Kill360Box
ServiceMain
Behavioral task
behavioral1
Sample
41ce689b277c5649b066983ae7f68bef.dll
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
41ce689b277c5649b066983ae7f68bef.dll
Resource
win10v2004-20231215-en
Target
41ce689b277c5649b066983ae7f68bef
Size
103KB
MD5
41ce689b277c5649b066983ae7f68bef
SHA1
06809621acdf3ea2fed770c70bb275bbc9f47a0e
SHA256
2c505d4fb9bd9df67171d8d93d9fa4b6d3447d5197c0826928e4da0a412025f0
SHA512
63ee357cbc9077517dc239291e5cb666c5030e5ece1665ff141b91458d1c992e93a4886b093c8afa3b2dde57574b8c7e98244a20b9e3eb821d242f41ef167618
SSDEEP
1536:Is+Jc7yvqPbsm8QfLpcILGoka7V2uJp1VcM/vfh7EP8Z8IeogD31:B+ibsmUul0uJXVb/Xh7EP88IeogD
resource | yara_rule |
---|---|
sample | family_gh0strat |
Checks for missing Authenticode signature.
resource |
---|
41ce689b277c5649b066983ae7f68bef |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
_ftol
_CxxThrowException
ceil
memmove
realloc
malloc
atoi
__CxxFrameHandler
strchr
??3@YAXPAX@Z
??2@YAPAXI@Z
strstr
wcstombs
wcsstr
wcscpy
_adjust_fdiv
_initterm
??1type_info@@UAE@XZ
calloc
_beginthreadex
wcsncat
wcschr
wcscat
_wcsnicmp
_snprintf
_errno
sprintf
strncpy
strncmp
fputs
wcslen
wcsrchr
_except_handler3
free
_wcsupr
fopen
fclose
fgets
mbstowcs
_strnicmp
LeaveCriticalSection
EnterCriticalSection
VirtualAlloc
ResetEvent
InterlockedExchange
CancelIo
Sleep
lstrlenW
MultiByteToWideChar
OutputDebugStringW
lstrcpyW
GetVersionExW
WinExec
DeleteFileW
DeleteFileA
CreateEventW
GetFileSize
CreateFileW
lstrcatW
GetSystemDirectoryW
ReleaseMutex
OpenEventW
SetErrorMode
CreateMutexA
GetTickCount
SetUnhandledExceptionFilter
FreeConsole
CopyFileW
SetFileAttributesW
GetLastError
GetModuleFileNameW
GetProcAddress
LoadLibraryW
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
CreateDirectoryW
VirtualFree
CreateProcessW
GetDriveTypeA
GetDiskFreeSpaceExA
GetVolumeInformationA
GetLogicalDriveStringsA
FindClose
LocalFree
FindNextFileW
lstrcmpW
LocalReAlloc
FindFirstFileW
LocalAlloc
RemoveDirectoryW
SetFilePointer
WriteFile
MoveFileW
GetLocalTime
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
GlobalSize
LocalSize
TerminateProcess
OpenProcess
GetCurrentProcess
GetModuleHandleW
lstrcmpiW
GetCurrentThreadId
DeleteCriticalSection
InitializeCriticalSection
CreateThread
ResumeThread
SetEvent
WaitForSingleObject
TerminateThread
GetFileAttributesW
CloseHandle
ReadFile
IsWindow
CloseWindow
CreateWindowExW
PostMessageW
OpenDesktopW
GetThreadDesktop
GetUserObjectInformationW
OpenInputDesktop
SetThreadDesktop
CloseDesktop
IsWindowVisible
GetWindowThreadProcessId
GetCursorPos
GetCursorInfo
ReleaseDC
GetDesktopWindow
GetDC
SetRect
GetSystemMetrics
OpenClipboard
EmptyClipboard
SetClipboardData
CloseClipboard
DispatchMessageW
TranslateMessage
GetMessageW
wsprintfW
SetProcessWindowStation
OpenWindowStationW
GetProcessWindowStation
CharNextW
GetWindowTextW
GetForegroundWindow
GetAsyncKeyState
GetKeyState
ExitWindowsEx
EnumWindows
LoadCursorW
DestroyCursor
BlockInput
SystemParametersInfoW
SendMessageW
keybd_event
MapVirtualKeyW
SetCapture
WindowFromPoint
SetCursorPos
mouse_event
GetClipboardData
GetDIBits
BitBlt
DeleteDC
DeleteObject
CreateCompatibleDC
CreateDIBSection
SelectObject
CreateCompatibleBitmap
CloseEventLog
RegSetValueExW
RegOpenKeyExW
RegQueryValueW
OpenSCManagerW
OpenServiceW
ChangeServiceConfigW
ControlService
StartServiceW
CloseServiceHandle
RegisterServiceCtrlHandlerW
SetServiceStatus
RegOpenKeyW
RegQueryValueExW
RegCloseKey
RegDeleteValueW
RegEnumKeyExW
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
RegDeleteKeyW
ClearEventLogW
OpenEventLogW
RegCreateKeyExW
RegEnumValueW
ShellExecuteW
SHGetFileInfoA
waveInPrepareHeader
waveInOpen
waveInGetNumDevs
waveOutPrepareHeader
waveInAddBuffer
waveOutGetNumDevs
waveInStart
waveOutWrite
waveOutReset
waveOutClose
waveOutUnprepareHeader
waveInStop
waveInReset
waveInUnprepareHeader
waveInClose
waveOutOpen
WSASocketW
ioctlsocket
socket
gethostbyname
htons
connect
setsockopt
WSAIoctl
WSACleanup
WSAStartup
__WSAFDIsSet
recvfrom
sendto
listen
accept
getpeername
bind
inet_addr
getsockname
inet_ntoa
gethostname
ntohs
select
closesocket
recv
send
InternetOpenUrlW
InternetOpenA
InternetOpenUrlA
InternetReadFile
InternetCloseHandle
InternetOpenW
InternetGetConnectedState
capCreateCaptureWindowW
capGetDriverDescriptionW
ICSeqCompressFrameEnd
ICCompressorFree
ICClose
ICOpen
ICSendMessage
ICSeqCompressFrame
ICSeqCompressFrameStart
?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@PBGI@Z
??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ
?_C@?1??_Nullstr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@CAPBGXZ@4GB
?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z
?npos@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@2IB
?_Grow@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAE_NI_N@Z
?_Xran@std@@YAXXZ
?_Split@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEXXZ
?_Eos@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEXI@Z
?_Refcnt@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEAAEPBG@Z
GetModuleFileNameExW
EnumProcessModules
Kill360Box
ServiceMain
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ