��y-��j&�}���u�����"�r��4�<�|c�2jl��O"Q8�:X.�O��w�$J$�Y���B����D�N�A���1G-%'p�����A��P���BDKWî��b�:����l��HY$�?�M�Ex1G��Y����h��G��|�DT�֚��RM��y& �P��%�����=���t ��o�(��j @4�]�\��C�f�,~^}д_��**��8������u΅z�*�uH� ���݂�1T����^�#]dj�yP�ʍ�[H��Q��6� ���g`����Y�$`�6�� ����$<Ʈ��CE���_M�i6���忈F.�y��p9��K�IM)gS�Ǻ'�,���w�M!�'/7D�7�mu6��qnY�f���w������ �2ߗ�*h75: 5����C9Tf�/Ѹ.�U�g���g�z������"�Wr������hhR�A �e�V�Z�:�c-v]kɥ6��oc ,p�k�BJ�*��E����:ȡ ��_���h�"�z{�AŮ������/�}\��͍L3����īgziyn��hx�ߑ'��mkQ�MOt9l2U�29`.y�;ᡄ�=�|���PW������*,�|�������� Q=�R��( f�z�1$�1yZ����@�ft0�:�G���g�kA��˸O?�s��s���B���mR�G{�B_,q4�?6�����0 %<�A��ʗ��dv�|��۾}�]�����_��#����@�C$�^�A'@7�i4��&����t��E|�~�8��ތ�`���5#)w-���kOؼ��GK8q*YrWo�l���z�� ��l�f��&i���m���T��N4�Ì%�u����Pv�D� ��nغy�� ќ�p��J8�~�1$ɷx�Mn�nd�z:e^ \p��� ߕ<���բ���I��=!S�3�@ёՏO�/#}��O@WbUۢ0͐�Iچ�?ڮ�5�rh��s�8�~��i��0���*�Cr��3�>jld��t���Q� Dy;��(���dn��5��+2$s����U���e��`&.U�]{�)f��H�*� �w���ke�봱�z�'��B]��ҵ�����.Xd��q�#^·��m�U�&0�Ώ���t ���& z �ԫ�{�����#��'p w��l;����32���� ���m�5��~�^�fƾ˾��6b�@�1���T ��)�r���LQ���+�r�XYY����1��z�{f@(�����Sp��ج���rإxkX�h�*��߬8qUő���//�����:���m`��S�5d͵4���ul���%S�:87���U��?ޜ�yԏ�5!Dn}@�4�-�*��zw�eè�������ɨ�Fy����m-�#B�����5���{�c�6cH�֮�m�au��f�Ҿ�O�o+�O�RvșQ���I?t�iA��2 F%�:u[�5R�O'"�le��KVm��$jF�f��Ydb�!X�P�}���L�e}����m�} �slD�����j������L��}�� ��EE������� ����uNAdןBr�1���3�I����R/,?b����D�,�7 kj�PI�nHY~�hy�7T��<9?һ����8+Z��S�����2�q��Z�f���*,3������|�8y���['��̔�����}g ?-VX�ۂ������Jb���_8z��|�t��b���yH�b���M9��(��ꄕ��qs�-@2tN�G�Q\5.�L[cك�l��#!2=�V�#��`Ox��}E��ś�vit�:�Z}ޏs�9��ݢ@~�w��7g48:P�r4�~"Q��Ć�0�C����Y���Ď�,s����8J$r��q��[b��{�/���YOX�!ϊ[Y�p3��U/�s UǯI�8������!�i �EE�^� ;�a)� w ���<.�7���/�Y�9�����X����V4x��A����0R��asy���j�r���'R M���?�FO{����XT��YX�5������m7�UNq9�*���1ğ2�5^k�������T��g���ހ�U����/��ж'�&��nō:�w�n����h"���e6��Ź]7]��[T�8M7�-5�xrb�"3���(�Ku���-��Y��^l��4���=>;)�OS^DcG2�sJ��2.<��Gr���J����/O�~T����I�S�#yM~��1]��P�p�f ��i���&pR ���ЦeRչ��a E�$�jIGN���W��d9���_���zlbHn�1�Qd��Y$k�>f���,�����۟u�}�][����#� ŧ��Ÿ�d���o&��@\� �~Rm��?8�-��v�Ei�B:[�D\�gA���&��Ax�������}����b1kJ�4C��^��H������l$9��Xo��ħ���\h�_�Ԕ��1����,G�G�8�(X ��8��[n��ywb��Le�@R��i�=���x����(f��Fs�l��b8�cR�����"��2lM����j5� v:ANZ���aE_���cZ��� j�I ��Gr�����(��:@�@+��D�1�{���ݾa� B��'����܌�yeQD�ԧ�u.ɰ��51���|÷�ܶ�!��k�� 9�fxH8��@i��+X���R>c�SY�s1������T�-p�> ����kVg�?^C�3�G �Z���UǾ���[����6>��{Q��������J������s��;-��.���)���"Sn�\�7�憪����+�֠$נ�nh������Y�cr�E2qy���������kw�n�-��%W�:<�b�B@��` Z�������.L�Z�8T3��Ssm���Y�H<��A��o��h��E��3AÀ|�������8�;I�B_Ÿ���� !�t�\ߒ����=x�E�k�I?�t��>4(x(TR[l�\+�A��'P.I5�2<��lT�`����B"뒛���jʨb�~im���8�!(����"��/x�S&`D'6u��!qKE|fA��K�ξ''?�8 �p��t�j
Behavioral task
behavioral1
Sample
草泥马白嫖车队版V6.6/WIN8.10.11自带杀毒如何设置.pdf
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
草泥马白嫖车队版V6.6/WIN8.10.11自带杀毒如何设置.pdf
Resource
win10v2004-20231023-en
Behavioral task
behavioral3
Sample
草泥马白嫖车队版V6.6/白嫖版使用步骤.pdf
Resource
win7-20231025-en
Behavioral task
behavioral4
Sample
草泥马白嫖车队版V6.6/白嫖版使用步骤.pdf
Resource
win10v2004-20231020-en
Behavioral task
behavioral5
Sample
草泥马白嫖车队版V6.6/草泥马白嫖车队版V6.6.exe
Resource
win7-20231023-en
General
-
Target
072f03820faa64e7c551effdcc346313f82137c951a9c84e1058a617207936a1
-
Size
15.2MB
-
MD5
896a6309713a235f15939f516e9c6f2b
-
SHA1
7f5886f5f00d4278b66329a43da946ebb450b24c
-
SHA256
072f03820faa64e7c551effdcc346313f82137c951a9c84e1058a617207936a1
-
SHA512
eae4814f567bb58a5e2a60b817fb8c90d4721a6ac7edf52587fd0cd39a7db4712047f3ef8e625be6ff99141cfb2553096518dfec2b47e4ec2dc5f92b256e4eb0
-
SSDEEP
393216:o5GsQfPWuFAHHPVdhPwAmsmhqnv0KRsO6gtn7una2SqfK3DPnt:o5G9fPWuFAHHPVkAmn1KWO6snqnaf3Tt
Malware Config
Signatures
-
resource yara_rule static1/unpack001/草泥马白嫖车队版V6.6/草泥马白嫖车队版V6.6.exe vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/草泥马白嫖车队版V6.6/草泥马白嫖车队版V6.6.exe
Files
-
072f03820faa64e7c551effdcc346313f82137c951a9c84e1058a617207936a1.zip
-
草泥马白嫖车队版V6.6/WIN8.10.11自带杀毒如何设置.pdf.pdf
-
草泥马白嫖车队版V6.6/白嫖版使用步骤.pdf.pdf
-
草泥马白嫖车队版V6.6/白嫖部分奖励预览.jpg.jpg
-
草泥马白嫖车队版V6.6/白票使用说明.jpg.jpg
-
草泥马白嫖车队版V6.6/草泥马白嫖车队版V6.6.exe.exe windows:5 windows x86
2ab63c7f6a12139694f962b987b59c85
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
rasapi32
RasHangUpA
winmm
waveOutUnprepareHeader
ws2_32
closesocket
kernel32
GetVersion
GetVersionExA
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetMenuItemID
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
gdi32
ExcludeClipRect
winspool.drv
OpenPrinterA
advapi32
RegCreateKeyA
shell32
SHGetSpecialFolderPathA
ole32
OleDuplicateData
oleaut32
SafeArrayUnaccessData
comctl32
ImageList_GetImageInfo
oledlg
ord8
wininet
InternetCanonicalizeUrlA
wldap32
ord29
comdlg32
GetSaveFileNameA
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 2.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 6.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 509KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 4.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 11.8MB - Virtual size: 11.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 372KB - Virtual size: 368KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
草泥马白嫖车队版V6.6/草泥马辅助介绍.txt