O��q}�&Ƣ��^�~�~��@m�������l���N��N ,�"Q�R��✀���1�(\���N�͛ ��]�L�����e���9��&�m�a#ͬ�R�f䏺���0�����{�e��ƀ4��Q�F�d��>��_R�c]�~�@hO_ ��*!�f�p�T�*�D�"cj:�8�i!��Si���ݔAn���KU���R�48�,��s`H�z�՜�VD�����L�ښ)sPbT�BB�O���l��S���͜���k�6�������"د�o.w����e�5��A��4#�InԴ�U|�g=2Q ��U�q���,x��� ��+�篔�z�fy�������Z����u�w(�+~�� ��Ci t�4�Bް���u��h�4M3�=�j��m�w.m;�A���9̡/�-���x�����B�P�"6ޓ��-q�"�pk����ŕ��� kEOX����#��u�b�p+��C���1�5���ܳR������%(0k�[ '����!T��AUrb��l+��o��&짨-��<�6Ax<�io8/����Y��מW��]S1h�Ơ�����U�!_�yџb^�F��~�RE'*ej�(>4�l�Sй��\]e������x�4�f'���G4������::0a�����4��.6��\8�-N���<B�]��/^�MKDk���0��c�?�s_V�<x���� ���1�X�����슴����Z�|TvT`0�8P��4�\ҟ�4�D�̷X�Ĵ{ø��s�%��q�f��!$�9sW�B8�������e�I���;��>�}=�_J��Z�А����ٶ��XF(I�6ӓ ǿ��W��yrog�#Yo�S�~5��� 23$d6�N!ulRTvC�]�v��ƗY>�7�xD@�~��+��'G^�U�y4u���B8�cA�$�V� �zNG��\|����>�jI�9T�8�;͐J|���fX0��<���=� �5��=�8���*�b3;��.� leA̳m�{ȿ1�m�0��N��A�N������\: Pf���Ѥ�dUi���@\���~O��GdBN��ZD����} �>Ai��%�Oߘu�M�C6x�%���y��>�C�V"3�:�����6Ú�쉍I�[>�=��24G;���5m"j�d��X�BD�B��}�,>�E�.��̈́�-C���� �O4�.���N�7��Sf��M��lKX�ל� T��.���w�a�����I��>;�Z=�D��ows ���D>�s���k�gW"8|���Γ����W3�=d!0q�a��I�HN��TUSyv��[n{2 źX���C��]�W:�~y,�0� ݥ�%��` P�8Kh7"A�@�{���_$���G�Dz���>�A�!?�+�Yڤn%g=����=��^>���z�9���c��}A��z.�����0���}I"��^�9���z��D��sj�B~�d�i��;ц�|쬟Anچ��_�E�@tm)m2�oU�:�D$kw������9,�[#�x[�$c�Jm��-��h��>���.L�B������>���|�2����P�ڸ -������'@�%�a����(d�x� Xu�I���Eh�8�k�(+aw�C���(q�.t���~U�m���[\V�X}^7(ixW��9�!`p��Ez����!���ʛ��DAX�R�IIN��އ��B�l����(l\Y��������K�����6 �M�8g��Qp�x��eA -.�%��A����7*{\{[y�[��)eQ����)�9\)�B�ϔ D��0����\SA��w��!a锯��&Oґ��mu���V����1X^��\]\���~��f��� ��������(u���8�oZw�%��ˣ�N=S�ȷ�馋�F[��ȧk�mAԖ�����r�ָf�㊴�Dڝp���Ĩ��[�k���Co�fg�FZ^���̳|]2��+�-���+P-�AVL�D�)1A����,,c��Fa�~�X�Ή̾��yim��1[�{�9�ٷsKB����m�H�����u]x�$3��]1�I��,LEc�Ʒ�}@?�챝�r�7��և����H^�����N7!I�gD)i��w�@ rfU��F���:v�K�?wD#v�x���>�ʫ7X�;9���W);�mw��̚7\J��g:��G^� ����H}� �a ɽg��y�e��ګ��o�H�Y�b�e�D|>����i��]I���Ӏ�� ����alaq�?̈́jM�s�:�RL<�Z"2I{_fG>�>~��J��e�x�X?�ˀ���ٻ�q���Ve�����&���uwgc��EJmU�>]y�~N7��"z��9cDT� ��,!Ɏ;ֶ{���� �??��S����cYz@&rg�V��O����u/e.^Ķ�ҟh?(�>�B{X_�Ф�(���!�T�k��W #��Y���t�:�-���<�f,�����w�:��8_ґ�f#�Y|F�j�n8��IZcV4��AG:P��z������`�y0���Z���\���SM�ǝY�パͣ�4���������%�U3D~>��i"l�-�Q*8z�ݬ��ř?�?A��e�!��UP�YI1�Z &��������k4��a���\�$_|{��Ө%���$�F�=��!�WE��:��"]>#ߨ�������J�Ј���)V�3杂y���b��u��!�MD+旃)nHqUjKЃ5���BFe�_+��T�#�qj/���М���O�𱦋���d��K��[�A;�`�;(qI�m/���L��s(�����k�����e0�.}�R7hYQ��j=�����Ȗ���_�T3M���0�'���/�ZBP"@�-բ�*7#'Z���Sx�n���B Eؐ~��H�k�z� /쇱2�e���?��MV� ��a*U���CWE��&n����H}Zn�e�A��{��|it��.�By���|ݎH�KGm:� ��?���v��ח]7��]l�+�W�BT-XBʉ��E�>i�"TM�����-�[��Z�9=d� ������.������-���k����1\�G�j18%P�kZ��Er
Static task
static1
Behavioral task
behavioral1
Sample
Setup.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
Setup.exe
Resource
win10v2004-20221111-en
General
-
Target
Use_2022_As_PSw0rd-FuIl&FinaI-B3.rar
-
Size
6.4MB
-
MD5
e49406dd71ea9a599c61875187ae5f92
-
SHA1
6a121381222fd5a7d3582e74a6109784b7a7b343
-
SHA256
c304bf933722c228b75e5f26af3b73fe1b13b1cd5fbc0bd9062cd558b5e6807b
-
SHA512
3f5c55f2dc801538461d6f29358d3903945537d5b3ed07eea8f054674fe0c01def7b95227dd620eda63b61d574e14f0cdaac4a412edef7c5fa14b2cb39d3f942
-
SSDEEP
98304:i8USpY9+QvnzsQbYeB6fuQ5EZnUkUVzyfJWDhpfQx3MR4XBvO2o8QF:7UGQvnISBbCVzKWhppRGXCF
Malware Config
Signatures
Files
-
Use_2022_As_PSw0rd-FuIl&FinaI-B3.rar.rar
Password: 2022
-
Setup.exe.exe windows x86
Password: 2022
11ea24073ee65343ee563e3160c77fde
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
lstrlenA
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
DestroyWindow
CharUpperBuffW
gdi32
GetObjectW
ole32
CoDecodeProxy
Exports
Exports
Sections
.text Size: - Virtual size: 93KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.CRT Size: 512B - Virtual size: 4B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.ru} Size: - Virtual size: 3.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.?O2 Size: 1024B - Virtual size: 896B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.xAW Size: 6.2MB - Virtual size: 6.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 82KB - Virtual size: 82KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
langz/Croatian.ini
-
langz/Danish.ini
-
langz/English.ini
-
langz/Finnish.ini
-
langz/Hebrew.ini
-
langz/Hungarian.ini.ps1
-
langz/Indonesian.ini
-
langz/Japanese.ini
-
langz/Kazakh.ini
-
langz/Korean.ini.ps1
-
langz/Kurdish.ini
-
langz/Norwegian.ini
-
langz/SimpChinese.ini
-
langz/Sinhala.ini
-
langz/Slovak.ini
-
langz/Swedish.ini
-
langz/Thai.ini
-
langz/TradChinese.ini
-
langz/Ukrainian.ini
-
langz/UyghurLatin.ini
-
langz/Uzbek.ini
-
langz/Vietnamese.ini