underground_Team_exe_11722906912[.]zip

Resubmissions

25/09/2024, 04:58

240925-fl3nvszang10

06/09/2023, 03:10

230906-dn8lsada9310

Sharing

Copy URL Twitter E-mail

General

Target
underground_Team_exe_11722906912.zip
Size 79KB
Sample230906-dn8lsada93
SHA256 739a7434533455d3b2d7926412a9ddb363c6c626185ef0efbc1dda2185f31485
MD5 0ea94d0397aab45a58b0b964355515ed
SHA1 a3cc337d09edfd268a7fda70525f12f2fcd34f72
SHA512 8e7d25a35f78668ee3f4677009411060ff0841e22289568054299072bd278503dbc9a9a744cf076d5018bfe995f4383defbcb9d89ab86ee8216c0e40b41e2474
SSDEEP 1536:AlvQSweoWGSvsHD3ryEFmIt2HGdZcL4a32FRB9SO5sxTJhI7zJuqhZj7/:OQesnyEKHGjETirf5s7hU4EZ//
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/d4a847fa9c4c7130a852a2e197b205493170a8b44426d9ec481fc4b285a92666

File Explorer

underground_Team_exe_11722906912.zip

.zip 79KB
d4a847fa9c4c7130a852a2e197b205493170a8b44426d9ec481fc4b285a92666

.exe 146KB

underground_Team_exe_11722906912.zip

SHA256 739a7434533455d3b2d7926412a9ddb363c6c626185ef0efbc1dda2185f31485
MD5 0ea94d0397aab45a58b0b964355515ed
SHA1 a3cc337d09edfd268a7fda70525f12f2fcd34f72
SHA512 8e7d25a35f78668ee3f4677009411060ff0841e22289568054299072bd278503dbc9a9a744cf076d5018bfe995f4383defbcb9d89ab86ee8216c0e40b41e2474
SSDEEP 1536:AlvQSweoWGSvsHD3ryEFmIt2HGdZcL4a32FRB9SO5sxTJhI7zJuqhZj7/:OQesnyEKHGjETirf5s7hU4EZ//
MD5 SHA1 SHA512 SSDEEP

Password

infected

d4a847fa9c4c7130a852a2e197b205493170a8b44426d9ec481fc4b285a92666

IMPHASH ad380d353776ceaab3ea64e4fe37c69c
SHA256 d4a847fa9c4c7130a852a2e197b205493170a8b44426d9ec481fc4b285a92666
MD5 059175be5681a633190cd9631e2975f6
SHA1 fb4ad5d21f0d8c6755eb4addba0ac288bd2574b6
SHA512 3a6c7667161ad9122785b6ef988d59f473b517e32e93c786c6a551d4c631f0ca82de1d262a056928935f05aa6723a7fe983158011e53042743194899c3e912e7
SSDEEP 3072:sdjFOoTVq4m0zRilymyU3pQuz1T5SKiVi6:4M2ZmEoL3Cu6K
MD5 SHA1 SHA512 SSDEEP

windows x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5624

Magic Number

523

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

shell32

ShellExecuteW CommandLineToArgvW

shlwapi

PathFindExtensionW

kernel32

GetStartupInfoW WriteConsoleW HeapReAlloc HeapSize GetCommandLineW CreateFileW DeleteFileW FindClose FindFirstFileW FindFirstVolumeW FindNextFileW FindNextVolumeW FindVolumeClose GetFileAttributesExW GetFileSize GetVolumeInformationW ReadFile SetEndOfFile SetFilePointer WriteFile GetVolumePathNamesForVolumeNameW CloseHandle GetLastError HeapAlloc HeapFree GetProcessHeap WaitForSingleObject Sleep WaitForMultipleObjects TerminateProcess CreateThread CreateProcessA OpenProcess GetSystemTimeAsFileTime GetWindowsDirectoryW GetModuleFileNameA GetModuleHandleA lstrcpyA lstrcpyW lstrlenA lstrlenW SetFilePointerEx GetFileSizeEx GetConsoleMode GetConsoleOutputCP FlushFileBuffers GetStringTypeW SetStdHandle QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId InitializeSListHead RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent GetModuleHandleW RtlUnwindEx SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW RaiseException GetStdHandle GetModuleFileNameW GetCurrentProcess ExitProcess GetModuleHandleExW LCMapStringW GetFileType FindFirstFileExW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW

user32

wsprintfA wsprintfW

rstrtmgr

RmRegisterResources RmEndSession RmStartSession RmGetList