��h)b{�XBu�r�SWK� Z�o�0�6i��U��\���7X,GIE�U�� ���·�Vgs+T���K1OWb��w)W��L}1C3!M��FvE8�9�s>���(�o&�NE�f!R@�N��D���q��R���g���Ǜ� ��W�}����Sp|��K�f�- `=[�����*��t��/"���a�2K�gPJ��*���}pm>,8��c�A�+����BX����0����y��R�'�85�G��K�'�;}�/8i��e$ʦaG]�Aw ,����3�1���ܬ�/�q�f�,�y�����w�6:�-�����/�Xw@��-}A@�@7I�|K]��|[���x�>�O˿�'*]��z�]I��8Q5l�$'��b4hx��h��u �_e����gF�U���o��<lk-�='z#�a�����o��aT-��Ub��RP��E,�gR/�B��a�e@X�8��[���z��v�y3�{v.�)���];h�@mL���A:Pi8�_*���4LJ#�:n��j��u DT�D����Ȕ �h�����A�ci㭷�����m�.�m�U��Vw��jHk����m��jPT]6h �=�O�V_�(�8ҝ��+���e.b#r��M�o!�ѽWf'{*^k*{{��#��6�픎�x.#����w8��zȆ� R(؆~�.O�Z� H/ <Tmq_M5۾:�*�f|���l�p�Q���N��<.w\�Hh�;�� %Xw_øU��Vz�|�4��N�Z��-�v0�Ee]��A�$X�ԣ��8��R9WA��AmYdjs�<h���]��힇 Q���9Y�עg��gbd7^J��c��z/m�hۚ/�W"�p�s���M�Kb��^9A�ۇqj�=` �՞��KF���6�������)(d�\��w%��(��_س�}��C$w(�y����-�r #����N�7A.���?�fWv:~_�N����**�d%~��s�@�-����'O���ԼO�iK�E�� � ���0�n}H�]�Dei�h%�����gQ1���O���zHu_��v��U����$��l����V�;���������'�����PNʸ�P%S2@,F�u�mF���n ���p��;�ܜ5Z��,�S����PJtN_�!TV+M![� �T��R<Aj7��\j1*V�>)�X� O<��p��~�����$ ����l�̵���}�hY�� ]�.�Էym��9��Ư�f�y@����$6w���{��N����L�[F�߮���Ϭ��2���W]cS�9�ѩ�j���;�>���(+5��L��5�퍽V��[��NPt�j�~�|RJ(h�ml1��=��a H{�/��w+A��S**��� ���L�!�^˼/���I$ ��v�������o��F{ 6�;%- b,��!_U�X�ɗ!������v�dp3MW�ń�!"\������x�w���rM�Q��i0�@) �Vw����B�)����^�D<�C�nz�f�Bq����]J����ܳ�y�#��7��%sq{T g`���Qٝ�p�����b�nj�������}�}W��vt1�l�L�+�Ny$̝�s�l��}�ΗC�O�[�b�jo]u?��H��T�_�_7'�x/sA� �"&��]��J.��:�^���������6����29�֜m�h������}����_�fF�yuaY�!X�l[�4~?��v��ǜ#F9,�2j�J��P9���kK|����U��ι���YP`71K�#�/�h�ʉ��˰@Q���x�h_V+gL4���.bb����(�L1Z�-�&�kLDd!�l ��CS�ULi�[��o�i:�5�pp�s(��V�C�� f��?��j�lT�1�gnn X�������=/���x0Wcr��#��j@�*U�`�w��(T/Y�[�U��lψ�Z��֚�"x[\�RXs�t��o�:������a+�3%��4�����էA�'��������3�̽-�51AnX�8�Bt�r�Id�'��W(��:rᬋ�Z�s��u�8[��yV��rC��.o�v�c�@Llc�d�n$zD���#;���-ud��P���鮧7~Y-l�11G1U�$���~Y��`�:�nWd֥.L7��@r�/��&G��3jj�� �$��G6'l��� @te����쎄��0pH�,{�\�<\`�+J$0��l�j��h���<)g��'���jp�I;��(̟W�a^]DG�D6K���a-�C�������U�MV�sL�ӈ(\ghw��G��U�g��]>.���^��U��8��ۺ^��gO��5[*����=����<rm=� ��� cd��K���c�}�/ +��������oT'�u��%����8fO������llRø�!`���o2�a���p$��BF�R"ֳ;\Wv"��#H������7�#m����O�㟜�H��Ĉ1(��{~�t�,h2� �isU��\����U/EL�6 ��~]�Ƭ��hD,�'-H%��;�;ؑ;M��Iߦ���rzR��&!�K��;G�%Ͻ��\m�&�X��&�2h�1t.Y}W~:��Ŋ�j+�xlAȟE��n�~�˹�x�/�ig"b�l=�|�ߔ JP��O�,JR����������\>/���������ˠ�~��>:u���v� �϶O���Al��T��fc�;.�=��J��0�&0+ѧ���(j�ϡ[�æ�Ͳշ�(E��+��<������`9���� G` e�� ��,�\�vÈ�GKM��Y�'�}�-��,7�m�m�*�KS����ec�Ғ�c�l�M��f2�/w�A�l�����7��2T�V>'.+G�'�P d_�Sg�,Rz_ďkeQ���J�"JWz����]9Ҹ�a�|���~Ӕ��dp?&-��Ґ���0��]�%9��jw`@�\J��O!ܚgJh�R����0�K�%k�,y3y��!��2�M�m �T8�%� M��Y���G�'�K�����r���qːv�,p3�9�0���x�t����Bc���th)w��ޜ� %g!�r�[e\��Ǘ�������5��2l
Static task
static1
General
-
Target
sohomperm.exe
-
Size
5.1MB
-
MD5
7b142b5c657cd7b997b0761885a28882
-
SHA1
3efc60542d7d8066b53486e664e299aa20755d54
-
SHA256
230b609eb08f2a0d25ee10b3a96d38178fe4bbaf8037801028eb243e1b303ec6
-
SHA512
43e937f1d0b7d2756a5fe8dde5a3c7d80c924e08b830577360fd1dc3a77c19e3ba61a378843aa0e0d8614195a6162599c280b953cc8d1b209237b9853903f528
-
SSDEEP
98304:PSAQbK9KXrIwsUdZVdS8XIViDb8IrQTQQBA2ZoM71MxwlWkq3GTo4jB:iW9KXrDSXiDhsTBBA2myMxyWD2v
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource sohomperm.exe
Files
-
sohomperm.exe.exe windows:6 windows x64 arch:x64
5325e7540369b71ef5c611e515e079e3
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
CloseHandle
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
ShowWindow
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
advapi32
RegCloseKey
shell32
ShellExecuteExA
msvcp140
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
iphlpapi
GetAdaptersInfo
vcruntime140_1
__CxxFrameHandler4
vcruntime140
_CxxThrowException
api-ms-win-crt-heap-l1-1-0
_set_new_mode
api-ms-win-crt-multibyte-l1-1-0
_mbscmp
api-ms-win-crt-utility-l1-1-0
srand
api-ms-win-crt-string-l1-1-0
toupper
api-ms-win-crt-stdio-l1-1-0
fwrite
api-ms-win-crt-runtime-l1-1-0
exit
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-math-l1-1-0
ceilf
api-ms-win-crt-filesystem-l1-1-0
remove
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 134KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 830KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.discord Size: - Virtual size: 3.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.discord Size: 5.1MB - Virtual size: 5.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ