lobshot | ae221670729038f92398b7fe4e08928ea6ebc0c1d006c63c8a3bac2e30770c2b

Sharing

Copy URL Twitter E-mail

General

Target
ae221670729038f92398b7fe4e08928ea6ebc0c1d006c63c8a3bac2e30770c2b
Size 94KB
Sample240319-xp7knacc97
SHA256 ae221670729038f92398b7fe4e08928ea6ebc0c1d006c63c8a3bac2e30770c2b
MD5 93fd11cf69ac4f2b596f4e51a561b7b0
SHA1 077e1d02b17f023a13e64b43d9b19764705e3e8d
SHA512 4d870ba8af1617982c5f0e9cbd2da6fa5b0f109b8cd9ef2e6f7fcefacd4e44a13a018e2d1733798e59d2bbe62d337c121eef3408efb315252eed729dd1cb6372
SSDEEP 1536:QNDrcwsIe38pzMX4Zm3QVd4lrYKIgInPv2Pvl/XNas2fRBW5nrJrc:QNDrpArCcQVd46bnPvuozrW5nrJo
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

lobshot

Malware Config

Signatures

Detects Lobshot family 1 IoCs

resource	yara_rule
sample	family_lobshot

Lobshot family
lobshot

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ae221670729038f92398b7fe4e08928ea6ebc0c1d006c63c8a3bac2e30770c2b

File Explorer

ae221670729038f92398b7fe4e08928ea6ebc0c1d006c63c8a3bac2e30770c2b

.exe 94KB

ae221670729038f92398b7fe4e08928ea6ebc0c1d006c63c8a3bac2e30770c2b

IMPHASH ecaf0cd424d956a22ecbd7780629e688
SHA256 ae221670729038f92398b7fe4e08928ea6ebc0c1d006c63c8a3bac2e30770c2b
MD5 93fd11cf69ac4f2b596f4e51a561b7b0
SHA1 077e1d02b17f023a13e64b43d9b19764705e3e8d
SHA512 4d870ba8af1617982c5f0e9cbd2da6fa5b0f109b8cd9ef2e6f7fcefacd4e44a13a018e2d1733798e59d2bbe62d337c121eef3408efb315252eed729dd1cb6372
SSDEEP 1536:QNDrcwsIe38pzMX4Zm3QVd4lrYKIgInPv2Pvl/XNas2fRBW5nrJrc:QNDrpArCcQVd46bnPvuozrW5nrJo
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Detects Lobshot family
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

16272

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetPrivateProfileSectionNamesW ResumeThread GetPrivateProfileStringW Sleep lstrcpyA MoveFileExW GetCurrentProcessId CreateProcessA TerminateJobObject lstrcmpiW GetTickCount GetCommandLineW GetCurrentProcess TerminateProcess lstrcmpA SetFileAttributesW ExitProcess lstrcmpW SetErrorMode ExitThread SetUnhandledExceptionFilter FindFirstFileW FindNextFileW ExpandEnvironmentStringsW FindClose TerminateThread GetWindowsDirectoryW CreateJobObjectW GetVersionExW WaitForMultipleObjects EnterCriticalSection lstrcpynW LeaveCriticalSection InitializeCriticalSection DeleteCriticalSection GetModuleFileNameW GetEnvironmentVariableA UnmapViewOfFile OpenProcess CreateToolhelp32Snapshot Process32NextW Process32FirstW CreateFileMappingA SetEnvironmentVariableA GetEnvironmentVariableW GetCurrentThreadId ProcessIdToSessionId GetTickCount64 WTSGetActiveConsoleSessionId AssignProcessToJobObject GetPrivateProfileIntW WritePrivateProfileStringW CreateDirectoryW lstrcmpiA GlobalUnlock GetTempFileNameW lstrcpyW CopyFileW CreateProcessW GetFileSize LocalFree GlobalLock GetProcAddress CreateThread CloseHandle DeleteFileW GlobalAlloc lstrcatW LoadLibraryA GetLastError FormatMessageW GetModuleHandleA lstrcatA GetFileAttributesW CreateFileW LocalAlloc WaitForSingleObject lstrlenA SetFilePointer VirtualAlloc WriteFile lstrlenW VirtualFree MoveFileW ReadFile

user32

GetUserObjectInformationW GetThreadDesktop MonitorFromWindow ToAscii SetForegroundWindow PtInRect OpenDesktopW MenuItemFromPoint HiliteMenuItem ActivateKeyboardLayout PrintWindow BringWindowToTop GetTopWindow CreateDesktopW SetWindowLongA VkKeyScanExA GetKeyboardState GetMenuItemCount SetActiveWindow SetWindowPos GetDC GetMenu GetWindow IsClipboardFormatAvailable GetDesktopWindow GetProcessWindowStation GetKeyboardLayoutList PostMessageW GetWindowRect SendMessageTimeoutW SendMessageTimeoutA ScreenToClient WindowFromPoint GetWindowPlacement IsWindow CloseDesktop GetKeyboardLayout MoveWindow SetFocus LoadKeyboardLayoutA SystemParametersInfoA GetParent IsWindowVisible SetThreadDesktop GetWindowLongA GetWindowTextW OemToCharA GetClassNameW CharLowerA GetWindowThreadProcessId FindWindowExW PostMessageA wsprintfA FindWindowW OpenClipboard wvsprintfW CloseClipboard EmptyClipboard wvsprintfA GetClipboardData SetClipboardData EnumDesktopWindows

gdi32

DeleteDC BitBlt CreateCompatibleBitmap SelectObject CreateCompatibleDC CreateDCA CreatePen Rectangle DeleteObject CreateSolidBrush GetDeviceCaps GetDIBits

advapi32

RegSetValueA GetSidSubAuthorityCount GetSidSubAuthority RegQueryValueExW RegDeleteValueA RegDeleteValueW RegOpenKeyExW RegOpenKeyExA RegSetValueExA RegSetValueExW RegQueryValueExA RegCloseKey RegQueryValueA RegEnumKeyA GetTokenInformation OpenProcessToken

shell32

ShellExecuteW SHGetFolderPathW