7�:� ���'@�Шb�c�Z��F�v�hE l8��5Z^<����Os��>#�Ū�c`9���zN)v�X��8�iB2�j�@z@u{J�)�вY8 ��|�p��S��zq��T^�(K=�=RP X��`҇�X�)O�G*�������^O��4�{�e��1լvQ��fv�xq�_��9j6O�5�.O��U�҃L�j�C%*Q�v���`���ħb1o����Ҧ=�Ew�RK��Ss!mDY�+� �ĭ�!!�?��3��e>i�R���e���D�X�W��I՚ 1ڹ���G�����?�h�\T7~V�:�� ��oS�X���1ᄆ��f<f�qFa��B��q�Y���R�����;�q���}��������!�;��6��������h���������Qo��9g��~}؎�V�^Zi�d��_���iv�ӕ���@�,��ʂ*�n�p0�IF�A{�ͨ0��zτ���دVe��z�ʒ�)�ri;��]���e�ƃ�,�S�}�׳8���@� +wO�=����(�S1��(v�3��u��쀉eq���E�X�r��?^�B6�@�|�\�?3o5�o&k o���>�|)QA@�ʕ�t�U�l��*v2s s����&�o������������)��En �>��� ��w�Zя�+ǚ�L��Q%�+yf5m�������EG%h-����r��xıǾ-����ⴸӁUo��ç_��{\�_��N���}�Z�>խ^P���Q���^w�J�w/�2v��>�����{�ɏ�}wޓ4Y��Q[Y 1�U1��7#�$�x ���b1��7� cGu/�� ��nș;�s������p`Z���O�~��Fb�3���5 ���������fۀU�*��=ŭ�S��\�E#�!��� @<|�^â9�K�5p`Us��G������XkܛQ��$V$�������\-�����j��~qO$�_�s���ݹv����V?x+ �����>r�QZ�a鶲C����Ld�xBF��,*���Z�JZ��Ȳ�h��M�H�#�_*���{U#&�t��+K��&��tq۔����Ō�0����� x��A�,��]��p�qԆ5`,�2��5?����.��-����9/���P��ó����ӱLy{�w�ʮMԓ���V��X��ۭi�33���5�Q�WY� G����m�����2y�$ �V����M���=���n����t�n��$�l��쥧9��4Pd�clvۭ�:�e�����ʚ%>�b��� Rw;���C�՜�}n�����X��aj�Z8Kq�����JT����)7k�A��5,f���&�M�0塌���nAo�q��Xv~�X,|���Lw&̨�otu;���۞�2ڵ��3����iE<z��Ew�����̳I��$ ��Թ� �c �'��G�b�g �2����1�� ڗ0�~a�x�J�l����R��T�O��#3Y���1������6{*[�\�����*�N��I�k<���6�G�^ ��ֵ�<(o���X��& fx���7qR�>�����[�.�4����E<�4��c�_~���Dž$Vp�0�Q��F�Y�qu������=;��-&ŵ@vc���|*0�+.\���vbSx�ڱȝ�&@23)e������}�ǚ���p�Q�+t%�#�,�*��[��p�!�Zq�2�5�91�M_���9)`������n�v����zm0-��\-�nw}�����GC2���W�}���/6�����{����(WS�ˍD,� �w�Ѻ���#�3�r���,����廙�٘�QL��y[���~�_��RE}N1��[�*�W_�����咢St�t����g.i�J,=��/���Є�8i,�hP��bpW럖��W19 $_x �-�8�ͭ�����{5�d�ZCr��?r���GxE�g{wb:���@5zr�_���BKk��i�.E�"wT^���(0~E�l���E���3c~�&��?���:���/d�� X+A�p�8 @���8ҥ��B�5��!@����#�fM�C�%������٥���2��i`t���R��ܞÑ����P�`�"�\�Ww�Q��Ҩ|�ّt9L��t�o@5t�Őh�6Of�Xa�� ��U_ƥ��v��3ѹd����@6DՑn,������/�u�P��%��h*����Q`wʝB=�M��N�퓱%���E%�V;��a���PG�s{���<kZu�U�Q(t0��>^�%�SG�Q8Gzd�Y��i��u9�ƠM[�tw}~�eX�S8����V�S�RPE{�}��g):��% ��8V�4�`�½ɷWU߀��"���7G�t� �jA�`�A\O���.q ���J�*>b$kBs]�W�3����)!����s�� Xȗ�̃�up�������0�ߗ情NJQ�P.�,N�^CƎߣW�*���-�g�&�^��CB�[�pl�A^�0 �r\�Z��ć�� ;����p�|*c�(z��+���K����'�/�a�0�W��:�{��� �������s �����_SI�P��C�,8ow�M�ӱo����is�vW����ij��8�Ud�)MA�t����R�]YKj�0"���n�P}��ٵ���~j�Uώ)h��a�������G嵦�ĝ�[p"�ډ��MW�n��)��Nz����4q?��S��%�-%U$V��v;-U��4K��鐵f%܆/Á��˴��B]�_XXT�C�;�ҳ�S\}V �kC�ct�ch���;��~8��ayl�P �øR���2]B\�ͳ]�������a�"�n�?Л�m����8 "��&@�h�J�hXt^��Eɍ;��9c�u?��x14�Z�t���)�s���� |Χ��,���,jM�o�N�h�A���K���ܴe{b!C�5��];N����-��X�U��]���^uL"�*�c��$�����U"���Yo�Y7��}^�0�H;�Ѹ�tk3�td�9����W�1ɑ�����6��'<M�^ĩ�X�b�ݶM'u��� �
Behavioral task
behavioral1
Sample
UnixLoader.exe
Resource
win10-20230621-en
General
-
Target
UnixLoader.exe
-
Size
4.9MB
-
MD5
4801af6b6c1f43634464986504bff6ba
-
SHA1
c7d7a6b04829fa9a14ea842ca6c16fcb52f8d369
-
SHA256
46b324e54ba7ca5dab50645cc294c051ffcc48fee8665220d3532356de21d229
-
SHA512
b3a63ecf192459db071d93d27c6f8ca755a15fc00357b52fe275b0d773d4bde19128fe3e70e78d149002450ec809248d4f963323756bbee1fd57ba1e255ad5ae
-
SSDEEP
98304:Ky7RgQu2HOVsBybpMsj06dwrY0EYeEqf5rlJCnLr:KyLHOVsBybu+06yrYrBh5rQ
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource UnixLoader.exe
Files
-
UnixLoader.exe.exe windows x64
ce4b364848e16dd9a9e14e8790c3dc5c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
d3d9
Direct3DCreate9Ex
kernel32
GetModuleHandleA
FlsSetValue
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
EnumWindows
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
advapi32
RegCreateKeyExW
shell32
ShellExecuteW
ntdll
RtlVirtualUnwind
winhttp
WinHttpSendRequest
api-ms-win-shcore-scaling-l1-1-1
GetDpiForMonitor
imm32
ImmGetContext
unidata.dat
ord4
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 996KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 586KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 30.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 25KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: - Virtual size: 244B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 3.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 4.9MB - Virtual size: 4.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 196B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 25KB - Virtual size: 25KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ