9891ecb3c0aa5d2c9a07e4f5fbf16444ef1ffeb74edfdf30bb3143229e6f9bb9[.]zip[.]zip

Sharing

Copy URL Twitter E-mail

General

Target

9891ecb3c0aa5d2c9a07e4f5fbf16444ef1ffeb74edfdf30bb3143229e6f9bb9.zip.zip
Size

1.7MB
MD5

f68f3081978354bec090d7f073ceb81b
SHA1

3d9806bf42536e85b44d48f3c9b9887e0b3fdc76
SHA256

3e050d1d40f34a8e336ae6d0c28fca1052953815e4b4e258daedcfe1d171a6fe
SHA512

08bd7a1b011696dade72d3bc5d7982a390a59b08568f7bb3720e2c4136dcd8f1d7cb8314c66cdb911c9fbe580ebb6e368a4a38facb3c66087943e9f72cfddaf9
SSDEEP

49152:S/vqcFmUdlyXgEiCWJ4NU6MLKULwjbuc/bmgB5Xy7:qicjlegRwU6Mw+CB5U

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
static1/unpack002/PrometheanRemoteControl.exe	upx
static1/unpack002/RemoteClient.exe	upx
static1/unpack002/RemoteControl.exe	upx

Unsigned PE 5 IoCs

Checks for missing Authenticode signature.

resource
unpack002/PrometheanRemoteControl.exe
unpack002/PrometheanSupport.exe
unpack002/RC-promethean.exe
unpack002/RemoteClient.exe
unpack002/RemoteControl.exe

Files

9891ecb3c0aa5d2c9a07e4f5fbf16444ef1ffeb74edfdf30bb3143229e6f9bb9.zip.zip
.zip

Password: infected
9891ecb3c0aa5d2c9a07e4f5fbf16444ef1ffeb74edfdf30bb3143229e6f9bb9.zip
.zip
Promethean RemoteControl.lnk
.lnk
Promethean Support.lnk
.lnk
PrometheanRemoteControl.exe
.exe windows:4 windows x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

UPX0
Size: - Virtual size: 696KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 335KB - Virtual size: 336KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PrometheanSupport.exe
.exe windows:4 windows x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

CODE
Size: 638KB - Virtual size: 637KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 3KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: - Virtual size: 16B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 44KB - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 66KB - Virtual size: 66KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
RC-promethean.exe
.exe windows:4 windows x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

CODE
Size: 638KB - Virtual size: 637KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 3KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: - Virtual size: 16B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 44KB - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 66KB - Virtual size: 66KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
RemoteClient.exe
.exe windows:4 windows x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

UPX0
Size: - Virtual size: 592KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 298KB - Virtual size: 300KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
RemoteControl.exe
.exe windows:4 windows x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

UPX0
Size: - Virtual size: 696KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 335KB - Virtual size: 336KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

Password: infected

Headers

File Characteristics

Sections

UPX0 Size: - Virtual size: 696KB

UPX1 Size: 335KB - Virtual size: 336KB

.rsrc Size: 5KB - Virtual size: 8KB

Headers

File Characteristics

Sections

CODE Size: 638KB - Virtual size: 637KB

DATA Size: 20KB - Virtual size: 19KB

BSS Size: - Virtual size: 3KB

.idata Size: 11KB - Virtual size: 11KB

.tls Size: - Virtual size: 16B

.rdata Size: 512B - Virtual size: 24B

.reloc Size: 44KB - Virtual size: 44KB

.rsrc Size: 66KB - Virtual size: 66KB

Headers

File Characteristics

Sections

CODE Size: 638KB - Virtual size: 637KB

DATA Size: 20KB - Virtual size: 19KB

BSS Size: - Virtual size: 3KB

.idata Size: 11KB - Virtual size: 11KB

.tls Size: - Virtual size: 16B

.rdata Size: 512B - Virtual size: 24B

.reloc Size: 44KB - Virtual size: 44KB

.rsrc Size: 66KB - Virtual size: 66KB

Headers

File Characteristics

Sections

UPX0 Size: - Virtual size: 592KB

UPX1 Size: 298KB - Virtual size: 300KB

.rsrc Size: 5KB - Virtual size: 8KB

Headers

File Characteristics

Sections

UPX0 Size: - Virtual size: 696KB

UPX1 Size: 335KB - Virtual size: 336KB

.rsrc Size: 5KB - Virtual size: 8KB

UPX0
Size: - Virtual size: 696KB

UPX1
Size: 335KB - Virtual size: 336KB

.rsrc
Size: 5KB - Virtual size: 8KB

CODE
Size: 638KB - Virtual size: 637KB

DATA
Size: 20KB - Virtual size: 19KB

BSS
Size: - Virtual size: 3KB

.idata
Size: 11KB - Virtual size: 11KB

.tls
Size: - Virtual size: 16B

.rdata
Size: 512B - Virtual size: 24B

.reloc
Size: 44KB - Virtual size: 44KB

.rsrc
Size: 66KB - Virtual size: 66KB

CODE
Size: 638KB - Virtual size: 637KB

DATA
Size: 20KB - Virtual size: 19KB

BSS
Size: - Virtual size: 3KB

.idata
Size: 11KB - Virtual size: 11KB

.tls
Size: - Virtual size: 16B

.rdata
Size: 512B - Virtual size: 24B

.reloc
Size: 44KB - Virtual size: 44KB

.rsrc
Size: 66KB - Virtual size: 66KB

UPX0
Size: - Virtual size: 592KB

UPX1
Size: 298KB - Virtual size: 300KB

.rsrc
Size: 5KB - Virtual size: 8KB

UPX0
Size: - Virtual size: 696KB

UPX1
Size: 335KB - Virtual size: 336KB

.rsrc
Size: 5KB - Virtual size: 8KB