��c'�D��&��4�C��u`J�!�\��7b0��� �4Y`��(*I}�v&L����y�4�)��5��e��R�� ���'��&8���2`"nG�N�q��)�5c6��f���ĔH���O.��(�)ơ"G�۾�ȉIV�?�Z�F ���l!��r/���5פ^BsN-��l�}���1�N�0��lJ�*g)읽�+<���E:��D�֠��+��"Jۗ�P����De��T����gYiKj$-#�� ��^g��Ew�����o6��U;z0!��ћ*W��8�y��BO]m���q�q��#-�|�Ɔ];龜P�?�_�*�:'є+P���Fb��;-�T��5�/1N�2*W���a�s0�0 N�i�#U�<��+�^���l���)�3�v���+E�+�9�@�'D�i 6#�㦒1��oR(����e�������3���<� ��Nt1�����ܭ���p.a�|�����0s�^�~l�����*=�d�:Z�>�Jز���5��f 2%q�&G�I�2w��2��{�3�F�P�7p��d8���s��V���~U�� ��o,џ����"���M ��(U:#��'����V�@hNg�݀�^v�����X�|�~Y38y���L&���ϟ~�0����n3��/�nZ���d�� A���S�O`�P|�ןP�@���ҋ��6�V��R�e6������Y1�����i�O4B��� Fd%��ދF$ @@b��;W�����{݊P�Uݑ~�ٔ����ӆ�^��*'s�y%Q�Fu6� l}y��Q4�/Ta�\����h�[}�?C^Z�s�e�(�6�#�&S<j�cX�Ll�L3�{�V圍Z��c��������1OV%� oz��~6Qg�0�D� ǹ̚�E��a8|�U����5�$N�:�r��`H�bR�R��ك�Q�� �~��K!�=3��`����F��s�}����;������K��7�#vm[�m��a���)r�-�����A������ξ1B���}M��a�'����Dt^�-Nai,:}�#u0���Q6�^B h�rT�t������9��rh�����F׳`f��18�/㙽F���yM�Ď C��"D��m�-)�Q{��Pܳt�@��w-]�C��؍�r��m�,�dk}L��A��q�R�ꧥa]hÏ��p_AW�^Nl�U�2j0漂ث��D����ygq#q+�n��D֎#�]uxHC�S�^ t����.��n�2�m��QƧFS��}�c/l�Y��3kM�a�;{�ha���I��]A�7~�x������3�,�`�+�$��uǼ0�j ��*��TD��I�ɘ���'^� _lvߝCs�U����n��'�t��跭m��k�C`G���>�N�`Y��ȝ ���;I"�Hhi�N��溠�vG����ăN㼄��8���*}m<K�B��6�r�W�_�u�Jg� }����~7F�٨�'��� �R23��?M}��!"Eї�":��&��3t�lD�t��cF��9.r]��s �>kŃo���M\����4p�.犎�S{�rDa� p~@��WŎ���{ڲ����e6�<����0?ӮFH�N�'ǝ�!bGc��4%�jZ49��|�ts81g|����kѪ���qv& ۔��!X��x�a���G� \z�ki|��/���@�CŨ#��Y����j nj=$pvo��)������*;�u�X�BM�>�[��/���#S���]�]�)�V�m����r�u?�3ÖF��o��f�dtݸar��p�P��ث��g�T����2�'���%�b�'����a��z�Z�1�:�$�6�D����YV���Jl$?��N�3Tr��� �e/ez�rP�t>1��R�+7[��`��t3��;�Ϫ'%m��8MX����I��V���s{f��mO��a7��GTKr�ɏ���" � .FG���;d�F#x�V:������C<̌��i'Z��[����!/��^ɀD*���i�|x��$��<������eL�����-�,,oU�����Z#ɧ���o����@�Kv�r�5j�CH�!y�\��a����l������0u����w)xgr c5DԐƮ}LfJOFz9�Mgx�I�Q+�-�!�G �+r�XOh9���F;���� [�1 ����4�M!j�����.�����l����8τ��҃��>5��-7�T�e��j�T9엿a���Z�ZDUJx���PAa^�&$=x��>n�61 ��[�h)Z$���+��ެߓ�;�x�i�wα�X��X���IR�X�,�q��u\AvV2ʣ�:�����sE���f���Y�>�Q<� w/������ �G�I�A�ZN� �?6i�&ʇ�]�.�_Z�,L�f�j�z��,�>I<�W���O�A�a��*�"��� ��1��n��ΨrX<��u<�3�El2�OM6��'n����ڡ��x�;�cHt����lhq2���#P����ӑ�ج���A���tDK���&�� fqs�{�)�hvBi_<hz�r�Ӿ����s_`���!�u�'�����@����)[�����D�M9�g�̯7�K[���{�L��$�d�^�Hi�m�yo��#�NL�U�)����1�b��"�=�ɜ���y������߹D�Éa����ˑ�nX54[5�-[��iM�ӤÆea��=^\/��6�����~eWj\����o(6$�0�0c��̺j�E(��� �2β���~�������q�{U�*���)�j���b'�u������v�\]��}ON��f~$L5u9r�*�m�3����Ua�,���D=M [��0RYۈi]��~��Ԇ��5 ��u�h�Z/���\|wۡ,Y[ͅVA�����n�-��S����Y7�U�5?�����a���sp�>z��n|����s�V�gr�E0�,����E�҉vޠ��:�o�|�w�}�%9��F ?$ʫ.5��9�k���MS��Q�zx��7��a�/�ƪ��k��0M�҂3� ��H�ݫ���t۞82��T�z
Static task
static1
Behavioral task
behavioral1
Sample
DLLLoad.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
DLLLoad.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral3
Sample
Hamachi France.url
Resource
win7-20231215-en
Behavioral task
behavioral4
Sample
Hamachi France.url
Resource
win10v2004-20231222-en
Behavioral task
behavioral5
Sample
TeknoGods.dll
Resource
win7-20231215-en
Behavioral task
behavioral6
Sample
TeknoGods.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral7
Sample
teknohelper.exe
Resource
win7-20231215-en
Behavioral task
behavioral8
Sample
teknohelper.exe
Resource
win10v2004-20231215-en
General
-
Target
f7b002fe39ed2144ff1ba674909ec7e0
-
Size
1.3MB
-
MD5
f7b002fe39ed2144ff1ba674909ec7e0
-
SHA1
80d7c2eb68db5c552865783946e236a0d14860b7
-
SHA256
e2fae47a626faef8538b9ef12935a02cfd26193bc283d0306e310a1403710223
-
SHA512
3aff459428202997d991600b1e6adb2643b9c901002280ea90f0aaeecbcdc4ecee8bf9475b578164acb464dfebfdd32c14bb452264248d31c89524c51475a7c5
-
SSDEEP
24576:+cOuWFLnabRCFJUDYzg/+5tLyfgy7g6fE8L4JJBqPnO6taLYjiYZ3/dFTP:lOPTabuQ0D5tufLPcBsO6YKf
Malware Config
Signatures
-
Unsigned PE 3 IoCs
Checks for missing Authenticode signature.
resource unpack001/DLLLoad.exe unpack001/TeknoGods.dll unpack001/teknohelper.exe
Files
-
f7b002fe39ed2144ff1ba674909ec7e0.rar
-
ConnectionOverrideHamachi.reg
-
DLLLoad.exe.exe windows:5 windows x86 arch:x86
7a7f59ca07e61dffb3b2041e237eea20
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
TlsFree
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
Exports
Exports
Sections
.text Size: - Virtual size: 35KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 696B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tekno0 Size: - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tekno1 Size: - Virtual size: 201KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tekno2 Size: 236KB - Virtual size: 236KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 220B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
DeleteConnectionOverrideHamachi.reg
-
Hamachi France.url.url
-
TeknoGods.dll.dll windows:5 windows x86 arch:x86
155977a8292f3129e7842c0c3748fb3e
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
user32
GetAsyncKeyState
kernel32
GetOEMCP
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
winmm
PlaySoundA
Exports
Exports
���[�WV$�F�m��e�m��7����fIǡ�o~%�2�pĊ���#��~^�Mڱ;��{& �,�9.���cm������(lK$g=�W�gq��Sj�ڑ;�/���ى{<wR�as�nG͝�-�X��*�8�ZY�1��U��#"��H��Be� ��W4r/����$���l"~"�μ�1Ŝ�p�9� -�vai,G⺳�3v~�hWv�h�P�!I_�P, �YqD����C��V<j'N���ۮӃ%���mSe���=��Bs��|��Z�ӛ�at"ָ:�H7�'!H=�hG�T�ױ7Di�|�֏&Y2�4:Oa�CF��lSgf%wZD��ܨ9@�c�ZZ�w:0�,yhDM�ԭJr��{����2�j&���㻓���>���Ҵ*�����gB"�����~=��Br��PL��DN:�a���@��7�>;8�����@t�%yV]K L"����FL����xE0���%H�=���Ю�YQ�9��2`{�o�b 2פRkOCD/H��4�af�!�fL6���m���6�x�>��AF� �Q��Zb��؟�6֦Pi��(?N���W���dE����5�%�{�/\A��e������_ʱ�Tf d���NVM��q7F���X��`m��^�Ķ�'�ud^F4x-Xw��&sOn)��&݇���~�S=��B��Eʽ�TH�8F��V�.m�ҝ��"y���gy��3k���ceo�l�_V��e1���Wu��&�$�����1����q�ُ3����+G�R�*��?��|�����}S���X��4���҉���P��S)��)�!�1 ��=�w�aJ��n�P�a�tb�\�����w���z8�g�\�;�qH���:&��?\|�ڼm�4�pN��ҫ�`r���9y>Y|�Ә���jO���"�c�L�s���9b_�,�|�"�Ю�H}�ً�L��� ��ј���d4�[���cS���`C7��Hw��! �-�Gu&����χ��pF��k�}���C��5Q�_�>�����s�0*�+�� ��`ϧ���ę� �����<�[���r�kD&G*]1z<}��8|���tm���bЬӮ[�d�Y���e�w��d�DOd �+��VgP�O8�ڌ����Su�x��,H*���-��������E����2��Y���1�w�I�D������~i�f�����m����0�ı�����l5y��e98}x�{=�cҗ��P�����u�g�)���T���1s����H�~�����.J���P�� �4����ʣ�A#Eeq��o����$_�� �Z�8 M(%��Op^�Ztɖ=@�-�f���R.&�t�<�w+��������߰-���%=QY�����Ɗ�z��^��E��=Z�*!B�7��<�S/�?r@4U���A+�ڂBs9x�?���h�C�x��MnB�h�ՃL?�_�p��-�'E�����߄ZF�Y�����on�q+���݉�J�b����z�S��:m�1֓y�&(o&��k��l��G�{������a��X���v Y��*�{Mw�3=��o˺��"<���R�n�K�ʑ�h���P��U�mOn��^A��4�G��з,lݙ�۹����f��&��Z�;l�\�d�!~�HLU�\@�=/L@ؙ�I� �/��>D�pm3N�M�.;=-��}2��v����� ���5��hxVM4���뒫Yp�~�ŭ��rװ 2R����Y�$����䳎�S����)}r6O�e߫v��$�羜�;�#�o�D� K�v͏v�R{RR��m���m�Ԑ��K�]�sp}�qؗK&>m{�1��[77���n����z(�Q�k��f�6cy]֪̍zI�fx�[*����m��P�ƔI�Wl�w8 ��^�i+K�hQ�n,e��Hե�b���� l�XucA)ޓD�$��2d�3y���`gRŘ����L��u���T�``�Md�Ps��%Z��3���"�ι��E*rv��:�R����#���F0���o5E"6����|%j���Y��G�n�%�/Xi��!UwZ����� .����ϓ�ў�%�+A3�6���/u�y����=ɶ��2�=��G�lm��9����e�>�.��ې\�}���� &M���^�����dq��rH��m��˭�Jҟ�v�1��Bl��N�FU��HV��@�o��ѧ�b��kw ��GFW�6�[�d��La�]W<)���Q��oZz$֚a߄��ú8��=<�&�!������r���M�I�BO�/!���[�3,Ƒ�;�=+e�Y�ߡ�'D�T����\���ȉ"��eb=ɥI��� �n�x��,>j}�7\��t��.�"'�P�d��Z�}٠��U���`m�v���0�z����tw�����*�2p���Ĭ�K�×� �(�8��~��Kڢ�[�ۓ�d���#��-��e��)�d�KE����mϗ��*�,Z�W�U@�����{��~v��I�a�E9���n�447�f��r0?�b1kݢ��ۈ�Z]��.�=�3U�����%.ZS��{�����ʻçt�24a�r�d�0�rZ�A���^�gJ{*aLe|�0�[��7�q�˟��[���E�?��+�xz$�6mp�� ��{�T3 ���� ��q�����t�p�E�J%�~k����1++����5��Oc��2f�uy%ے��Wu*������mJ�L��ńd:mc�?B��0��B^?de��q������-������i�/��!�%�F%��)'���S0�����:� �O����ƞһ'L7<�z�_l�0����ޱ��J�rkGǑ�*�Q�52�g���/H/d��E+�h����Y��n���f�`���*���ܵ&��K�r9�,����8W�.�����؏o&&ֳw6�ʭ̡�7��`��Z8=�-������@q�� -�lg�������AIb^1�X�����k�FB���JH}�u�g�� �aܙ���l_I;'�$�����}��!��' =�`'�ɑ�Fl>��f��b�~�
_x
Sections
.text Size: - Virtual size: 22KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 35KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tekno0 Size: - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tekno1 Size: - Virtual size: 530KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tekno2 Size: 638KB - Virtual size: 637KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 232B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
readme.txt
-
readmehelper.txt
-
teknohelper.exe.exe windows:5 windows x86 arch:x86
0c888e133105308885f3999fbfc70287
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree
wsock32
__WSAFDIsSet
version
VerQueryValueW
winmm
timeGetTime
comctl32
ImageList_Remove
mpr
WNetCancelConnection2W
wininet
InternetReadFile
psapi
EnumProcesses
userenv
CreateEnvironmentBlock
user32
SetWindowPos
gdi32
DeleteObject
comdlg32
GetSaveFileNameW
advapi32
RegEnumValueW
shell32
DragQueryPoint
ole32
OleSetMenuDescriptor
oleaut32
SafeArrayAllocData
Sections
.text Size: 243KB - Virtual size: 696KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 10KB - Virtual size: 12KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE