�"o�.�Q����UJ ���,a}�`D�(��R+*�U�mI���_ �-�D����x�brJ�y�dn��M?���_�2-�����f� m��#3�P'M��(����I�b�\�$��K&t>�s����}�]U�V�� �?)���ߚ����R����S ��c�J� �\t�\K�B,��n���=\���Yq�p��IoTM��n�oq���wƵ�yPh��e*��]�o�yVN�c��.Nk_A���X�̓�p�:2���Ƴ>)���O�;֞w�F�kMA��Y�8x{z����Ү����QY�MyǦq���3yu��9*{�Q0� Sb(��0-��m��V`p�H�����b��.� !�^ZF�>V,�a9��(Utn���������e�i/��H���Zb���i���`:� �<�Y(��V����9Q��'����î��y������ˮF�z�����6����|��3��0�7x,j+���f���{g�|+���|�v�dF쨂8D�*�$���oe�?�����ufI7H��?����,�����9��m�;�6�D�luuS��F`{�Y����b�. ����@�"ֺ�
Behavioral task
behavioral1
Sample
Whiteout V3.02.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
Whiteout V3.02.exe
Resource
win10v2004-20221111-en
General
-
Target
Whiteout V3.02.exe
-
Size
20.8MB
-
MD5
3aa14b7c69c9dc4d526edfd153cddfbe
-
SHA1
39df2917c6646b5bd27b4b720e1aabdc11e04f29
-
SHA256
70d1064e1a09d4a002d4fa70f635b085cf8e89ff41acbeb451c13785c3333b79
-
SHA512
47ed8c8f4965864e4204846fad606f51c10e5fd31569b3d35dee68f546588113177c37d3f0345c13431e25f8a80ddc00bbf8d367710f949a5f6a11d76a84d111
-
SSDEEP
393216:tSmSKg94sDs6uu4/4ZhyD5iUyMuL2+4IHWz5ocfSafx6weLRtKDUfT:tSMgGUluu4khyD5Ryb2W2dpfTeLRtKaT
Malware Config
Signatures
-
resource yara_rule sample upx
Files
-
Whiteout V3.02.exe.exe windows x64
50b1e7539ccbb27fd2ff38d78d32bcc8
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
wintrust
WinVerifyTrust
d3d10
D3D10CreateDeviceAndSwapChain
d3dcompiler_47
D3DCompile
ws2_32
WSAStartup
WSACleanup
__WSAFDIsSet
closesocket
connect
getnameinfo
freeaddrinfo
getaddrinfo
WSAGetLastError
socket
setsockopt
send
select
recv
getsockopt
getpeername
ioctlsocket
kernel32
IsValidCodePage
GetTimeZoneInformation
GetFileSizeEx
ReadConsoleW
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
LoadResource
LockResource
SizeofResource
FindResourceA
CloseHandle
GetTickCount64
Sleep
VirtualQueryEx
ReadProcessMemory
WriteProcessMemory
GetSystemInfo
VirtualAlloc
VirtualFree
VirtualQuery
HeapCreate
HeapAlloc
HeapReAlloc
HeapFree
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
OpenThread
SuspendThread
ResumeThread
GetThreadContext
SetThreadContext
FlushInstructionCache
VirtualProtect
GetModuleHandleW
GetProcAddress
CreateToolhelp32Snapshot
Thread32First
Thread32Next
GlobalAlloc
GlobalUnlock
GlobalLock
GlobalFree
QueryPerformanceCounter
QueryPerformanceFrequency
SetUnhandledExceptionFilter
GetLastError
SetLastError
CreateRemoteThread
GetHandleInformation
TerminateProcess
GetModuleFileNameA
GetModuleHandleA
K32EnumProcesses
WaitForSingleObject
VirtualFreeEx
GetVolumeInformationA
Beep
ExitProcess
GetSystemTimeAsFileTime
GetPhysicallyInstalledSystemMemory
VirtualAllocEx
GetACP
MultiByteToWideChar
AllocConsole
SetConsoleCtrlHandler
GetConsoleWindow
VirtualProtectEx
Process32Next
WideCharToMultiByte
LocalFree
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
GetFileType
WriteFile
GetStdHandle
GetModuleFileNameW
SetEnvironmentVariableW
GetModuleHandleExW
FreeLibraryAndExitThread
ExitThread
CreateThread
ReadFile
LoadLibraryExW
FreeLibrary
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
RtlUnwindEx
RaiseException
RtlPcToFileHeader
InitializeSListHead
IsProcessorFeaturePresent
GetStartupInfoW
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
SetStdHandle
UnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
CreateEventW
ResetEvent
SetEvent
InitializeCriticalSectionAndSpinCount
GetLocaleInfoEx
LCMapStringEx
GetCPInfo
CompareStringEx
DecodePointer
HeapSize
WriteConsoleW
GetComputerNameA
RtlUnwind
InitializeSRWLock
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
TryEnterCriticalSection
DeleteCriticalSection
FormatMessageA
InitializeConditionVariable
WakeConditionVariable
WakeAllConditionVariable
SleepConditionVariableCS
SleepConditionVariableSRW
CreateFileW
FindClose
FindFirstFileExW
FindNextFileW
GetFileAttributesExW
SetEndOfFile
SetFilePointerEx
AreFileApisANSI
WaitForSingleObjectEx
GetExitCodeThread
GetNativeSystemInfo
GetStringTypeW
EncodePointer
GetSystemTimeAsFileTime
GetModuleHandleA
CreateEventA
GetModuleFileNameW
LoadLibraryA
TerminateProcess
GetCurrentProcess
CreateToolhelp32Snapshot
Thread32First
GetCurrentProcessId
GetCurrentThreadId
OpenThread
Thread32Next
CloseHandle
SuspendThread
ResumeThread
WriteProcessMemory
GetSystemInfo
VirtualAlloc
VirtualProtect
VirtualFree
GetProcessAffinityMask
SetProcessAffinityMask
GetCurrentThread
SetThreadAffinityMask
Sleep
FreeLibrary
GetTickCount
SystemTimeToFileTime
FileTimeToSystemTime
GlobalFree
LocalAlloc
LocalFree
GetProcAddress
ExitProcess
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
GetModuleHandleW
LoadResource
MultiByteToWideChar
FindResourceExW
FindResourceExA
WideCharToMultiByte
GetThreadLocale
GetUserDefaultLCID
GetSystemDefaultLCID
EnumResourceNamesA
EnumResourceNamesW
EnumResourceLanguagesA
EnumResourceLanguagesW
EnumResourceTypesA
EnumResourceTypesW
CreateFileW
LoadLibraryW
GetLastError
FlushFileBuffers
CreateFileA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
FlsSetValue
GetCommandLineA
RaiseException
RtlPcToFileHeader
RtlLookupFunctionEntry
RtlUnwindEx
HeapFree
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
EncodePointer
DecodePointer
FlsGetValue
FlsFree
SetLastError
FlsAlloc
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlCaptureContext
HeapAlloc
LCMapStringA
LCMapStringW
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapSetInformation
HeapCreate
HeapDestroy
QueryPerformanceCounter
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
HeapSize
WriteFile
SetFilePointer
GetConsoleCP
GetConsoleMode
HeapReAlloc
InitializeCriticalSectionAndSpinCount
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
OpenClipboard
CloseClipboard
SetClipboardData
GetClipboardData
EmptyClipboard
GetCursorPos
GetKeyState
GetAsyncKeyState
MapVirtualKeyA
SetWindowPos
GetWindowRect
GetDesktopWindow
ShowWindow
GetActiveWindow
GetForegroundWindow
SetActiveWindow
UpdateWindow
DestroyWindow
IsWindow
CreateWindowExA
RegisterClassExA
UnregisterClassA
DefWindowProcA
PeekMessageA
DispatchMessageA
TranslateMessage
MessageBoxExA
LoadCursorA
ScreenToClient
ClientToScreen
SetCursor
SetCursorPos
ReleaseCapture
SetCapture
GetCapture
GetClientRect
GetUserObjectInformationW
CharUpperBuffW
MessageBoxW
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
advapi32
OpenProcessToken
GetCurrentHwProfileA
ole32
CoInitializeSecurity
CoSetProxyBlanket
CoCreateInstance
CoInitializeEx
CoUninitialize
oleaut32
VariantClear
SysStringLen
SysFreeString
SysAllocString
VariantInit
imm32
ImmReleaseContext
ImmSetCompositionWindow
ImmGetContext
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 4.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 836KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 190KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 299KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: - Virtual size: 244B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.UPX0 Size: - Virtual size: 16.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.UPX1 Size: 18.4MB - Virtual size: 18.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ