Static task
static1
Behavioral task
behavioral1
Sample
Extreme Injector v3.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral2
Sample
superiority_RUST.dll
Resource
win10v2004-20230220-en
General
-
Target
Архив ZIP - WinRAR.zip
-
Size
2.6MB
-
MD5
69e0f45cd119f8c462003f8de0f8cff1
-
SHA1
0273c0a66f4b71cc53e3074f1d6dc08ec3006bf2
-
SHA256
c240c1fcc8a56a7e6dd3e42e6749ca8dfa074d3f96188f996c1b58ea06381dff
-
SHA512
dcbc82f22e28dd244c6de3f5759e98a0971c9dced20bbb30a142ffccb4241e4b413c7912a214a8c26a2f5ec447bdc5518574f194c93a385a3e14b636ba030122
-
SSDEEP
49152:3egk0K4Q1Zhr6qvozP9w8aiCf9JHBV+M/K4EJhneEFNx+Qiit2VsZ2rDV29+:3er0K4LqeeT7hKPhneat2Vsonj
Malware Config
Signatures
-
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/Extreme Injector v3.exe unpack001/superiority_RUST.dll
Files
-
Архив ZIP - WinRAR.zip.zip
-
Extreme Injector v3.exe.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 1.9MB - Virtual size: 1.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 19KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
superiority_RUST.dll.dll windows x64
5db1f27003c73e582608c3eb86bf4b6c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
GetCurrentThread
GetModuleHandleW
Sleep
FreeLibraryAndExitThread
GetPriorityClass
SetPriorityClass
Process32NextW
DisableThreadLibraryCalls
CreateThread
CloseHandle
MultiByteToWideChar
lstrlenA
QueryPerformanceFrequency
QueryPerformanceCounter
GlobalAlloc
GlobalFree
GlobalLock
WideCharToMultiByte
GlobalUnlock
GetTickCount64
DeleteFileA
GetStdHandle
AllocConsole
AttachConsole
GetCurrentProcessId
SetConsoleMode
SetConsoleTitleA
FreeConsole
SetStdHandle
WriteConsoleA
K32GetModuleInformation
WriteConsoleW
HeapSize
GetProcessHeap
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
HeapReAlloc
ReadConsoleW
GetFileSizeEx
GetConsoleMode
GetConsoleOutputCP
WriteFile
FlushFileBuffers
DeleteFileW
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetFileType
HeapAlloc
HeapFree
GetModuleFileNameW
GetModuleHandleExW
GetLastError
GetModuleHandleA
GlobalMemoryStatusEx
GetProcAddress
GetCurrentProcess
GetCurrentThreadId
SuspendThread
ResumeThread
GetThreadContext
SetThreadContext
FlushInstructionCache
VirtualAlloc
VirtualProtect
VirtualFree
VirtualQuery
SetLastError
FreeLibrary
LoadLibraryExW
FormatMessageA
CreateDirectoryW
CreateFileW
FindClose
FindFirstFileExW
FindNextFileW
GetFileAttributesExW
SetEndOfFile
SetFilePointerEx
AreFileApisANSI
GetFileInformationByHandleEx
LocalFree
EncodePointer
DecodePointer
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
LCMapStringEx
GetSystemTimeAsFileTime
GetStringTypeW
GetCPInfo
InitializeCriticalSectionAndSpinCount
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
InitializeSListHead
RtlUnwindEx
RtlPcToFileHeader
RaiseException
InterlockedFlushSList
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
ReadFile
ExitProcess
RtlUnwind
user32
DefWindowProcW
mouse_event
RegisterClassExW
OpenClipboard
CloseClipboard
EmptyClipboard
GetClipboardData
SetClipboardData
GetKeyState
ScreenToClient
GetCapture
ClientToScreen
IsChild
GetForegroundWindow
SetCapture
SetCursor
GetClientRect
ReleaseCapture
SetCursorPos
GetCursorPos
UnregisterClassW
DestroyWindow
CreateWindowExW
shell32
SHOpenFolderAndSelectItems
ord155
SHParseDisplayName
winmm
PlaySoundA
winhttp
WinHttpCloseHandle
WinHttpOpen
d3dcompiler_47
D3DCompile
imm32
ImmSetCompositionWindow
ImmReleaseContext
ImmGetContext
Sections
.text Size: 1.2MB - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 849KB - Virtual size: 848KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 191KB - Virtual size: 212KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 28KB - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.detourc Size: 9KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.detourd Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
_RDATA Size: 512B - Virtual size: 244B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 248B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ