4�nj8���4�ǝNҢA�����bu����NFș�q����G�i���@�AN�b� wx�L��l�^Ԧ$x:2T�r��F�ԧ1������ aM�T"�qq��gU�Ҋ$�\��JK�@�.��[�>]�����.���Cvs�)�E���>c���7{4��E�ʆ+�G�-�&*�W���'�+��mxZ�b��ဒ�;��\�F~��ο�N���o� 9&Sq�J�g�o�W4מ�ĩάp�|ѿ��iJn��-�m�P�ȅ�Qz�.����I�����Yn�rO�Xl8����!;\ݕ��+p���.ҧa���W��=ɡ����D c������ʶQ����H�(&#����9����%�̗D�_Ca��7R����y,2&���uu�� UxO\z�m�&I��ʨ_]z(<ܤ���{ވ��)G�yI��k3����([Z9vA���{��6�Wg�h�°�ŀه����N�}I�+��ΐ����Nv��y&e����g�YHs�9��xҀ��9q�����7� ��5ί[��I�T�,U�yEȕ_�S�K���K�C���W���C���t6]�Ʀ�$�#�D���rG�y83�-(!�X�Z<�%(QGUkK�(a�~x���>��Qa@~�Y�fzVI7�tA��Z�]�[�)�}m�]/3��3~�E�ZU8j�\�U��������3��R��:*��"��˃��I`�饷�@� �ʚ����*]/N��yh�䕭��e DA���6e��E �x��^*�T+A�� �W����m��Do>�Ͷ��i`gهx���:��b�G���v���ۘ���v��3Ef���) 3-�[&���Zv�4<q�����OĞ�y�� e�lNc���D)_W�!-u[��8�U� �g��i����� k|�'�[�~��-����LneNAS���B�E�S�V�����H�$�(�PV�o��O����\=�Д�e+਼�Sإީ�h oϮ Ϊ����(*�߫�D�ğ�Sķ�f��g��R��yw��tC����K=�+͜<����c93�������h���M\fM���_�K�������.�hN�6Q�o�D�Ə������M���f*)���K,��@������?��������H@�9�n��PS��G��)p{j�h�s�)���ߓ�xW� �h@zj��lp4�Pj*o�l;�����`�wm�+G �U5�sK&Ⅾ��!b�s)蒁�Y�(;K��� ���[G�7�ot�>9� ��SD�OѲ�K��#�ڷ���DR;�>�R�9�������rsQ0i�0S����9��J�-N>��Go(�����&�F^�����Ό*�E����g�ǧ��w���/6L��Tk�V�d���_?^�����������ZK���;��,>3'�릻� �^f����Ϗ~7�PC��~T�T>����kgK�g�I?����l�_B]�@�����i�����UL������+��rwlߘ�(+>��sfC���6�ü`��>�( �r<�J�� w�q��QRF+�A|�������O�q��$�z`}�WA��*%��vz���Po �����> �]����"���ۮ�����`=���B� ��y���Op���ܮ�7��-B_g&���X�_:Bft��b�c����Ѩ�LM�y��h23��%:Oٔ\L� $b.�>3���ǃ� $e�x%K�Y5������2�j���k�I<[�1)���Xv�}f:�Ę�W߱�"��."�a�mioV�C�Z������O�wV��� �Z��� �N��p�2���䕼S��G�6�ֻE�ZB��H��%o��<o�Qo���q��z�o<��݁/݄k}�]ej.7TP�v8�r6;�~vD�mz5|��Դ!<�� ����o�m�K ���A����?V��ǤD�6K�X,��-Z����l�䁃�Y(V_Ǡ�R��N(0Αn%Z����٢�[wW��Wm�|�ޡ6�M�E嵕�Y0��e!J��j�p��鞳�~<#�����7����������9�s)��7O�y���4��|>-�X%\0���, ��1J��_�e��F�cL;�����i!�U]����mS��+�ޥ�3�!��,eq�2��8aل�M�4Q��iQd����b�d.�P���bK�fVYt<��r�\� ��/�v��1���uӆ�=/�+����O�c���%ް6�b�����ţr�d�-�zx�������4�n��A���e���q��m�Ƒ�%}���#�����J�J��9����ȫb�s��J���z�� ��D��Zؓ-Z�+�����eH��"����!�1i�F} -�Heʻ!�rp����z8> ���+q�����e�L�l;��Z��L�q��Q�iTU�w�tG�h�b�z�%�[m#rIG�݇���z%��%� ��=��GNL�|RKZ��0��Uh�Td�r��hS_S��LN��B kա���l͕E?�Q�� G�1�X]sz��V�'��h��_�� ߙd<���M�X;<�E�٬~"~�gN%������id��B���N�]�t]?�Ga�.������پ��˹���=��#,�E�7\|���Ө�䤋H�^��E����97��1���g=�1SQhy|�'!��y�����b�gsU�I��t���vjز�d��%��s%��!6�T��-�)��[�D]vA�V>����Q\A`x��P��JzG���B�����ކ�ꈼ�= �#�w� g�c<�Y���A�'�C�_t__��fuLċ�]����`"U�'��L��9P�0�},�q_� ����5��x��hYĜi��Qà�+%��&i�и��gA�f��)fWC�8�^*����*v�vx�������B/�,�FYk�E�����Ĕ�Ї���K�~>|�D[�Q�!'y<��e�XN���U�BO�����-o�ﯛ�;`&���pV��h��1j]���8^)���n��*B�l��B;d����7P���q'y:��!;�AU��ڟ�K��XMc;�hD�,ovts��Ф֏�i�+9�:�c�#�r��E��k�ޘ�~^ \)�J�O�3�DE�P���_�d�&�s�fs�H�u�=���:�gU�s��L7XYѶD��q��������Px�=� .��X��z��g�Υ0K%�{���j.��r��9x��4aq����a�����6
Static task
static1
General
-
Target
Cheto_Updated.exe
-
Size
6.7MB
-
MD5
b0f876b9cf399be5e39a40a50e996085
-
SHA1
bda77e510b356c80514c837e31dd15afb325084d
-
SHA256
57c2367d2736610dad723238573a76892ac362ad0788f5eb5c754b64e81893d4
-
SHA512
36ff5ed7863051ceeb0eb65f76874fdd905b364bc71989dfd895123e6486bab23ab67394acf8f321935f51d335c9b65b77e028fa22c7d8ba823e65a6e277d0d5
-
SSDEEP
196608:p82IFLBKitsC2lN/FcOTGQJBDh127uxeYRc63wAaZ:pBmL4VCuRAQJBDh127uxeYRXR
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Cheto_Updated.exe
Files
-
Cheto_Updated.exe.exe windows:4 windows x86 arch:x86
Password: cheto
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Exports
Exports
Sections
Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 4.0MB - Virtual size: 5.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 4KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 364KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 363KB - Virtual size: 364KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 202KB - Virtual size: 7.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE