Static task
static1
Behavioral task
behavioral1
Sample
BTSOU v23.05.08/BTSOU.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
BTSOU v23.05.08/BTSOU.exe
Resource
win10v2004-20230915-en
Behavioral task
behavioral3
Sample
BTSOU v23.05.08/Interop.ThunderAgentLib.dll
Resource
win7-20230831-en
Behavioral task
behavioral4
Sample
BTSOU v23.05.08/Interop.ThunderAgentLib.dll
Resource
win10v2004-20230915-en
Behavioral task
behavioral5
Sample
BTSOU v23.05.08/MySql.Data.dll
Resource
win7-20230831-en
Behavioral task
behavioral6
Sample
BTSOU v23.05.08/MySql.Data.dll
Resource
win10v2004-20230915-en
General
-
Target
a096e03201e23b41f6095ed391031d74540ac1043c62422859e9bcb69e4cebde
-
Size
922KB
-
MD5
a2af0621617458172015fdb09941a2a3
-
SHA1
8bd0c2814a3d919b8d1240663203de2f4aead510
-
SHA256
a096e03201e23b41f6095ed391031d74540ac1043c62422859e9bcb69e4cebde
-
SHA512
0804bfde34c6f9f46778878ae8208fc96209799da87db0887ea3bf915301866cf70541b72fa076653a3bb046e175d8fd01b06171509ea214c9e96805283cbb20
-
SSDEEP
24576:FPOjELZXpwCnBLlySn2lzmIsUe3Nw+hf7OVv:hOjE9ZlnueWVsphhjOVv
Malware Config
Signatures
-
Unsigned PE 3 IoCs
Checks for missing Authenticode signature.
resource unpack001/BTSOU v23.05.08/BTSOU.exe unpack001/BTSOU v23.05.08/Interop.ThunderAgentLib.dll unpack001/BTSOU v23.05.08/MySql.Data.dll
Files
-
a096e03201e23b41f6095ed391031d74540ac1043c62422859e9bcb69e4cebde.zip
-
BTSOU v23.05.08/BTSOU.exe.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 797KB - Virtual size: 797KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 29KB - Virtual size: 29KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
BTSOU v23.05.08/Interop.ThunderAgentLib.dll.dll windows x86
dae02f32a21e03ce65412f6e56942daa
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
mscoree
_CorDllMain
Sections
.text Size: 27KB - Virtual size: 26KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 880B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
BTSOU v23.05.08/MySql.Data.dll.dll windows x86
dae02f32a21e03ce65412f6e56942daa
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
Imports
mscoree
_CorDllMain
Sections
.text Size: 1.4MB - Virtual size: 1.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
BTSOU v23.05.08/data.ryx
-
BTSOU v23.05.08/常见问题.txt
-
BTSOU v23.05.08/更新说明.txt