Static task
static1
Behavioral task
behavioral1
Sample
Backdoor.Win32.Androm.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
Backdoor.Win32.Androm.exe
Resource
win10v2004-20230220-en
General
-
Target
Backdoor.Win32.Androm.kwkh-b9dd2668c348c75e658e1ab0af50cfed16eb1f14e5b6dc8a5b28c7faf23ce678
-
Size
156KB
-
MD5
a413bff6f7acb24d45557a6dcc335c57
-
SHA1
766584bbb71259e3b0b954b7da683e88a8640724
-
SHA256
b9dd2668c348c75e658e1ab0af50cfed16eb1f14e5b6dc8a5b28c7faf23ce678
-
SHA512
4c314cf505b758ad117aba6398d15d5c260dcdb51ef69f23525dc502ea327da4f7a63a97fca0459d5335693d47ae0efe8c9ef15dd3b3f8cdeb02f75ee3b92d4e
-
SSDEEP
3072:tywhlVX+9dfqnInVaIIZdV+0bzMrEWEc9EWUOXwHI6V/:8wrVX7In4IIZdVJ8rEMhUOXw
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Backdoor.Win32.Androm.kwkh-b9dd2668c348c75e658e1ab0af50cfed16eb1f14e5b6dc8a5b28c7faf23ce678
Files
-
Backdoor.Win32.Androm.kwkh-b9dd2668c348c75e658e1ab0af50cfed16eb1f14e5b6dc8a5b28c7faf23ce678.exe windows x86
1e9b2698b88062b68a4f9a9b96874c61
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
IsDebuggerPresent
GetTempPathA
SetThreadExecutionState
AddAtomA
GetCurrentProcessId
DisableThreadLibraryCalls
GetModuleHandleW
GetLastError
GetTimeFormatA
GetFileAttributesExA
VirtualProtect
GetModuleHandleA
GetShortPathNameA
CreateProcessW
GetCommState
ExitProcess
lstrcpyW
ConvertThreadToFiber
LCMapStringW
Sleep
FindAtomA
IsValidCodePage
FoldStringA
CopyFileW
GetStdHandle
AddAtomW
GetCurrencyFormatW
lstrcmpiA
GlobalFree
GlobalAlloc
TerminateThread
GetCurrentThread
GetWriteWatch
GetCurrentActCtx
ResumeThread
GetCommandLineW
BindIoCompletionCallback
AddLocalAlternateComputerNameA
LoadLibraryA
InterlockedExchange
FreeLibrary
GetProcAddress
LocalAlloc
TermsrvAppInstallMode
SetTermsrvAppInstallMode
SetConsoleCursorMode
GetConsoleMode
DeleteFileW
RaiseException
user32
GetCursorPos
RegisterClassExA
GetMenuItemCount
CreateMenu
GetWindowTextW
CharNextA
IsWindow
GetMenu
GetShellWindow
IsRectEmpty
GetWindowRect
GetKeyState
GetForegroundWindow
GetClassNameW
GetDesktopWindow
LoadStringW
IsMenu
GetWindowTextLengthW
GetTopWindow
GetActiveWindow
AdjustWindowRect
GetWindowLongA
AnyPopup
LoadMenuA
GetWindow
GetClipboardViewer
FlashWindow
GetMenuDefaultItem
IsZoomed
gdi32
GetStockObject
msvcrt
memset
comsvcs
CoEnterServiceDomain
GetTrkSvrObject
MiniDumpW
RecycleSurrogate
ComSvcsLogError
DispManGetContext
CoCreateActivity
pdh
PdhVbGetLogFileSize
PdhSetCounterScaleFactor
PdhAddCounterW
PdhEnumObjectItemsW
PdhSelectDataSourceW
PdhVbIsGoodStatus
PdhUpdateLogFileCatalog
PdhEnumMachinesA
PdhVbCreateCounterPathList
PdhVbUpdateLog
PdhGetDefaultPerfObjectW
PdhSetQueryTimeRange
PdhAddCounterA
PdhCollectQueryData
PdhParseCounterPathW
PdhOpenQuery
PdhEnumObjectsHW
PdhOpenQueryW
PdhEnumMachinesHA
PdhGetFormattedCounterArrayA
PdhGetDataSourceTimeRangeW
PdhCloseLog
PdhBrowseCountersHA
PdhConnectMachineA
PdhCollectQueryDataEx
PdhEnumLogSetNamesA
PdhGetLogSetGUID
PdhGetRawCounterValue
PdhSetDefaultRealTimeDataSource
PdhCreateSQLTablesA
PdhGetFormattedCounterArrayW
PdhGetDefaultPerfCounterW
PdhVbAddCounter
PdhLookupPerfIndexByNameW
PdhGetRawCounterArrayA
PdhBindInputDataSourceA
Sections
.text Size: 72KB - Virtual size: 69KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 44KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.CZQ2 Size: 24KB - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ