����CԲI(Y�:��@gQ���@H]bg�{����巷7����H �^#�$�Wa���� ������c��m�.)�v~���aY"��&�gd�'"7Ʉ�j���1�s�:b5\LEY�Mĉ����8��c�u߉���e��4>W�]�����*�#�ݢH��H*���*ٜ$�Źf�-k�;˜�_o�v�>�9�)~u0�!0)�^ʄզ��a���:3:) s�'��A���!sb��ϝ��^O���P��h�Տ1l"�f0���f��e���hɏ0����Uuԝ���w��R�������X x�8��}ϊ��Y���ê�a� ��/�/w��-�ɗ!�窝�T���bU����ˇ� �P\�\Wyf�����|m�g;�K���"�eo� x�T��hA1�=��Z�2��]$rc�j�|�EmI�� s���mmS�/��u=�&�/t�fZ�^ѝ�u�nSD�QU�"�0!c��ӄ�p�N�S�eC��zWKBƍJ|��B�+NÞ����L����s��� |��:V&�M�:s����ft����ZAK>'J������x�Ҡ���섋���o�I�����i}�3�e��bn2fw 3������pu������ϡ����(z@\����`��l��"�����a-d�r������B!�㹛�jć���������'�A��8�e��%���Ξ��q�|�~�rñ�Nɦ ���f�s'�p����#�s��ZX&\2{��Q�1�[!v��7\f���,��ܳ3�邢��=�v�ɀ�+ PD��tϳ�L��! }<�+&�����;�qtй������|ZP-ZQ��~��0 dy���nR(:������ȯMyhF�*s�Y !b��!�M}h��j$=���M�4��0d/ST���_g��5��u�����F!$_��%k��e��Nz^���V~\��9>�Q����3�r3��vg�Uγ����&�2H�X��V ��������;�>�,��erf&�B�&q� c��y[l��H���H��~�&�x��y�9��$���-�UD���0j���+�v;�o?�\�8o4�`bn���W<M�K��T�[�� jB�_*�A]�ԭ��*�s�]+th�W�ZH̤90�_�E8�UN N:�]�l�ެ���I{��:�h���-����o����Un���7=����ac�2fr·�[͗��W��e�}],������=2�^!cR��?�� �_��Y�L�[�FXO������ħ!�YT$����V��0�x ��<KXZ�M���|^�#��ҰYKj+Q���Kc��GΩ������Yn(�N0u��x�~�uq���Ʃ��|� >U�$�5w���r� ?���$5��Y���)���P�u7b��� �0�:2=*A czT�0Z5��9�� q����'����ĠG$��QC������)�o�����onO�~��c��1@Y��;:}�f��PV�"0�Խ���P�֨^��D���>RP��܍����Z�����B5�3��$���7B�:�O|?-���"jД������sƝ �^�Tm܇�R���j�7�T=I"�OI��羘�J_��V�7�]Z��Y��¹^c�A_��� ^ad;e�K.����~�BQ]��t�*xR��%L�g��9ݪ��r��Bm�����7��X�D��7���"{ͩ��?���������^��L� �@�-�8��/�ݖ`��V-j_p�?|��+]�TDőy��6q��E.-70�\�T�G���o�yET��>Z�6�B@�֝v�%iU.�&|��H��f�]�X&:h9$E�S���������Pv�p�#os<�HG�'#b9k$��l�k4�ٷ�'ؘq�˧�;E�I�cg�*��T�L�����(�<�+Rϩ���z�A'�B|��E>�4�o=��-� ����KnE4�t��Ƞ$*�@�F�����ZZ1������^`���om��o1VF�f��J �uO�{\e"���KcSZ �b����)>Ѝ�X�}-���{/3�B�i�h��m�����y�S^�7>t�ok�O6Q���������3������N���=r�Ѿ$�G&�X�N�W��k]���~��.�`}�T��JU�.��;+vp�3�N�"� �����{�a�Zo�4��C�O<_���Z�ݣ�.�T�2���F�����4����Y}��[�"�����Q���E�>,��]���#�.)X�ǐ����BݺN!�%�<p)\Ylj�L�9P.�@C�,7#�����pF.f]�ؒ<E���HĮ�ul������쟏#���}�en*a{���&��v� Y)Xj����n�J�"b���?��n�Vd2���5�@S9�yijF��6c��~be�7��k�(Ŗ��մJ�����Q;��;���E�j$|:��UI�2q��ˎ��j��9�n�d�Y��̎��p���E�{� |8e!>�Lj�I��z��/���"�d�n��=y��?Y��`'I��5۫]� ʑe���=pʅ�ȧ��M�9"��Q���u ÷��<�?frL����0G��-x*�tWa��#e�� �� �d`��������]C��� ���b.k�"�/줐��r���.<9Fe����:��0��ş.��-K���eE8�g.�������?�[���v r[ֆ�����;P�U�D�S�{�Ǔ����,��Ֆh%�ݣdL8���{,ԯDmn����5��)�R���1������9.��V�A,��d]E_�˹�e/Ya�m�\��B���ɏ�6{�=�P�Q������؊�n�qϱ�6������Q��z4�!E�L�~�v�v����MԎ+�Ƙ@t P%�Xj}���� i�#�a�7��ʗ��:m�E�|��� ��@ȑ�[z�����'��H�@�DZ^>an��H��j7J\K��~�C7���α7w��{���2T��G��� �ۂ�1�����Cz��'S�����a ����=�B���h͵��+$\�
Behavioral task
behavioral1
Sample
SquadHack_BP.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
SquadHack_BP.exe
Resource
win10v2004-20231215-en
General
-
Target
SquadHack_BP.exe
-
Size
5.3MB
-
MD5
1b4dd2bfa8a0aaa2a19c8a2b9f17d976
-
SHA1
17258e7466558791a4ba45a90fb06105fc24d3bb
-
SHA256
7e84ed507d22361c66ec82eaa22d09227f8d9939d36b3ec47d30f9e9bf1e13c4
-
SHA512
1a916bc1e5641df341b07ade7bd6b488dfb2c541ad51b3727c019fab438de22e661103cf21786f3893399203540f1e656e015d3fe9b7a167225b83b36ca3896e
-
SSDEEP
98304:MFEG7VeHq19bQVrPoNZj+1ue5uxlOQbzFhEr9XYtuNEabW6k/yuLNcnYE:8EkQH0bArQNd+vClOQb7sTEabW6MDYY
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource SquadHack_BP.exe
Files
-
SquadHack_BP.exe.exe windows:6 windows x86 arch:x86
fdc0005bafdfb5710633a58ee679ca72
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
WriteProcessMemory
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
msvcp140
?_Xlength_error@std@@YAXPBD@Z
urlmon
URLDownloadToFileA
wininet
DeleteUrlCacheEntryW
vcruntime140
_except_handler4_common
api-ms-win-crt-utility-l1-1-0
rand
api-ms-win-crt-runtime-l1-1-0
__p___argc
api-ms-win-crt-environment-l1-1-0
getenv
api-ms-win-crt-heap-l1-1-0
free
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-stdio-l1-1-0
_set_fmode
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
wtsapi32
WTSSendMessageW
user32
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
Exports
Exports
Sections
.text Size: - Virtual size: 5KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1020B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 3.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 5.3MB - Virtual size: 5.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ