Overview
overview
7Static
static
7PATCH/CRC32Finder.exe
windows7-x64
7PATCH/CRC32Finder.exe
windows10-2004-x64
7PATCH/PATC...k).bat
windows7-x64
1PATCH/PATC...k).bat
windows10-2004-x64
1PATCH/xdel...te.bat
windows7-x64
1PATCH/xdel...te.bat
windows10-2004-x64
1PATCH/xdelta.exe
windows7-x64
7PATCH/xdelta.exe
windows10-2004-x64
7Behavioral task
behavioral1
Sample
PATCH/CRC32Finder.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
PATCH/CRC32Finder.exe
Resource
win10v2004-20231020-en
Behavioral task
behavioral3
Sample
PATCH/PATCH STARTEN (Doppelklick).bat
Resource
win7-20231020-en
Behavioral task
behavioral4
Sample
PATCH/PATCH STARTEN (Doppelklick).bat
Resource
win10v2004-20231023-en
Behavioral task
behavioral5
Sample
PATCH/xdelta-create.bat
Resource
win7-20231020-en
Behavioral task
behavioral6
Sample
PATCH/xdelta-create.bat
Resource
win10v2004-20231020-en
Behavioral task
behavioral7
Sample
PATCH/xdelta.exe
Resource
win7-20231023-en
Behavioral task
behavioral8
Sample
PATCH/xdelta.exe
Resource
win10v2004-20231023-en
General
-
Target
766ad9eb45266e16534ad6fc025bc54e59973034dc2b8d2dad6b0c2241092040.zip.zip
-
Size
1.3MB
-
MD5
42abdf995adf1517707598fb457afc68
-
SHA1
e786c609163ddcbaf48ec88adfbeb5de8648bf21
-
SHA256
0a25a8bedb9c58ee05835c90574904852869e62812b8cd04c8200ceab5e43346
-
SHA512
9ebb662205f4d1ed8bfd990cd8e1715539e88850b1e710451e4912c2fe5cfc7a7262b9bf62a2d9524093d90e765cec9b14274a01881d627cd1a91696ea74ab90
-
SSDEEP
24576:9yKeeZ7MW3IKio3rUzIdg9XC5v6+FWoQcbZOnIq3ZZUpdCFW:9seMWJiYUMS9iSpoQBNpmn
Malware Config
Signatures
-
resource yara_rule static1/unpack002/PATCH/CRC32Finder.exe upx static1/unpack002/PATCH/xdelta.exe upx -
Unsigned PE 3 IoCs
Checks for missing Authenticode signature.
resource unpack002/PATCH/CRC32Finder.exe unpack003/out.upx unpack002/PATCH/xdelta.exe
Files
-
766ad9eb45266e16534ad6fc025bc54e59973034dc2b8d2dad6b0c2241092040.zip.zip.zip
Password: infected
-
766ad9eb45266e16534ad6fc025bc54e59973034dc2b8d2dad6b0c2241092040.zip.zip
-
PATCH/CRC32Finder.exe.exe windows:1 windows x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 312KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 17KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 3KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
out.upx.exe windows:1 windows x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 32KB - Virtual size: 32KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.bss Size: - Virtual size: 270KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
PATCH/PATCH STARTEN (Doppelklick).bat
-
PATCH/mushishi05mkv-xdelta.bin
-
PATCH/xdelta-create.bat
-
PATCH/xdelta.exe.exe windows:4 windows x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 320KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 671KB - Virtual size: 672KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX2 Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE