Behavioral task
behavioral1
Sample
2024-03-18_7215848012df0c285b446b6014a25595_aspxspy_darkside_dns-tunnel_equationdrug_fiveeyes_hacktools_revil_sakula_x-agent.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-03-18_7215848012df0c285b446b6014a25595_aspxspy_darkside_dns-tunnel_equationdrug_fiveeyes_hacktools_revil_sakula_x-agent.exe
Resource
win10v2004-20240226-en
General
-
Target
2024-03-18_7215848012df0c285b446b6014a25595_aspxspy_darkside_dns-tunnel_equationdrug_fiveeyes_hacktools_revil_sakula_x-agent
-
Size
2.4MB
-
MD5
7215848012df0c285b446b6014a25595
-
SHA1
942f5bf033e98c45ea69bde02a548f488a6feb60
-
SHA256
8aa68bdee8ebfff590007d293823e3fbef23175cb6b53c65ee57cfc6e8817432
-
SHA512
731383786dd223896d676687fe0587b9d1f693ceed98842b4c2986aeecc94e6c6937eead8de39c6da2b36dbf5277ab3c070d18f88cb07f6feb87bf7cfaaf60f6
-
SSDEEP
49152:gHYtkQsTUthJ9sHjNJDE357TyjQg0APxAIfs/PQz/0jl:NtkQuUthbsekAIEN
Malware Config
Signatures
-
Detect Lumma Stealer payload V4 1 IoCs
resource yara_rule sample family_lumma_v4 -
Detects command variations typically used by ransomware 1 IoCs
resource yara_rule sample INDICATOR_SUSPICIOUS_GENRansomware -
Detects executables (downlaoders) containing URLs to raw contents of a paste 1 IoCs
resource yara_rule sample INDICATOR_SUSPICIOUS_EXE_RawPaste_URL -
Detects executables Discord URL observed in first stage droppers 1 IoCs
resource yara_rule sample INDICATOR_SUSPICIOUS_EXE_DiscordURL -
Detects executables packed with ConfuserEx Mod 1 IoCs
resource yara_rule sample INDICATOR_EXE_Packed_ConfuserEx -
Detects files referencing the transfer.sh file sharing website 1 IoCs
resource yara_rule sample INDICATOR_SUSPICIOUS_EXE_TransferSh_URL -
Lumma family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-03-18_7215848012df0c285b446b6014a25595_aspxspy_darkside_dns-tunnel_equationdrug_fiveeyes_hacktools_revil_sakula_x-agent
Files
-
2024-03-18_7215848012df0c285b446b6014a25595_aspxspy_darkside_dns-tunnel_equationdrug_fiveeyes_hacktools_revil_sakula_x-agent.exe windows:5 windows x86 arch:x86
6e9877b859ac48faff3c38f86948fa42
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetPrivateProfileIntW
GetModuleFileNameW
GetSystemDirectoryW
LoadLibraryW
CreateEventW
Sleep
GetFullPathNameW
GetVersionExW
GetModuleHandleW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
GetFileSize
WriteFile
ReadFile
FindClose
lstrcpyW
GetTempPathW
CreateFileW
GetFileAttributesW
DeleteFileW
FindFirstFileW
FindNextFileW
CopyFileW
MoveFileExW
GetTickCount
DecodePointer
HeapReAlloc
HeapSize
RaiseException
GetLastError
InitializeCriticalSectionAndSpinCount
MultiByteToWideChar
WideCharToMultiByte
GetLongPathNameW
GetEnvironmentVariableW
CreateDirectoryW
FileTimeToSystemTime
GetSystemInfo
ReleaseMutex
CreateMutexW
GetVolumeInformationW
GlobalAlloc
GlobalFree
WaitForSingleObject
GetExitCodeProcess
CreateProcessW
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
DeviceIoControl
OutputDebugStringA
SetPriorityClass
EncodePointer
RtlUnwind
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetStdHandle
GetACP
GetStringTypeW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetFileType
GetConsoleMode
ReadConsoleW
SetFilePointerEx
FindFirstFileExW
IsValidCodePage
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
SetConsoleCtrlHandler
OutputDebugStringW
SetStdHandle
GetConsoleCP
GetTimeZoneInformation
FlushFileBuffers
WriteConsoleW
SetEndOfFile
GetCurrentDirectoryW
FreeLibraryAndExitThread
ExitThread
SystemTimeToTzSpecificLocalTime
GetDriveTypeW
SystemTimeToFileTime
GetSystemTime
ReadConsoleA
SetConsoleMode
ConvertThreadToFiber
ConvertFiberToThread
CreateFiber
DeleteFiber
SwitchToFiber
VerifyVersionInfoA
GetSystemDirectoryA
GetModuleHandleA
VerSetConditionMask
ExpandEnvironmentStringsA
PeekNamedPipe
WaitForMultipleObjects
SetEvent
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
CreateThread
OpenFileMappingW
UnmapViewOfFile
FlushViewOfFile
MapViewOfFile
CloseHandle
IsBadReadPtr
LoadLibraryA
GetNativeSystemInfo
SetLastError
SleepEx
FormatMessageA
GetProcessHeap
HeapFree
HeapAlloc
VirtualProtect
VirtualFree
VirtualAlloc
GetProcAddress
FreeLibrary
WritePrivateProfileStringW
OpenProcess
GetPrivateProfileStringW
advapi32
ReportEventW
RegOpenKeyExW
DuplicateTokenEx
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
RegOpenKeyW
RegEnumKeyW
RegCreateKeyExW
RegQueryValueExW
OpenProcessToken
ImpersonateLoggedOnUser
RevertToSelf
CryptAcquireContextW
CryptReleaseContext
CryptGenRandom
DeregisterEventSource
RegisterEventSourceW
RegCloseKey
shell32
SHGetFolderPathW
SHGetSpecialFolderPathW
shlwapi
PathFileExistsW
PathIsDirectoryW
user32
GetProcessWindowStation
wsprintfW
GetUserObjectInformationW
LoadStringW
MessageBoxW
ole32
CoUninitialize
CoCreateInstance
CoInitialize
wininet
InternetCloseHandle
InternetQueryOptionW
HttpQueryInfoW
InternetOpenW
InternetSetOptionW
InternetOpenUrlW
InternetReadFile
wldap32
ord143
ord46
ord211
ord60
ord50
ord41
ord22
ord26
ord27
ord32
ord33
ord35
ord79
ord30
ord200
ord301
ws2_32
WSACleanup
WSAGetLastError
__WSAFDIsSet
select
gethostname
ioctlsocket
listen
accept
sendto
recvfrom
freeaddrinfo
getaddrinfo
WSAIoctl
socket
setsockopt
ntohs
htons
getsockopt
getsockname
getpeername
connect
closesocket
WSAStartup
send
recv
WSASetLastError
bind
Sections
.text Size: 1.6MB - Virtual size: 1.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 526KB - Virtual size: 525KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 20KB - Virtual size: 44KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gfids Size: 512B - Virtual size: 432B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 9B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 160KB - Virtual size: 160KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 77KB - Virtual size: 77KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ