Static task
static1
Behavioral task
behavioral1
Sample
AbitSmarter.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
AbitSmarter.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral3
Sample
Читы на CS.url
Resource
win7-20231215-en
Behavioral task
behavioral4
Sample
Читы на CS.url
Resource
win10v2004-20231222-en
General
-
Target
75a93661210842c2207bf3d7b7bb91c7
-
Size
2.2MB
-
MD5
75a93661210842c2207bf3d7b7bb91c7
-
SHA1
e2e99d2f75de2630ee0f3da13aa320f68dd0ca74
-
SHA256
e024b8f1330c0db5cf8e529a3282058e99034be288447cd03e54877c111bace3
-
SHA512
bb1733d7a88e453acca5d85abddc8ef556c624d51a6a27d6545a82f27b441511e57c56a2e0d1683b03a213cc0a8f549d801d920f8ad62db345dd67a29e07993e
-
SSDEEP
49152:pwGGQ97Ycw3DKzTjX2e8WqjInbpH3n6mCn3nC6yL5Yy/P:pwXQ97JwA/X2eCjInbpH3ntCnm6yn
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/AbitSmarter.exe
Files
-
75a93661210842c2207bf3d7b7bb91c7.rar
-
AbitSmarter.exe.exe windows:6 windows x86 arch:x86
92b59e772914f320c058ce8901f9c428
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
K32GetModuleFileNameExA
GetPrivateProfileIntA
GetPrivateProfileStringA
WritePrivateProfileStringA
CloseHandle
OpenProcess
WriteProcessMemory
Process32FirstW
Process32NextW
Module32FirstW
Module32NextW
GetModuleHandleA
EnterCriticalSection
CreateToolhelp32Snapshot
Sleep
Beep
WideCharToMultiByte
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
GetStartupInfoW
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetProcAddress
GetModuleHandleW
CreateEventW
WaitForSingleObjectEx
ResetEvent
SetEvent
DeleteCriticalSection
LeaveCriticalSection
ReadProcessMemory
user32
GetAsyncKeyState
GetForegroundWindow
mouse_event
FindWindowW
ClientToScreen
GetWindowRect
GetClientRect
InvalidateRect
EndPaint
BeginPaint
SetWindowPos
CloseWindow
SetLayeredWindowAttributes
ShowWindow
DestroyWindow
CreateWindowExA
RegisterClassExA
UnregisterClassA
DefWindowProcA
DispatchMessageA
TranslateMessage
GetMessageA
FindWindowA
MessageBoxA
gdi32
CreateSolidBrush
msvcp140
?uncaught_exception@std@@YA_NXZ
?_Xbad_alloc@std@@YAXXZ
?_Xlength_error@std@@YAXPBD@Z
?_Xout_of_range@std@@YAXPBD@Z
?good@ios_base@std@@QBE_NXZ
?flags@ios_base@std@@QBEHXZ
?width@ios_base@std@@QBE_JXZ
?width@ios_base@std@@QAE_J_J@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDXZ
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@D@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
_Xtime_get_ticks
_Thrd_sleep
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
??0_Lockit@std@@QAE@H@Z
??1_Lockit@std@@QAE@XZ
??Bid@locale@std@@QAEIXZ
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
?is@?$ctype@D@std@@QBE_NFD@Z
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?in@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PAD1AAPAD@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
??Bios_base@std@@QBE_NXZ
?getloc@ios_base@std@@QBE?AVlocale@2@XZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXH@Z
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z
?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?_Gndec@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXH@Z
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD0@Z
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAPAD0PAH001@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAH@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAM@Z
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UAE@XZ
?_Fiopen@std@@YAPAU_iobuf@@PBDHH@Z
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
?_BADOFF@std@@3_JB
?id@?$ctype@D@std@@2V0locale@2@A
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
_Thrd_start
_Thrd_join
_Thrd_id
_Mtx_init
_Mtx_destroy
_Mtx_lock
_Mtx_unlock
_Cnd_init
_Cnd_destroy
_Cnd_wait
_Cnd_signal
_Cnd_do_broadcast_at_thread_exit
?_Throw_C_error@std@@YAXH@Z
?_Throw_Cpp_error@std@@YAXH@Z
_Thrd_yield
?always_noconv@codecvt_base@std@@QBE_NXZ
d3d9
Direct3DCreate9Ex
d3dx9_42
D3DXMatrixScaling
D3DXCreateTextureFromFileA
D3DXCreateLine
D3DXCreateSprite
D3DXCreateFontA
dwmapi
DwmExtendFrameIntoClientArea
vcruntime140
__CxxQueryExceptionSize
__FrameUnwindFilter
_except_handler4_common
__vcrt_InitializeCriticalSectionEx
_purecall
__std_exception_destroy
__std_exception_copy
_CxxThrowException
memset
memmove
memcpy
memcmp
memchr
__CxxFrameHandler3
__CxxUnregisterExceptionObject
__CxxExceptionFilter
__CxxDetectRethrow
__CxxRegisterExceptionObject
api-ms-win-crt-math-l1-1-0
_except1
sin
exp
atan
cos
ceil
sqrt
__setusermatherr
api-ms-win-crt-runtime-l1-1-0
_cexit
_seh_filter_exe
_set_app_type
_crt_atexit
_get_narrow_winmain_command_line
_initterm
_initterm_e
_exit
abort
_c_exit
_register_thread_local_exe_atexit_callback
_invalid_parameter_noinfo_noreturn
exit
_controlfp_s
_initialize_onexit_table
system
_invalid_parameter_noinfo
_errno
_initialize_narrow_environment
_configure_narrow_argv
terminate
_register_onexit_function
api-ms-win-crt-string-l1-1-0
isdigit
wcscmp
strcmp
wcslen
strlen
api-ms-win-crt-time-l1-1-0
clock
api-ms-win-crt-stdio-l1-1-0
fgetc
_set_fmode
_get_stream_buffer_pointers
__stdio_common_vsprintf_s
ungetc
setvbuf
fwrite
_fseeki64
fsetpos
fputc
fgetpos
fclose
fflush
__p__commode
api-ms-win-crt-filesystem-l1-1-0
_lock_file
_unlock_file
api-ms-win-crt-convert-l1-1-0
atof
atoi
api-ms-win-crt-heap-l1-1-0
_set_new_mode
_callnewh
free
malloc
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
mscoree
_CorExeMain
Sections
.text Size: 428KB - Virtual size: 428KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2.6MB - Virtual size: 2.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1KB - Virtual size: 105KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gfids Size: 512B - Virtual size: 84B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 9B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 162KB - Virtual size: 162KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
Читы на CS.url.url