Overview
overview
7Static
static
7365Llxt/365Llxt.exe
windows7-x64
7365Llxt/365Llxt.exe
windows10-2004-x64
7365Llxt/update.exe
windows7-x64
7365Llxt/update.exe
windows10-2004-x64
7365Llxt/�...��.url
windows7-x64
1365Llxt/�...��.url
windows10-2004-x64
1365Llxt/�...��.url
windows7-x64
1365Llxt/�...��.url
windows10-2004-x64
1Behavioral task
behavioral1
Sample
365Llxt/365Llxt.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
365Llxt/365Llxt.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
365Llxt/update.exe
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
365Llxt/update.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral5
Sample
365Llxt/官方网站.url
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
365Llxt/官方网站.url
Resource
win10v2004-20240226-en
Behavioral task
behavioral7
Sample
365Llxt/新云软件.url
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
365Llxt/新云软件.url
Resource
win10v2004-20240226-en
General
-
Target
b3f6ef6507cb95de94b33149dfdcd1bc
-
Size
1000KB
-
MD5
b3f6ef6507cb95de94b33149dfdcd1bc
-
SHA1
38c93497f464150f72cba9281a6fadc5afb82785
-
SHA256
4129cb39e41585e2c46775650f8cae1558fa89935954a3a03f610898cd1b7c0c
-
SHA512
afd9d2e52bec800e616fb51cab927ea4d17e8303fa51485b7ba3050e7c8497039f8106c80b0025bc5c93bd88730f88f39d70b411579caa4645bc287da5dba320
-
SSDEEP
24576:dIdCciHHRjvHPU5i7bqducnQkXv+zHAh/yXspQ7a8:dvciHHRDPU5cbqgcn7sgxyXspQ77
Malware Config
Signatures
-
resource yara_rule static1/unpack001/365Llxt/365Llxt.exe upx static1/unpack001/365Llxt/update.exe upx -
Unsigned PE 4 IoCs
Checks for missing Authenticode signature.
resource unpack001/365Llxt/365Llxt.exe unpack002/out.upx unpack001/365Llxt/update.exe unpack003/out.upx
Files
-
b3f6ef6507cb95de94b33149dfdcd1bc.rar
-
365Llxt/365Llxt.exe.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Sections
UPX0 Size: - Virtual size: 1.5MB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 715KB - Virtual size: 716KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 104KB - Virtual size: 104KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
out.upx.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Sections
CODE Size: 1.4MB - Virtual size: 1.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: 13KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 7KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 72B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 96KB - Virtual size: 95KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 650KB - Virtual size: 650KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
365Llxt/config.ini
-
365Llxt/ip.txt
-
365Llxt/iprule.dat
-
365Llxt/update.exe.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Sections
UPX0 Size: - Virtual size: 560KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 245KB - Virtual size: 248KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 102KB - Virtual size: 104KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
out.upx.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Sections
CODE Size: 573KB - Virtual size: 573KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 5KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 9KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 72B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 45KB - Virtual size: 44KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 132KB - Virtual size: 132KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
365Llxt/使用前说明.txt
-
365Llxt/官方网站.url
-
365Llxt/新云软件.url.url
-
365Llxt/网站流量系统新特性.txt
-
365Llxt/软件定制服务.txt