O� ���1���%�r#��9/Q�Y����^%���q(���n9B�[�Z��Pge��̲��X��@lSN;X,�O|g�#$}������>�����ӕ�&�������RK~��YiS;u�ٛ�&������L{Џ�<����9�U N������4v=�w&�z�e']�����_������ݤ�a���HF. ТS��ͪ���E<����z���V�k�GU�jX ���k�N������TKK�"7ˢ{H�dE |���W ��BP�M9����U��M�C�wQ� �6f��2)I�Ab8�R�'�X���}N��+x�e_�ܫr%A���Ը^͠�R:��<l�>J�R]=w��JT,i�F��X> T!�]o�MpL��o������׀����ZL�����*���^���.qb������<�_H��$�xx1]�܊��M�(Bx�}�%�)�C���(���>t���QI��ȫ�#r,xS�s;�H�����J��̍#�|"��qr�N՟���N�HZ1��k�W��va����>a"Ԡ֓s��;"�OĔ:Y���96l2#\���E�:X@j!�~9�� �I��R��?8�������\��!������W\Q긹�5�$:��oZ��k���E�������e<l/Ӧ���C���� � ũ�|[����m�3*ڱ0�n:��{���5�v4^3��8��0� �������*w>?U=����6V�A�t~����ܝ~r���h�=ԛ)%�Ke�6ίC�E`k�a��#��O$ jR��n�Mpx�\J/R��ؖ2���t�Ɩ��+,��`��}��]3Rp�Q���!���Od�ی��^<ߡR8lh�z;�71��E'�Б�D��<´���k�0�@�>E�i�\vN��.�DL~�5�r_R�~J��y��p�h��~�6c�͇��r��c>M-���1���1�Mʖd�ø_,�۟�Dq>�d<T�iF Rh �R�~�ȲT>��u�w� ���U:AÁ" �=cHP�:�r.�|j!:I�;��GV�@�����F�b�&k�IW"�9��&/~�랎o@FԘCV����_A���!ܡ��x�Er�(GJ���wijmӬ�.�b�g���!����R^{{�:W�Up�-�S9�㴞]���&X��?�m[��d�.�@ʹ���ϒI?-=��G�Z�_�t����!0�H��Hp� ��2Yb�҃��xE1���m�~+ip��Y�t�-~��ʐ�L�C�R��~��=��Bzx-呑�3?��&���lz��i�r����v���Օ�[�%��iׁ�m�ZM�-l�=���7�8��|#���n��3��PcB3up�^E�qee��G�Ku9*p����Dl%,�ޖ�Rx��I��� �G�� �Gvl����3���RC�W��W�_���0��ř�'c�J()ZRӣ:"fr���9)����'�viѐ}���gi�aFT��A�s�[��3���ٻYa� ��Ŧ$���8{?V '����l��9BknW�z�z����yUɢLpJ�>������h��V��L���� [��������C��͟��JxlaT�ER4j��y�8y�r+���ug�?Xn�����)UC���%���c)0����!-��h�:�]�EF�� ,i��_�y�g± 6B'/�2��%��Q���9Y =�Hr���q��=��t"��o��ij �[yp��Q�8�-�"O��� �* �w}SW��{�!9�*"6Ǥ�U�>�IpB��쓇吥���)6 0� +ӱġ?>����6��x��<M�M���F�`-s�dx d ��ݛ������ �� C˟_{�w�?�/."��b����w~��w���������~�X%�5Z� �9�"`g�2�6/�=ykX� ��q��/+lo��^����'��e��߬��%�TĠ�XW�ax�1J(g�aKd4�����7�G�?Ѩu�`*���H������.�S�`�m ;tL0�� <Gp�x�j���PWU�����˳�AN���_zn�.8Xl��G(kB�� 5n��T@E;�nG���q�E�7�`ī���B=��ʟ��~�q���7��ED�\>hO��*G$ �E-� x������t��k�x;�eLq���?�yԩ�kH^��0�����V� aG�w3��V�Z;���:+�T$O��JL�n/��#�4b��Р��%�0����7��fu�dzA�j %"�ω�����������ggS�K?:_�L�6���I}��"rl�D������']�TsK��GMC�Toe�>��<j�i���L]��8 ��Ns�p�鐛��EI���@�v��䍰Ŵn��ה��>^�c��.� ����Q�����ȸ\܉�$ĢZ�����8�����J�h�k�j�:v��m��3Tn�S��2Ьe@�-��b���r�Y���$+����5����4�Ŝ_2�gg�JV�����������ĐQ�i��Ρ[ L=ᔦʅ���R/̐ ��5.�x��_��$ �r�*|nx�e�#����Ϭ��J�,|��%RӽKǐ3��9�2(�R`���{R�(��`{�EBR�pCb�a7Q�G!8�佴���%R�!�ӧ%����lL�!�=����! �"F�F����u�g��0�K�Xt�A:���Z�fpu�����(�^��� ���6,��� I�j]����*�O���{犨�<1������i��{�� P�+E�;Ŀ���²%����T�}�v���������Ý0H�Ծ���j�2'��)�_�[A�luZ3I8�_���c�J���Ў��S��틣�6�i��滆-(�Z~�W_&��JF�P�e��aa�m65 ���*�8:a��ĭh��}Ss��7T�]�zE�kj�0tx��X�śG�g��)�h��8�={�*�۬���k��Н�q��R\��.�: �5l0#QK���uJ�:�Ϲ��dmY�#�����0زE��D�\O�I���^�H<��!],�˴eM4�{�'1����2~R.��ڷ��{@(�?���80-5�U��U.����S��^�o(��"
Static task
static1
Behavioral task
behavioral1
Sample
EtarryLauncherV6.1 (1).exe
Resource
win10v2004-20230220-en
General
-
Target
EtarryLauncherV6.1 (1).exe
-
Size
11.0MB
-
MD5
7b13f53ba97bf6952c1db4e8bd9a1bcb
-
SHA1
1be61be54ceed9a1e23b5684ddc5739e983a1a85
-
SHA256
1d3e40c1978590aae7b032bf4999eca78d0ec6ee16bb989b52b9a8907d000130
-
SHA512
2cea8ba1df6a7355aa1745da067c5bf94d949a091986c49739e029582516568313af1844edda644e2faef077b3d93cc596d49129c45eb39962e330dbd49e0d50
-
SSDEEP
196608:gAB2YrmWdr0Tlr6r5AF6tlIDhKN7wUUNjw5eUVFamB24X7tmiAVBdMvvIfZD6mC:gOtr0YrXtlID4twUUxwJLdhYzJfZD63
Malware Config
Signatures
Files
-
EtarryLauncherV6.1 (1).exe.exe windows x64
98e8910bdc627abfdcaaf3af9604876d
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
CloseHandle
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
api-ms-win-crt-runtime-l1-1-0
_register_onexit_function
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vsprintf_s
api-ms-win-crt-filesystem-l1-1-0
_unlock_file
api-ms-win-crt-string-l1-1-0
isalpha
api-ms-win-crt-heap-l1-1-0
_set_new_mode
api-ms-win-crt-utility-l1-1-0
srand
api-ms-win-crt-time-l1-1-0
_gmtime64_s
api-ms-win-crt-convert-l1-1-0
strtol
api-ms-win-crt-environment-l1-1-0
getenv
api-ms-win-crt-math-l1-1-0
_dtest
api-ms-win-crt-locale-l1-1-0
localeconv
wtsapi32
WTSSendMessageW
user32
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
Exports
Exports
Sections
.text Size: - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 217KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 90KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.cracksy Size: - Virtual size: 10.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.cracksy Size: 10.9MB - Virtual size: 10.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 91KB - Virtual size: 91KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ