��c'�D��&��4�C��u`J�!�\��7b0��� �4Y`��(*I}�v&L����y�4�)��5��e��R�� ���'��&8���2`"nG�N�q��)�5c6��f���ĔH���O.��(�)ơ"G�۾�ȉIV�?�Z�F ���l!��r/���5פ^BsN-��l�}���1�N�0��lJ�*g)읽�+<���E:��D�֠��+��"Jۗ�P����De��T����gYiKj$-#�� ��^g��Ew�����o6��U;z0!��ћ*W��8�y��BO]m���q�q��#-�|�Ɔ];龜P�?�_�*�:'є+P���Fb��;-�T��5�/1N�2*W���a�s0�0 N�i�#U�<��+�^���l���)�3�v���+E�+�9�@�'D�i 6#�㦒1��oR(����e�������3���<� ��Nt1�����ܭ���p.a�|�����0s�^�~l�����*=�d�:Z�>�Jز���5��f 2%q�&G�I�2w��2��{�3�F�P�7p��d8���s��V���~U�� ��o,џ����"���M ��(U:#��'����V�@hNg�݀�^v�����X�|�~Y38y���L&���ϟ~�0����n3��/�nZ���d�� A���S�O`�P|�ןP�@���ҋ��6�V��R�e6������Y1�����i�O4B��� Fd%��ދF$ @@b��;W�����{݊P�Uݑ~�ٔ����ӆ�^��*'s�y%Q�Fu6� l}y��Q4�/Ta�\����h�[}�?C^Z�s�e�(�6�#�&S<j�cX�Ll�L3�{�V圍Z��c��������1OV%� oz��~6Qg�0�D� ǹ̚�E��a8|�U����5�$N�:�r��`H�bR�R��ك�Q�� �~��K!�=3��`����F��s�}����;������K��7�#vm[�m��a���)r�-�����A������ξ1B���}M��a�'����Dt^�-Nai,:}�#u0���Q6�^B h�rT�t������9��rh�����F׳`f��18�/㙽F���yM�Ď C��"D��m�-)�Q{��Pܳt�@��w-]�C��؍�r��m�,�dk}L��A��q�R�ꧥa]hÏ��p_AW�^Nl�U�2j0漂ث��D����ygq#q+�n��D֎#�]uxHC�S�^ t����.��n�2�m��QƧFS��}�c/l�Y��3kM�a�;{�ha���I��]A�7~�x������3�,�`�+�$��uǼ0�j ��*��TD��I�ɘ���'^� _lvߝCs�U����n��'�t��跭m��k�C`G���>�N�`Y��ȝ ���;I"�Hhi�N��溠�vG����ăN㼄��8���*}m<K�B��6�r�W�_�u�Jg� }����~7F�٨�'��� �R23��?M}��!"Eї�":��&��3t�lD�t��cF��9.r]��s �>kŃo���M\����4p�.犎�S{�rDa� p~@��WŎ���{ڲ����e6�<����0?ӮFH�N�'ǝ�!bGc��4%�jZ49��|�ts81g|����kѪ���qv& ۔��!X��x�a���G� \z�ki|��/���@�CŨ#��Y����j nj=$pvo��)������*;�u�X�BM�>�[��/���#S���]�]�)�V�m����r�u?�3ÖF��o��f�dtݸar��p�P��ث��g�T����2�'���%�b�'����a��z�Z�1�:�$�6�D����YV���Jl$?��N�3Tr��� �e/ez�rP�t>1��R�+7[��`��t3��;�Ϫ'%m��8MX����I��V���s{f��mO��a7��GTKr�ɏ���" � .FG���;d�F#x�V:������C<̌��i'Z��[����!/��^ɀD*���i�|x��$��<������eL�����-�,,oU�����Z#ɧ���o����@�Kv�r�5j�CH�!y�\��a����l������0u����w)xgr c5DԐƮ}LfJOFz9�Mgx�I�Q+�-�!�G �+r�XOh9���F;���� [�1 ����4�M!j�����.�����l����8τ��҃��>5��-7�T�e��j�T9엿a���Z�ZDUJx���PAa^�&$=x��>n�61 ��[�h)Z$���+��ެߓ�;�x�i�wα�X��X���IR�X�,�q��u\AvV2ʣ�:�����sE���f���Y�>�Q<� w/������ �G�I�A�ZN� �?6i�&ʇ�]�.�_Z�,L�f�j�z��,�>I<�W���O�A�a��*�"��� ��1��n��ΨrX<��u<�3�El2�OM6��'n����ڡ��x�;�cHt����lhq2���#P����ӑ�ج���A���tDK���&�� fqs�{�)�hvBi_<hz�r�Ӿ����s_`���!�u�'�����@����)[�����D�M9�g�̯7�K[���{�L��$�d�^�Hi�m�yo��#�NL�U�)����1�b��"�=�ɜ���y������߹D�Éa����ˑ�nX54[5�-[��iM�ӤÆea��=^\/��6�����~eWj\����o(6$�0�0c��̺j�E(��� �2β���~�������q�{U�*���)�j���b'�u������v�\]��}ON��f~$L5u9r�*�m�3����Ua�,���D=M [��0RYۈi]��~��Ԇ��5 ��u�h�Z/���\|wۡ,Y[ͅVA�����n�-��S����Y7�U�5?�����a���sp�>z��n|����s�V�gr�E0�,����E�҉vޠ��:�o�|�w�}�%9��F ?$ʫ.5��9�k���MS��Q�zx��7��a�/�ƪ��k��0M�҂3� ��H�ݫ���t۞82��T�z
Static task
static1
Behavioral task
behavioral1
Sample
TeknoGods_Beta22/DLLLoad.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
TeknoGods_Beta22/DLLLoad.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral3
Sample
TeknoGods_Beta22/TeknoGods.dll
Resource
win7-20231215-en
Behavioral task
behavioral4
Sample
TeknoGods_Beta22/TeknoGods.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral5
Sample
TeknoGods_Beta22/teknohelper.exe
Resource
win7-20231215-en
Behavioral task
behavioral6
Sample
TeknoGods_Beta22/teknohelper.exe
Resource
win10v2004-20231222-en
General
-
Target
670b83f0c3f227904036c60e7fad9190
-
Size
1.3MB
-
MD5
670b83f0c3f227904036c60e7fad9190
-
SHA1
91b3c16f3be3e8f5e65e40698e9993c4a3dd34d5
-
SHA256
4d7893d1467568642308085e07f4a092673b7a6330ae3998e93038e4edfc1726
-
SHA512
871d8f42123aabfb09d5ebe67907ef15bd27294d5cad3d399b8ed68f4e40ffe5a11d5b5c83765610ced9ff7e962930568652e83eeb495fcf3e514641603a8aad
-
SSDEEP
24576:sbI9WED8EGDf40nDaqUKpVh512476Ur83FCyALJvnd59j5bKdL18gJo+mrWagM:skUEGDg0nmqXpVL1p767oJvX9j5b218X
Malware Config
Signatures
-
Unsigned PE 3 IoCs
Checks for missing Authenticode signature.
resource unpack001/TeknoGods_Beta22/DLLLoad.exe unpack001/TeknoGods_Beta22/TeknoGods.dll unpack001/TeknoGods_Beta22/teknohelper.exe
Files
-
670b83f0c3f227904036c60e7fad9190.zip
-
TeknoGods_Beta22/DLLLoad.exe.exe windows:5 windows x86 arch:x86
7a7f59ca07e61dffb3b2041e237eea20
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
TlsFree
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
Exports
Exports
Sections
.text Size: - Virtual size: 35KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 696B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tekno0 Size: - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tekno1 Size: - Virtual size: 201KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tekno2 Size: 236KB - Virtual size: 236KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 220B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
TeknoGods_Beta22/TeknoGods.dll.dll windows:5 windows x86 arch:x86
54902619b3d73cc8a52195715a50e909
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
user32
GetAsyncKeyState
kernel32
GetModuleFileNameA
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
winmm
PlaySoundA
Exports
Exports
_x
|��"I)p�4-�"||����0�kx�����.�g���p����a_n�xoq~]���3c�o�4L���\�A�����G!����P+�,ˉJ�+�6��?��F:�M�0H�1��[�j�Ϸg�-~���F��8�9SI��O5P�_�`�{������ a��㤂ӦJA�����w��o���J��~�vЧO��k0@% �e���ܓi�7��|�!��|���E�BY���YhDB4�y~��.mΩp��`����rRj�/g� #-ٱ��|���Q���X����\i;4����H���rN:֣*�C.~ә]�GL����*��q��ƺI�F��9I�=�`�y�e}������5��~ю�.��ڵ;���F��g8�6��P��S�5)���9;�N�,A.�g�W���A8��LԳ��B� k*Y��#�;�U#��1��o� �P&ߖ���=��#?.���KG �F$*` }n31)���}:���<�Fu����a�nE���� �Q�N��A�����R��Jw@r � V �:�D�O����?H}$�n|���\K���$T�z<6 )��pڹ��H-Q�m���H�^̏���O�{����B�N=k>���rg2�Q�1���qN��(�������~�=�F qJ$��� ���8�a��V�?�>�Fm�[��l�Uw�z,z�ؕ��������g��%7���^�'h�BP䨭s�꾌�PǸ�����b�2���H�[Ʊt�����'�J��=BbM燦�-�����@V��b�ޱY�~z������Al���8k�ouW��ϣ�+�ek��2��G�rƨ5���o��Px�U~z�,�v g�yH�y��X���0��� {�F�~�Ƌ�^�K`tG�{4���ܬU(���2B���mvEB��}oȾX����Y���LlxƖ��`��R�r"��Hv�n�u�Jo.��0�K�����-�'ԗ��?*ǾP$N��[�e���2WV3���P$b�-�0�B�Az<�7��y�q��5�A���Zޘ=�״B��X�bTҰ��Ǣ���1�N�� �v�f)���]�ߑ4��9An3{P�*ӽW�AO�< F�G��9��')F[��7�`L��u���s�uf$�7E��Ҏ�7=x���$��!r����Ѡ��� ���N��;�M�]%��K��Th�^�]_+8͡�"u�]r?]"�//��z��uں�)�(�&��;Xd�|e���h�<�~z����M"�d����U����c�pR����ɒMFD�T�G���~!�y�=8��Ll��ލ��n`��������9��'voF��@v�V���I��ӓ�A����̗3<@��}���)�c#�����w�/�l�a�L.,h x�r�y����y.�[l��X�S������c��c>i!��g����A>�TC)��z7<����Ҩ�[�Mcz|1����cf&��l �L'@m�/?��?�O���3���cչ9�Ӽ��/7{Y��,��%�W�����//Ԁ��'�oHEaupv" ��X7�`�`�)�������_ۿ㌲�@�j�=��Ȃ(�G��S;���K�k��n������T$y�UZ�Yb�ۯ�tF��)�u�@�U�b�Ӏ��7���7�_����hT�������ϼ�?ϩ^?�k�W�f����^i�_�Rd��H90x%��~�<V�c����7��@b���7 �R�U�/D����n�a�!��4u��-���� ����,Q�L9 i�e��+�E��dE���+a���Ko�(d�<�4,����r��d������j�*��@7������RnM�]��՝����Ǒ����F�M�lˏ'���:��j�� %���-�h=}3_���ڳ�������V�[w/�̲[Ңy�L�&6�z�+ׯX�O�ʩm�c)��[�_���{aؔ͝���Q�־Xd2{ѡ���X���4��.���2�lǩ��m�R2�FJ&]�kR��$_�A?�v�t��\@;�Y �ؓ���J�S.�շ�^�r��a0Fo�$�ʂ�Kƅ ϝN����~Jk/k45O8��;P�E���N��`�����)TO�=��,�%R�����4�7������4g���[j�!���D[إ_��Lb�:�3��0�EEU.d�/z��C=��i�ŵ� 0�C��g�v�b����l�t�w-��_N��"�{q��9�?/�������g���������#8M��0ˣ(s[��z��G�$���>��(�Cny�x�2��Y%cx=����t��{;����l�D�Gĕ^�����#�'i���&�K�JD<���\,�X���p03MK���ڵ{�mw��̡T[��������C`! h�f�X��PJ'������|(j�K��C:�:�I��~��&���d�C����'�����(�Ճ\��y"&X�I(n�U{MWa�=����!#B�+ ���A���1VE(���z���3�p%=S��;G���@8�&�Ȓi?��V~h�^r�����Ga�e�+a 7>���$��IT �䓩~"A�t7-I�5�/V�+$���Y� {���?"�M�����}jp�\]���p[�2�9��%�s�/_�A����p�3e�o���\l���G�CZ�ç%8�{A����Ⱦ�y�Y`HԤ�:���!�����6:L��e�b{�`�$4���+L�[�D��tIH)�����%;*xq��g^}�%�/{��9ޮ8Z��N���`��G~K�uױx��O��AW�Ž���ʼn����nK���ݓ��H�I��[3+�w�]��:�P��v�հ�AxLBbu���Z�����n�:O0��4v76,�u��ƻ7>Py��5�m����E�"��4�0܇noi��K�zaָ�Ϭ�L������&w�g���7H֚=Z8Xw�J��gVwd�ٕ���T������ G̕�@��8�����[z�&�:�O�TZ>s� �a�c]���5�"n�-[ę셠��Û��������/�>�q���b�<�Vx���B�WZe�� ��V
Sections
.text Size: - Virtual size: 22KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 35KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tekno0 Size: - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tekno1 Size: - Virtual size: 518KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tekno2 Size: 607KB - Virtual size: 606KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 160B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
TeknoGods_Beta22/logfile.log
-
TeknoGods_Beta22/readme.txt
-
TeknoGods_Beta22/readmehelper.txt
-
TeknoGods_Beta22/teknohelper.exe.exe windows:5 windows x86 arch:x86
0c888e133105308885f3999fbfc70287
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree
wsock32
__WSAFDIsSet
version
VerQueryValueW
winmm
timeGetTime
comctl32
ImageList_Remove
mpr
WNetCancelConnection2W
wininet
InternetReadFile
psapi
EnumProcesses
userenv
CreateEnvironmentBlock
user32
SetWindowPos
gdi32
DeleteObject
comdlg32
GetSaveFileNameW
advapi32
RegEnumValueW
shell32
DragQueryPoint
ole32
OleSetMenuDescriptor
oleaut32
SafeArrayAllocData
Sections
.text Size: 243KB - Virtual size: 696KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 10KB - Virtual size: 12KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE