General

  • Target

    aridek.zip

  • Size

    6.8MB

  • MD5

    99be6681d5e5d5c6d68e60ae83a752c4

  • SHA1

    dcc1d20297192dc14a2f38d255c8d75dae93a9c0

  • SHA256

    6171370b6a2321b2e3910f5818c5e5b89bb3e8aabe15ce53ef5f81acd7881e21

  • SHA512

    af8b0ff6c7a1e3bdb91cb90eb7a3b3fe1ff9b612e1ff8f0025e088e965071c316c6208752d3a5f1ffded1463f928499291ed2d468651df10357cc12ed82596ca

  • SSDEEP

    98304:X7AlaaZAnzPylFp2T2U2ZaZ34DudiZf+R3y7Q6ak0V1YOe8hSARaAW:X8mKQTlPhBdE7taF1o8hLW

Score
7/10
upx

Malware Config

Signatures

  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Unsigned PE 25 IoCs

    Checks for missing Authenticode signature.

Files

  • aridek.zip
    .zip
  • aridek/4138.sys
    .sys windows:10 windows x64 arch:x64

    720e565b52ea3060f0b8df3c54201145


    Headers

    Imports

    Sections

  • aridek/Aridek/H2OSDE-Wx64.exe
    .exe windows:6 windows x64 arch:x64

    f2531102fa40c55e6ccc64a53bc417cc


    Headers

    Imports

    Sections

  • aridek/Aridek/amifldrv64.sys
    .sys windows:6 windows x64 arch:x64

    363922cc73591e60f2af113182414230


    Code Sign

    Headers

    Imports

    Sections

  • aridek/Aridek/convert.bat
  • aridek/Aridek/h20.bat
    .bat .vbs
  • aridek/Aridek/load.exe
    .exe windows:4 windows x86 arch:x86

    2c5f2513605e48f2d8ea5440a870cb9e


    Headers

    Imports

    Sections

  • aridek/Aridek/sde.log
  • aridek/Aridek/segwindrv.cat
  • aridek/Aridek/segwindrv.inf
  • aridek/Aridek/segwindrvx64.sys
    .sys windows:6 windows x64 arch:x64

    8a3d3f89c1a7e11f163988eab00064a1


    Headers

    Imports

    Sections

  • aridek/Aridek/tool.exe
    .exe windows:6 windows x64 arch:x64

    ed928bd060b03bab412d37a11b9d26a0


    Headers

    Imports

    Sections

  • aridek/clean_traces/cleaner_1.exe
    .exe windows:4 windows x86 arch:x86

    2c5f2513605e48f2d8ea5440a870cb9e


    Headers

    Imports

    Sections

  • aridek/clean_traces/cleaner_2.exe
    .exe windows:4 windows x86 arch:x86

    2c5f2513605e48f2d8ea5440a870cb9e


    Headers

    Imports

    Sections

  • aridek/full_virtualizer/README.txt
  • aridek/full_virtualizer/cache/ZemanaAntimalware.sys
    .sys windows:6 windows x64 arch:x64

    1344fde2c12f5e22ffaa1db042f72e8b


    Code Sign

    Headers

    Imports

    Sections

  • aridek/full_virtualizer/cache/convert.bat
  • aridek/full_virtualizer/cache/destra.exe
    .exe windows:4 windows x86 arch:x86

    2c5f2513605e48f2d8ea5440a870cb9e


    Headers

    Imports

    Sections

  • aridek/full_virtualizer/cache/drv64.dll
    .dll windows:6 windows x64 arch:x64


    Headers

    Exports

    Sections

  • aridek/full_virtualizer/cache/lgsvcl.exe
    .exe windows:6 windows x64 arch:x64

    bc4bcbd0ac0bbecfca493f24c0c4c313


    Headers

    Imports

    Sections

  • aridek/full_virtualizer/cache/struct.exe
    .exe windows:4 windows x86 arch:x86

    2c5f2513605e48f2d8ea5440a870cb9e


    Headers

    Imports

    Sections

  • aridek/full_virtualizer/first.bat
  • aridek/full_virtualizer/util/extd.exe
    .exe windows:4 windows x64 arch:x64


    Headers

    Sections

  • aridek/mapper.exe
    .exe windows:6 windows x64 arch:x64

    afc1f930b16856804326528e39e42dd5


    Headers

    Imports

    Sections

  • aridek/nvidia/nvidia_gpu.sys
    .sys windows:10 windows x64 arch:x64

    b858e807cdbf62ec805d6aaec6cec4f9


    Headers

    Imports

    Sections

  • aridek/nvidia/start.bat
  • aridek/reset data_table/kill wmi.exe
    .exe windows:6 windows x64 arch:x64

    a4d7ef7ec1e5b24e0b37dc8366f08a2f


    Headers

    Imports

    Sections

  • aridek/reset data_table/network.exe
    .exe windows:4 windows x86 arch:x86

    5877688b4859ffd051f6be3b8e0cd533


    Headers

    Imports

    Sections

  • aridek/reset data_table/other/README.txt
  • aridek/reset data_table/other/first.bat
  • aridek/reset data_table/other/second.exe
    .exe windows:4 windows x86 arch:x86

    5877688b4859ffd051f6be3b8e0cd533


    Headers

    Imports

    Sections

  • aridek/serial_check/checker.exe
    .exe windows:6 windows x64 arch:x64

    66d9b492cbfae79da599bcdff4f87c0f


    Headers

    Imports

    Sections

  • aridek/virtualization_arp/README.txt
  • aridek/virtualization_arp/cache/ZemanaAntimalware.sys
    .sys windows:6 windows x64 arch:x64

    1344fde2c12f5e22ffaa1db042f72e8b


    Code Sign

    Headers

    Imports

    Sections

  • aridek/virtualization_arp/cache/convert.bat
  • aridek/virtualization_arp/cache/destra.exe
    .exe windows:4 windows x86 arch:x86

    2c5f2513605e48f2d8ea5440a870cb9e


    Headers

    Imports

    Sections

  • aridek/virtualization_arp/cache/drv64.dll
    .dll windows:6 windows x64 arch:x64


    Headers

    Exports

    Sections

  • aridek/virtualization_arp/cache/lgsvcl.exe
    .exe windows:6 windows x64 arch:x64

    bc4bcbd0ac0bbecfca493f24c0c4c313


    Headers

    Imports

    Sections

  • aridek/virtualization_arp/cache/struct.exe
    .exe windows:4 windows x86 arch:x86

    2c5f2513605e48f2d8ea5440a870cb9e


    Headers

    Imports

    Sections

  • aridek/virtualization_arp/first.bat
  • aridek/virtualization_arp/fourth.exe
    .exe windows:4 windows x64 arch:x64

    f326f88ca83c9aacaa44acfb8884f1d4


    Headers

    Imports

    Sections

  • aridek/virtualization_arp/second.exe
    .exe windows:4 windows x64 arch:x64

    f326f88ca83c9aacaa44acfb8884f1d4


    Headers

    Imports

    Sections

  • aridek/virtualization_arp/third.bat
  • aridek/virtualization_arp/util/extd.exe
    .exe windows:4 windows x64 arch:x64


    Headers

    Sections

  • aridek/прочти.txt