fenix atc.7z
- SHA256 4e24d3469f403d346aee8db502bcf8b774ab9558d1e00d1b1da869e15b6a72f6
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
fenix atc/ATCFenixTelco.exe
Resource
win10-20240404-es
windows10-1703-x64
1 signatures
1800 seconds
Behavioral task
behavioral2
Sample
fenix atc/FenixATCInstaller.exe
Resource
win10-20240404-es
windows10-1703-x64
15 signatures
1800 seconds
General
- Target fenix atc.7z
- Size 6.2MB
- Sample240404-vwtk9sdd6y
- SHA256 4e24d3469f403d346aee8db502bcf8b774ab9558d1e00d1b1da869e15b6a72f6
- MD5 30433bffb199021f552d1ed0bc0661a1
- SHA1 d58ba68ab0a566cdc7623034912f47f8a19767af
- SHA512 c49dd3f3fb4ee992e8c02e9837b95ca0fd2368d79227d9d345259168ec7711f6260ccbb77c0c41aabf06561134d6675ff1daf82423e525191cdc7592c8e73969
- SSDEEP 196608:NBPdhKBvVnMzndeO7vx9/CuGxa6SKvyMKLNY:b4VMzEO7yulVNL2
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/fenix atc/ATCFenixTelco.exe unpack001/fenix atc/FenixATCInstaller.exe
File Explorer
-
fenix atc.7z.7z 6.2MB
-
fenix atc/ATCFenixTelco.exe.exe 23.3MB
-
fenix atc/FenixATCInstaller.exe.exe 5.3MB
-
fenix atc/Leeme.txt219B
fenix atc/ATCFenixTelco.exe
- IMPHASH 4dbf67cc3bbffe41d599e20718ceb7f5
- SHA256 7fc25cb94282fe204e9b4366c55fe891518f3c805f75a082a47532dd9d1fa39b
- MD5 300b4b4fb907badd001e6cd0ec31e4a4
- SHA1 0ea8bc4fec51a116dc087820a426d58e1afe394d
- SHA512 561ecb69efa2155109b44fb3100d48e03bcbe6606246441b9dbeaaa8d9f936f5f22eddd25b4f5fb85f3dc151defa752c96a04c179d3d344509bd6f24e33cc53e
- SSDEEP 393216:0EBx9UTVJQhSbEqVGNipShvfdZdSlm7NDOQpzi2KOooHZyr8wcpZXlnvOqYJ56b4:rX9UTVJQhSbEqVGNEShvfdZdSlm7NDOb
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
159392
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
msvbvm60
EVENT_SINK_GetIDsOfNames
__vbaVarTstGt
__vbaVarSub
ord690
__vbaStrI2
__vbaNextEachAry
_CIcos
_adj_fptan
__vbaStrI4
__vbaVarMove
__vbaRedimPreserveVar
__vbaVarVargNofree
__vbaAryMove
__vbaFreeVar
ord588
__vbaStrVarMove
__vbaLateIdCall
__vbaLenBstr
__vbaEnd
__vbaFreeVarList
_adj_fdiv_m64
__vbaFpCDblR8
EVENT_SINK_Invoke
__vbaVarIndexStore
__vbaNextEachVar
__vbaRaiseEvent
__vbaFreeObjList
ord516
ord517
__vbaVarIndexLoadRef
__vbaStrErrVarCopy
_adj_fprem1
__vbaRecAnsiToUni
ord518
ord519
__vbaResume
__vbaForEachCollAd
__vbaVarCmpNe
__vbaStrCat
ord552
ord553
__vbaLsetFixstr
ord660
__vbaRecDestruct
__vbaStrDate
ord661
__vbaSetSystemError
ord662
__vbaHresultCheckObj
ord556
ord557
__vbaVargVarCopy
ord558
__vbaLenVar
_adj_fdiv_m32
ord666
__vbaVarTstLe
__vbaAryVar
Zombie_GetTypeInfo
__vbaVarCmpGe
__vbaAryDestruct
ord591
__vbaLateMemSt
__vbaVarIndexLoadRefLock
ord592
ord593
__vbaBoolStr
__vbaVarForInit
__vbaStrBool
__vbaForEachCollObj
__vbaExitProc
ord300
ord594
ord301
__vbaCyAdd
__vbaStrLike
__vbaOnError
__vbaObjSet
ord595
ord302
__vbaVargObj
ord596
_adj_fdiv_m16i
ord303
ord702
__vbaObjSetAddref
_adj_fdivr_m16i
ord304
__vbaVarIndexLoad
ord598
ord305
__vbaFpR4
ord306
__vbaStrFixstr
__vbaForEachCollVar
ord520
__vbaBoolVar
ord307
ord308
ord522
ord309
__vbaVargVar
__vbaVarTstLt
__vbaRefVarAry
__vbaBoolVarNull
__vbaFpR8
_CIsin
ord524
__vbaErase
ord631
__vbaVargVarMove
__vbaVarZero
ord525
__vbaNextEachCollObj
ord632
__vbaVarCmpGt
__vbaChkstk
__vbaCyVar
ord526
__vbaFileClose
EVENT_SINK_AddRef
ord527
__vbaVarAbs
__vbaGenerateBoundsError
ord528
ord529
__vbaExitEachColl
__vbaStrCmp
__vbaAryConstruct2
__vbaVarTstEq
__vbaDateR8
__vbaR4Str
ord560
__vbaNextEachCollVar
__vbaVarLikeVar
__vbaObjVar
__vbaI2I4
ord561
ord562
DllFunctionCall
__vbaVarLateMemSt
__vbaVarOr
__vbaCySub
__vbaCastObjVar
__vbaLbound
__vbaRedimPreserve
__vbaStrR4
_adj_fpatan
__vbaR4Var
__vbaLateIdCallLd
Zombie_GetTypeInfoCount
__vbaR8Cy
__vbaStrR8
__vbaRedim
__vbaRecUniToAnsi
EVENT_SINK_Release
__vbaNew
ord600
__vbaUI1I2
_CIsqrt
ord310
__vbaRedimVar
__vbaLateIdCallSt
__vbaVarAnd
__vbaObjIs
ord311
EVENT_SINK_QueryInterface
__vbaStrUI1
__vbaUI1I4
__vbaVarMul
__vbaExceptHandler
ord312
ord711
ord313
__vbaPrintFile
__vbaStrToUnicode
ord712
__vbaDateStr
ord606
_adj_fprem
_adj_fdivr_m64
ord714
__vbaFailedFriend
__vbaVarDiv
ord607
__vbaR8ErrVar
__vbaLateIdStAd
__vbaI2Str
ord608
ord531
ord716
__vbaVarCmpLe
__vbaFPException
ord717
__vbaInStrVar
ord319
__vbaUbound
__vbaStrVarVal
ord534
__vbaVarCat
__vbaCheckType
__vbaDateVar
__vbaI2Var
ord537
ord645
_CIlog
__vbaErrorOverflow
__vbaFileOpen
ord648
__vbaVarLateMemCallLdRf
__vbaR8Str
__vbaInStr
__vbaNew2
__vbaVarInt
_adj_fdiv_m32i
_adj_fdivr_m32i
__vbaVarSetObj
__vbaStrCopy
__vbaI4Str
ord681
__vbaVarCmpLt
__vbaFreeStrList
__vbaVarNot
ord576
_adj_fdivr_m32
__vbaPowerR8
__vbaR8Var
_adj_fdiv_r
ord685
ord100
__vbaVarTstNe
__vbaVarSetVar
__vbaI4Var
__vbaVarLateMemStAd
__vbaForEachAry
ord689
__vbaVarCmpEq
__vbaFpCy
ord610
__vbaAryLock
__vbaVarAdd
__vbaLateMemCall
ord320
__vbaStrComp
ord612
__vbaStrToAnsi
__vbaVarDup
ord321
ord613
__vbaVerifyVarObj
__vbaFpI2
__vbaVarTstGe
__vbaVarCopy
ord616
__vbaFpI4
__vbaUnkVar
__vbaVarLateMemCallLd
__vbaRecDestructAnsi
__vbaVarSetObjAddref
__vbaLateMemCallLd
ord617
__vbaR8IntI2
_CIatan
ord540
ord618
__vbaI2ErrVar
__vbaAryCopy
__vbaStrMove
__vbaCastObj
__vbaForEachVar
__vbaR8IntI4
__vbaStrVarCopy
ord619
ord542
ord543
ord650
_allmul
__vbaVarLateMemCallSt
ord544
__vbaLateIdSt
ord545
ord652
_CItan
ord546
__vbaNextEachCollAd
ord547
__vbaFPInt
__vbaAryUnlock
__vbaVarForNext
_CIexp
__vbaStrCy
__vbaRecAssign
__vbaI4ErrVar
__vbaFreeStr
__vbaFreeObj
ord581
Name
.text
Size
22.7MB
Virtual Size
22.6MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
104KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
660KB
Virtual Size
656KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=14, version=7299,
count=83, id=9, version=8041,
count=1, id=13, version=8169,
fenix atc/FenixATCInstaller.exe
- IMPHASH ac220fb01eeea4ecb84da554526c3e36
- SHA256 ba4da4c0e7257660436b8c4c49f8046c6d0fd5348a7d24f3cc7734b4dbb31f4d
- MD5 423ce463869b85b1581e26a3535d3377
- SHA1 8ad5f7430cf4b2f0a9755af8cd111f7ac9a76711
- SHA512 598136d28ceb6002ebb2dae2b1b9f4edc53f60ce24f0806d3ed15b61d48ce606936b869241730b16e6643787e25dfcb932abca8005d8db449587ddd5b0014c4b
- SSDEEP 98304:gmbEM8+51vYLB0VhaA8dhakIneoXggn/JWxog7bWgq5t63XCoBj0F:zn/drXg4JqWgkt6ioBj0F
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
855401
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\Branch\win\Release\stubs\x86\ExternalUi.pdb
kernel32
CreateFileW
CloseHandle
WriteFile
DeleteFileW
GetLastError
SizeofResource
LockResource
LoadResource
FindResourceW
FindResourceExW
HeapDestroy
HeapSize
HeapReAlloc
HeapFree
HeapAlloc
GetProcessHeap
InterlockedDecrement
InterlockedIncrement
EnterCriticalSection
LeaveCriticalSection
GetModuleFileNameW
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
GetCurrentThreadId
RaiseException
SetLastError
GlobalUnlock
GlobalLock
GlobalAlloc
MulDiv
lstrcmpW
CreateEventW
SetEvent
InitializeCriticalSection
lstrcpynW
WaitForSingleObject
CreateThread
GetProcAddress
LoadLibraryExW
DecodePointer
Sleep
GetDiskFreeSpaceExW
GetExitCodeThread
GetCurrentProcessId
CreateDirectoryW
GetSystemDirectoryW
FreeLibrary
lstrlenW
GetVersionExW
lstrcmpiW
GetModuleHandleW
LoadLibraryW
GetDriveTypeW
CompareStringW
GetTempPathW
GetSystemTime
SystemTimeToFileTime
GetTempFileNameW
FindFirstFileW
RemoveDirectoryW
FindNextFileW
GetLogicalDriveStringsW
GetFileSize
GetFileAttributesW
SetFileAttributesW
GetFileTime
CopyFileW
ReadFile
FindClose
MultiByteToWideChar
WideCharToMultiByte
InterlockedExchange
GetCurrentProcess
GetSystemInfo
WaitForMultipleObjects
WriteConsoleW
VirtualProtect
VirtualQuery
LoadLibraryExA
GetShortPathNameW
GetStringTypeW
SetUnhandledExceptionFilter
FormatMessageW
GetEnvironmentVariableW
LocalFree
LoadLibraryA
GetModuleFileNameA
GetFullPathNameW
GetCurrentThread
SetConsoleTextAttribute
GetStdHandle
GetConsoleScreenBufferInfo
SetFilePointer
FlushFileBuffers
OutputDebugStringW
CreateProcessW
GetExitCodeProcess
GetCommandLineW
SetCurrentDirectoryW
SetEndOfFile
EnumResourceLanguagesW
GetLocaleInfoW
GetSystemDefaultLangID
GetUserDefaultLangID
GetWindowsDirectoryW
FileTimeToSystemTime
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
ResetEvent
MoveFileW
GlobalFree
GetPrivateProfileStringW
GetPrivateProfileSectionNamesW
WritePrivateProfileStringW
GetLocalTime
CreateNamedPipeW
ConnectNamedPipe
TerminateThread
LocalAlloc
CompareFileTime
CopyFileExW
OpenEventW
PeekNamedPipe
IsDebuggerPresent
EncodePointer
InitializeSListHead
InterlockedPopEntrySList
InterlockedPushEntrySList
FlushInstructionCache
IsProcessorFeaturePresent
VirtualAlloc
VirtualFree
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetCPInfo
LCMapStringW
WaitForSingleObjectEx
UnhandledExceptionFilter
TerminateProcess
GetStartupInfoW
QueryPerformanceCounter
RtlUnwind
QueryPerformanceFrequency
GetACP
ExitProcess
GetModuleHandleExW
GetFileType
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetConsoleCP
GetConsoleMode
IsValidCodePage
GetOEMCP
SetFilePointerEx
FindFirstFileExW
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetStdHandle
ReadConsoleW
Name
.text
Size
1.1MB
Virtual Size
1.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
337KB
Virtual Size
336KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
9KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
71KB
Virtual Size
70KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
83KB
Virtual Size
82KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=15, id=241, version=40116,
count=164, id=243, version=40116,
count=31, id=242, version=40116,
count=24, id=259, version=25305,
count=36, id=260, version=25305,
count=79, id=261, version=25305,
count=4, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=674, id=1, productName=Unmarked objects,
count=284, id=265, version=25547,
count=1, id=255, productName=VS2017 v15.4.5 build 25547, version=25547,
count=1, id=151,
count=1, id=258, productName=VS2017 v15.4.5 build 25547, version=25547,
fenix atc/Leeme.txt
- SHA256 cbf6d9f0f19227791bb1bb931415429ed888e0d452a3c9e595a313a01831f4ec
- MD5 c9f413af492ad0792abf345e7c437f24
- SHA1 e673b913fc46c27d43d7e0efce72fefd40c75751
- SHA512 5b95e128b7711e9cee4681b1d243b1189d6a7f236fe98ca9e36bdb3ef4dd041bbb9bb564e9ea4a05d30467fdea714161dc19937bfa0f3f18c3cc2a2149aeef56
- MD5 SHA1 SHA512