Monoxid Opener[.]zip

Sharing

Copy URL Twitter E-mail

General

Target

Monoxid Opener.zip
Size

21.0MB
MD5

c0eec1f8a94a5004a53fca150fa15ca8
SHA1

8308a317a06c2ec62bd6ddcfc25bc2e51b55b7fa
SHA256

45b28098be2c17eaf73cf51e0e34be3dda0af18625e7328499b1e00334c46090
SHA512

fd9318ff37d69411e6c6bd40a34e717ff0e986cb685e26d8e9f6311e7844f966ffbe8103c66a5b41aa994b05c4970366586d0de05e8cf2e2485a480312d1b4b6
SSDEEP

393216:AO3Y0AuF6rAad/pg0Ms8kS9L7X/7T1NpH5iWuNYx:73Y0AVrAG/p5z8kSN7X/H1TCYx

Score

3^/10

pyinstaller

Malware Config

Signatures

Detects Pyinstaller 1 IoCs

pyinstaller

resource	yara_rule
static1/unpack001/Monoxid Opener/dll/1.exe	pyinstaller

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Monoxid Opener/dll/1.exe
unpack001/Monoxid Opener/dll/3.exe

Files

Monoxid Opener.zip
.zip
Monoxid Opener/dll/1.exe
.exe windows x64

0b5552dccd9d0a834cea55c0c8fc05be

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

user32

CreateWindowExW
MessageBoxW
MessageBoxA
SystemParametersInfoW
DestroyIcon
SetWindowLongPtrW
GetWindowLongPtrW
GetClientRect
InvalidateRect
ReleaseDC
GetDC
DrawTextW
GetDialogBaseUnits
EndDialog
DialogBoxIndirectParamW
MoveWindow
SendMessageW

comctl32

ord380

kernel32

GetStringTypeW
GetFileAttributesExW
HeapReAlloc
FlushFileBuffers
GetCurrentDirectoryW
IsValidCodePage
GetACP
GetModuleHandleW
MulDiv
GetLastError
SetDllDirectoryW
GetModuleFileNameW
GetProcAddress
GetCommandLineW
GetEnvironmentVariableW
GetOEMCP
ExpandEnvironmentStringsW
CreateDirectoryW
GetTempPathW
WaitForSingleObject
Sleep
GetExitCodeProcess
CreateProcessW
GetStartupInfoW
FreeLibrary
LoadLibraryExW
SetConsoleCtrlHandler
FindClose
FindFirstFileExW
CloseHandle
GetCurrentProcess
LocalFree
FormatMessageW
MultiByteToWideChar
WideCharToMultiByte
GetCPInfo
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
GetTimeZoneInformation
HeapSize
WriteConsoleW
SetEnvironmentVariableW
RtlUnwindEx
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
SetEndOfFile
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
EncodePointer
RaiseException
RtlPcToFileHeader
GetCommandLineA
CreateFileW
GetDriveTypeW
GetFileInformationByHandle
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
GetFullPathNameW
RemoveDirectoryW
FindNextFileW
SetStdHandle
DeleteFileW
ReadFile
GetStdHandle
WriteFile
ExitProcess
GetModuleHandleExW
HeapFree
GetConsoleMode
ReadConsoleW
SetFilePointerEx
GetConsoleOutputCP
GetFileSizeEx
HeapAlloc
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
CompareStringW
LCMapStringW

advapi32

OpenProcessToken
GetTokenInformation
ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertSidToStringSidW

gdi32

SelectObject
DeleteObject
CreateFontIndirectW

Sections

.text
Size: 162KB - Virtual size: 162KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 75KB - Virtual size: 74KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 64KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 348B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Monoxid Opener/dll/2.vbs
Monoxid Opener/dll/3.exe
.exe windows x86

44a369e948a6abc1185bc3f30a2fdb2b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

winmm

waveOutWrite
waveOutUnprepareHeader
waveOutReset
waveOutOpen
waveOutPrepareHeader

kernel32

GetLastError
lstrcatW
DeleteFileW
CloseHandle
LoadLibraryW
CreateThread
GetProcAddress
LocalFree
CreateProcessW
CopyFileW
lstrcpyW
lstrcmpW
GetCurrentThreadId
HeapAlloc
GetProcessHeap
CreateMutexW
WaitForSingleObject
TerminateThread
FreeLibrary
HeapFree
GetConsoleCP
FlushFileBuffers
GetStringTypeW
Sleep
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetCPInfo
GetOEMCP
IsValidCodePage
FindFirstFileExW
GetFileType
LCMapStringW
GetLogicalDriveStringsW
SetFileAttributesW
CreateFileW
FindClose
GetTempPathW
GetModuleFileNameW
RemoveDirectoryW
WriteFile
GetCurrentProcess
FindFirstFileW
FindNextFileW
DecodePointer
ReadFile
GetConsoleMode
HeapSize
HeapReAlloc
SetFilePointerEx
WriteConsoleW
SetStdHandle
GetACP
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
RtlUnwind
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
RaiseException
GetStdHandle
MultiByteToWideChar
WideCharToMultiByte
ExitProcess
GetModuleHandleExW

user32

GetMessageW
DispatchMessageW
SetTimer
TranslateMessage
EnumDisplayMonitors
GetWindowRect
GetDC
EnumChildWindows
CallNextHookEx
GetSystemMetrics
SetWindowTextW
DrawIcon
DestroyCursor
ShowWindow
GetCursorInfo
RedrawWindow
MoveWindow
UnhookWindowsHookEx
EnumWindows
mouse_event
SetWindowsHookExW
SetCursorPos
ReleaseDC
EnableWindow
MessageBoxW
ExitWindowsEx

gdi32

DeleteDC
CreatePen
Ellipse
DeleteObject
CreateSolidBrush
BitBlt
SelectObject
CreateDIBSection
CreateCompatibleDC
StretchBlt

advapi32

LookupPrivilegeValueW
AdjustTokenPrivileges
AllocateAndInitializeSid
SetEntriesInAclW
SetNamedSecurityInfoW
OpenProcessToken
FreeSid

shell32

ShellExecuteW

Sections

.text
Size: 104KB - Virtual size: 104KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 46KB - Virtual size: 46KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

_RDATA
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 143KB - Virtual size: 142KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Monoxid Opener/main.vbs
Monoxid Opener/run.bat

Sharing

General

Malware Config

Signatures

Files

0b5552dccd9d0a834cea55c0c8fc05be

Headers

DLL Characteristics

File Characteristics

Imports

user32

comctl32

kernel32

advapi32

gdi32

Sections

.text Size: 162KB - Virtual size: 162KB

.rdata Size: 75KB - Virtual size: 74KB

.data Size: 3KB - Virtual size: 64KB

.pdata Size: 8KB - Virtual size: 8KB

_RDATA Size: 512B - Virtual size: 348B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 2KB - Virtual size: 1KB

44a369e948a6abc1185bc3f30a2fdb2b

Headers

DLL Characteristics

File Characteristics

Imports

winmm

kernel32

user32

gdi32

advapi32

shell32

Sections

.text Size: 104KB - Virtual size: 104KB

.rdata Size: 46KB - Virtual size: 46KB

.data Size: 2KB - Virtual size: 21KB

_RDATA Size: 1KB - Virtual size: 1KB

.rsrc Size: 143KB - Virtual size: 142KB

.reloc Size: 6KB - Virtual size: 6KB

.text
Size: 162KB - Virtual size: 162KB

.rdata
Size: 75KB - Virtual size: 74KB

.data
Size: 3KB - Virtual size: 64KB

.pdata
Size: 8KB - Virtual size: 8KB

_RDATA
Size: 512B - Virtual size: 348B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 2KB - Virtual size: 1KB

.text
Size: 104KB - Virtual size: 104KB

.rdata
Size: 46KB - Virtual size: 46KB

.data
Size: 2KB - Virtual size: 21KB

_RDATA
Size: 1KB - Virtual size: 1KB

.rsrc
Size: 143KB - Virtual size: 142KB

.reloc
Size: 6KB - Virtual size: 6KB