R���F�u����N'ںFi�Ohs]�U��]��B�=lb�𣏚Cwe|�{�Ӵ�/�+Q�loߩ�j�������e4X$�������V��n����'��a�K����ac�ʐe̘�j�pNs 5f!�T7��tj'�6<(ΰ{�ۇ�Q��_��(��T<Ϊ3��B�Fe�����-~j�`.q�k�A�p� ��������@k�;�"塚���XA4t�k'>$j����3^G#�>ɸT���F���'�ׂ��_����%���w��<��p-�$�.!�&�ƌw�ڗ7��-`���i��ꥳ��G3�\�܈�|���k�"\�2;XN͵a7���Kb��.�х��h;w ������i��������i�b� ���4!�'1qF�p6�B��uA�4Z��`Xr���� :=-�e��{�{Dzo$'DT��ݓ�eDe;Ѱ��=L�E�5�#�[h?��$8� X��+P�q0;ۦ�{��I��՚��x�&�-)We$��#vH�d&���ݢ�������>CC�cs�1C���-V�m��k��$���� �o%G�8)�9^)�R��PM"����4���On����!IL^{ej�7�Dk��DzVt��t�A���a�w�6��5Jşx�����-�L1��h�yHw�)���e:G*�&eb�d5���l}P� �����F�z^���T�`�wt[!���P�������"K @'�l����Z��8h��1>o? �������[?K�6�!�m=)��(����y������*����-Z��w��(�z����;�\�_�j>V"D���i�(��������<��}?���B��-ɔl@�˽�Ҳ�$��� Q6~[IuV,�Q�!`�LhE?���b|�ś7k����@���Yj����-�����H ?Ʋ��g�`H��+5�G.w�����������ٯ�^����ȄN�~H= Yr��<�$��]��d ��(y�ު�ٿiO_y��t��z�_a�ZJY��T��h�TMn�XV��Q��µ������.������M���~�R�r��H��[d���Z���v-�%�!3�;��"+�Q��GL�m���=Z����J�ٳ����/M��w���H��ɂ��s��tUBId��]���f.�KB�]� �% ���L%/���qq�M �NG��+���ᚊ��/dF4Z���b�����c��l#��������5LrZ�������k���R�^p���<�l �!B�C^�K��Y���Z���ͧ�|�2��)7Fwߩ k�X�!&S�=��z��y��)��5��!:M:r�v��zq;X ����DA����hVlM>�����?[�k(��ZB#����ߔ�ퟺF� #5iɪ����V+�J�b�|ˍ���Z>�2�@�ZIi]��-���.>R#ɧᣍn�%��4TyZRB��v���#�����hr5�'�)uBh���źZs�I�C��r���!Rg}���߽����)���\���>�r��N@" ɔ7{��{zh�1�1�p������$)5���)�thU4����?���x0Z�&1���������@y��>�[h~�@ �-�GGFEծ�$�$���4y�-1��R賾P��Mؓ�*�8*ނk�J1C�M/xk��d����'����i���|,Pa3���b�I3s�ƞ|z�خgX�~�� Y���4��M�XI�!��k�w��q����Á�h ��WXҡ�v�l}(����DI������2QރIV�mBn9�л��q�`=����t%NT����"lX�EF�J#�����J<^}�����w c{��k2Q c"�����eO��L��6r�H�X�2 ��R;�����I�x?!�25Rd-�gw�4��XIV1vʱ�l�eRw�������R����7�FД�����k�F���F���#�/�U�˪�,+��:���S��aݽ�Q��]�`8W0_�'�c)�iD~3֧P߹ZΘU��d�"y����x^l���W��_Y���r ��VL�X/��wI�͝!���TS�*VԤV��*�T$��"�H�-�;�k�j �Yj���ʧ�&�����U\�xW[(8j,�A�U�xt��;ǩ��p) �uf;F��~e-g��^�ù!������q���ӽ����"�ܿ�3#�b�l���7�U��$��o�/�npt���8FY�n7�y��d��jx���)_K�y�-���0{�;�'�H�V�0Y����t��Q�v.�Y��/��`�_���!����>Z��Z]��O��+?d�F�3�'lw�_�F?i��;����@��*s�˥b��[4u=��xi�j�f"0=lU!��z��I)��ؙ�ĖlT�ѽ�\�����:�S��-�֎o�m�g�����B����h���tv �T_�5�ϖ�Q�}>�A{J�ʳ,��sI��������Y���mvXUWqiz(Ts���Xa۾��[��62GI!\�VtD��M���W���L)�kՉ ,s�_��d��El�E�b��.�������P�-�q�N13C�~��7*�p��5��o��Gz�R��}"��@�x�C�a�����n�xDNWlw��]' ��Ye�Ńc��%���4����n�p�̑+���r�&�^vtB�M3>�I|�)��9��p,9@�{'Ͽ�~���s$����Aܜ����(I�zx�N̙A+�|�%.V_�:V N}{N6H���J/h�½_]����7 �券`pi �����=:�BP���>E��uP�Q��L�Sv>����jdب~��M?�<;H���YZD����uu`^w77$�.�Q�� �}h��K�A9� @�&pPkS�Έ�"�L* ��M�-3&�;{����&�|Q �L<������W#�1 �Rc����W��N��\� ���hR��"�^A����R| ��h��kRQ�|! ?q���ej��\K={S��?~�}�n��/�)��!�9�A��ݜ��)P�^����B'�����ۖ�f�A�U�":�;�Ų�au|�,���#Z������4u
Static task
static1
Behavioral task
behavioral1
Sample
Fury.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
Fury.dll
Resource
win10v2004-20240221-en
Behavioral task
behavioral3
Sample
Fury.exe
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
Fury.exe
Resource
win10v2004-20240221-en
General
-
Target
FURY_116.zip
-
Size
24.2MB
-
MD5
631f4a3407e4e6eb88c418a81c38dbcb
-
SHA1
f664bac189f05f3083fe8bee2440601dc3792acd
-
SHA256
3572a9b3719b56028c4bb7c935333fbdab9e0eb58c084e559cece55242578cff
-
SHA512
244ffcee97dc310f7583645e0455e58c134e436e0e7a8eece311644a2e5dc815be7b748e57022af4ff40cd5d33b6572a98f0303ea4356df805cd6892fbbfb459
-
SSDEEP
786432:3XikhRY4TfBA7VMqJz7pcm0BBA2ZINA6IORji:3Xik+7aqJz7pxd2ZeIORji
Malware Config
Signatures
-
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/Fury.dll unpack001/Fury.exe
Files
-
FURY_116.zip.zip
-
Fury.dll.dll windows:6 windows x86 arch:x86
a29b73179a8a2a43448c9a0faca69c81
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
ws2_32
WSACreateEvent
crypt32
CertFindExtension
kernel32
GetConsoleMode
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
FindWindowExW
CharUpperBuffW
advapi32
GetLengthSid
shell32
ShellExecuteA
ntdll
NtReadVirtualMemory
d3d11
D3D11CreateDeviceAndSwapChain
dwmapi
DwmExtendFrameIntoClientArea
userenv
UnloadUserProfile
rpcrt4
UuidToStringA
imm32
ImmGetContext
d3dcompiler_47
D3DCompile
xinput1_4
ord2
Exports
Exports
Sections
X-HARD#1 Size: - Virtual size: 1.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
X-HARD#2 Size: - Virtual size: 18.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
X-HARD#3 Size: - Virtual size: 1.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
X-HARD#4 Size: - Virtual size: 5.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
X-HARD#5 Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
X-HARD#6 Size: 24.2MB - Virtual size: 24.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
X-HARD#7 Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
X-HARD#8 Size: 512B - Virtual size: 233B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
Fury.exe.exe windows:6 windows x86 arch:x86
ad5228cfdb4d721b078f4fa3b8d9c4ed
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
D:\Codes\XB-Loader\Release\XB-Loader.pdb
Imports
kernel32
WriteProcessMemory
GetFullPathNameA
lstrlenA
lstrcmpA
GetModuleHandleA
OpenProcess
CreateToolhelp32Snapshot
Sleep
Process32NextW
LoadLibraryA
Process32FirstW
GetProcAddress
VirtualAllocEx
GetConsoleWindow
CreateRemoteThread
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetModuleHandleW
UnhandledExceptionFilter
user32
ShowWindow
msvcp140
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?getloc@ios_base@std@@QBE?AVlocale@2@XZ
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
??Bid@locale@std@@QAEIXZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
??1_Lockit@std@@QAE@XZ
??0_Lockit@std@@QAE@H@Z
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
?uncaught_exception@std@@YA_NXZ
?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A
?id@?$ctype@D@std@@2V0locale@2@A
?_Xlength_error@std@@YAXPBD@Z
vcruntime140
__current_exception_context
__current_exception
_except_handler4_common
__std_terminate
__std_exception_destroy
__CxxFrameHandler3
memset
_CxxThrowException
memcpy
__std_exception_copy
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vfprintf
__acrt_iob_func
_set_fmode
__p__commode
api-ms-win-crt-runtime-l1-1-0
_initialize_onexit_table
_register_onexit_function
_crt_atexit
_cexit
__p___argc
_controlfp_s
terminate
_exit
_invalid_parameter_noinfo_noreturn
exit
_register_thread_local_exe_atexit_callback
system
__p___argv
_get_initial_narrow_environment
_initialize_narrow_environment
_configure_narrow_argv
_c_exit
_set_app_type
_seh_filter_exe
_initterm_e
_initterm
api-ms-win-crt-convert-l1-1-0
wcstombs_s
api-ms-win-crt-heap-l1-1-0
malloc
free
_callnewh
_set_new_mode
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
Sections
.text Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 186KB - Virtual size: 185KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 884B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ