Overview

overview

7

Static

static

3

ArmAccess.dll

windows7-x64

1

ArmAccess.dll

windows10-2004-x64

1

BasicRunner.exe

windows7-x64

1

BasicRunner.exe

windows10-2004-x64

1

DialUp.dll

windows7-x64

1

DialUp.dll

windows10-2004-x64

1

OLREG.htm

windows7-x64

1

OLREG.htm

windows10-2004-x64

1

RunAsService.exe

windows7-x64

1

RunAsService.exe

windows10-2004-x64

1

RunMCRFile.exe

windows7-x64

1

RunMCRFile.exe

windows10-2004-x64

1

RunMacro.exe

windows7-x64

1

RunMacro.exe

windows10-2004-x64

1

UIComponents.dll

windows7-x64

1

UIComponents.dll

windows10-2004-x64

1

Uninst.exe

windows7-x64

7

Uninst.exe

windows10-2004-x64

7

WhoAmI.exe

windows7-x64

1

WhoAmI.exe

windows10-2004-x64

1

Win98code.dll

windows7-x64

1

Win98code.dll

windows10-2004-x64

1

WinNTCode.dll

windows7-x64

1

WinNTCode.dll

windows10-2004-x64

1

_apmousedll.dll

windows7-x64

1

_apmousedll.dll

windows10-2004-x64

1

_b_keydll.dll

windows7-x64

1

_b_keydll.dll

windows10-2004-x64

1

_keydll.dll

windows7-x64

1

_keydll.dll

windows10-2004-x64

1

_loader.exe

windows7-x64

7

_loader.exe

windows10-2004-x64

7

Sharing

Copy URL Twitter E-mail

General

  • Target

    8cae328c990f4c641ff95a7eb76b25ac

  • Size

    1.7MB

  • MD5

    8cae328c990f4c641ff95a7eb76b25ac

  • SHA1

    1766e60f96f8e18d217a90fceb1f577f7b064a17

  • SHA256

    b92acea34e74c95f2a6466d2009e132c67111eac7d07345e15aa1711ccc547fb

  • SHA512

    2bb8962fa70b81c7c3099809b44a7c292e70e6d3a1338db2a8f34de521a39276e7830ffa6b6ba02d38864d13a833257cc0f5a0fd6c03ac4b224d10d8311ded62

  • SSDEEP

    49152:CUGOYTPTWvf+lqnAuyOgwvw52hPw8bLSwpRUWqDnulUdfUJ7NRus98kVUUW:BGOuEfyJROtIEw8n7pXunNsJ73usKWhW

Score
3/10

Malware Config

Signatures

  • Unsigned PE 24 IoCs

    Checks for missing Authenticode signature.

Files

  • 8cae328c990f4c641ff95a7eb76b25ac
    .rar
  • ArmAccess.dll
    .dll windows:4 windows x86 arch:x86

    d1e10a04ad85a14abc67c0f2a2f79aed


    Headers

    Imports

    Exports

    Sections

  • BasicRunner.exe
    .exe windows:4 windows x86 arch:x86

    8b17a5df12fb04adbff445696c1b8d78


    Headers

    Imports

    Sections

  • Custom/custom.txt
  • Custom/下载说明.htm
    .html .js polyglot
  • DemoFile.4pk
  • DialUp.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    202d258b7702c2b38767b7fc988b9a2a


    Headers

    Imports

    Exports

    Sections

  • OLREG.HTM
    .html
  • README.TXT
  • RunAsService.exe
    .exe windows:4 windows x86 arch:x86

    236da76da9655f623cdb85fb8bcd33ac


    Headers

    Imports

    Sections

  • RunMCRFile.exe
    .exe windows:4 windows x86 arch:x86

    84256d121c22692e8c3c461ce237e5bb


    Headers

    Imports

    Sections

  • RunMacro.exe
    .exe windows:4 windows x86 arch:x86

    c31ad904310311c242c311309c42b52a


    Headers

    Imports

    Sections

  • SONIC.WAV
  • Samples/Activate or run Notepad.mcr
  • Samples/Add prefix and postfix text to each line in text file.mcr
  • Samples/Close all Notepad windows.mcr
  • Samples/Convert clipboard text to uppercase.mcr
  • Samples/Detects if notepad.exe is running and kills it on users request.mcr
  • Samples/Filter formatted text out of clipboard - leave only unformatted text in clipboard.mcr
  • Samples/Generate file name containing current date.mcr
  • Samples/Generate letter from information defined in form.mcr
  • Samples/Insert current date to file name (uses procedures).mcr
  • Samples/Insert time & date in Notepad.mcr
  • Samples/Is connected to internet.mcr
  • Samples/List files from selected directory.mcr
  • Samples/Math expressions calculator.mcr
  • Samples/Parse full file path to components.mcr
  • Samples/Process lines in text file.mcr
  • Samples/Retrieve e-mail addresses from a text file.mcr
  • Samples/Run context menu command.mcr
  • Samples/Select file and open it in Notepad.mcr
  • Samples/Show menu of opened window and activate selected.mcr
  • Samples/Show registry subkeys.mcr
  • Samples/Shows how to use menus.mcr
  • Samples/Simple FTP file download.mcr
  • Samples/Simple form example.mcr
  • Samples/Start Notepad and type text in it - safe way.mcr
  • Samples/Tests if clipboard contains text.mcr
  • Samples/下载说明.htm
    .html .js polyglot
  • UIComponents.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    9b4fbc82b6f70167027adf47a97955ec


    Headers

    Imports

    Exports

    Sections

  • Uninst.exe
    .exe windows:4 windows x86 arch:x86

    efcfc6e7622396e9f04783b3de8ab7da


    Headers

    Imports

    Sections

  • WhoAmI.exe
    .exe windows:4 windows x86 arch:x86

    91efb78109cc58ad3ccf2c61599850bb


    Headers

    Imports

    Sections

  • Win98code.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    7942838106132cda0db44d9e93bcc63d


    Headers

    Imports

    Exports

    Sections

  • WinNTCode.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    4f54d45413223aa3d471b47da6391eb7


    Headers

    Imports

    Exports

    Sections

  • _apmousedll.dll
    .dll windows:4 windows x86 arch:x86

    38e37a124be4cc891a2ba48db749df03


    Headers

    Imports

    Exports

    Sections

  • _b_keydll.dll
    .dll windows:4 windows x86 arch:x86

    5678036c53abef8e904c6373a2e0ddad


    Headers

    Imports

    Exports

    Sections

  • _keydll.dll
    .dll windows:4 windows x86 arch:x86

    5678036c53abef8e904c6373a2e0ddad


    Headers

    Imports

    Exports

    Sections

  • _loader.exe
    .exe windows:4 windows x86 arch:x86

    435f8c1bc657f93fe10cafeeb0757f6b


    Headers

    Imports

    Sections

  • _prog.exe
    .exe windows:4 windows x86 arch:x86

    aaa734bdf233e7b6248c47353f08a15f


    Headers

    Imports

    Sections

  • _prog.exe.manifest
    .xml
  • _prog_service.bat
  • _prog_wd.exe
    .exe windows:4 windows x86 arch:x86

    c43e2dc7726c9f825d40753116a72c2a


    Headers

    Imports

    Sections

  • admin.ini
  • cc_ERB.exe
    .exe windows:4 windows x86 arch:x86

    0ce9247564a3d5eac1fdd3c7f2285e19


    Headers

    Imports

    Sections

  • cui.dll
    .dll windows:4 windows x86 arch:x86

    5c54715227e960c5019e7a45d4b9d02a


    Headers

    Imports

    Sections

  • help.chm
    .chm
  • ic_keyb.ico
  • license.txt
  • mtwbho.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    ae5d135654ad8dc6aea6afdc85cbe929


    Headers

    Imports

    Exports

    Sections

  • options.ini
  • pk32.exe
    .exe windows:4 windows x86 arch:x86

    e06bc8177dec2c2e877d5ec941b976c4


    Headers

    Imports

    Sections

  • pkother.htm
    .html
  • pmlt_default_listonly.htm
  • pmlt_default_withmacro.htm
  • register.txt
  • resdll.dll
    .dll windows:4 windows x86 arch:x86

    5c54715227e960c5019e7a45d4b9d02a


    Headers

    Imports

    Sections

  • setup.exe
    .exe windows:4 windows x86 arch:x86

    e0e0da199723f21b51e48d3655e71fba


    Headers

    Imports

    Sections

  • setup.exe.manifest
    .xml
  • users.ini
  • win2000code.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    2c911e684159a3c07a4a0ea1306394c4


    Headers

    Imports

    Exports

    Sections

  • 下载说明.htm
    .html .js polyglot