Behavioral task
behavioral1
Sample
Device/HarddiskVolume3/Ex Disco C/utenti/VerginerF/AppData/Local/Microsoft/Windows/Temporary Interne.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
Device/HarddiskVolume3/Ex Disco C/utenti/VerginerF/AppData/Local/Microsoft/Windows/Temporary Interne.exe
Resource
win10v2004-20230221-en
General
-
Target
6q0kph0p.exe
-
Size
288KB
-
MD5
41956f9e4ca0c21df9e10075c4dcc711
-
SHA1
55ceaa53e7d5c4bd3b67c0ae2442d3716348d36b
-
SHA256
23e5caaccd9e494fa9b8c181fdb9ddf03928d3803f6300a6483524458b3a6d7b
-
SHA512
5af59fd968a6cc48527e9c18d3160e1bf340e2f3ba541d82a620c710b1ff0c7b53f29019d9ae7a74f4c18bd0a377d3d84c15a2891d0e086a83957e6981706ddd
-
SSDEEP
6144:EziKl8RAkk6e3F4lEzhBRY9ggS+9hXE1ZdzH7a6Yi4WFqKJaebYz:k/kkr6lAhvY+saZxH7a6TqNebYz
Malware Config
Signatures
-
resource yara_rule static1/unpack001/Device/HarddiskVolume3/Ex Disco C/utenti/VerginerF/AppData/Local/Microsoft/Windows/Temporary Internet Files/Content.IE5/4MFAN0LK/6q0kph0p.exe upx
Files
-
6q0kph0p.exe.zip
Password: DsUjmlG885/kkmS
-
Device/HarddiskVolume3/Ex Disco C/utenti/VerginerF/AppData/Local/Microsoft/Windows/Temporary Internet Files/Content.IE5/4MFAN0LK/6q0kph0p.exe.exe windows x86
Password: DsUjmlG885/kkmS
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 444KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 289KB - Virtual size: 292KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 5KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
out.upx.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 485KB - Virtual size: 485KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 63KB - Virtual size: 62KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 59KB - Virtual size: 80KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 88KB - Virtual size: 88KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
manifest.json