Trojan[.]Ransom[.]Satana[.]zip | Triage

Sharing

General

Target

Trojan.Ransom.Satana.zip
Size

34KB
MD5

18881d488739f0fffa5f08c18d8a650d
SHA1

f1ad045b8d0a53c13cce1a18f1a2f59b5ca2dba9
SHA256

50716abdde2a383ed8c5da0c10d7c42e52a0d1c7b38878f1b130d08e13d5c5a5
SHA512

a0c303a37ad4dc56e938463003544bff50eddb8d13390d6890fe16a1d02b5e9f05a75cb5cf2cb0e6baad31514a025f7c07d8185f30facdff4051981524ecaf7c
SSDEEP

768:rZuS5bFDAovPXSyiIHcNNVt173snyUJNEbV33ARp:rZuS5jvPNih/H1738DQpQP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs
Checks for missing Authenticode signature.

Processes:

resource

unpack001/Trojan.Ransom.Satana

Files

Trojan.Ransom.Satana.zip
.zip

Password: withnothing
Trojan.Ransom.Satana
.exe windows:5 windows x86 arch:x86

Password: withnothing

a3bc0305643e7601d6deca72652f4ab5

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_ISOLATION
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

ntdll

vsprintf
memmove
NtYieldExecution
strchr
strncpy
_stricmp
memset

kernel32

GetLocalTime
OutputDebugStringA

user32

MessageBoxA

opengl32

glEnd
glEnable
glLineWidth
glPolygonMode
glColor3d
glBegin
glDisable
glClear
glPointSize
glLineStipple
glVertex3d

Sections

.text
Size: 8KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 38KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 930B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ