Intercepter-NG[.]v1[.]3[.]zip

Resubmissions

30/10/2023, 09:52

231030-lv3ywacb81 7

30/10/2023, 09:49

231030-ltevnadh98 7

30/10/2023, 09:47

231030-lr98sacb8t 7

Sharing

Copy URL Twitter E-mail

General

Target

Intercepter-NG.v1.3.zip
Size

3.3MB
MD5

8122ae321bfd6cc9a77a02cb6bc0ed12
SHA1

f1bc5453a70769665d195a57340bcb17f91827e9
SHA256

800b56e2e101ea06d4e9616856b6c4466fe40995e9065b9bdfb97eb07aa94c7f
SHA512

e9e88cfee7c90890b03abd1780fc44b9fbb57dcb2dea489c6b1c9dcb54c9fb03792f6c5988e3a3a1355dc884aa56bc4299fb7768b71402863897bba8bb0a3600
SSDEEP

49152:B4rERzsetCc52dkUIunGUDW6bQxp0PIZiOpELoYmxszhGbJRFrWjU2vsUY1MBkth:zjZ1UIunG6SWIoOioYtFGNFLMdx0c8t

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
static1/unpack001/Intercepter-NG.exe	upx

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Intercepter-NG.exe
unpack001/ssh.dll

Files

Intercepter-NG.v1.3.zip
.zip
Intercepter-NG.exe
.exe windows:6 windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 17.4MB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 2.4MB - Virtual size: 2.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 27KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
misc/FATE/sites/accounts.google.com/index.html
.js
misc/FATE/sites/intercepter.captive.com/index.html
.html
misc/FATE/sites/intercepter.captive.com/index2.html
.html
misc/FATE/updates/bsplayer.org/config.txt
misc/FATE/updates/bsplayer.org/request1.txt
misc/FATE/updates/internetdownloadmanager.com/config.txt
misc/FATE/updates/internetdownloadmanager.com/request1.txt
misc/FATE/updates/liveupdate01.asus.com/config.txt
misc/FATE/updates/liveupdate01.asus.com/request1.txt
misc/FATE/updates/liveupdate01.asus.com/request2.txt
misc/FATE/updates/vladonai.com/config.txt
misc/FATE/updates/vladonai.com/request1.txt
misc/FATE/updates/winscp.net/config.txt
misc/FATE/updates/winscp.net/request1.txt
misc/FATE/updates/winscp.net/request2.txt
misc/Xurls.txt
.vbs
misc/bd.jar
.jar
misc/fingerprints.txt
misc/hsts.txt
misc/oui.txt
misc/pwlist.txt
.vbs
misc/server.crt
misc/server.key
misc/ssh_host_dsa_key
misc/ssh_host_rsa_key
misc/whitelist.txt
misc/xscan_pwlist.txt
settings.cfg
ssh.dll
.dll windows:5 windows x86

d73aeea5c530bbe127b514c40c8055e9

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ws2_32

accept
listen
setsockopt
ioctlsocket
send
WSACleanup
WSAStartup
select
recv
getsockname
getpeername
WSAStringToAddressA
gethostname
__WSAFDIsSet
socket
bind
connect
getsockopt
closesocket
WSASetLastError
getservbyport
gethostbyaddr
htons
getservbyname
inet_ntoa
gethostbyname
WSAGetLastError
inet_addr
ntohs
ntohl
htonl

kernel32

FreeEnvironmentStringsW
GetModuleFileNameA
WriteConsoleW
SetFilePointer
GetCurrentDirectoryW
CreateFileA
PeekNamedPipe
GetFileInformationByHandle
GetFullPathNameA
LCMapStringW
GetTimeZoneInformation
FlushFileBuffers
SetStdHandle
DeleteCriticalSection
Sleep
FormatMessageA
GetProcAddress
FreeLibrary
LoadLibraryA
GetSystemDirectoryA
GetEnvironmentStringsW
SetEndOfFile
GetStdHandle
GetSystemTimeAsFileTime
GetCurrentThreadId
GetLastError
GetModuleHandleA
GetVersion
GetFileType
MultiByteToWideChar
GetCurrentProcessId
GlobalMemoryStatus
QueryPerformanceCounter
CloseHandle
GetTickCount
GetVersionExA
FlushConsoleInputBuffer
GetStartupInfoW
InitializeCriticalSectionAndSpinCount
SetHandleCount
IsValidCodePage
GetOEMCP
LoadLibraryW
VirtualQuery
CreateFileW
GetStringTypeW
SetConsoleMode
GetDriveTypeW
GetACP
GetCPInfo
GetProcessHeap
HeapSize
CompareStringW
GetConsoleMode
EnterCriticalSection
HeapFree
HeapAlloc
HeapReAlloc
SetEnvironmentVariableA
LeaveCriticalSection
GetTimeFormatA
GetDateFormatA
GetFileAttributesA
CreateDirectoryA
FindClose
FileTimeToSystemTime
FileTimeToLocalFileTime
GetDriveTypeA
FindFirstFileExA
DeleteFileA
ReadFile
WriteFile
WideCharToMultiByte
GetConsoleCP
DecodePointer
GetCommandLineA
GetModuleHandleW
ExitProcess
EncodePointer
SetConsoleCtrlHandler
RtlUnwind
ReadConsoleInputA
HeapCreate
HeapDestroy
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
TerminateProcess
GetCurrentProcess
GetModuleFileNameW
IsProcessorFeaturePresent
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement

user32

MessageBoxA
GetDesktopWindow
GetProcessWindowStation
GetUserObjectInformationW

shell32

SHGetSpecialFolderPathA

advapi32

ReportEventA
DeregisterEventSource
GetUserNameA
RegisterEventSourceA

Exports

Exports

buffer_free
buffer_get
buffer_get_len
buffer_new
channel_accept_x11
channel_change_pty_size
channel_close
channel_forward_accept
channel_forward_cancel
channel_forward_listen
channel_free
channel_get_exit_status
channel_get_session
channel_is_closed
channel_is_eof
channel_is_open
channel_new
channel_open_forward
channel_open_session
channel_poll
channel_read
channel_read_buffer
channel_read_nonblocking
channel_request_env
channel_request_exec
channel_request_pty
channel_request_pty_size
channel_request_send_signal
channel_request_sftp
channel_request_shell
channel_request_subsystem
channel_request_x11
channel_select
channel_send_eof
channel_set_blocking
channel_write
channel_write_stderr
privatekey_free
privatekey_from_file
publickey_free
publickey_from_file
publickey_from_privatekey
publickey_to_string
sftp_async_read
sftp_async_read_begin
sftp_attributes_free
sftp_canonicalize_path
sftp_chmod
sftp_chown
sftp_close
sftp_closedir
sftp_dir_eof
sftp_extension_supported
sftp_extensions_get_count
sftp_extensions_get_data
sftp_extensions_get_name
sftp_file_set_blocking
sftp_file_set_nonblocking
sftp_free
sftp_fstat
sftp_fstatvfs
sftp_get_error
sftp_init
sftp_lstat
sftp_mkdir
sftp_new
sftp_open
sftp_opendir
sftp_read
sftp_readdir
sftp_readlink
sftp_rename
sftp_rewind
sftp_rmdir
sftp_seek
sftp_seek64
sftp_server_init
sftp_server_new
sftp_server_version
sftp_setstat
sftp_stat
sftp_statvfs
sftp_statvfs_free
sftp_symlink
sftp_tell
sftp_tell64
sftp_unlink
sftp_utimes
sftp_write
ssh_accept
ssh_auth_list
ssh_basename
ssh_bind_accept
ssh_bind_accept_fd
ssh_bind_fd_toaccept
ssh_bind_free
ssh_bind_get_fd
ssh_bind_listen
ssh_bind_new
ssh_bind_options_set
ssh_bind_set_blocking
ssh_bind_set_callbacks
ssh_bind_set_fd
ssh_blocking_flush
ssh_buffer_free
ssh_buffer_get_begin
ssh_buffer_get_len
ssh_buffer_new
ssh_channel_accept_x11
ssh_channel_change_pty_size
ssh_channel_close
ssh_channel_free
ssh_channel_get_exit_status
ssh_channel_get_session
ssh_channel_is_closed
ssh_channel_is_eof
ssh_channel_is_open
ssh_channel_new
ssh_channel_open_forward
ssh_channel_open_reverse_forward
ssh_channel_open_session
ssh_channel_open_x11
ssh_channel_poll
ssh_channel_poll_timeout
ssh_channel_read
ssh_channel_read_nonblocking
ssh_channel_request_env
ssh_channel_request_exec
ssh_channel_request_pty
ssh_channel_request_pty_size
ssh_channel_request_send_exit_signal
ssh_channel_request_send_exit_status
ssh_channel_request_send_signal
ssh_channel_request_sftp
ssh_channel_request_shell
ssh_channel_request_subsystem
ssh_channel_request_x11
ssh_channel_select
ssh_channel_send_eof
ssh_channel_set_blocking
ssh_channel_window_size
ssh_channel_write
ssh_channel_write_stderr
ssh_clean_pubkey_hash
ssh_connect
ssh_copyright
ssh_dirname
ssh_disconnect
ssh_event_add_fd
ssh_event_add_session
ssh_event_dopoll
ssh_event_free
ssh_event_new
ssh_event_remove_fd
ssh_event_remove_session
ssh_execute_message_callbacks
ssh_finalize
ssh_forward_accept
ssh_forward_cancel
ssh_forward_listen
ssh_free
ssh_get_disconnect_message
ssh_get_error
ssh_get_error_code
ssh_get_fd
ssh_get_hexa
ssh_get_issue_banner
ssh_get_openssh_version
ssh_get_pubkey
ssh_get_pubkey_hash
ssh_get_publickey
ssh_get_random
ssh_get_serverbanner
ssh_get_status
ssh_get_version
ssh_getpass
ssh_handle_key_exchange
ssh_init
ssh_is_blocking
ssh_is_connected
ssh_is_server_known
ssh_key_cmp
ssh_key_free
ssh_key_is_private
ssh_key_is_public
ssh_key_new
ssh_key_type
ssh_key_type_from_name
ssh_key_type_to_char
ssh_log
ssh_message_auth_interactive_request
ssh_message_auth_kbdint_is_response
ssh_message_auth_password
ssh_message_auth_pubkey
ssh_message_auth_publickey
ssh_message_auth_publickey_state
ssh_message_auth_reply_pk_ok
ssh_message_auth_reply_pk_ok_simple
ssh_message_auth_reply_success
ssh_message_auth_set_methods
ssh_message_auth_user
ssh_message_channel_request_channel
ssh_message_channel_request_command
ssh_message_channel_request_env_name
ssh_message_channel_request_env_value
ssh_message_channel_request_open_destination
ssh_message_channel_request_open_destination_port
ssh_message_channel_request_open_originator
ssh_message_channel_request_open_originator_port
ssh_message_channel_request_open_reply_accept
ssh_message_channel_request_pty_height
ssh_message_channel_request_pty_pxheight
ssh_message_channel_request_pty_pxwidth
ssh_message_channel_request_pty_term
ssh_message_channel_request_pty_width
ssh_message_channel_request_reply_success
ssh_message_channel_request_subsystem
ssh_message_channel_request_x11_auth_cookie
ssh_message_channel_request_x11_auth_protocol
ssh_message_channel_request_x11_screen_number
ssh_message_channel_request_x11_single_connection
ssh_message_free
ssh_message_get
ssh_message_global_request_address
ssh_message_global_request_port
ssh_message_global_request_reply_success
ssh_message_reply_default
ssh_message_retrieve
ssh_message_service_reply_success
ssh_message_service_service
ssh_message_subtype
ssh_message_type
ssh_mkdir
ssh_new
ssh_options_copy
ssh_options_get
ssh_options_get_port
ssh_options_getopt
ssh_options_parse_config
ssh_options_set
ssh_pcap_file_close
ssh_pcap_file_free
ssh_pcap_file_new
ssh_pcap_file_open
ssh_pki_export_privkey_to_pubkey
ssh_pki_export_pubkey_base64
ssh_pki_export_pubkey_file
ssh_pki_generate
ssh_pki_import_privkey_base64
ssh_pki_import_privkey_file
ssh_pki_import_pubkey_base64
ssh_pki_import_pubkey_file
ssh_print_hexa
ssh_privatekey_type
ssh_publickey_to_file
ssh_scp_accept_request
ssh_scp_close
ssh_scp_deny_request
ssh_scp_free
ssh_scp_init
ssh_scp_leave_directory
ssh_scp_new
ssh_scp_pull_request
ssh_scp_push_directory
ssh_scp_push_file
ssh_scp_push_file64
ssh_scp_read
ssh_scp_request_get_filename
ssh_scp_request_get_permissions
ssh_scp_request_get_size
ssh_scp_request_get_size64
ssh_scp_request_get_warning
ssh_scp_write
ssh_select
ssh_send_debug
ssh_send_ignore
ssh_service_request
ssh_set_blocking
ssh_set_callbacks
ssh_set_channel_callbacks
ssh_set_fd_except
ssh_set_fd_toread
ssh_set_fd_towrite
ssh_set_message_callback
ssh_set_pcap_file
ssh_silent_disconnect
ssh_string_burn
ssh_string_copy
ssh_string_data
ssh_string_fill
ssh_string_free
ssh_string_free_char
ssh_string_from_char
ssh_string_get_char
ssh_string_len
ssh_string_new
ssh_string_to_char
ssh_threads_get_noop
ssh_threads_set_callbacks
ssh_try_publickey_from_file
ssh_userauth_autopubkey
ssh_userauth_kbdint
ssh_userauth_kbdint_getanswer
ssh_userauth_kbdint_getinstruction
ssh_userauth_kbdint_getname
ssh_userauth_kbdint_getnanswers
ssh_userauth_kbdint_getnprompts
ssh_userauth_kbdint_getprompt
ssh_userauth_kbdint_setanswer
ssh_userauth_list
ssh_userauth_none
ssh_userauth_offer_pubkey
ssh_userauth_password
ssh_userauth_privatekey_file
ssh_userauth_pubkey
ssh_userauth_publickey
ssh_userauth_publickey_auto
ssh_userauth_try_publickey
ssh_version
ssh_write_knownhost
string_burn
string_copy
string_data
string_fill
string_free
string_from_char
string_len
string_new
string_to_char

Sections

.text
Size: 687KB - Virtual size: 687KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 195KB - Virtual size: 195KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 38KB - Virtual size: 37KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

Files

Headers

DLL Characteristics

File Characteristics

Sections

UPX0 Size: - Virtual size: 17.4MB

UPX1 Size: 2.4MB - Virtual size: 2.4MB

.rsrc Size: 27KB - Virtual size: 28KB

d73aeea5c530bbe127b514c40c8055e9

Headers

DLL Characteristics

File Characteristics

Imports

ws2_32

kernel32

user32

shell32

advapi32

Exports

Exports

Sections

.text Size: 687KB - Virtual size: 687KB

.rdata Size: 195KB - Virtual size: 195KB

.data Size: 10KB - Virtual size: 26KB

.rsrc Size: 512B - Virtual size: 436B

.reloc Size: 38KB - Virtual size: 37KB

UPX0
Size: - Virtual size: 17.4MB

UPX1
Size: 2.4MB - Virtual size: 2.4MB

.rsrc
Size: 27KB - Virtual size: 28KB

.text
Size: 687KB - Virtual size: 687KB

.rdata
Size: 195KB - Virtual size: 195KB

.data
Size: 10KB - Virtual size: 26KB

.rsrc
Size: 512B - Virtual size: 436B

.reloc
Size: 38KB - Virtual size: 37KB