meteor | bd5acbbfc5c2c8b284ec389207af5759

Sharing

Copy URL Twitter E-mail

General

Target
bd5acbbfc5c2c8b284ec389207af5759
Size 695KB
Sample240310-cafheaha26
SHA256 9b0f724459637cec5e9576c8332bca16abda6ac3fbbde6f7956bc3a97a423473
MD5 bd5acbbfc5c2c8b284ec389207af5759
SHA1 c71b6cd6a46494e9132da20a6bacfe0b870a460e
SHA512 833d0783e508b9f995734753fba4e7b546c8756b07c79cd962a448ac76e90ba9c07954f9387d49d64571b664bc9265265961ffb15c48d7285b529a238c959b33
SSDEEP 12288:XyYRp4jlsiiMfEyICdcaTTpZqLKdVlU1I7brdo40NzTDiTrSu0IOgeXfP5JzP:iYcjLiMfDICDTzGxMbrIDiTr50COfRJT
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

meteor

Malware Config

Signatures

Detects Meteor wiper 1 IoCs

resource	yara_rule
sample	family_meteor_wiper

Meteor family
meteor

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
bd5acbbfc5c2c8b284ec389207af5759

File Explorer

bd5acbbfc5c2c8b284ec389207af5759

.exe 695KB

bd5acbbfc5c2c8b284ec389207af5759

IMPHASH 34a9ab58f1729530088ab6d5639a7282
SHA256 9b0f724459637cec5e9576c8332bca16abda6ac3fbbde6f7956bc3a97a423473
MD5 bd5acbbfc5c2c8b284ec389207af5759
SHA1 c71b6cd6a46494e9132da20a6bacfe0b870a460e
SHA512 833d0783e508b9f995734753fba4e7b546c8756b07c79cd962a448ac76e90ba9c07954f9387d49d64571b664bc9265265961ffb15c48d7285b529a238c959b33
SSDEEP 12288:XyYRp4jlsiiMfEyICdcaTTpZqLKdVlU1I7brdo40NzTDiTrSu0IOgeXfP5JzP:iYcjLiMfDICDTzGxMbrIDiTr50COfRJT
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Detects Meteor wiper
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

219868

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

WriteConsoleW HeapSize GetProcessHeap SetEndOfFile SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage HeapReAlloc SetFilePointerEx ReadConsoleW EnumSystemLocalesW GetUserDefaultLCID SetStdHandle SetErrorMode IsValidLocale GetCurrentProcess GetLastError GetConsoleWindow Sleep Process32First TerminateProcess WaitForSingleObject OpenProcess CreateToolhelp32Snapshot Process32Next ReadFile SetHandleInformation CreatePipe CreateProcessW GetExitCodeProcess CloseHandle GetComputerNameExW SetEvent ResetEvent CreateEventA CreateDirectoryW CreateFileW DeleteFileW FindClose FindFirstFileExW FindNextFileW GetFileAttributesExW GetFileInformationByHandle RemoveDirectoryW AreFileApisANSI SetLastError GetModuleHandleW GetProcAddress CopyFileW MultiByteToWideChar WideCharToMultiByte FormatMessageW EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection DeleteCriticalSection GetCurrentThreadId DuplicateHandle WaitForSingleObjectEx SwitchToThread GetCurrentThread GetExitCodeThread QueryPerformanceCounter GetStringTypeW InitializeCriticalSectionAndSpinCount CreateEventW TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime GetTickCount EncodePointer DecodePointer GetCPInfo CompareStringW LCMapStringW GetLocaleInfoW GetCurrentProcessId InitializeSListHead IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent CreateTimerQueue SignalObjectAndWait CreateThread SetThreadPriority GetThreadPriority GetLogicalProcessorInformation CreateTimerQueueTimer ChangeTimerQueueTimer DeleteTimerQueueTimer GetNumaHighestNodeNumber GetProcessAffinityMask SetThreadAffinityMask RegisterWaitForSingleObject UnregisterWait GetThreadTimes FreeLibrary FreeLibraryAndExitThread GetModuleFileNameW GetModuleHandleA LoadLibraryExW GetVersionExW VirtualAlloc VirtualProtect VirtualFree ReleaseSemaphore InterlockedPopEntrySList InterlockedPushEntrySList InterlockedFlushSList QueryDepthSList UnregisterWaitEx LoadLibraryW RtlUnwind RaiseException ExitThread GetModuleHandleExW GetStdHandle WriteFile ExitProcess GetCommandLineA GetCommandLineW GetFileType FlushFileBuffers GetConsoleCP GetConsoleMode HeapFree HeapAlloc

ws2_32

select __WSAFDIsSet socket WSAStartup getpeername WSACleanup WSASocketW closesocket sendto send connect recv getsockopt freeaddrinfo ioctlsocket getnameinfo setsockopt WSAGetLastError getaddrinfo

netapi32

NetApiBufferFree NetUserEnum NetUserSetInfo NetUnjoinDomain NetUserAdd NetLocalGroupAddMembers

iphlpapi

GetAdaptersAddresses

user32

SystemParametersInfoW ShowWindow

advapi32

RegSetValueExA OpenProcessToken RegGetValueA RegCreateKeyExA RegCloseKey InitiateSystemShutdownExW RegOpenKeyExA LookupPrivilegeValueW AdjustTokenPrivileges