Overview

overview

8

Static

static

3

Logon_over...rm1.js

windows7-x64

1

Logon_over...rm1.js

windows10-2004-x64

1

Logon_over...m1.vbs

windows7-x64

1

Logon_over...m1.vbs

windows10-2004-x64

1

Logon_over...er.vbs

windows7-x64

1

Logon_over...er.vbs

windows10-2004-x64

1

Logon_over...es.vbs

windows7-x64

1

Logon_over...es.vbs

windows10-2004-x64

1

Logon_over...UI.exe

windows7-x64

1

Logon_over...UI.exe

windows10-2004-x64

1

Logon_over...er.exe

windows7-x64

8

Logon_over...er.exe

windows10-2004-x64

8

Logon_over...er.exe

windows7-x64

1

Logon_over...er.exe

windows10-2004-x64

8

Logon_over...cs.dll

windows7-x64

1

Logon_over...cs.dll

windows10-2004-x64

1

RSOD/RSOD/Form1.vbs

windows7-x64

1

RSOD/RSOD/Form1.vbs

windows10-2004-x64

1

RSOD/RSOD/...er.vbs

windows7-x64

1

RSOD/RSOD/...er.vbs

windows10-2004-x64

1

RSOD/RSOD/...es.vbs

windows7-x64

1

RSOD/RSOD/...es.vbs

windows10-2004-x64

1

RSOD/RSOD/...UI.exe

windows7-x64

1

RSOD/RSOD/...UI.exe

windows10-2004-x64

1

RSOD/RSOD/...OD.exe

windows7-x64

1

RSOD/RSOD/...OD.exe

windows10-2004-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target

    LogonUI_overwriter_source_code.zip

  • Size

    112KB

  • MD5

    3c20c305466728aa8174c34434d98b3f

  • SHA1

    927c4d779522423beaea517fa2fc0eaf3bf32350

  • SHA256

    dca2d88f17f988d79900e1cb81654b0996b711415a52096eca892d175b28558e

  • SHA512

    798f03976d76c8b08e2c0af12692c2c644738d2ea4caa6a02037c9a73ae90d172d4023c0d83b3b68c386625f7d48f178845c42c3da4e8813e846115b80dcf1c2

  • SSDEEP

    3072:LulclVM/kDBulclVM/kDaTNNTHYGkGuTHU1dubTH4nQ:LEco/kdEco/kOpNzYRGuz6dubzEQ

Score
3/10

Malware Config

Signatures

  • Unsigned PE 6 IoCs

    Checks for missing Authenticode signature.

Files

  • LogonUI_overwriter_source_code.zip
    .zip

    Password: infected

  • Logon_overwriter/.vs/Logon_overwriter/v16/.suo
  • Logon_overwriter/Logon_overwriter.sln
  • Logon_overwriter/Logon_overwriter/Form1.Designer.cs
  • Logon_overwriter/Logon_overwriter/Form1.cs
    .js
  • Logon_overwriter/Logon_overwriter/Form1.resx
    .vbs
  • Logon_overwriter/Logon_overwriter/Logon_overwriter.csproj
  • Logon_overwriter/Logon_overwriter/Program.cs
  • Logon_overwriter/Logon_overwriter/Properties/AssemblyInfo.cs
  • Logon_overwriter/Logon_overwriter/Properties/Resources.Designer.cs
    .vbs
  • Logon_overwriter/Logon_overwriter/Properties/Resources.resx
    .vbs
  • Logon_overwriter/Logon_overwriter/Properties/Settings.Designer.cs
  • Logon_overwriter/Logon_overwriter/Properties/Settings.settings
  • Logon_overwriter/Logon_overwriter/Resources/LogonUI.exe
    .exe windows:4 windows x86 arch:x86

    Password: infected

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • Logon_overwriter/Logon_overwriter/app.manifest
  • Logon_overwriter/Logon_overwriter/bin/Debug/Logon_overwriter.exe
    .exe windows:4 windows x86 arch:x86

    Password: infected

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • Logon_overwriter/Logon_overwriter/bin/Debug/Logon_overwriter.pdb
  • Logon_overwriter/Logon_overwriter/obj/Debug/.NETFramework,Version=v4.0.AssemblyAttributes.cs
  • Logon_overwriter/Logon_overwriter/obj/Debug/DesignTimeResolveAssemblyReferences.cache
  • Logon_overwriter/Logon_overwriter/obj/Debug/DesignTimeResolveAssemblyReferencesInput.cache
  • Logon_overwriter/Logon_overwriter/obj/Debug/Logon_overwriter.Logon.resources
  • Logon_overwriter/Logon_overwriter/obj/Debug/Logon_overwriter.Properties.Resources.resources
  • Logon_overwriter/Logon_overwriter/obj/Debug/Logon_overwriter.csproj.CoreCompileInputs.cache
  • Logon_overwriter/Logon_overwriter/obj/Debug/Logon_overwriter.csproj.FileListAbsolute.txt
  • Logon_overwriter/Logon_overwriter/obj/Debug/Logon_overwriter.csproj.GenerateResource.cache
  • Logon_overwriter/Logon_overwriter/obj/Debug/Logon_overwriter.csprojAssemblyReference.cache
  • Logon_overwriter/Logon_overwriter/obj/Debug/Logon_overwriter.exe
    .exe windows:4 windows x86 arch:x86

    Password: infected

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • Logon_overwriter/Logon_overwriter/obj/Debug/Logon_overwriter.pdb
  • Logon_overwriter/Logon_overwriter/obj/Debug/TempPE/Properties.Resources.Designer.cs.dll
    .dll windows:4 windows x86 arch:x86

    Password: infected

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • RSOD/.vs/RSOD/v16/.suo
  • RSOD/RSOD.sln
  • RSOD/RSOD/Form1.Designer.cs
  • RSOD/RSOD/Form1.cs
  • RSOD/RSOD/Form1.resx
    .vbs
  • RSOD/RSOD/Program.cs
  • RSOD/RSOD/Properties/AssemblyInfo.cs
  • RSOD/RSOD/Properties/Resources.Designer.cs
    .vbs
  • RSOD/RSOD/Properties/Resources.resx
    .vbs
  • RSOD/RSOD/Properties/Settings.Designer.cs
  • RSOD/RSOD/Properties/Settings.settings
  • RSOD/RSOD/RSOD.csproj
  • RSOD/RSOD/bin/Debug/LogonUI.exe
    .exe windows:4 windows x86 arch:x86

    Password: infected

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • RSOD/RSOD/bin/Debug/RSOD.pdb
  • RSOD/RSOD/obj/Debug/.NETFramework,Version=v4.0.AssemblyAttributes.cs
  • RSOD/RSOD/obj/Debug/DesignTimeResolveAssemblyReferences.cache
  • RSOD/RSOD/obj/Debug/DesignTimeResolveAssemblyReferencesInput.cache
  • RSOD/RSOD/obj/Debug/RSOD.Properties.Resources.resources
  • RSOD/RSOD/obj/Debug/RSOD.RSOD.resources
  • RSOD/RSOD/obj/Debug/RSOD.csproj.CoreCompileInputs.cache
  • RSOD/RSOD/obj/Debug/RSOD.csproj.FileListAbsolute.txt
  • RSOD/RSOD/obj/Debug/RSOD.csproj.GenerateResource.cache
  • RSOD/RSOD/obj/Debug/RSOD.csprojAssemblyReference.cache
  • RSOD/RSOD/obj/Debug/RSOD.exe
    .exe windows:4 windows x86 arch:x86

    Password: infected

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • RSOD/RSOD/obj/Debug/RSOD.pdb