60c488a82df94c6ecaf276063ff3df4c

Sharing

Copy URL Twitter E-mail

General

Target

60c488a82df94c6ecaf276063ff3df4c
Size

2.0MB
MD5

60c488a82df94c6ecaf276063ff3df4c
SHA1

a5833e96c07bd013951144eda3ab06c2b92c9d18
SHA256

6fc5f99ac2a731a0f6fa33c0af8d4811f2367bdaf526078177d0ef62c1b0dc69
SHA512

f432905f8cdeeffc77f00800f9ddcd210c2b291d8f9b600f04cd07ba8901c237c3d8f00721a2c636ce58573a95a699db4ce53209c4f3defd9810d5051b84acf1
SSDEEP

49152:rgXEJflmmLbFy5+wOoO3BjGHRB4185GX48A:rAEZLxy5+w1O5ERG0Uk

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
static1/unpack001/sleep.dll	upx

Unsigned PE 6 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Pkill.dll
unpack001/s.dll
unpack001/sleep.dll
unpack002/out.upx
unpack001/ssh+1.exe
unpack001/ssh.exe

Files

60c488a82df94c6ecaf276063ff3df4c
.rar
Pkill.dll
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.nsp0
Size: - Virtual size: 92KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.nsp1
Size: 39KB - Virtual size: 40KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.nsp2
Size: - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Port.ini
expA
.elf linux x86
expB
.elf linux x86
expC
.elf linux x86
expD
expE
.elf linux x64
ip.txt
pas.dic
s.dll
.exe windows:4 windows x86 arch:x86

9daa2077796c1e1eebb7432dbfbf9100

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

WriteConsoleA
GetStdHandle
VirtualAlloc
VirtualFree
ExitProcess
GetCommandLineA
QueryPerformanceCounter
GetVersionExA
CloseHandle
WriteFile
lstrlenA
SetFilePointer
CreateFileA
GetLocalTime
ReleaseSemaphore
LeaveCriticalSection
EnterCriticalSection
Sleep
lstrcpynA
lstrcpyA
GetLastError
WaitForSingleObject
CreateThread
GetTickCount
CreateSemaphoreA
lstrcmpiA
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
SetConsoleCtrlHandler

ws2_32

__WSAFDIsSet
select
send
closesocket
WSAGetLastError
connect
ioctlsocket
htons
htonl
socket
recv
setsockopt
ntohs
ntohl
WSAIoctl
bind
inet_addr
inet_ntoa
gethostbyname
WSACleanup
sendto
WSAStartup

iphlpapi

GetBestInterface
GetIpAddrTable

user32

wsprintfA

ntdll

_vsnprintf
strstr
memset
memcpy
atoi
strcpy
_chkstk
strchr
_strnicmp

Exports

Exports

free
malloc
strtok

Sections

.text
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
shell.txt
sleep.dll
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Sections

UPX0
Size: - Virtual size: 52KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 18KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Sections

.text
Size: 38KB - Virtual size: 37KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.bss
Size: - Virtual size: 8KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
ssh+1.exe
.exe windows:5 windows x86 arch:x86

3dc7a323ab0d18496598760e70f99079

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SetUnhandledExceptionFilter

user32

MessageBoxA

msvcp90

??$?HDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@PBD@Z

ws2_32

getsockopt

msvcr90

malloc

advapi32

RegisterEventSourceA

msvcrt

strncpy

iphlpapi

GetInterfaceInfo

psapi

GetMappedFileNameW

shell32

SHGetFolderPathW

Sections

.text
Size: 288KB - Virtual size: 616KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.sedata
Size: 823KB - Virtual size: 824KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.sedata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
ssh.exe
.exe windows:5 windows x86 arch:x86

3dc7a323ab0d18496598760e70f99079

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SetUnhandledExceptionFilter

user32

MessageBoxA

msvcp90

??$?HDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@PBD@Z

ws2_32

getsockopt

msvcr90

malloc

advapi32

RegisterEventSourceA

msvcrt

strncpy

iphlpapi

GetInterfaceInfo

psapi

GetMappedFileNameW

shell32

SHGetFolderPathW

Sections

.text
Size: 288KB - Virtual size: 616KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.sedata
Size: 827KB - Virtual size: 828KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.sedata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
声明.txt
开始.bat
插件.bat
活跃IP大段处理/IP.txt
活跃IP大段处理/ips.txt
活跃IP大段处理/使用说明.txt
活跃IP大段处理/域名.txt
活跃IP大段处理/完成.txt
活跃IP大段处理/第一步域名处理.bat
活跃IP大段处理/第三步ip生成.bat
活跃IP大段处理/第二步ip整理.bat
活跃IP大段处理/第四步去重复整理.bat
.bat .vbs
防卡监听.bat

Sharing

General

Malware Config

Signatures

Files

Headers

File Characteristics

Sections

.nsp0 Size: - Virtual size: 92KB

.nsp1 Size: 39KB - Virtual size: 40KB

.nsp2 Size: - Virtual size: 7KB

9daa2077796c1e1eebb7432dbfbf9100

Headers

File Characteristics

Imports

kernel32

ws2_32

iphlpapi

user32

ntdll

Exports

Exports

Sections

.text Size: 14KB - Virtual size: 13KB

Headers

File Characteristics

Sections

UPX0 Size: - Virtual size: 52KB

UPX1 Size: 18KB - Virtual size: 20KB

.rsrc Size: 3KB - Virtual size: 4KB

Headers

File Characteristics

Sections

.text Size: 38KB - Virtual size: 37KB

.data Size: 2KB - Virtual size: 2KB

.bss Size: - Virtual size: 8KB

.idata Size: 3KB - Virtual size: 2KB

.rsrc Size: 3KB - Virtual size: 3KB

3dc7a323ab0d18496598760e70f99079

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

msvcp90

ws2_32

msvcr90

advapi32

msvcrt

iphlpapi

psapi

shell32

Sections

.text Size: 288KB - Virtual size: 616KB

.sedata Size: 823KB - Virtual size: 824KB

.idata Size: 1024B - Virtual size: 4KB

.rsrc Size: 1024B - Virtual size: 4KB

.sedata Size: 4KB - Virtual size: 4KB

3dc7a323ab0d18496598760e70f99079

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

msvcp90

ws2_32

msvcr90

advapi32

msvcrt

iphlpapi

psapi

shell32

Sections

.text Size: 288KB - Virtual size: 616KB

.sedata Size: 827KB - Virtual size: 828KB

.idata Size: 1024B - Virtual size: 4KB

.rsrc Size: 1024B - Virtual size: 4KB

.sedata Size: 4KB - Virtual size: 4KB

.nsp0
Size: - Virtual size: 92KB

.nsp1
Size: 39KB - Virtual size: 40KB

.nsp2
Size: - Virtual size: 7KB

.text
Size: 14KB - Virtual size: 13KB

UPX0
Size: - Virtual size: 52KB

UPX1
Size: 18KB - Virtual size: 20KB

.rsrc
Size: 3KB - Virtual size: 4KB

.text
Size: 38KB - Virtual size: 37KB

.data
Size: 2KB - Virtual size: 2KB

.bss
Size: - Virtual size: 8KB

.idata
Size: 3KB - Virtual size: 2KB

.rsrc
Size: 3KB - Virtual size: 3KB

.text
Size: 288KB - Virtual size: 616KB

.sedata
Size: 823KB - Virtual size: 824KB

.idata
Size: 1024B - Virtual size: 4KB

.rsrc
Size: 1024B - Virtual size: 4KB

.sedata
Size: 4KB - Virtual size: 4KB

.text
Size: 288KB - Virtual size: 616KB

.sedata
Size: 827KB - Virtual size: 828KB

.idata
Size: 1024B - Virtual size: 4KB

.rsrc
Size: 1024B - Virtual size: 4KB

.sedata
Size: 4KB - Virtual size: 4KB