6c8a41af3344dc63c4a21990f11b4e96[.]bin

Sharing

Copy URL Twitter E-mail

General

Target
6c8a41af3344dc63c4a21990f11b4e96.bin
Size 39KB
Sample230127-qqvtxsbc88
SHA256 b448cac2a9d3bdc47b3946f19b57469371369b7d3d2e19293ecbcf9c3cb73602
MD5 031d64c47453a6c4148f32723fff365d
SHA1 05d17d93ba1d7707855e3793029b97e40f2a2c4b
SHA512 57863788bc0fa342f7bf5ba65c3a5172d081543c1c45d2ce960f3f4ce110d273d0ff07c8a41638100eab667d1faab96933194f1b63d2e0cb04f2cf547298dd78
SSDEEP 768:CBcW9mLEWmvNFNkW0ScVfyAuOd5bZWchgDxUyDE+pWSNzb+HEMFQWPOAs1i:CBcHIvNFNkW03V5d5bZQDGZ+pWSdikMf
MD5 SHA1 SHA512 SSDEEP

Score

N/A

Malware Config

Signatures

File Explorer

6c8a41af3344dc63c4a21990f11b4e96.bin

.zip 39KB
cc43fc18d6d1dc662ad747652cd961152ee13dbf2cea9bf75564f3e2e8ffd2e8.exe

.exe 56KB

6c8a41af3344dc63c4a21990f11b4e96.bin

SHA256 b448cac2a9d3bdc47b3946f19b57469371369b7d3d2e19293ecbcf9c3cb73602
MD5 031d64c47453a6c4148f32723fff365d
SHA1 05d17d93ba1d7707855e3793029b97e40f2a2c4b
SHA512 57863788bc0fa342f7bf5ba65c3a5172d081543c1c45d2ce960f3f4ce110d273d0ff07c8a41638100eab667d1faab96933194f1b63d2e0cb04f2cf547298dd78
SSDEEP 768:CBcW9mLEWmvNFNkW0ScVfyAuOd5bZWchgDxUyDE+pWSNzb+HEMFQWPOAs1i:CBcHIvNFNkW03V5d5bZQDGZ+pWSdikMf
MD5 SHA1 SHA512 SSDEEP

Password

infected

cc43fc18d6d1dc662ad747652cd961152ee13dbf2cea9bf75564f3e2e8ffd2e8.exe

IMPHASH 851a0ba8fbb71710075bdfe6dcef92eb
SHA256 cc43fc18d6d1dc662ad747652cd961152ee13dbf2cea9bf75564f3e2e8ffd2e8
MD5 6c8a41af3344dc63c4a21990f11b4e96
SHA1 0cf67235a9a94f016dfd2d0b0416415f38502a6d
SHA512 bd15674b2a89957b2735a2860fc211c99e494da32a46e913cf9c2d4e9e71131cd7d2894b6fa968825f8f2418d2b9427f8422e8fb498b0c83216e8436f01f9690
SSDEEP 1536:3NeRBl5PT/rx1mzwRMSTdLpJdfeYm+L8i1NNw:3QRrmzwR5JXJL1D
MD5 SHA1 SHA512 SSDEEP

windows x86

Password

infected

Minor OS version

Major OS version

Entry point

12199

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

mpr

WNetEnumResourceW WNetUseConnectionW WNetOpenEnumW WNetCloseEnum

ws2_32

ioctlsocket getpeername ntohl select WSAGetLastError htons recv socket closesocket getsockopt WSAAddressToStringW htonl connect

iphlpapi

GetIpAddrTable

winhttp

WinHttpReceiveResponse WinHttpOpenRequest WinHttpConnect WinHttpCloseHandle WinHttpOpen WinHttpSendRequest

kernel32

FindClose FindNextFileW SystemTimeToFileTime OpenProcess FindFirstFileW MoveFileW GetFileSizeEx SetFilePointerEx SetEndOfFile GetCurrentThreadId GetLocalTime ExitProcess SetFilePointer WaitForSingleObject GetComputerNameW SetEvent GetLogicalDrives GetTickCount Sleep CopyFileW GetFileAttributesW ReadFile CreateFileW MultiByteToWideChar CreateEventW WaitForMultipleObjects CloseHandle SetFileAttributesW CreateThread InitializeCriticalSectionAndSpinCount LeaveCriticalSection EnterCriticalSection ResetEvent DeleteCriticalSection AllocConsole WriteFile WideCharToMultiByte WriteConsoleW GetStdHandle CreateMutexW CreateProcessW GetCurrentProcess SetHandleInformation HeapFree GetLocaleInfoW ReadProcessMemory TerminateProcess GetModuleFileNameW FlushFileBuffers OpenMutexW GetLastError GetProcAddress Process32FirstW GetExitCodeThread CreatePipe Process32NextW GetModuleHandleA CreateToolhelp32Snapshot ReleaseMutex GetVersion DeleteFileW GetCurrentProcessId GetVolumeInformationW ExpandEnvironmentStringsW HeapAlloc GetProcessHeap HeapReAlloc QueryPerformanceCounter

user32

GetWindowThreadProcessId GetShellWindow

advapi32

FreeSid LookupPrivilegeValueW OpenProcessToken GetTokenInformation EqualSid RegSetValueExW RegCloseKey AdjustTokenPrivileges RegOpenKeyExW LookupAccountSidW AllocateAndInitializeSid DuplicateTokenEx RegQueryValueExW

shell32

ShellExecuteExW

ole32

CoGetObject CoInitializeEx CoUninitialize