�I��=B9<`} �sC�,������N��RS���KA� ��t�f�*�C2��� atգ�QBJ�]g��s�=�����,��Q���G�� C�����_�f�^z/Ҁm��'*w��0m�h����A�S��7��ب�/C(����adu�5MN7�[H�߳W �O lM�א�����������m�����ƙu;&�'��������J�E v �0L �TD�'�����^Jg�ja�G�W�����$��hįt9WP�h��J���W_<"&��І2���e��pO/�NnL��R�#�2[kTG���_ꠊ���V3�q�V��nVˊ���v�E��w�j�]6�!?�$�)2�s�/I���N��8f��W��9cH�5�,��B}Qk�iged��{̜e�/:ه����m�'�@!�Լ̥ uJ*W����U��M6�l�o\�8A�]�%N�|��#�O��?�C�z�n��"��d}�Voz���LF�$�&իdĕZ�c���c���� l'�[�9���g!ۣ��Bh͍V���Nڊ zXw��E)g7�@��BPZP������{v�Y����nZ�4�_�G� �p������l�/Ɵ�˵"�S^ D��t�pN���q�3�� �=���}"g�B@u�:\u�E�7���P��r��EEy�t�ُ��ŗK�ԝ�f;K������m�r�!�$C��ӧv"6``��E��H�B���6�|JT�e,����I~��36��N��4��EaE�B�'?v{7��:}�W�POZD.�3`��ߦ���S��2�7Hf�S@F�����yL��Y�~��v'�5�Wp��q��ѻM�����*���n��J�gJ; �l'���N�#.��v���ϤY.���\��n�h�|Wo�{��>��/�˗��X��2o�)�8��_î�]o1�U� �U�r����)��2�������x�*�~}r��i,�4��c�֩F�@��5�LhË�)>1�<�h`���O���z��J�Uv�t�/���9^������/��&;�^cJ�K��1�[Z�8QZ�?Ufӝ܊�$]c�x�p#i9]����\k*vC<C�Ahl0��#��)st�y��c��T�c���=��D�3o��a�l�����r�A;����W�;.u&|���C�����Lv���e|�DyL#�����G-$g,���TÈ_���kbq@����3k�����_[�D�ӌ�Cú�eRAj⎌9/0jQXa�����[ ���}�6%�yU��Ȓ%c����*�U�@�KᦛM��A��T����OB�P����H'ѻH�y�t�XPB]o�=�!f/��hç��0 :�_�>c�)g5<�@k��F&���5u��jn��G?������3�+�*�\Y�S�"9�S�#4�}��֦U�h�K�g�q$�7� �5��o�y������M�3����M;S�i�Q��朷/�I�+0}�� �i&,���H���- ȵ��p8���@��һpJ���y&�;�����)��L���5�T���{;&�J^���>��{�i�� �q.K@l*C}�U��F�O�V��}e!igJ*��T(@J���H�] N����ś�;.�:*b�#Y�g���D�2�ڮ��Q�D�{� d�!l'�}��L(�K��V<�`<w@}:����3D'�a���m1�Yo(����k`���噇sp���6��*��W��,EU���W7!b*lgW4Z��t� �lz<̂1X�? b��[��ܔ�[��3�l9�4{H�������Pp�뛤gפI؝��B6�Ƿ��LwΙ� �?���M#v�CkMnߨ���W����O�4v�gw7�yA��{y�Km߯�=��ؒjk ��8$��Z�G�I�A YcB�!I�S�f��� ���j� �i7o"��JG|�?��&F�z�e�z%%�+͠��p�_��3����mPc�zIX���ڇ R�$�O�y��R_�!���deAxvI8�si�|����\�gϴ�E���B�8.3a��S�+2a�[ݰ�m|J�����Em�˟�7�p4����E��be�����L�&�ut� �������D� ��q�i�G��'c&�T����5��)Yl?��>߹���!%S%J�}�m U��k���}wۯ�g�jo,�N�q��e�|���4�q�>��m6=���g'%�� �r�m��@���b�D$�]��Y��ك5Rc1Y-�� �+ �J����}�Q��r�k��I2d7�s���Sbo������q�&��9��n����F�����~�a��˛&�f��H����b������gِ�Iz��Z�:���z3�4���uc�,�ި��>��U�0_�H���ϔ$}+J�+���Dg�S��x�0���W�l��6������ْ�-O5Hz,eRݵGt�� �Т��}�j�u����� Y�i�Ԩ�ʛ�k��Tr�n� Z6B,�@0�u5���� ��_��}�dUY��P%��߮=������$Og�d,0W12W8�x$,� ��{�+rW�Kͧ|���mL%埞y��G���x����$(��L����4�b���Tqw�� y?�����.��f�2a{�h=�������'��/\qO�-6C""��M���p��!�:f�C=hG���D������-挹Ri�b�DP�e�tm��-X@g.=�]�..�:���0���������(ee�뤧M�����!��b^�5� ���8Ѿ)�'�-�{�`/��ʿ�d�B�Qr�� �!hx���5��f$���>��V1<����@�@M��{!��q�D�6T�����92��Si��V2�[����M\D����6�|��>n��kZ-���ѭz�eb���Ĥ��ge���dt >*�����H�$�ۚ�r�����Oi� B&ږ���|��8"�-N���,JK\��D7*�y����Է�R5��'�"4�jػO��I\�+{�_U�4��: M���;��;ߍ,�b�.�}Dw��C��R]���$˯���K-_Ɍ(�P�X[F.�� BU1�&
Behavioral task
behavioral1
Sample
Meow.exe
Resource
win10v2004-20230220-en
General
-
Target
Meow.rar
-
Size
6.5MB
-
MD5
6fbc258ba8abb50cc295eb2d77c9dd6f
-
SHA1
c4ead77d4652e0c15c6eeac98d7b28c0255fdeb4
-
SHA256
5d6d5c567c6207058fe34fc14d745b584b2baa13e77c603f5084259ec6f9fc4e
-
SHA512
a5ca77f240369d52c4fe4e056c6df77b9dd91b3c94682509aab39aa9134d346d09011bd73788d6e1745b1fc3242b3693b5a26749a39beb1b239a57fdca2bdbc4
-
SSDEEP
196608:f7T2qUgvxZPaABdsqH/sEgBY3kaL3jjBI1Lc/qvz:f7rxBaFqEWZLgc/qb
Malware Config
Signatures
-
resource yara_rule static1/unpack001/Meow.exe vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Meow.exe
Files
-
Meow.rar.rar
-
Meow.exe.exe windows x64
6f9fd663e51ff0b2bd34f9a67ac564f4
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
GetTempPathW
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
MessageBoxW
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
advapi32
RegisterEventSourceW
shell32
ShellExecuteA
ws2_32
__WSAFDIsSet
wldap32
ord143
crypt32
CertOpenStore
userenv
UnloadUserProfile
rpcrt4
UuidCreate
ntdll
RtlVirtualUnwind
bcrypt
BCryptGenRandom
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 2.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 821KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 96KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 99KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: - Virtual size: 348B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 3.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 6.9MB - Virtual size: 6.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 188B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ