SecuriteInfo[.]com[.]Trojan[.]MulDrop21[.]49737[.]27111[.]4063 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

SecuriteInfo.com.Trojan.MulDrop21.49737.27111.4063
Size

1.4MB
MD5

be4a08fd694ea3e090f8dbf7937577a5
SHA1

e28dce3810cb9e2835159a9718fd2f78422d03dc
SHA256

bbe03529b28557142c18ab676bbcf5c60d6609a641d09695096c61175688c064
SHA512

f43cb1e51c61d8d9d4237638ae314524f413743cba4094b063327069ede920972b9ea3d26bc8bd967eacf744feddfb7be25b26a05da0ce69c7be91ae7ec8c626
SSDEEP

24576:XRAAEPCgM97GH/GgqHnXPrRXtVRx7V/n3zrDw/xYcCtZGPz+vhmOHV9GFTO:XxEKgM97IAHfd9B5jXw/GtZGr+vQOHV

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
SecuriteInfo.com.Trojan.MulDrop21.49737.27111.4063

Files

SecuriteInfo.com.Trojan.MulDrop21.49737.27111.4063
.exe windows:6 windows x64 arch:x64

6f3e24da2e63007773c2390ce08bcd4d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

GetModuleHandleA
GetProcAddress

shell32

ShellExecuteW

advapi32

CryptGenRandom

ws2_32

bind

iphlpapi

GetAdaptersAddresses

user32

ShowWindow

Exports

Exports

NvOptimusEnablementCuda

Sections

.MPRESS1
Size: 1.4MB - Virtual size: 6.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.MPRESS2
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE