Static task
static1
Behavioral task
behavioral1
Sample
mysqldump.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
mysqldump.exe
Resource
win10v2004-20230220-en
General
-
Target
mysqldump.exe
-
Size
1.9MB
-
MD5
dee70a754f551c0c18b513ca21005a9a
-
SHA1
840dd78cb0f65f772bf9f3c1966b4d7806c1933a
-
SHA256
b0ff68c6385ffa64c85e3e2eca251c5b7e54f0811014ec92d1ceed5d192f2121
-
SHA512
1228f52a7f843604b671c52704c3645c341502c2d7f9753d982e1556988c49149f08abd7444927929f0a83d3e16efe7b2e3cb93304eacf93dc699e2ebc961bda
-
SSDEEP
24576:VcC7syP5Nwqa8YVJOS9THRNGaU+fq58KEflvfIP:2Cw8xkTHRJUWqS5fJI
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource mysqldump.exe
Files
-
mysqldump.exe.exe windows x86
df871e284b6efc9a1fb1f55a04b31db3
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
wsock32
inet_addr
WSASetLastError
gethostbyname
getpeername
shutdown
closesocket
setsockopt
send
recv
select
__WSAFDIsSet
inet_ntoa
getservbyname
ntohs
socket
WSAGetLastError
ioctlsocket
htons
connect
WSAStartup
WSACleanup
kernel32
PeekNamedPipe
GetDriveTypeA
GetCurrentDirectoryA
GetFullPathNameA
SetCurrentDirectoryA
ReadConsoleInputA
GetFileInformationByHandle
GetLocaleInfoW
SetEndOfFile
LCMapStringW
LCMapStringA
SetEnvironmentVariableA
CompareStringW
CompareStringA
LeaveCriticalSection
EnterCriticalSection
GetLocaleInfoA
GetSystemDirectoryA
GetProcAddress
GetModuleHandleA
GetModuleFileNameA
GetWindowsDirectoryA
InterlockedIncrement
CloseHandle
SetNamedPipeHandleState
WaitNamedPipeA
CreateFileA
GetLastError
UnmapViewOfFile
WaitForSingleObject
SetEvent
MapViewOfFile
OpenFileMappingA
OpenEventA
DeleteFileA
MoveFileA
GetTickCount
DeleteCriticalSection
InitializeCriticalSection
TlsFree
GetSystemTimeAsFileTime
TlsSetValue
TlsGetValue
TlsAlloc
GetFileAttributesExA
FindClose
FindNextFileA
FindFirstFileA
ReadFile
WriteFile
WaitForMultipleObjects
CreateEventA
ResetEvent
SetThreadPriority
GetCurrentThreadId
QueryPerformanceCounter
QueryPerformanceFrequency
ExitProcess
TerminateProcess
GetCurrentProcess
GetCommandLineA
GetVersionExA
HeapAlloc
HeapFree
WideCharToMultiByte
GetTimeZoneInformation
SetConsoleCtrlHandler
SetEnvironmentVariableW
SetConsoleMode
GetConsoleMode
PeekConsoleInputA
GetNumberOfConsoleInputEvents
WriteConsoleA
SetStdHandle
GetFileType
FileTimeToSystemTime
FileTimeToLocalFileTime
HeapReAlloc
ExitThread
ResumeThread
CreateThread
RtlUnwind
SetHandleCount
GetStdHandle
GetStartupInfoA
FatalAppExitA
GetCurrentProcessId
SetLastError
GetCurrentThread
FlushFileBuffers
UnhandledExceptionFilter
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
IsBadWritePtr
GetTimeFormatA
GetDateFormatA
GetCPInfo
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
IsValidCodePage
GetStringTypeA
MultiByteToWideChar
GetStringTypeW
VirtualProtect
GetSystemInfo
VirtualQuery
SetFilePointer
RaiseException
InterlockedExchange
HeapSize
LoadLibraryA
GetACP
GetOEMCP
advapi32
RegEnumValueA
RegOpenKeyExA
CryptAcquireContextA
CryptReleaseContext
CryptGenRandom
RegCloseKey
Sections
.text Size: 640KB - Virtual size: 637KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 120KB - Virtual size: 117KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1.2MB - Virtual size: 1.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 8KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE