��#>�*���T�1�-Dɻ����0z/V'�R�/�!�;�O�1�����*<z�-Z�#�N�,�x�Cz��H�gJ\L�p$��@��~|,�K5 9Nյ���# =�o_�7E�ѐj�pu��4�o�]����M���sO���l���D`�E`{c��ќ?�̢���|�ݭWypUߧ��;�(V8(���˺����c�)�f�@�=��_)W��%����.�i̤�v��]��õT���i�����U��ʟӾL�l��+�<Ý&��;=E�v6���t�Ic���)�^҆ETҕ��0|tL�g =� D��3�4���ܽK�j��Yv�RB�z$���`��XR]��Z��^P�uqӟs�"?-�ȭ܋���Qm@��w�M��t� ��\eb��:��D�&cqA��#'�k���%�'RJE�hb\)�;�Z� N�{-Ќ����Q�/��7b����T���Ȏ��f:��H���6p���6?�kyz;6��9st�/�27�T�T�{��i!�gG�Tv�J�D�Nֶ��`�O�F�rxt�(*"�ݔ� 2�ӹ�q�������"o�I������w�'��tZ�����-r��KW�����N�_%�G:��T�9�j=�OyŇqա+��e�0��DE4V�0�.P���-^�a�Aks&�q���N��C�.V�W���mX����̟����X��d��.������]��_��te��nb!}��2�9H���|��^h.���2�>�rS.k���T�1v�W�$�6~�b�f�$j�ɧ?�E�b�2���z�;�dc�Z\Y!�V2g�'zzq�@�PLP�ٸ��@��i:���0�Ö��?�;"쿪��A�e� �l������;<���J��؇L�1�wf�& ��f�#���TuG����&��y)<,h�R|�m�(���15}�"��MVS��m�m+ząf�XB�ARr�Gb���گ�2�C'��� ���BfL�ᔡA�B�c�-ዤ<IU�-w2蛽7��W�~��$�W6^�b��a^4}�B�=Ꝓ�q�> $�:i�Q� �(q"��֦�_1U�;w���.���.c%}_�E�G�{pj�V�Ж��N c˔��=y�heR��s�uF�B�e� I�/ 6�+('�OUU9J�2$�q�0��r �"�v1<XųW�,�k<&���3�_��_�o"����*���4�<��A�Mb`�=�I���m��jE� � f�p:�a���YM+~\r#�q��%z�U��3Cmu^x�zugp{k��7u.��\���X�_0�����N E9���b��[X��?)��� �,�e�*��2+�9>��;�_�bY���ue�OIp15�CU�O�y^ j����=r��P�� e��Q16��� ������Ս`�F8�}��'���? @��c��!aE\��%Y|V{yX�Qű��]I�Z ��(mX������{�p@��P��ԁ�q�DM潉8BU�vRz�F�}������.�9_;#�8 =t��V-ӇÞ_��� 4j֎�@>��i=l�Q !����G����j//q��7�"~�P�&U������/�����r�pTx�tys���_6fy ��#{�߬]���4wM�I���<3���vUmo6Q�� �%�yA%�~����S�x�{��cp!���죿v�� eG�f��NDz�%���h�%*�\�Ӑ�mT�Td&� ��B������ţ0�xؾݖ������u$�}�t��:����W�/���v��:�S $�0Y�O7;H�I<�^���F�H���fAs��~��V2���1(�*��{��C�-�������] ����0g#Չ����S�:n�S�k`vY�En'C��Ӵ2j�5?�ʗD� (��#��i�$�:�݈�7�+*��F���������Ƣ�p�|cO���� *�|>|R������Mᕝl���E���� �ňS-�ק1��䳫��~s,��������=�Q?��lmgp���/��1��^` 4���^�L�.�XP���+�O �Mi������eؠ.�;�:�� A�� � �>ܫ�����f!�vɌȼL\��wF�# ��U������NܤM<����bU�E�3k>����yPa���/H�#y�p�"'ժbd�w�,qb�'�v-c����� j��#Ucn7uÉ��x��&[N�R�ٷ�Q��Ys��b�,�V���RQ�{X���� ,��MGk^����ת'ܗ�O1�����`�qu9��������{���I�8]�@�j~W-���?��\6�53�0y(z#R��M���(��`$�m���v��S�q���Y߈���.��rsN����x���紐QޙA���C�����֕YM����I�s����DI D^���L��2�Y��&��+�)p{�M�<�Z��F�<n{F:��]8�p�UE����৭����>�y����RcǍ=�M���*��<����B1�K���DD��Q�;�7X�L_�n�ˈ��u�}��=�,w�.��BC��uЫ��?�0������B�D)��WC���*yq���T�sI��[_���]�{��qş����r����W�Y�� 2$��W��ZX�ɴp�g�ˮ]�� ��-n|�<�{)�&���hT[h͡�TX���/�մ��D\���e/�\FCL�3��X�ы�lP��/Ko���Zdr����X)�#,�� ��7ն��T�Ě���+}���؏���Ew�|ɹ�Vm���{-�;�t��i�����oE-.�0��q�Kǜ��'(����/�%�ٮ, ����f3J�/�E���e���tE�=��־�Q#��0dTvjf�G��M�0-O������Ѣyz@���54�)�U��/H��B�F��j��\�q�= Y.vd� �}M��T��c'��0�3��K\�/i,��@.R�?���p����w�=����Ƌt�����<}�M�>��iA��x��d���F��(9lONMb2Ѕ����V�
Behavioral task
behavioral1
Sample
Bot Especial Stage 53 Coded By ITzOscuro.dll
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
Bot Especial Stage 53 Coded By ITzOscuro.dll
Resource
win10v2004-20231222-en
General
-
Target
71ce05282890b19965001713fa07decb
-
Size
1.4MB
-
MD5
71ce05282890b19965001713fa07decb
-
SHA1
49d1d180984b831c1b8eca5dc611b0e0b9c2f65c
-
SHA256
aa7dbfafe32568a5032d30fe56814dc28e4f06bd03fb5a88be1994ee269471b9
-
SHA512
e90f07e70ab5a8114c0b6eb489232494c72053bdaf9ff619562b6ea73e80278eb878503bddcac0784533726d28996015b8c151bd1270e5965fdbc6cc93f59cdf
-
SSDEEP
24576:tuprR2f3P3W3mPCxAKoSpR/4r1m3SUQpH1xUNYGdo76SJ2FmH3UWK2NHln:KVcP3WeCxFbR/YY3SUQpH1VoAMHFOn
Malware Config
Signatures
-
resource yara_rule static1/unpack001/Bot Especial Stage 53 Coded By ITzOscuro.dll vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Bot Especial Stage 53 Coded By ITzOscuro.dll
Files
-
71ce05282890b19965001713fa07decb.rar
-
Bot Especial Stage 53 Coded By ITzOscuro.dll.dll windows:4 windows x86 arch:x86
0c76f6f179d704ee5874fee587719b34
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
user32
GetAsyncKeyState
MessageBoxA
kernel32
GetModuleHandleA
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
Exports
Exports
Sections
.text Size: - Virtual size: 972B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 302B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 308B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 182B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 16KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp2 Size: 66KB - Virtual size: 65KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 232B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
musica2.wma