Overview
overview
10Static
static
10$RECYCLE.B...3D.exe
windows7-x64
$RECYCLE.B...3D.exe
windows10-2004-x64
$RECYCLE.B...L8H.js
windows7-x64
1$RECYCLE.B...L8H.js
windows10-2004-x64
1$RECYCLE.B...PRW.js
windows7-x64
1$RECYCLE.B...PRW.js
windows10-2004-x64
1$RECYCLE.B...R2U.js
windows7-x64
1$RECYCLE.B...R2U.js
windows10-2004-x64
1$RECYCLE.B...VCX.js
windows7-x64
1$RECYCLE.B...VCX.js
windows10-2004-x64
1$RECYCLE.B...3D.exe
windows7-x64
10$RECYCLE.B...3D.exe
windows10-2004-x64
10$RECYCLE.B...L8H.js
windows7-x64
10$RECYCLE.B...L8H.js
windows10-2004-x64
10$RECYCLE.B...PRW.js
windows7-x64
10$RECYCLE.B...PRW.js
windows10-2004-x64
10$RECYCLE.B...R2U.js
windows7-x64
10$RECYCLE.B...R2U.js
windows10-2004-x64
10$RECYCLE.B...VCX.js
windows7-x64
10$RECYCLE.B...VCX.js
windows10-2004-x64
10Tb2_paymen...df.vbs
windows7-x64
8Tb2_paymen...df.vbs
windows10-2004-x64
8Behavioral task
behavioral1
Sample
$RECYCLE.BIN/$I40P23D.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
$RECYCLE.BIN/$I40P23D.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral3
Sample
$RECYCLE.BIN/$I4FIL8H.js
Resource
win7-20230220-en
Behavioral task
behavioral4
Sample
$RECYCLE.BIN/$I4FIL8H.js
Resource
win10v2004-20230220-en
Behavioral task
behavioral5
Sample
$RECYCLE.BIN/$I5VEPRW.js
Resource
win7-20230220-en
Behavioral task
behavioral6
Sample
$RECYCLE.BIN/$I5VEPRW.js
Resource
win10v2004-20230220-en
Behavioral task
behavioral7
Sample
$RECYCLE.BIN/$IMH8R2U.js
Resource
win7-20230220-en
Behavioral task
behavioral8
Sample
$RECYCLE.BIN/$IMH8R2U.js
Resource
win10v2004-20230220-en
Behavioral task
behavioral9
Sample
$RECYCLE.BIN/$INQFVCX.js
Resource
win7-20230220-en
Behavioral task
behavioral10
Sample
$RECYCLE.BIN/$INQFVCX.js
Resource
win10v2004-20230220-en
Behavioral task
behavioral11
Sample
$RECYCLE.BIN/$R40P23D.exe
Resource
win7-20230220-en
Behavioral task
behavioral12
Sample
$RECYCLE.BIN/$R40P23D.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral13
Sample
$RECYCLE.BIN/$R4FIL8H.js
Resource
win7-20230220-en
Behavioral task
behavioral14
Sample
$RECYCLE.BIN/$R4FIL8H.js
Resource
win10v2004-20230220-en
Behavioral task
behavioral15
Sample
$RECYCLE.BIN/$R5VEPRW.js
Resource
win7-20230220-en
Behavioral task
behavioral16
Sample
$RECYCLE.BIN/$R5VEPRW.js
Resource
win10v2004-20230220-en
Behavioral task
behavioral17
Sample
$RECYCLE.BIN/$RMH8R2U.js
Resource
win7-20230220-en
Behavioral task
behavioral18
Sample
$RECYCLE.BIN/$RMH8R2U.js
Resource
win10v2004-20230220-en
Behavioral task
behavioral19
Sample
$RECYCLE.BIN/$RNQFVCX.js
Resource
win7-20230220-en
Behavioral task
behavioral20
Sample
$RECYCLE.BIN/$RNQFVCX.js
Resource
win10v2004-20230220-en
Behavioral task
behavioral21
Sample
Tb2_payment_receipt_pdf.vbs
Resource
win7-20230220-en
Behavioral task
behavioral22
Sample
Tb2_payment_receipt_pdf.vbs
Resource
win10v2004-20230220-en
General
-
Target
4BDC37982E65F60E5F20F4868B4851F2B59BF7ACE5F723B6FDA011EE25285E01
-
Size
295KB
-
MD5
d61f40c75f47eb48ed1cf9f260a5e7ac
-
SHA1
b7237d806312e558c2a31a38a47d69bbaeabad04
-
SHA256
4bdc37982e65f60e5f20f4868b4851f2b59bf7ace5f723b6fda011ee25285e01
-
SHA512
fdafcfa5d984499ded51ea8f87543817d13fe362e0eaa516eb2e7fb65c1ea45f03ea3154a5e261d1c57295e45c18059280111b461f5a2638aae12660293e29fd
-
SSDEEP
1536:8W3JRZLzBJ5wGq4up0KjIko1EnTJgOiAOqZ8RzrWWmBSwGjols/ZL4vUAl:8WVzBJ5wGqpjIko1EVzGlfwGnJ2l
Malware Config
Extracted
purecrypter
https://ashaambulanceservice.com/Vuzbri.bmp
Signatures
-
Purecrypter family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack002/$RECYCLE.BIN/$R40P23D.exe
Files
-
4BDC37982E65F60E5F20F4868B4851F2B59BF7ACE5F723B6FDA011EE25285E01.zip
-
Tb_Order_Receipt_Pdf.vhd.vhd
-
$RECYCLE.BIN/$I40P23D.exe
-
$RECYCLE.BIN/$I4FIL8H.js
-
$RECYCLE.BIN/$I5VEPRW.js
-
$RECYCLE.BIN/$IMH8R2U.js
-
$RECYCLE.BIN/$INQFVCX.js
-
$RECYCLE.BIN/$R40P23D.exe.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 83KB - Virtual size: 82KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
$RECYCLE.BIN/$R4FIL8H.js.js
-
$RECYCLE.BIN/$R5VEPRW.js.js
-
$RECYCLE.BIN/$RMH8R2U.js.js
-
$RECYCLE.BIN/$RNQFVCX.js.js
-
$RECYCLE.BIN/desktop.ini
-
System Volume Information/WPSettings.dat
-
Tb2_payment_receipt_pdf.vbs.vbs