General

Malware Config

Signatures

Files

• a2414360dce8d1ef6655be853d6e8a4f916095ad7ff51d6232de1e0e09e78e86

  .exe windows x86

  
  

  Code Sign

  0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

  Certificate

  Issuer

  CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  01-08-2022 00:00

  Not After

  09-11-2031 23:59

  Subject

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

  Certificate

  Issuer

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  23-03-2022 00:00

  Not After

  22-03-2037 23:59

  Subject

  CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

  Certificate

  Issuer

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  29-04-2021 00:00

  Not After

  28-04-2036 23:59

  Subject

  CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a

  Certificate

  Issuer

  CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

  Not Before

  21-09-2022 00:00

  Not After

  21-11-2033 23:59

  Subject

  CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  01:70:c5:d8:e6:2a:ba:c7:db:20:91:8f:8c:95:b7:e8

  Certificate

  Issuer

  CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

  Not Before

  07-07-2021 00:00

  Not After

  11-07-2024 23:59

  Subject

  CN=Tenorshare Co.\, Ltd.,O=Tenorshare Co.\, Ltd.,L=Wan Chai,C=HK

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

  Certificate

  Issuer

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  29-04-2021 00:00

  Not After

  28-04-2036 23:59

  Subject

  CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  01:70:c5:d8:e6:2a:ba:c7:db:20:91:8f:8c:95:b7:e8

  Certificate

  Issuer

  CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

  Not Before

  07-07-2021 00:00

  Not After

  11-07-2024 23:59

  Subject

  CN=Tenorshare Co.\, Ltd.,O=Tenorshare Co.\, Ltd.,L=Wan Chai,C=HK

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a

  Certificate

  Issuer

  CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

  Not Before

  21-09-2022 00:00

  Not After

  21-11-2033 23:59

  Subject

  CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

  Certificate

  Issuer

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  23-03-2022 00:00

  Not After

  22-03-2037 23:59

  Subject

  CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

  Certificate

  Issuer

  CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  01-08-2022 00:00

  Not After

  09-11-2031 23:59

  Subject

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  a1:21:a7:96:36:85:14:f7:3d:69:b8:35:f3:49:e6:e5:54:cc:14:4a:d6:68:5d:ad:4c:fb:13:99:8a:e6:f8:6b

  Signer

  Actual PE Digest

  a1:21:a7:96:36:85:14:f7:3d:69:b8:35:f3:49:e6:e5:54:cc:14:4a:d6:68:5d:ad:4c:fb:13:99:8a:e6:f8:6b

  Digest Algorithm

  sha256

  PE Digest Matches

  true

  Signature Validations

  Trusted

  true

  Verification

  Signing Certificate

  CN=Tenorshare Co.\, Ltd.,O=Tenorshare Co.\, Ltd.,L=Wan Chai,C=HK

  14-03-2023 07:25

  Valid: true

  Chain 1

  CN=Tenorshare Co.\, Ltd.,O=Tenorshare Co.\, Ltd.,L=Wan Chai,C=HK

  CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  Chain 2

  CN=Tenorshare Co.\, Ltd.,O=Tenorshare Co.\, Ltd.,L=Wan Chai,C=HK

  CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  86:e5:20:94:3a:de:cd:26:17:7e:3c:fd:63:95:d4:1b:69:20:48:db

  Signer

  Actual PE Digest

  86:e5:20:94:3a:de:cd:26:17:7e:3c:fd:63:95:d4:1b:69:20:48:db

  Digest Algorithm

  sha1

  PE Digest Matches

  true

  Signature Validations

  Trusted

  true

  Verification

  Signing Certificate

  CN=Tenorshare Co.\, Ltd.,O=Tenorshare Co.\, Ltd.,L=Wan Chai,C=HK

  14-03-2023 07:25

  Valid: true

  Chain 1

  CN=Tenorshare Co.\, Ltd.,O=Tenorshare Co.\, Ltd.,L=Wan Chai,C=HK

  CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  Chain 2

  CN=Tenorshare Co.\, Ltd.,O=Tenorshare Co.\, Ltd.,L=Wan Chai,C=HK

  CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Sections

  UPX0

  Size: - Virtual size: 2.2MB

  IMAGE_SCN_CNT_UNINITIALIZED_DATA

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  UPX1

  Size: 1.6MB - Virtual size: 1.6MB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 451KB - Virtual size: 452KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

• out.upx

  .exe windows x86

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Exports

  Exports

  CreateExportObj

  DestroyExportObj

  NSISLog

  libssh2_agent_connect

  libssh2_agent_disconnect

  libssh2_agent_free

  libssh2_agent_get_identity

  libssh2_agent_init

  libssh2_agent_list_identities

  libssh2_agent_userauth

  libssh2_banner_set

  libssh2_base64_decode

  libssh2_channel_close

  libssh2_channel_direct_tcpip_ex

  libssh2_channel_eof

  libssh2_channel_flush_ex

  libssh2_channel_forward_accept

  libssh2_channel_forward_cancel

  libssh2_channel_forward_listen_ex

  libssh2_channel_free

  libssh2_channel_get_exit_signal

  libssh2_channel_get_exit_status

  libssh2_channel_handle_extended_data

  libssh2_channel_handle_extended_data2

  libssh2_channel_open_ex

  libssh2_channel_process_startup

  libssh2_channel_read_ex

  libssh2_channel_receive_window_adjust

  libssh2_channel_receive_window_adjust2

  libssh2_channel_request_pty_ex

  libssh2_channel_request_pty_size_ex

  libssh2_channel_send_eof

  libssh2_channel_set_blocking

  libssh2_channel_setenv_ex

  libssh2_channel_wait_closed

  libssh2_channel_wait_eof

  libssh2_channel_window_read_ex

  libssh2_channel_window_write_ex

  libssh2_channel_write_ex

  libssh2_channel_x11_req_ex

  libssh2_exit

  libssh2_free

  libssh2_hostkey_hash

  libssh2_init

  libssh2_keepalive_config

  libssh2_keepalive_send

  libssh2_knownhost_add

  libssh2_knownhost_addc

  libssh2_knownhost_check

  libssh2_knownhost_checkp

  libssh2_knownhost_del

  libssh2_knownhost_free

  libssh2_knownhost_get

  libssh2_knownhost_init

  libssh2_knownhost_readfile

  libssh2_knownhost_readline

  libssh2_knownhost_writefile

  libssh2_knownhost_writeline

  libssh2_poll

  libssh2_poll_channel_read

  libssh2_scp_recv

  libssh2_scp_send64

  libssh2_scp_send_ex

  libssh2_session_abstract

  libssh2_session_banner_get

  libssh2_session_banner_set

  libssh2_session_block_directions

  libssh2_session_callback_set

  libssh2_session_disconnect_ex

  libssh2_session_flag

  libssh2_session_free

  libssh2_session_get_blocking

  libssh2_session_get_timeout

  libssh2_session_handshake

  libssh2_session_hostkey

  libssh2_session_init_ex

  libssh2_session_last_errno

  libssh2_session_last_error

  libssh2_session_method_pref

  libssh2_session_methods

  libssh2_session_set_blocking

  libssh2_session_set_timeout

  libssh2_session_startup

  libssh2_session_supported_algs

  libssh2_sftp_close_handle

  libssh2_sftp_fstat_ex

  libssh2_sftp_fstatvfs

  libssh2_sftp_get_channel

  libssh2_sftp_init

  libssh2_sftp_last_error

  libssh2_sftp_mkdir_ex

  libssh2_sftp_open_ex

  libssh2_sftp_read

  libssh2_sftp_readdir_ex

  libssh2_sftp_rename_ex

  libssh2_sftp_rmdir_ex

  libssh2_sftp_seek

  libssh2_sftp_seek64

  libssh2_sftp_shutdown

  libssh2_sftp_stat_ex

  libssh2_sftp_statvfs

  libssh2_sftp_symlink_ex

  libssh2_sftp_tell

  libssh2_sftp_tell64

  libssh2_sftp_unlink_ex

  libssh2_sftp_write

  libssh2_trace

  libssh2_trace_sethandler

  libssh2_userauth_authenticated

  libssh2_userauth_hostbased_fromfile_ex

  libssh2_userauth_keyboard_interactive_ex

  libssh2_userauth_list

  libssh2_userauth_password_ex

  libssh2_userauth_publickey

  libssh2_userauth_publickey_fromfile_ex

  Sections

  .text

  Size: 2.0MB - Virtual size: 2.0MB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 641KB - Virtual size: 641KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 53KB - Virtual size: 71KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .gfids

  Size: 3KB - Virtual size: 3KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .tls

  Size: 512B - Virtual size: 9B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 1003KB - Virtual size: 1002KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 98KB - Virtual size: 97KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ