<���xP�&�N|۩�ԌB�r��5�7��D���B7�c�'�C�Z+( ��@bO�1����s��s�6����./��נA�"}��ʟrlJ���co lln��������Hdz��R�o*r���Q�S .Lf��|d��O�]��jI:��X`c���H�#=~���� #���a�G|�eL�|ў�W���\���`��-V7Ɲ���E��A)����uZ#(K9�<��)�3����ͳy�!�ɼ%�����aGZ���3���g��6�Q�"z�Aed��6#��G�+`�U�����S��w�TV=��%.���~ip��g#��ʃ`k�������7�� ,=.�#O/�d{L����Q �b�z���{��P��8Ag h a�\Ϣ�� �u���Yd[�a�W��`3g����0M�]����ShY�.���"��KY*�D"��@�ފ�r{�K|"�m���x�� %0���uK���F(�x��茯4�y7��S� OՏ����\����]����@$67(�ePՃ�9A��j��a��d!&Ӈ�M��v��)�f7�$Ӑ��l���I�t33��8�`Ƴ@E�KZ�m�w���5��:g��Ezz�sPR65��-�sK��p���t�ɇ��!W_�@�L��l��)��q�aq�ɨ�c��BZY�G��&�� ��uv��+�&��[lBQJ�6v���Q���_?�b�&T��l��$C�3ߍ����>ᓨ-P�YDRN �M�n��21��� ���V�2g�YkAecU��#�|�/rsa��X�������&9�h-��n�U�NHxܢF��|�QY֨qż���j�p���Q)vC�G]z��<wmUpF�gC����Q���G*��i�|dn�J9࠵�H������H|���� ���'���ڠ���V�� _�vCQ���},���,Bxe�M��hQ����"�ӌUsp�f���,��9�;�b�'2�p*�7z��kS�;|^���~�P����[PS��<&.� i7�W(�v�Sh�L�p�`�� �A!���͗� �@�pc���fA:>���~h�A�D\uH�֏��#�Ř���踚�Q�������ЙkH�`��H��Ѥ?O~�T����T�b�;DO2i��19�=�w@�l��g��M��#��#n��l崂X�8 O�H���VɌ=|�{���� �!��O�7�Ғ!��)2H�P��'�69���>��J����]V �Y=m*Q�7��2��>6*y�������3�:Xύ]�4�)e`��ţ � �q�[~M4��������_-~�q���3�_3ߞ &Lj^Q!k�T�6��m^1 w�r�$��nܦ(@/Г< ��@-�Ϋ�˝��Ruv,C����.y�.;���4�0M{_/��#��xu�h�o�bP�����AG�i|}�|F+<N ��aM��A]r�]f���+g���/�����$�ɱ��4`���b���NT�B�!�����O�M�][q�j�e��`�l� �U�Ђm4'�U?�5\�6�|��0�C6�uKu��4�h>���ľV.V��0��5o��$����=P��kz��r����Ky��k�>������k�Se��j^�Y��f��-����.%m'=��:�|qQ�`�.��~���[.R)��q�� �p2j`,�X �%꧰Pj6��t�aWΞr�C�>q��<-��f�,!Dwn��ǵ���u9��K�� ���=����Xȷ�)�-�B���]ޞU>Kʫ8њH�%!D5;-���@��l�G��x���S�5WA6 [�IP1g��pf7'�9�0���n!��i� ����Hm�&��C�����/%�a�!�͖�Jl� �Q~��3����qOnY뒙��`��>,p%5������.�������2Ŝ�XCs�K>�w���&S(L���@�O.���[�ǐ''��1���I�:X� ��;��~Q̰���I�RcL�*`�F/�,^��lo���|�]q�I�惜<0�ޒX����?�e�bk���A��yjܵ~���-"Kēr=b:�5q�9A,�8��:t��q����.��jbgִcZ�t�y���l{GR�(T侚 �B�y:���~�J��3�Z�x>�����Y�#��j�G�����-�8���(��,�p�`к�4e���N��h����iO����JV Hp�xk�E�"Ҙ�{�Y��q�0��m@;��Nr��0R�~�!��c%bf��~�ws��qR�4.B���:`t�[&s�@8}�ߵO������Tt�O�#e��~��"���r�9�K���1/Y7�s��,���*�0��ܳ��d�h�b��lB�p|mi$���7��eK %���\�P���[>�I&��E㞈-Jz̉�-�㋞1����#ns�L�0vx�A��`����}��^��1� ���1[`� ���Ya q[/r�ސ�i0�ZTLװ�����]/E�ޓ��hI�������?B�뒁���)!��*[K~z&����L<v��Jy����K��j����W�0z<�l �1O� �g�%��R�O���PA� ���_:Ԥ��Cu6 Ü�u�)�XN�����wQy��]~H�jOd�+��c������^��h������j��~>]������`��!������c��{M�<Q$����{X�`�g�h&��e���I� �:���������B:�L� o�O����(v _�RK�Gߞ��O�Zh�41�0/y�G�"��qTOI��<�q�z(� *�����`��1nJ���{맽��Ea�SV4�X)�ha���j/o�*� �~;���ܰ�Q������r��5�7߃����&�9�� i�+M�d��5�F�9b�Ϝ�9W �x�L\��{^B�����fs�+�Rp ՕlQ*6���i@RK�P<�Z�����,�(���$��[d�90�b�Ac}��Z�÷A5��^Ή�c�ԻU���ˆ�U����X�x��%ʥhF��+��������|�VS��dQ �E|ɨ�D䍪 ��'��,�R���S��Ӷ�fLH
Static task
static1
Behavioral task
behavioral1
Sample
Boost Tool Rebrand Adarsh/BoostTool.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
Boost Tool Rebrand Adarsh/BoostTool.exe
Resource
win10v2004-20231215-en
General
-
Target
Boost_Tool_Rebrand_Adarsh.rar
-
Size
12.1MB
-
MD5
b9336419aea6197bd5186c02b7837b13
-
SHA1
c93154945cd91727c779cf7df6df5aa760b29c74
-
SHA256
a1070d49f415120cba5c94b4a8c8fb793fdd2eaca26b231632f00e76d7e97bfa
-
SHA512
989e5a36254506fc3588666c6396a629c2ef70eafde13754d9011bf647874a4f3b1a8a0e69a3acc16c9a34133cae2aa86918b2cbb1a3deac9a20212fd46cd42f
-
SSDEEP
196608:vvzV9A/E1BwMKXIf2mPnpCfqQHwRXKkwvZLI1Xqn+cdw/oOQZdet2kAYI/wo/rB:nTa4mndfUXnwvZCqtdSoJZAdADw6N
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Boost Tool Rebrand Adarsh/BoostTool.exe
Files
-
Boost_Tool_Rebrand_Adarsh.rar.rar
-
Boost Tool Rebrand Adarsh/BoostTool.exe.exe windows:6 windows x64 arch:x64
9cfc7e5db1974002df63adc9ba2c0f75
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
WriteFile
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
CharUpperBuffW
Exports
Exports
Sections
.text Size: - Virtual size: 4.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 4.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 998KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 91KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.xdata Size: - Virtual size: 168B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.zdebug_ Size: - Virtual size: 297B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.zdebug_ Size: - Virtual size: 691KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.zdebug_ Size: - Virtual size: 147KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.debug_g Size: - Virtual size: 48B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.zdebug_ Size: - Virtual size: 1.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.zdebug_ Size: - Virtual size: 885KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.zdebug_ Size: - Virtual size: 244KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.5\* Size: - Virtual size: 78KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.symtab Size: - Virtual size: 666KB
IMAGE_SCN_MEM_READ
.`zH Size: - Virtual size: 3.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.."V Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.v}* Size: 12.5MB - Virtual size: 12.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 156B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 100KB - Virtual size: 99KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
Boost Tool Rebrand Adarsh/settings.json