CreateInterface
Overview
overview
3Static
static
3Aim.cfg/aim.dll
windows7-x64
1Aim.cfg/aim.dll
windows10-2004-x64
1Aim.cfg/cl...ve.dll
windows7-x64
1Aim.cfg/cl...ve.dll
windows10-2004-x64
1Aim.cfg/cl...ve.dll
windows7-x64
1Aim.cfg/cl...ve.dll
windows10-2004-x64
1Aim.cfg/re...er.dll
windows7-x64
1Aim.cfg/re...er.dll
windows10-2004-x64
3Static task
static1
Behavioral task
behavioral1
Sample
Aim.cfg/aim.dll
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
Aim.cfg/aim.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral3
Sample
Aim.cfg/client_save.dll
Resource
win7-20231215-en
Behavioral task
behavioral4
Sample
Aim.cfg/client_save.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral5
Sample
Aim.cfg/client_save.dll
Resource
win7-20231215-en
Behavioral task
behavioral6
Sample
Aim.cfg/client_save.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral7
Sample
Aim.cfg/revSrvBrowser.dll
Resource
win7-20231215-en
Behavioral task
behavioral8
Sample
Aim.cfg/revSrvBrowser.dll
Resource
win10v2004-20231215-en
General
-
Target
0a38a831f49af50b844ac50e67f64aa9
-
Size
325KB
-
MD5
0a38a831f49af50b844ac50e67f64aa9
-
SHA1
34fcb6dd5c0d329d2f730382968efd47f5b2662c
-
SHA256
765c53def0d0a1b1be4341a554a403531eb1fa458103dad59d239b2d96c6ecaf
-
SHA512
1469e56d21ea89a7fd50aeebcea0c7c3b3cde9c9ec621448a50d24bb371e837e17d817a0ba87b14d7c4a0a4e54f73c58d9206fd1eb1fb0459c1e66904fca975d
-
SSDEEP
6144:hyv88Chm2tK7WBH6zR1QAarnJCvwSda8pre2QLRJ0h7xrkgA//:Y88Chm2tqmoR1QAoCdUdbYZfg
Malware Config
Signatures
-
Unsigned PE 3 IoCs
Checks for missing Authenticode signature.
resource unpack001/Aim.cfg/client_save.asi unpack001/Aim.cfg/client_save.dll unpack001/Aim.cfg/revSrvBrowser.dll
Files
-
0a38a831f49af50b844ac50e67f64aa9.rar
-
Aim.cfg/aim.cfg
-
Aim.cfg/aim.dll
-
Aim.cfg/client_save.asi.dll windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
Sections
CODE Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: 512B - Virtual size: 164B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 1KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 1024B - Virtual size: 786B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 512B - Virtual size: 19B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 472B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 512B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
Aim.cfg/client_save.dll.dll windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
Sections
CODE Size: 207KB - Virtual size: 207KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 5KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 512B - Virtual size: 19B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 10KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
Aim.cfg/client_setting.ini
-
Aim.cfg/revSrvBrowser.dll.dll windows:5 windows x86 arch:x86
11b00b20b406117cd0bc7f9c885014f3
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
wsock32
recvfrom
ntohl
ioctlsocket
getsockname
setsockopt
bind
socket
closesocket
inet_addr
htonl
ntohs
sendto
htons
gethostbyname
user32
MessageBoxW
kernel32
GetModuleFileNameA
GetProcessHeap
SetEndOfFile
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
LCMapStringW
CreateDirectoryW
GetModuleHandleW
VirtualProtect
QueryPerformanceCounter
QueryPerformanceFrequency
GetStdHandle
WaitForSingleObject
Sleep
CreateThread
GetLastError
HeapFree
HeapAlloc
EnterCriticalSection
LeaveCriticalSection
SetStdHandle
GetFileType
GetCurrentThreadId
GetCommandLineA
GetProcAddress
ExitProcess
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapCreate
HeapDestroy
VirtualFree
DeleteCriticalSection
VirtualAlloc
HeapReAlloc
RtlUnwind
SetHandleCount
GetStartupInfoA
CloseHandle
WriteFile
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
HeapSize
InitializeCriticalSectionAndSpinCount
RaiseException
MultiByteToWideChar
ReadFile
SetFilePointer
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
GetConsoleCP
GetConsoleMode
FlushFileBuffers
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LoadLibraryA
GetModuleHandleA
CreateFileA
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
LCMapStringA
Exports
Exports
Sections
.text Size: 110KB - Virtual size: 109KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 17KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 436B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
Aim.cfg/НЕ ПРОПУСТИ!.txt
-
Aim.cfg/Установка.txt