Errors

Reason
config extraction: GuloaderBin: guloader: invalid shellcode

General

  • Target

    URLhaus.rar

  • Size

    23.8MB

  • MD5

    7500442939e9a87f5fd7ccf31614ae2c

  • SHA1

    ae3d786e709601d09934eebd178df9d1fcf2f523

  • SHA256

    31fcc1a7c79fa0e760d81e479154824551be394658821275380c9fc45343ae22

  • SHA512

    296f773a7b446f0248060d6e28eb82359fa457d221c8faaf4b8db1ebe38e24ad873d486dafac78469e93155a73827bffb223948ce3fe3c6170db30007c2c704b

  • SSDEEP

    393216:4+MP2MD3WnDrzbI6GnTaIE0AGyYy6VpgXiBxsWko1EVHdoz07MHQ2q+SWJUlp/Do:4+42MszM6afAGyT6HgSUbo+VH80Mw2qG

Score
10/10

Malware Config

Extracted

Family

pony

C2

http�--kek.b4mb4m.ru/gate.php

http://b4mb4m.ru/kek/

Attributes
  • payload_url

    http://185.222.202.114/uploads/uploads/update_z.exe

Extracted

Family

formbook

Version

3.8

Campaign

da

Decoy

chainwalkchambers.com

foxyhaul.com

yetisnackdesigns.com

paleodiettips.xyz

51zxsf.com

jisulianxiufu.com

qianbianyun.com

unitedresponders.info

contentlab.video

traveloyunnan.com

tonybehrenslaw.com

adithyafuels.com

huanayule.net

conscious-cross.com

link2register.com

anchoritis.com

vicente20.com

jnmbc.info

m-1944.com

naap-tol.com

Signatures

  • Formbook family
  • Formbook payload 1 IoCs
  • Pony family
  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Unsigned PE 32 IoCs

    Checks for missing Authenticode signature.

Files

  • URLhaus.rar
    .rar
  • 1.exe
    .exe windows x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 1221.exe
    .exe windows x86


    Headers

    Sections

  • 6b282d34fv2.exe
    .exe windows x86


    Headers

    Sections

  • B000CEF.exe
    .exe windows x86

    4d59a35b1b431625c014a44bb5f4297c


    Headers

    Imports

    Sections

  • Builder.exe
    .exe windows x86

    799d78bdb07347786f30047ee21d6f9f


    Headers

    Imports

    Sections

  • POVOFJYqCoZfOoPkWOsSBcVYWIu.exe
    .exe windows x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • Terracotta.exe
    .exe windows x64

    8eada872b6f292ff58c2a55744a2ea76


    Headers

    Imports

    Exports

    Sections

  • TerracottaGUI.exe
    .exe windows x64

    a7c0a3ab0679307dd23c82f26efafde6


    Headers

    Imports

    Exports

    Sections

  • Zver.exe
    .exe windows x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • a.exe
    .exe windows x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • amdcontroller.exe
    .exe windows x86


    Headers

    Sections

  • bg.exe
    .exe windows x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • bin.exe
    .exe windows x86


    Headers

    Sections

  • bin2.exe
    .exe windows x86

    4dce94f0f23a764ed66d7203d9cea91a


    Headers

    Imports

    Sections

  • ej.exe
    .exe windows x86

    3fde4334102f29784f18762767cceca3


    Headers

    Imports

    Sections

  • fban4.exe
    .exe windows x86

    4368ee82e251b8e90303a7365b191f8e


    Headers

    Imports

    Sections

  • glash.exe
    .exe windows x86


    Headers

    Sections

  • johngotovo (2).exe
    .exe windows x86

    2a23b322f4a5d4d7ef2a2b48495acd72


    Headers

    Imports

    Sections

  • johngotovo (2)_original_original.exe
    .exe windows x86

    2a23b322f4a5d4d7ef2a2b48495acd72


    Headers

    Imports

    Sections

  • ktg.exe
    .exe windows x86


    Headers

    Sections

  • otIXAOPqOVgvIKePlwFQLX.exe
    .exe windows x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • scvsots.exe
    .exe windows x86


    Headers

    Sections

  • setup.exe
    .exe windows x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • shit.exe
    .exe windows x86


    Headers

    Sections

  • ss.exe
    .exe windows x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • stealedd517v2.exe
    .exe windows x86


    Headers

    Sections

  • steel.exe
    .exe windows x86


    Headers

    Sections

  • ted.exe
    .exe windows x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • update_b.exe
    .exe windows x86


    Headers

    Sections

  • update_z.exe
    .exe windows x86


    Headers

    Sections

  • uyo.exe
    .exe windows x86


    Headers

    Sections

  • v72d8z2.exe
    .exe windows x86


    Headers

    Sections