MonaServer_Win32[.]zip

Sharing

Copy URL Twitter E-mail

General

Target

MonaServer_Win32.zip
Size

1.1MB
MD5

a0782729b17b395235fc9e7e1017eea9
SHA1

96608658ad7fc70458bae8e0c39a801ef40620c2
SHA256

641a14fc65c18bf85522f878284cc1aefab9c21f7c7e5d2c5a09399a464d91f7
SHA512

6c29ed1789cfacfc12975b07bf149da1366490d9fb5254c45ab673de5099eaa779be604a0bf42c2de48f3c95afa43a25914f5b79d5755cd835d4e587f6809e38
SSDEEP

24576:dOD17EfZiCeTHpBeqaqJlM4jfO8m5+rrYU7piu9maRNE8ZLpp69BwL5nrP53g1F4:dODGiCI3zK4jJrrxwWP66hr21F4

Score

3^/10

Malware Config

Signatures

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
unpack001/MonaServer.exe
unpack001/lua51.dll

Files

MonaServer_Win32.zip
.zip
MonaServer.exe
.exe windows:5 windows x86 arch:x86

e78f568bb8a7f9ab89be5032a866fc51

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

lua51

luaL_unref
lua_tocfunction
luaL_openlibs
lua_close
lua_call
lua_atpanic
luaL_newstate
lua_insert
lua_pcall
lua_remove
lua_equal
lua_getfenv
lua_pushinteger
lua_rawseti
lua_rawget
lua_rawgeti
lua_next
lua_pushnil
lua_replace
lua_objlen
lua_tonumber
lua_setmetatable
lua_typename
lua_topointer
lua_isuserdata
lua_newuserdata
lua_createtable
lua_setfield
lua_gettable
lua_pushlightuserdata
lua_type
lua_settable
lua_pushlstring
lua_pushcclosure
lua_pushvalue
lua_settop
lua_toboolean
lua_getfield
lua_rawset
lua_gc
luaL_loadfile
lua_setfenv
luaL_ref
lua_gettop
lua_pushnumber
lua_getstack
lua_pushstring
lua_touserdata
lua_isstring
lua_tolstring
lua_pushboolean
lua_getmetatable
lua_getinfo
lua_isnumber

kernel32

GetConsoleCP
FlushFileBuffers
GetACP
GetCommandLineW
GetCommandLineA
SetConsoleMode
ReadConsoleInputA
GetConsoleMode
ReadFile
ExitProcess
HeapReAlloc
GetModuleHandleExW
ExitThread
HeapFree
GetCurrentThreadId
SetConsoleTextAttribute
GetStdHandle
MultiByteToWideChar
GetModuleFileNameA
FindFirstFileW
FindNextFileW
RemoveDirectoryW
FindClose
GetCurrentDirectoryA
GetLastError
DeleteFileW
SetConsoleCtrlHandler
SetThreadPriority
GetCurrentThread
WideCharToMultiByte
GetModuleHandleA
IsValidLocale
GetProcAddress
FormatMessageA
GetCurrentProcessId
LoadLibraryA
FreeLibrary
HeapAlloc
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
PeekNamedPipe
GetDriveTypeW
CreateFileW
CreateDirectoryW
GetUserDefaultLCID
EnumSystemLocalesW
SetFilePointerEx
IsValidCodePage
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
GetCurrentDirectoryW
GetFullPathNameW
SetStdHandle
MoveFileExW
GetProcessHeap
ReadConsoleW
FindFirstFileExA
FindNextFileA
WriteConsoleW
HeapSize
SetEndOfFile
RtlUnwind
RaiseException
LoadLibraryW
UnregisterWaitEx
QueryDepthSList
InterlockedFlushSList
InterlockedPushEntrySList
InterlockedPopEntrySList
ReleaseSemaphore
VirtualProtect
VirtualFree
VirtualAlloc
GetVersionExW
LoadLibraryExW
GetModuleFileNameW
FreeLibraryAndExitThread
GetThreadTimes
UnregisterWait
RegisterWaitForSingleObject
SetThreadAffinityMask
GetProcessAffinityMask
GetNumaHighestNodeNumber
DeleteTimerQueueTimer
ChangeTimerQueueTimer
CreateTimerQueueTimer
GetLogicalProcessorInformation
GetTimeZoneInformation
EnterCriticalSection
LeaveCriticalSection
TryEnterCriticalSection
DeleteCriticalSection
QueryPerformanceCounter
CloseHandle
DuplicateHandle
WaitForSingleObjectEx
Sleep
GetCurrentProcess
GetExitCodeThread
GetNativeSystemInfo
SetLastError
InitializeCriticalSectionAndSpinCount
CreateEventW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetTickCount
GetModuleHandleW
EncodePointer
DecodePointer
CompareStringW
LCMapStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
GetFileType
WriteFile
GlobalMemoryStatus
FlushConsoleInputBuffer
InitializeSListHead
SetEvent
ResetEvent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
CreateTimerQueue
SignalObjectAndWait
SwitchToThread
CreateThread
GetThreadPriority

user32

GetUserObjectInformationW
MessageBoxA
RegisterClassExA
CreateWindowExA
DefWindowProcA
PostMessageA
DestroyWindow
GetMessageA
GetProcessWindowStation

advapi32

SystemFunction036
ReportEventA
RegisterEventSourceA
DeregisterEventSource
SetServiceStatus
StartServiceCtrlDispatcherA
OpenServiceA
ChangeServiceConfigA
RegCloseKey
RegCreateKeyExA
RegSetValueExA
RegisterServiceCtrlHandlerA
RegOpenKeyExA
CreateServiceA
CloseServiceHandle
OpenSCManagerA
DeleteService

ws2_32

getsockname
send
socket
connect
recvfrom
recv
sendto
getpeername
setsockopt
WSAGetLastError
getservbyname
htons
ntohl
getaddrinfo
inet_addr
ntohs
freeaddrinfo
listen
shutdown
closesocket
bind
accept
WSAStartup
WSACleanup
WSAAsyncSelect
ioctlsocket

Sections

.text
Size: 1.6MB - Virtual size: 1.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 399KB - Virtual size: 398KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 53KB - Virtual size: 71KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 107KB - Virtual size: 106KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
lua51.dll
.dll windows:6 windows x86 arch:x86

049f3684949881aab462ba9c4934f08c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

msvcr120

ldexp
fputs
_CIcosh
_CIsinh
_CItanh
strstr
putchar
strtoul
fgets
clearerr
fprintf
fscanf
_fseeki64
_ftelli64
getc
_pclose
_popen
setvbuf
tmpfile
ungetc
strncmp
floor
setlocale
clock
strftime
_difftime64
_gmtime64
sprintf
_mktime64
_time64
remove
rename
tmpnam
getenv
system
strrchr
memchr
strpbrk
_except1
_crt_debugger_hook
__crtUnhandledException
__crtTerminateProcess
__CppXcptFilter
_amsg_exit
free
_malloc_crt
_initterm
_initterm_e
_lock
_unlock
_calloc_crt
__dllonexit
_onexit
__clean_type_info_names_internal
_except_handler4_common
strerror
strchr
fread
fopen
ferror
feof
fclose
__iob_func
tanh
sinh
strlen
cosh
fputc
fflush
fwrite
_errno
strncpy
_fmode
exit
memmove
memset
_localtime64
memcpy

kernel32

GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
DecodePointer
EncodePointer
IsDebuggerPresent
IsProcessorFeaturePresent
GetModuleHandleA
GetModuleFileNameA
LoadLibraryA
FormatMessageA
GetProcAddress
GetModuleHandleExA
FreeLibrary
VirtualProtect
VirtualQuery
VirtualFree
VirtualAlloc
SetLastError
GetLastError
DisableThreadLibraryCalls

Exports

Exports

luaJIT_setmode
luaJIT_version_2_0_3
luaL_addlstring
luaL_addstring
luaL_addvalue
luaL_argerror
luaL_buffinit
luaL_callmeta
luaL_checkany
luaL_checkinteger
luaL_checklstring
luaL_checknumber
luaL_checkoption
luaL_checkstack
luaL_checktype
luaL_checkudata
luaL_error
luaL_execresult
luaL_fileresult
luaL_findtable
luaL_getmetafield
luaL_gsub
luaL_loadbuffer
luaL_loadbufferx
luaL_loadfile
luaL_loadfilex
luaL_loadstring
luaL_newmetatable
luaL_newstate
luaL_openlib
luaL_openlibs
luaL_optinteger
luaL_optlstring
luaL_optnumber
luaL_prepbuffer
luaL_pushresult
luaL_ref
luaL_register
luaL_traceback
luaL_typerror
luaL_unref
luaL_where
lua_atpanic
lua_call
lua_checkstack
lua_close
lua_concat
lua_cpcall
lua_createtable
lua_dump
lua_equal
lua_error
lua_gc
lua_getallocf
lua_getfenv
lua_getfield
lua_gethook
lua_gethookcount
lua_gethookmask
lua_getinfo
lua_getlocal
lua_getmetatable
lua_getstack
lua_gettable
lua_gettop
lua_getupvalue
lua_insert
lua_iscfunction
lua_isnumber
lua_isstring
lua_isuserdata
lua_lessthan
lua_load
lua_loadx
lua_newstate
lua_newthread
lua_newuserdata
lua_next
lua_objlen
lua_pcall
lua_pushboolean
lua_pushcclosure
lua_pushfstring
lua_pushinteger
lua_pushlightuserdata
lua_pushlstring
lua_pushnil
lua_pushnumber
lua_pushstring
lua_pushthread
lua_pushvalue
lua_pushvfstring
lua_rawequal
lua_rawget
lua_rawgeti
lua_rawset
lua_rawseti
lua_remove
lua_replace
lua_resume
lua_setallocf
lua_setfenv
lua_setfield
lua_sethook
lua_setlocal
lua_setmetatable
lua_settable
lua_settop
lua_setupvalue
lua_status
lua_toboolean
lua_tocfunction
lua_tointeger
lua_tolstring
lua_tonumber
lua_topointer
lua_tothread
lua_touserdata
lua_type
lua_typename
lua_upvalueid
lua_upvaluejoin
lua_xmove
lua_yield
luaopen_base
luaopen_bit
luaopen_debug
luaopen_ffi
luaopen_io
luaopen_jit
luaopen_math
luaopen_os
luaopen_package
luaopen_string
luaopen_table

Sections

.text
Size: 309KB - Virtual size: 309KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e78f568bb8a7f9ab89be5032a866fc51

Headers

DLL Characteristics

File Characteristics

Imports

lua51

kernel32

user32

advapi32

ws2_32

Sections

.text Size: 1.6MB - Virtual size: 1.6MB

.rdata Size: 399KB - Virtual size: 398KB

.data Size: 53KB - Virtual size: 71KB

.gfids Size: 3KB - Virtual size: 3KB

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 512B - Virtual size: 480B

.reloc Size: 107KB - Virtual size: 106KB

049f3684949881aab462ba9c4934f08c

Headers

DLL Characteristics

File Characteristics

Imports

msvcr120

kernel32

Exports

Exports

Sections

.text Size: 309KB - Virtual size: 309KB

.rdata Size: 24KB - Virtual size: 23KB

.data Size: 512B - Virtual size: 1KB

.reloc Size: 6KB - Virtual size: 5KB

.text
Size: 1.6MB - Virtual size: 1.6MB

.rdata
Size: 399KB - Virtual size: 398KB

.data
Size: 53KB - Virtual size: 71KB

.gfids
Size: 3KB - Virtual size: 3KB

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 107KB - Virtual size: 106KB

.text
Size: 309KB - Virtual size: 309KB

.rdata
Size: 24KB - Virtual size: 23KB

.data
Size: 512B - Virtual size: 1KB

.reloc
Size: 6KB - Virtual size: 5KB