Overview
overview
7Static
static
7Aalesund-i...ter.js
windows7-x64
1Aalesund-i...ter.js
windows10-2004-x64
1Aalesund-i...nd.cmd
windows7-x64
7Aalesund-i...nd.cmd
windows10-2004-x64
7Aalesund-i...in.cmd
windows7-x64
7Aalesund-i...in.cmd
windows10-2004-x64
7Aalesund-i...er.cmd
windows7-x64
1Aalesund-i...er.cmd
windows10-2004-x64
1Aalesund-i...et.exe
windows7-x64
7Aalesund-i...et.exe
windows10-2004-x64
7Behavioral task
behavioral1
Sample
Aalesund-issue/Models/ifc_adapter.js
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
Aalesund-issue/Models/ifc_adapter.js
Resource
win10v2004-20231023-en
Behavioral task
behavioral3
Sample
Aalesund-issue/get.aalesund.cmd
Resource
win7-20231020-en
Behavioral task
behavioral4
Sample
Aalesund-issue/get.aalesund.cmd
Resource
win10v2004-20231020-en
Behavioral task
behavioral5
Sample
Aalesund-issue/ifctest-login.cmd
Resource
win7-20231025-en
Behavioral task
behavioral6
Sample
Aalesund-issue/ifctest-login.cmd
Resource
win10v2004-20231025-en
Behavioral task
behavioral7
Sample
Aalesund-issue/startEdmServer.cmd
Resource
win7-20231025-en
Behavioral task
behavioral8
Sample
Aalesund-issue/startEdmServer.cmd
Resource
win10v2004-20231023-en
Behavioral task
behavioral9
Sample
Aalesund-issue/wget.exe
Resource
win7-20231023-en
Behavioral task
behavioral10
Sample
Aalesund-issue/wget.exe
Resource
win10v2004-20231025-en
General
-
Target
6306b44996bf2c87d67cf73306204cb20b569c7ec50ccccbe63b51c09cbce79c.zip.zip
-
Size
11.1MB
-
MD5
dd52d2dae6dc1784eb2195d51c026937
-
SHA1
39abcffd9e22f6f951219997fe1037985f6f124f
-
SHA256
5f265f7ec7d80f9a08881a49370a0e2274f3ea4f9661421b14d925298bc6316a
-
SHA512
00591b238f8771f013d6b835988d57ade29b437429a3fa5bb162d2e0c943eb73afb42ae60ab29eebbbde07b0a58802757f75b7590e27ecb84e391efc333e8560
-
SSDEEP
196608:BgztPVlMm4VDjuu7r7YmsoCFMqVr7E5tXS+bq2D2BUn70dcNK0dSe7iKsMnJ2:B+2JPuu7Ht5vCnT+bC4QWwu7JsF
Malware Config
Signatures
-
resource yara_rule static1/unpack002/Aalesund-issue/wget.exe upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack002/Aalesund-issue/wget.exe
Files
-
6306b44996bf2c87d67cf73306204cb20b569c7ec50ccccbe63b51c09cbce79c.zip.zip.zip
Password: infected
-
6306b44996bf2c87d67cf73306204cb20b569c7ec50ccccbe63b51c09cbce79c.zip.zip
-
Aalesund-issue/Models/IFC2X3_for_generation.exp
-
Aalesund-issue/Models/aalesund.ifc
-
Aalesund-issue/Models/ifc_adapter.qex.js
-
Aalesund-issue/get.aalesund.cmd
-
Aalesund-issue/get.aalesund.request.xml
-
Aalesund-issue/ifctest-login.cmd
-
Aalesund-issue/ifctest-login.request.xml
-
Aalesund-issue/startEdmServer.cmd.cmd .vbs
-
Aalesund-issue/web.xml.xml
-
Aalesund-issue/wget.exe.exe windows:4 windows x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 556KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 390KB - Virtual size: 392KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX2 Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE