�8[��j����0���ө{�`ϥ#���?�J��boIS^�HB�����X'��B6���n��5��7�pQԿ��^�ķ��'�3n���F��臨�O��b���~�&��YfQ�s���o�#�8J+m5̾s�kw��k<�1�Rfq�Y�=1� ��쏴��v:_~���� q+���1y{�Udr߲��|>��C����Q�٫�J�<�c K�o�x�#0���9ɋ=�D��f��v�;����đ?y����i��T+�g��������M�.-���H��H6&�q�5n��o���]e*=��q�TB�-�s��(e�؇u���_�R��S�4K�H����-T��-�9[,���蜻W�F2�F<���,�?�JѲDRFg�D�J���<�@�h[�v��f�(4g�"���(��i�5>���8��-`�1R`�N��0�"���R���.�%�Q *��m|�7{�Oc��U(����K�Z�5H�%�p��"2���h��Нk��M�����e���OX5�x�(� [zE��^�-�JU��>�ȱ4~��Ⱦ��-Z�$H1�q�q�{SGlnt��m_��S�Ӽ�BX����D���ʇ3����\�7�h�6q|��$q�,��'�!��J �ni� �+�2RVcŭuo���L)���ǀ�_�T�$#v�����6N.a��x�u]R{s�P��H��6Y`�XK� �a���!�V��4�PhgU�����4^'-�l/I�|�� ��ʂsO���!#�_�7�>��o+Cl��R����5�������%Egz�̫��5�zJ�����ß��$��5.�x�����WI>����+0�!,� ������O�� U�γv8�V�)��nN���^5�$L�S�P) /��7���F4�:��8>�D�8��l��Z,��CE_jWjT�"����a���;�*h���4�N]ݏ�ΦN��l�J,��%���9$��k�����Apk� �f�.�H��J�Y��O�7zߣ9_�˓U�oP�����Z�Fʘ�����*y5�������<]��� ͇)�U�����T���쓚?�>f���T�Ӗ��]I�r`���: 9�zX�J�RT�f0��J�H���ف���T�����@Z*e�25��5�67N�N��|!,�X�e�C��cP �W�.�N��P�ᬰ�ۇ6����xt1BtJg>���a��J�}� Dv��fj���!�yj^�� �E:�gࡹ�b;��m���ǣ7|{��ҕZ`�s���k�U��TT*×�9f��Aީ[�$~ziF �q���Q:"���|���;+��+e��IO>YI��2���$ Q+�ݽ�Pq}X4�2w������ �#��T���S���l�pIm���7���X��Be3M�Ǩ��j8ǚP���`�c��#�s1i6JW�!�2���d�+h�.j/w�Ή��u���x A�܊M "�M#C�T��=�*ﷃA�X�N ;D5?<'���z���&�N�>�O.���p)@G�=b���=U� ����T?��.^��7�%Of��H���`ȃ���U�ty��bK��J���w����9 v|��8�7�ĵ�X�U5��_����0F��6�2S�:�}�C������ك�3�o�ݱ���=���s���(��?c��z X �휋Fӧ`d,�������Q���D�'^̹5t��&�h%?Z�^�SV�&���5�Q�QN*�=�B���<_o��T�8�����8R���k�p'co'�;�����ɬ�:���221}��^�A�<q�U�H�<Wh�Ju���e8��S�Q�\Q 吪�'��[��1�[u��z����?�"��&C;��������1��E�$p>��!�v� �P$����M� �{�hd�56�ohN�e�݀�2�0p*���{S�a�1��z�+ҕ{��/�ʠa0P�o֬����|x�����v����5}�.ztbѬ״�l��D[u�!���ۥ��^�lS�[��D��;�7�;��g��'��,9��iiDa�Ӊ�G*yK��,�u��j^�Y6���侥ME�hE�����WB�D���:��c�3�F ���,� �Xe@�>kf)�Z�7 �������߀���˭�YP�=W�OE0.K~�l��hL,g���3�7��c����j���p'\?-��s�oc��^4/�� `V0�E�'�`�p���� �S�;B���̤����;�Pu#$���v2�����{��K����Q�cYR{���#B�Jii)٤l�+��F��V�/.�!��G�l�\r���������@��eX]_��%O#����u���z?S�!�����Y����="]�J��U`�z'e�s��A�M��R�Eë��H �r}!@9�̰[GV/�60b�sA����������t�����C\s+݂=��0�a�әǬ�ԥ��Uڭ�'7��a��6�8ð���>Z�Z���i�n5��ͮ�'^�(z,tN�d�^�����[p}1�k}�WîI�q�&� ��b7�@{��iZ�k����}��� ?��)�j<�Z������L����ed~�Q)�_���P#��N�W��?���U0"}�hup�2A�>���:,��a�s*�s��F�M�x��OM58�I�J-׃�E�c֗�I�:���@i��(j�GK)f�!��!a ��*l��#5zSK���v& ����ҭn_C&u�t�pܶ����߇�b�. ^-�<�Wxj�!���Oc�FK�?�mt���q���G�x���m��)D�D�H/�8�F^Kh�zњ e������:l0qlg�=�ڜ�K���o��>BU��r|W` .�1���A�9{*��Ώ�Unu<�,�Z4�����T��ʦ�%![��Y� @�N�7�q#�k�J���*�%�g5)��w �p 9+n�3&!]jZJ�1uj����0��k��)2m��V;>z�^���������cA���sw6N�@H:d���aK�i9��� &����տqu��lS9�D���jXz�V��T�bs�>D��[f���K�a�l�rBq*������Rc@��'�
Static task
static1
Behavioral task
behavioral1
Sample
AnyDesk (ETERNAL AIMASSIST WITH BINDS).exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
AnyDesk (ETERNAL AIMASSIST WITH BINDS).exe
Resource
win10v2004-20231025-en
General
-
Target
AnyDesk (ETERNAL AIMASSIST WITH BINDS).exe
-
Size
5.6MB
-
MD5
310d8ddc72e714af04727915faeb1b2b
-
SHA1
21352ccd509f8cdf67449199a7fafed00f9ffa88
-
SHA256
e217e7f5986fd524e18536cf112f79386549cfae8f7dba39a9c1e32e13d61b3d
-
SHA512
dcfe4bba91029ddae4c4e62af33864975e30146024457acd570c7a79569c98b0c66ec8feec384f709f64ffc1a4be6b18bcdd6041ce674b3c7331047d1fef10bb
-
SSDEEP
98304:gn8bXMaQhEZq9hQ132dXs2/SG04VH1pTRFrB4b21tbRcW14tek1IHjhPhpGRv+:gn8TYK4fGG8404T9LudW17k2dh2v+
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource AnyDesk (ETERNAL AIMASSIST WITH BINDS).exe
Files
-
AnyDesk (ETERNAL AIMASSIST WITH BINDS).exe.exe windows:6 windows x64
Password: infected
6d42ef84cc38df897d3081d86e0b4f6a
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
d3d9
Direct3DCreate9
kernel32
LoadLibraryA
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
SetCursor
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
advapi32
InitializeSecurityDescriptor
msvcp140
??1_Lockit@std@@QEAA@XZ
imm32
ImmReleaseContext
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__std_exception_copy
api-ms-win-crt-heap-l1-1-0
_set_new_mode
api-ms-win-crt-runtime-l1-1-0
_beginthreadex
api-ms-win-crt-math-l1-1-0
_dclass
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
api-ms-win-crt-stdio-l1-1-0
ftell
api-ms-win-crt-string-l1-1-0
strncmp
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-convert-l1-1-0
strtol
api-ms-win-crt-time-l1-1-0
_localtime64_s
api-ms-win-crt-filesystem-l1-1-0
_lock_file
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 960KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 399KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 375KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 46KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vroom0 Size: - Virtual size: 3.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vroom1 Size: 5.6MB - Virtual size: 5.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 469B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ