���'S�@e����/]E��J����=���t�>�8���p�yl"�Ѓ���Vo��Cߪ<s��d���p���N�y�xo��L�6B���#m��Q��p�ۤ������(t����(�}D�Ԋ��>T���l�LM�K1T���d�vTX9G�J2�w h;Vj�a�;k|��0�I����$��TKIJ�$u� o;��J���|epɬ�:'.]¾�ø��xh����&��1���p D��W>�a~rZ��������x����F�݂ ��yR>��������3B ��dB+5���':o>$�/���/`��c_���'?��d�����<��*�:���9�/fǮ:zS���qʤ��>�_d��?��so�?�$.��Կ$�@Qx3��r]&�+�O� �7��~�ś�!��G㈢��@}J���Ycb�x�eڋ8�j�9�(@@�[����J"�|%����}�j�oN���ɔs�#'0 +mǻ�/U���.�M.@@JǓ��&ʚ����k�"�-7��AX�F#��1Ds�<��"�4m?�o=%�8J� ��m�L�τ�{��."2.{B�t�P��8��*zhdž�G-�@U[ͰBmܵ��v�/^#G�2����m���)��g;~#�����n�� g�0'��2̘�!n��c.���f���EK��&�RR���4&�|�|��JK�'p.��WC'�>L� @I�s�O<��E��|�۩ �"����}��,������x�g�+~1��r�/� �j5B�O�`����%�4�Fb�`D��ES���ڽǰ�f��>�>&�����9�!;��t�q%�< s�|K\f/t��ȾE �� ��='�c�0s��te�/;8@W@״5���:q�6�"gtyP���V�n����:�2�/���IO���t -�,\V�j��� ����S�>��D���>4W#��x-��|\?��<�9Ԃ�>~�Sq1ۨ���Nr����m��������fL���E���[��h?0&�>�0�(h��hj���|l�G+��_�2�X����J��A��8����cT��^̦qz��#�����b Q��2�8�>�����^�AyQD<^����p[����"�����e�#xx=*��B����:up�S]/ �_���� "L�s�[�GGmΛ(*a�a}�d@\TI�S8F����8':�L)��v���Z@8u��{�xZxɶYL��1\�C%�zb�ܧc P�������Vo������tPX¯���"R<���JTO�K圝F��� k9�/]��+�j�|Ipw</ߎv��@����7�h�$��3��!�<w�z�y5�ZT�c�^���m=|/�zb� lj��?����&\--Z���\���$4�:���m��`�:�>Wށ ���ė��WGg%> �O��z>Q�&���z�jf��S��t�G� 嚓�ίYR+�� s�bfˈw9j �/)+���ze��7��இa�Z0/<�j^��@��E�m�P�*�N�Ҏ���VY��R��V���V}�Bd��H��~�g շՉ�8�-��r��dx�_����yJ�=25t�D�i���M�k�XPH�{xh�Q=������;o��>�tB�ަ�Ĝ��w��ng��(sij���R�� N�n���W�L2�Tp�C��~��N�#h������Ae7-�%��Oxg�-]a�E#����V�ڭ��ϥ�燪ZU �D��ح��J��;�3����2C]��w���ȼ��ٚ?�%���0���k=>�Y��h`�����!�5�����[V�~M^��"dW7��;O�&���v��]���?��G~�.�S�^}����=�������|�W:�d���]:�w��4��I#�ػQ}s&~����ҫ���~��{���+�\m\5�tKInd�P��x@g��CWQ��:<$�����ר�����/Ɖ[��0Dh�����h�N��M�X�۩S J+i���E��� ��p�p��IsX��p�q���3s�1 ����L+T��a��(��g����"���b{��KmG�B��e�u��Ù�~�C/���R��0�A�Z�ໞ]�7��F?��2-�m�����^U`���X�1�@=��@/Bh#P.���Gn�a��Z&U�[��L+����+����_T����5|��Ւ���X�gV��u�i��Ai��=���e��N9������A?h ���5i�d(!�O7&�r+�Z@n/_� f'"\���fOz���G0l��s�iF��7sqy��j2~��0��Y��w�~�3L������2��I[�@1f;uq'^Л���-TX){�Z$ij�gn�UZ9>M���MLWA��О'�9b�p����[X?�����X���K>8���VI`̪.�Fkb�v�Ǔ�2��%��#f�ߖ�Ҕ>4q�9�M�����a���2}\�O�z^ �#t� �������)G�5 ��D���g���������"�<z���P?c'j_�&�c�U�'Z��ҥ]��v�Y�<� ���E;�K� ���Ǜ�uv<\��M�����|���M�bKƶ7��A ʣR�Šv=f�� ��(=]�8kvp�ʲ�b�Oc��P�.�<K�X!~�����U�����u�`�S(Ϋ&F!ۢ�Ф�~�H��&��u��k��x줾�6�>�.���%���>��Y�zY]�����:�V�tjֈ��c����J_�_(RY>@��_�ۺ�D�t�Ϳ����TB}9�z.5���� �M�gu^�����̈I�yI�"�u�������s�YfrРJ��C[���orA�J�uNZ|L`�F,���u�~� ��� 6�@R���u�±���b��7�W�dk�_s�>ߨ�ۚV�5Co�p�Y �,D��z�������{�Ùȥ�|�*z9��WԲ�F��n21�+�X�������_���o�S��������8Q�G���E$r#o٩^���v�_6o$ƾ mL����ј�����w��qru���r�歧�4l��>o��̏�e�{�9�}?�
Behavioral task
behavioral1
Sample
FSMGtdS.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
FSMGtdS.exe
Resource
win10v2004-20230703-en
General
-
Target
FSMGtdS.exe
-
Size
14.0MB
-
MD5
2db558684507cfcc44eba7235654a1ff
-
SHA1
9d20cb99fdf40641cf1e9a066cd4535659445e05
-
SHA256
bd7f63e3f2d0131674af340834d23ba71f83ebc18b4d81f79147c1f4112cf1b3
-
SHA512
b719c159d315d995e0bfdcebe10e26f7b6386ec1a6590eee5524e9b3bd5ecc248aaacaec1c65c53d8ec7a003e1767837da982927f733c2ade6f648a4ac009ce4
-
SSDEEP
393216:H1+oI7gEcpEEFGI7yAXWaYdATIvNubXPoGPo0LO2jKU:NIEEUEE4haYdATI8roGPVqU
Malware Config
Signatures
-
resource yara_rule sample themida -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource FSMGtdS.exe
Files
-
FSMGtdS.exe.exe windows x64
6c08c20a36b4f53d1fcc341eddd6d840
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
GetModuleHandleA
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetKeyState
CharUpperBuffW
gdi32
GetDeviceCaps
advapi32
RegGetValueA
wininet
InternetOpenUrlA
imm32
ImmReleaseContext
d3d9
Direct3DCreate9
Exports
Exports
Sections
.text Size: - Virtual size: 563KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 166KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: - Virtual size: 348B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.themida Size: - Virtual size: 11.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.themida Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.themida Size: 14.0MB - Virtual size: 14.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 236B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ