F:\locker_08_08_2011\Release\locker.pdb
Behavioral task
behavioral1
Sample
1.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
out.exe
Resource
win7-20240220-en
Behavioral task
behavioral3
Sample
2.exe
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
2004_akt.scr
Resource
win7-20240221-en
Behavioral task
behavioral5
Sample
3.exe
Resource
win7-20240221-en
General
-
Target
kys.rar
-
Size
1.4MB
-
MD5
fc8fccfa89094906cbd20f94794b89d4
-
SHA1
b39f772bf2f6c79d81d8631d944320d7021c5711
-
SHA256
98f0a95b821db0ee09af459cadefd860d332f635ea6021f148709fbbf78cc1bc
-
SHA512
4f55d493a8488b017907b8029d04f7778f6ca9b9ed472cd96aad812809eabe75bca63916a4decc3d6d863337dcbbe72b46c927975bfce8b485a2e5874b03febf
-
SSDEEP
24576:D+xsnXMlxw0Y6IOA1FTVeK0v3YLw+SHD+27pTEScwof3sqh3SY88nOKhR7AQtx:6GnXI/Y6IOEFTVjFw+SHa27pT7cHrSYr
Malware Config
Signatures
-
resource yara_rule static1/unpack001/1.exe upx static1/unpack001/3.exe upx -
Unsigned PE 5 IoCs
Checks for missing Authenticode signature.
resource unpack001/1.exe unpack002/out.upx unpack001/2.exe unpack001/2004_akt.scr unpack001/3.exe
Files
-
kys.rar.rar
-
1.exe.exe windows:4 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 216KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 280KB - Virtual size: 280KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
out.upx.exe windows:4 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Sections
.text Size: 105KB - Virtual size: 104KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 172KB - Virtual size: 324KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 32KB - Virtual size: 31KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
2.exe.exe windows:5 windows x86 arch:x86
a4532256d4940e3b78236677a0df71f4
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
GetWindowsDirectoryA
GetModuleFileNameA
CompareStringW
CompareStringA
LCMapStringW
LCMapStringA
GetStringTypeW
MultiByteToWideChar
GetStringTypeA
GetTimeZoneInformation
CopyFileA
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
GetFileType
SetHandleCount
GetEnvironmentStringsW
WideCharToMultiByte
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
lstrlenA
GetModuleHandleA
FindResourceA
LoadResource
SizeofResource
LockResource
GlobalAlloc
GlobalLock
GlobalUnlock
GetLocaleInfoA
MulDiv
InitializeCriticalSectionAndSpinCount
LoadLibraryA
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetStdHandle
WriteFile
InterlockedDecrement
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
GetLastError
GetModuleHandleW
Sleep
GetProcAddress
ExitProcess
GetLocalTime
RaiseException
RtlUnwind
GetCommandLineA
GetStartupInfoA
HeapCreate
VirtualFree
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
VirtualAlloc
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
SetEnvironmentVariableA
user32
CallNextHookEx
GetAsyncKeyState
PostMessageA
GetDC
GetWindowTextA
DefWindowProcA
EndPaint
ReleaseDC
FindWindowA
BeginPaint
SendMessageA
LoadStringA
LoadAcceleratorsA
GetMessageA
TranslateAcceleratorA
TranslateMessage
DispatchMessageA
SetWindowPos
SetWindowLongA
ShowWindow
SetTimer
SetWindowsHookExA
UpdateWindow
LoadIconA
LoadCursorA
RegisterClassExA
GetSystemMetrics
PostQuitMessage
CreateWindowExA
gdi32
SetTextColor
SetBkColor
GetStockObject
GetDeviceCaps
CreateFontA
advapi32
RegOpenKeyExA
RegCreateKeyExA
RegCloseKey
RegSetValueExA
ole32
CreateStreamOnHGlobal
oleaut32
OleLoadPicture
ws2_32
connect
WSAStartup
WSACleanup
closesocket
send
recv
inet_addr
htons
socket
Sections
.text Size: 43KB - Virtual size: 43KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 182KB - Virtual size: 181KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
2004_akt.scr.exe windows:5 windows x86 arch:x86
25d250bb0b37b2d256b9bd4682dcd668
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
LoadResource
LocalAlloc
LocalFree
LockResource
MapViewOfFile
MoveFileExW
MulDiv
MultiByteToWideChar
OpenEventW
OpenProcess
OutputDebugStringW
ProcessIdToSessionId
QueryInformationJobObject
QueryPerformanceCounter
QueryPerformanceFrequency
RaiseException
ReadProcessMemory
ReleaseMutex
RemoveDirectoryW
SearchPathW
SetConsoleCtrlHandler
SetEndOfFile
SetEnvironmentVariableA
SetFileAttributesW
SetFilePointer
SetHandleCount
SetLastError
SetStdHandle
SetThreadPriority
LoadLibraryW
SetVolumeLabelW
SizeofResource
Sleep
SystemTimeToTzSpecificLocalTime
TerminateProcess
TerminateThread
TlsFree
TlsGetValue
TlsSetValue
UnhandledExceptionFilter
UnmapViewOfFile
VerSetConditionMask
VerifyVersionInfoW
VirtualAllocEx
VirtualFreeEx
VirtualProtect
WaitForSingleObject
WideCharToMultiByte
WinExec
WriteConsoleA
WriteConsoleW
WriteFile
WritePrivateProfileStringW
WriteProcessMemory
lstrcmpW
lstrcmpiA
lstrcpyA
lstrlenA
lstrlenW
LoadLibraryExW
LoadLibraryA
LeaveCriticalSection
IsValidLocale
IsValidCodePage
IsBadWritePtr
IsBadReadPtr
InterlockedIncrement
InterlockedExchangeAdd
InterlockedExchange
InterlockedDecrement
InterlockedCompareExchange
InitializeCriticalSectionAndSpinCount
InitializeCriticalSection
HeapReAlloc
HeapFree
HeapDestroy
HeapCreate
HeapAlloc
GlobalUnlock
GlobalSize
GlobalLock
GlobalHandle
GlobalFree
GlobalFindAtomW
GlobalAlloc
GetWindowsDirectoryW
GetVolumePathNameW
GetVolumeInformationW
GetVersionExW
GetVersionExA
GetTimeZoneInformation
GetTickCount
GetThreadPriority
GetTempPathW
GetTempFileNameW
GetSystemTimeAsFileTime
GetSystemTime
GetSystemInfo
GetSystemDirectoryW
GetSystemDefaultLangID
GetStringTypeA
GetStdHandle
GetStartupInfoW
GetStartupInfoA
GetShortPathNameW
GetProcessHeap
GetProcAddress
GetOEMCP
GetModuleHandleW
GetModuleFileNameW
GetModuleFileNameA
GetLongPathNameW
GetLocaleInfoW
GetLocaleInfoA
GetLastError
GetFileType
GetFileSize
GetFileAttributesW
GetFileAttributesExW
GetExitCodeProcess
GetDriveTypeW
GetDiskFreeSpaceW
GetCurrentThreadId
GetCurrentThread
GetCurrentProcessId
GetCurrentProcess
GetConsoleOutputCP
GetConsoleMode
GetConsoleCP
GetComputerNameW
GetCommandLineW
GetACP
FreeResource
FreeLibrary
FormatMessageW
FlushInstructionCache
FlushFileBuffers
FindResourceA
FindFirstFileW
FindClose
FileTimeToSystemTime
FileTimeToLocalFileTime
FileTimeToDosDateTime
FatalAppExitA
ExpandEnvironmentStringsW
ExitProcess
EnumTimeFormatsA
EnumSystemLocalesA
EnumDateFormatsA
EnterCriticalSection
DeviceIoControl
DeleteFileW
DeleteFileA
DeleteCriticalSection
CreateThread
CreateProcessW
CreateProcessA
CreateMutexW
CreateJobObjectW
CreateFileW
CreateFileMappingW
CreateEventW
CreateDirectoryW
CopyFileW
CompareStringW
CompareStringA
CloseHandle
AssignProcessToJobObject
VirtualAlloc
SetUnhandledExceptionFilter
GetModuleHandleA
user32
SetWindowTextA
SetWindowsHookExW
ShowWindow
SystemParametersInfoW
TrackPopupMenu
TranslateMessage
UnhookWindowsHookEx
UpdateLayeredWindow
UpdateWindow
WaitForInputIdle
wsprintfA
SetWindowRgn
SetWindowPos
SetWindowLongW
SetWindowLongA
SetTimer
SetScrollInfo
SetPropW
SetForegroundWindow
SetFocus
SetClassLongW
SendMessageW
SendMessageA
ScreenToClient
RemovePropW
RemoveMenu
ReleaseDC
RegisterClipboardFormatW
RegisterClassA
RedrawWindow
PtInRect
PostQuitMessage
PostMessageW
PostMessageA
PeekMessageW
OpenDesktopA
OemToCharA
MoveWindow
MessageBoxW
MessageBoxA
MessageBeep
MapWindowPoints
LockWindowUpdate
LoadStringW
LoadStringA
LoadMenuA
LoadCursorW
LoadCursorA
KillTimer
IsWindowVisible
IsWindowEnabled
IsWindow
IsIconic
IsDialogMessageA
IsCharUpperW
IsCharUpperA
IsCharAlphaA
InvalidateRect
IntersectRect
InflateRect
HideCaret
GetWindowThreadProcessId
GetWindowTextW
GetWindowTextA
GetWindowRect
GetWindowPlacement
GetWindowLongW
GetWindowLongA
GetWindowDC
GetWindow
GetSystemMetrics
GetSysColorBrush
GetSysColor
GetSubMenu
GetScrollRange
GetScrollPos
GetScrollInfo
GetScrollBarInfo
GetMessageA
GetMenuState
GetIconInfo
GetForegroundWindow
GetDlgItemTextA
GetDC
GetCursorPos
GetCursor
GetClipboardData
GetClientRect
GetClassNameW
GetClassNameA
GetCapture
GetActiveWindow
FrameRect
FindWindowW
FindWindowExW
FillRect
ExitWindowsEx
EqualRect
EnumWindows
EndPaint
EnableWindow
EnableMenuItem
DrawTextW
DrawFrameControl
DispatchMessageW
DispatchMessageA
DestroyWindow
DestroyMenu
DestroyIcon
DefWindowProcW
DefWindowProcA
CreateWindowExA
ClientToScreen
CheckMenuItem
CharUpperW
CharUpperA
CharToOemA
CallWindowProcW
CallWindowProcA
CallNextHookEx
BringWindowToTop
BeginPaint
AttachThreadInput
CharNextA
GetWindowTextLengthA
GetMessageExtraInfo
CharLowerA
GetAsyncKeyState
ReleaseCapture
PaintDesktop
OemKeyScan
InSendMessage
GetTopWindow
GetCaretBlinkTime
GetKeyState
CloseDesktop
CharLowerW
GetWindowContextHelpId
ShowCaret
DestroyCursor
GetDialogBaseUnits
VkKeyScanA
LoadIconA
GetClassLongW
gdi32
StretchDIBits
StretchBlt
SetViewportOrgEx
SetTextColor
SetStretchBltMode
SetBkMode
CreatePen
SetBkColor
SelectPalette
SelectObject
SelectClipRgn
SaveDC
RestoreDC
ResizePalette
Rectangle
RealizePalette
Polyline
MaskBlt
IntersectClipRect
GetViewportOrgEx
GetTextMetricsW
GetTextMetricsA
GetStockObject
GetPaletteEntries
GetObjectW
GetObjectType
GetNearestPaletteIndex
GetDeviceCaps
GetDIBits
GetDIBColorTable
GetCurrentObject
CreatePalette
CreateHalftonePalette
CreateFontW
CreateFontIndirectW
CreateDIBSection
CreateCompatibleDC
CreateCompatibleBitmap
CreateBitmap
BitBlt
BeginPath
GetEnhMetaFileA
CreateSolidBrush
DeleteDC
GetSystemPaletteUse
GetClipBox
GdiFlush
FillPath
ExtTextOutW
ExcludeClipRect
EndPath
DeleteObject
CreateRoundRectRgn
CreateMetaFileW
PathToRegion
GetGraphicsMode
CreateMetaFileA
UpdateColors
EndDoc
DeleteColorSpace
CreateRectRgn
advapi32
GetLengthSid
CopySid
ControlService
CloseServiceHandle
CheckTokenMembership
AllocateAndInitializeSid
AdjustTokenPrivileges
AddAccessAllowedAce
RegQueryValueExW
SetSecurityDescriptorDacl
RevertToSelf
RegSetValueExW
RegSetValueExA
RegQueryValueExA
RegOpenKeyExW
RegOpenKeyExA
RegNotifyChangeKeyValue
RegEnumValueW
RegEnumValueA
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
RegCreateKeyExA
RegCloseKey
OpenServiceW
OpenSCManagerW
OpenProcessToken
LookupPrivilegeValueW
LookupAccountSidW
IsValidSid
InitializeSecurityDescriptor
InitializeAcl
ImpersonateLoggedOnUser
GetUserNameW
GetUserNameA
GetTokenInformation
RegOpenKeyW
FreeSid
DuplicateTokenEx
DeleteService
shell32
ShellExecuteW
ShellExecuteExW
SHGetSpecialFolderPathW
SHGetPathFromIDListW
SHGetFileInfoW
SHGetDesktopFolder
SHFileOperationW
SHBrowseForFolderW
ord680
ExtractIconExW
DragQueryFileW
DragFinish
DragAcceptFiles
ole32
CLSIDFromProgID
CoCreateInstance
CoFreeUnusedLibraries
CoGetMalloc
CoInitialize
CoInitializeEx
CoRegisterClassObject
CoRevokeClassObject
CoTaskMemAlloc
CoTaskMemFree
CoTaskMemRealloc
CoUninitialize
CreateStreamOnHGlobal
StgCreateDocfile
StgOpenStorage
shlwapi
StrRChrW
StrChrW
PathStripToRootW
PathIsUNCW
PathIsRootW
PathIsRelativeW
comctl32
_TrackMouseEvent
InitCommonControlsEx
ImageList_LoadImageW
ImageList_GetIcon
ImageList_Draw
ImageList_Destroy
ImageList_AddMasked
CreateToolbarEx
msvcrt
_stricmp
wcsncmp
wcsncat
wcslen
wcscpy
wcscmp
wcschr
wcscat
toupper
tolower
strstr
strncpy
strncmp
strlen
strcpy
strcat
_EH_prolog
_XcptFilter
__CxxFrameHandler
__dllonexit
__getmainargs
__p__commode
__p__fmode
__set_app_type
__setusermatherr
__wgetmainargs
_acmdln
_adjust_fdiv
_amsg_exit
_cexit
_controlfp
_except_handler3
_exit
_gcvt
_initterm
_lock
_onexit
_purecall
_strcmpi
_unlock
_vsnwprintf
_wcmdln
_wcsicmp
_wcsnicmp
_wstrdate
atoi
atol
bsearch
calloc
exit
free
isspace
iswalpha
iswspace
iswupper
malloc
memcmp
memcpy
memmove
memset
qsort
realloc
Sections
.text Size: 1.2MB - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 14KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 540B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 27KB - Virtual size: 691KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
3.exe.exe windows:4 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 80KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 202KB - Virtual size: 204KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE