�^����+;�+�&�Zo������ ��$n��������9M��y猓��ޟ��)0vD0�����TA q����y�d�����֠E+���� �R����bni*V����d�J��Z��8M�e��3�5�Ap5����uXl� DMүWtU.�V��.� �h�I����g��.�����N"��7H$\�zܦlG��܆\S�۳�� �����ռoU�m�0G���^^�(�h��� M���f���ʑ8�����'ޅ[?�D����f�q+��e�N��VMF犀[BT� ��}��4�o4���MWEO9��cy�Gf�*Cb�Ө�x�q� ��+�Ǒρ�S~�e��e�e?�^��h������8��}b�7?gwP 0�R*�U�l�@����6z�}%�s�� �����i��v�r�eDx�Ѱ��p�Z��vڸ"���K�J\|��-���a�QG]������gj�h"lΟ� &l�^�d�'������ y!,9%�O��K�,&<[ܴ�AK�-�֏!ۮzI�h��lÂ�ets~���ji��F|����*�{jeГ^��̮O�Ni���BxYh��~�_�Lplڎ����A!{ ���v�|��gB�8�B/�s�E�^]n�������� �u�L�p3�v0�ޮq\g.��$lX��l��>Y��� �aە�(�{�[; ��cp�N��"Ƃajp<I�VQ��8;42���g4q������!�nţ�/ M�� J�9�9�+S9�r!��v-�a�)]=%R��>l^��I� ?"���/0�" � ��:��Ir���+!-�B��`��@�te`�DfU��%;�wl�`���-�I�З#�0#���q�jFnt䥸�%���FN���� I݇>�eu�Z���M[�I� �g<6c�js���[d�>���T 8�0-�,��*�ր�I�����"��U+���J{�ܰgXD���3� M%z�����NJ���G4{ ʑ��5�r&7&�= @..;�����B��#��I]��A]1�!JnZo�<������˲x��n���Y2����ل%�;��i�j0*���%�����¼���fbL�����I��c��������"�����Y<D>C,ʘƣ2�r�_u�5����=k؛�?ة�8p��ߨ1����P��i�Y�������6ҨE:�4Z����&�=`U�W�W+���U =I�>�e�b�q�ҔU��sP� r|[��~��]m5BV �v�2����V+k����(a��Npa~9���]6����tK�X��m #��;8����oh��2� ���l���[�C�m̜yZ�PsP�z�e�U4����>������܍��1%�H��Cv�KZ���%��?��[���Q�s�:��t����w6Ⱦӆ�Z�A4٨C`��_zd���OPt��]$Yg�Qsy҂A�7��%t�����|�;��p,'���k���2��b)�u��Ge01��ej����U"g(nR����'��,�դ�kQ`���7���l�! "}���$�<e�'��}i���,�j��*�ScO�^�)�1x� v�zڗ4Е�]��\p6;3�d>���p��V�&���,�a���|���8ᒿ�i?� 0�1(�,��L;80�)�%*v�֯������+��P�%�+ru�yLԜ����*VB��?�y�i��=n#�18i�P��1�_�LW�i�0�#��s%e�H�:!����H�|N���F��v�xj�]�&~���z�\��1r$���0�`�K?/r͟�����4a������)}:ߵEz�W�b�� n?]X"FY�#�^#�5�'�'$����>U'���� ^���^h�/aVjT�N��T��o�@�F�^�Ǚ hC}\L*��1��Jt��TLv!U4__��5*LNK�XA����Oq;�uY/+$�ѓ�C��E��_e=�8�?������R�"��ǵ5�!�Q��:�ik:��%RQ~Q���_�����o�Lz��7�~Ԑz�l m@.[�h�\=�8�Z���C��Z��{�0�c��t�uk�e��;_���<~�*�!2Vj�J��'jht��-]���e��Faq5|�g�O�+jѧ�P���U���McҘAQF�4�쐾9t���^�]�P��� ��0�utJ[l1~v��[B6�6�Ye�ь�C�8>o�D]d�Hy#�J�<H9E� ��<�X�{�&;�ΩcT,{�ζ��ls :l��/����Z�����Ԟ��k�}�(���)�P���cΠx�-��*P�ݛp���'M�y��o(�����견0ۑ������ �Kт�_����,����&��Gه):r����{�;P����_��'��)��LJ%�������I�1!�V�(Z�/]�;6�kB��-��/��M�^y���w/}��b�~7u�?�`^CN��@m�۠T�x��{%I]�Z�U⧃1�C�f��e�:��!3Z�.D���ɝ去�j]֚c���.W ��9����|�ִ!͟� ������'Z��BZu�Ih�m��U�Cd)��"�h�^ �2����c���O2���Q{8�P~����w��Ԟ��S����v�wgD������b�5K�����w�@�����J?ui��҉����t�@��P�U �9Z@O�"�~�iK�DQin㉩<Ԕꭽ�'�Syׂ�鴲��V����&��kk�q������/r9wT ��;�� 3,5�\� ����/�%z�R�;`x���)SH��@��C�ˣF%�s�4~[ ���2��]�v*�������Y?b���=Z��",\��$ƣ��A���i9gs'�[��W�Ev��j *j ��둶�/dN�/:�s�����u@�z��r�͒?F�/�㷶�E䴟V�!����|Q�M� ��߾��pejQI��9ߪ�7;U�'�J��0��~y��E�q �Wg��XP�>�8�d��������+~����7Gx�E.\BdV��@l��6 F �ɷb���Q��Eg��=wނ�i
Behavioral task
behavioral1
Sample
RAGE TRIGGER/Winject.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
RAGE TRIGGER/Winject.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral3
Sample
RAGE TRIGGER/binary32.dll
Resource
win7-20231129-en
Behavioral task
behavioral4
Sample
RAGE TRIGGER/binary32.dll
Resource
win10v2004-20231215-en
General
-
Target
218da2312c34694e3016e117d7a0314e
-
Size
8.1MB
-
MD5
218da2312c34694e3016e117d7a0314e
-
SHA1
f827c478438aa3a011c5e3938db2f5e74aa538fc
-
SHA256
41b7c17eb0633631288f315c5fd4ae190f35ce28a14d3d3457a6f2266a3890ef
-
SHA512
e51dd85ba1011d0656385fe3a68aeb1d77d74d4c3ebdd810f80ee66a11c13178643f5fee4a2a2881df1a33adf1da2ccaa0364d80f5973fdb39da9acb5f245b7b
-
SSDEEP
196608:1EFDwNt7SHQ8x0hnrAUT7bQlwvoEFDwNt7SHQ8x0hnrAUT7bQlwvf:1EZwOHQ8ShnUebwwvoEZwOHQ8ShnUebj
Malware Config
Signatures
-
resource yara_rule static1/unpack001/RAGE TRIGGER/binary32.dll vmprotect -
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/RAGE TRIGGER/Winject.exe unpack001/RAGE TRIGGER/binary32.dll
Files
-
218da2312c34694e3016e117d7a0314e.rar
-
RAGE TRIGGER/Winject.exe.exe windows:4 windows x86 arch:x86
6d3e5814450a38a649e01d0651a6e25e
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
WaitForSingleObject
CreateRemoteThread
WriteProcessMemory
VirtualAllocEx
LoadLibraryA
GetExitCodeThread
LocalFree
FormatMessageA
UnmapViewOfFile
MapViewOfFile
LocalAlloc
DebugActiveProcess
TerminateProcess
FreeLibrary
GetFileSize
CreateFileA
SetStdHandle
GetOEMCP
GetACP
GetCPInfo
GetStringTypeW
GetStringTypeA
SetFilePointer
HeapReAlloc
VirtualAlloc
WriteFile
RtlUnwind
VirtualFreeEx
HeapCreate
HeapDestroy
GetVersionExA
GetEnvironmentVariableA
GetFileType
GetStdHandle
SetHandleCount
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
UnhandledExceptionFilter
LCMapStringW
LCMapStringA
MultiByteToWideChar
WideCharToMultiByte
HeapAlloc
HeapFree
ExitProcess
GetVersion
GetCommandLineA
GetStartupInfoA
SuspendThread
FlushFileBuffers
FlushInstructionCache
SetThreadContext
CreateProcessA
ResumeThread
VirtualProtectEx
GetLastError
Module32First
Module32Next
GetModuleFileNameA
OpenProcess
GetFileAttributesA
CreateToolhelp32Snapshot
Process32First
CloseHandle
Process32Next
GetModuleHandleA
GetProcAddress
GetCurrentThread
GetThreadContext
GetTickCount
SetUnhandledExceptionFilter
RaiseException
Sleep
IsDebuggerPresent
GetCurrentProcessId
GetCurrentProcess
VirtualFree
ReadProcessMemory
winmm
PlaySoundA
shlwapi
PathRemoveFileSpecA
PathCompactPathA
PathStripPathA
comdlg32
GetOpenFileNameA
user32
EnableMenuItem
DlgDirListComboBoxA
GetMenu
CheckMenuItem
GetAsyncKeyState
GetDlgItemTextA
SetFocus
DialogBoxParamA
GetDC
DrawIcon
ReleaseDC
KillTimer
GetSysColorBrush
EnableWindow
SetTimer
GetDesktopWindow
GetWindow
ShowWindow
GetClassLongA
GetClientRect
InvalidateRect
UpdateWindow
GetWindowThreadProcessId
MessageBoxA
FindWindowA
FindWindowExA
EnumWindows
SetWindowTextA
GetSysColor
SetRect
DrawIconEx
GetDlgItem
LoadIconA
SendMessageA
EndDialog
GetWindowTextA
GetDialogBaseUnits
MoveWindow
SendMessageTimeoutA
SetDlgItemTextA
advapi32
RegCreateKeyExA
AdjustTokenPrivileges
LookupPrivilegeValueA
GetSecurityInfo
SetEntriesInAclA
SetSecurityInfo
RegDeleteKeyA
OpenProcessToken
RegSetValueExA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
gdi32
CreateFontA
SelectObject
DeleteObject
SetBkColor
SetTextColor
SetBkMode
GetTextExtentPoint32A
GetTextMetricsA
ExtTextOutA
Sections
.text Size: 64KB - Virtual size: 60KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 24KB - Virtual size: 1.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 56KB - Virtual size: 53KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
RAGE TRIGGER/binary32.dll.dll windows:6 windows x86 arch:x86
aa8ba54ff69f9ac36ba743db2fc3e45d
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
OutputDebugStringA
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
msvcp110
?_Xout_of_range@std@@YAXPBD@Z
msvcr110
?terminate@@YAXXZ
Exports
Exports
Sections
.text Size: - Virtual size: 20KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 57KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 158KB - Virtual size: 158KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 252B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 469B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
RAGE TRIGGER/Новая папка/Баласт
-
RAGE TRIGGER/Новая папка/Баласт2