1��~W�I�|�W���2pcj���v�8���?}fL�� ����g�XC���r�D�Ō�������3��@�Z��#O��}�՛�֭�U�f~�� ���#�Z�>�)̜�D�4�&HPH�z�_a�]��#?a�G���B2�b{�vm���ޒ�;J>���S�u�lH�o��C�T@d�� ��X�-��k� ����:�y����^�]�@R�MQ���"R�0J�»��J��..V��C��9���5����ٴ�.��� 3����M38|�ѿ�8ڈ�Pb�x�ё� R��{�\Y���=����@)�L��$/�T-�O*������Iդ�n�Y��9�1�-;b��ve����n:�#Y���:�%Iu>�����X��� ���o8�E�s%�v�����78�N?d����Ci4��J,�/Q�"f�r(=@���a�3�6^�W�6tx����4���5��Ne Y9!���)�5�N�븆�O�r+�B�e��W�}���;�W�fkk�����V�IJ�|=�K��hɺ��z��R�et%g�c��яgtzXI�a}3]���Kc}.o�`F�x���la2����{|�P�i�P?���!(%��s5�����|[�)�/[`��{m+5�82WE�}�Nk+%Au�%���Q����1X�A ��q���+�<66L��ұ��&S�8p3(r�v�,�@�Rwji�m:�K��|�7;4�.O=��ږ�,} H��p�b�~�(�6��Xբ������'�f�~�!��� 8�Z�IJ+��F��8�N�cj���H�z%��#n�tP��ٍ?�VF�w�Q���c��(1x;�c:�Ҙ�d�����0����:�oQ��Xs�]�~�2��n�����.�s��}����Ƅ!�����Y�or��n�a�;��N}���,<�u*����8}��>��~�ݻ �2֟�-�� (FB�����cꉁqW����=����*�F���1˖ �z܋a�d��r�R�����u<�VH�ӭ�;Գ�A��:Ã�CP�#�������4hJl�(Kn��\�YJSF$��3�. ��c�� ����H�i*%�M������4J7pb����X�ln��q��sq�z�1�ߣ� �3VF��c�\1Cz{{?�Ӣ�Tu�@+�n;-� �8���4���#�c蜧�Cw�G��fˡ�2� *����qo����gh�����,_����#�ji�J-%ڷ�H|�z�6/�dԆ��ä]9��:���[0٢q;�,ah��f[��R9����<?��[c�i��8�W� ��<f��6p��J��On�K��j`�p�@g�!B���R��j�HMw�>cS��thcʦ�Gh���y�j!=S?ϳ��' ��8H�\�oe�4��zS�%1R��)dc�%�����rĜx�yU���(�t2��!��Kj��~5��-�� O8蒢I��(�E(��*"���jD�{s��{JVU�=����2mL�U�>���0=�����UD��$?��}7�m˖���+��NW��Vkc�%����^��� e2.�%�7�hUd^<�}9������N��*:�<�/`Elmbq��Ȍ�QX��8��?�&"����e��'J\�8kB���?����j�"��P�BHOp'B��S�bdj��Z?�Na�̛�SN�4�" ���X竫&v���|}�M*�.�-��@M��\-�o;Y�q𱶮`-9����Ȇ��=�mk���4��.~ ��3���7�8ߝ���5�c���D� ���O;���4Kݍ��]��s"g\R�}�ۉI�o���*[�UC�ߥ{4���2��4�N!?��H=�NS�� 7�S+���A�BۤJO����ګY4�C���N���{2�����'E�\�������f������-M���|��t4R���d@ܞ��c?ʫ��06q���(C{E�Cmm��]W��:S�p7�"��XJ;�wa�F��`��a2���#�W���&B�u�JDoQ5���\��ux\bT�k�̝�ɚ����0]ܡ��:P@e��A�@}�G�b2�PJ��1�|MJ��C]&��E)����<u=�~䮬�� ��)��� �G��md?�A��h�����շ�e?�T��(���ʍ�e�r�vej\̄���8�9��Tov=� Nˢ>$AH���$��xF���o�5#׳ ��Xl_���=���!�[QAƗ&�\�J( �6j�/9�q)��8��:����+��i*�k'lz�ԘKP������lH&j�Q#���T�� i�,��6x�7[h�c�O����)'�]éÓ����ND�̎~E��Ƹ"����#�r��ԂD,��p'#a?)m��w`���6&'𦡄�c��j8�[(�5[샍�1�j��]����Z�"�u�h8�G��J�>]H3\a�]������,�Naa�3t��S ��D�ă,\�d�1��`$T͆�6�H� 2_�S܈O�~�$�m�(�r��$���u�K�s���8$��3�MMȵ��h~E/�EQF���(P��)um@�0L~�����>�1h ��?K���ԑks :��9� ���q(8���$Ԏ� �SH�\%/ap��b�K��$��}k>���g��x����2�b� �6@#�.��>�^q�L�����霈8��=�{��a��I�������/[PJȩ�U.>���_�x"G��� �aQ��v D�t�U��<LH�vw��F��p������Y�����-�~"�e��7���F�U���ٰſ�h1��db�b���X����c6�>ͫ�sGr��g,{�[�LI�>�B �gR��U�v�����I\B�u<�����W^�fu���+"�i'�6wQ���*O�w+i�_7���{DLY�';z�XNx�*�C�,wUX!��\�*�O��A(1-JD�]XV��^�A���uG ����m��;"SG_�6�b`�����.o<�N�^�QD^�+�6D�⎕�-�;�>���X�R%����n�_4u4飓��k>�rE�i�_�RHc�a�����
Static task
static1
Behavioral task
behavioral1
Sample
Clarity, fix bez naeba/Clarity_mapper.exe
Resource
win10v2004-20221111-en
General
-
Target
[brokencore.club]_Clarity, fix bez naeba.7z
-
Size
7.8MB
-
MD5
d51bd671230f77afda00c878e1c0794b
-
SHA1
6ef0218029f269fc76566c758e78336e1d1da335
-
SHA256
2a27682a1ac800aadbb75c3159ab5836ea97a0273ca6395b57bb524c2d269cce
-
SHA512
abbe34cac85a193425c13d9383c0056763ff2e1a10c633a45c54257fbdb37f1c9ef5c217c1ca6392d13796ffcd9ece31f01b8bdcd6071493a8bb3d1782c9e358
-
SSDEEP
196608:c4r/Qf2dZe/1yUuH51ELyt9ZhXZSktlV+Z4U0Rz:cy/Q2Le/1xuHLxbpSktlIZ4zJ
Malware Config
Signatures
Files
-
[brokencore.club]_Clarity, fix bez naeba.7z.7z
-
Clarity, fix bez naeba/Clarity_mapper.exe.exe windows x86
0ba8e5f599a14bc725b7a8c7a596e11e
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
Process32First
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
MessageBoxA
CharUpperBuffW
shell32
ShellExecuteA
msvcp140
?_Xlength_error@std@@YAXPBD@Z
wininet
InternetOpenA
vcruntime140
_except_handler4_common
api-ms-win-crt-heap-l1-1-0
free
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vfprintf
api-ms-win-crt-runtime-l1-1-0
__p___argv
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
Exports
Exports
Sections
.text Size: - Virtual size: 12KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 2.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
soltaz1 Size: - Virtual size: 488B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
soltaz0 Size: - Virtual size: 868B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
soltaz Size: - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
soltaz Size: - Virtual size: 2.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
soltaz2 Size: - Virtual size: 3.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
soltaz3 Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
soltaz4 Size: 8.0MB - Virtual size: 8.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
Clarity, fix bez naeba/Инструкция.txt