Behavioral task
behavioral1
Sample
a015646aab82bb4563fda68ec04d6a669ee42e78ce4caa2975e16b0c65d444c5.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
a015646aab82bb4563fda68ec04d6a669ee42e78ce4caa2975e16b0c65d444c5.dll
Resource
win10v2004-20240226-en
General
-
Target
572a47c923eec276d29dafa361b87b29.bin
-
Size
422KB
-
MD5
50fa0d4752cd0533ffa7bc7fea7f9ddf
-
SHA1
8966dee3d89cc6dccdb572d17e2e350ec848d0e6
-
SHA256
52793c206d7cbaf6ef58c02e96850235996c38cad9897c51b9d4adda1ec44ba5
-
SHA512
ac7dc15225ca8682bb4202fcdcefefd92df8f672251bdb8063e076ee0f3e3e0415a4c42b827d4d5050a2a3e77143fc6083c10582c0a380db99c03c64960cc9ab
-
SSDEEP
12288:1sQwu8k/inzmw6YaRt5MFAokqDrKU9xLWLG+ezoNDcDMLwuZ:1smb/Wzmw6YqGGokAeU9xUGcDNj
Malware Config
Signatures
-
Detect Socks5Systemz Payload 1 IoCs
resource yara_rule static1/unpack001/a015646aab82bb4563fda68ec04d6a669ee42e78ce4caa2975e16b0c65d444c5.dll family_socks5systemz -
Socks5systemz family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/a015646aab82bb4563fda68ec04d6a669ee42e78ce4caa2975e16b0c65d444c5.dll
Files
-
572a47c923eec276d29dafa361b87b29.bin.zip
Password: infected
-
a015646aab82bb4563fda68ec04d6a669ee42e78ce4caa2975e16b0c65d444c5.dll.dll windows:5 windows x86 arch:x86
Password: infected
eb9d6ffddd190d49eba975e74b68f8b0
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
wininet
InternetCloseHandle
InternetOpenA
InternetSetOptionA
InternetReadFile
InternetOpenUrlA
dnsapi
DnsFree
DnsQuery_A
kernel32
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetStartupInfoW
VirtualQuery
CreateFileA
lstrlen
TlsGetValue
SetWaitableTimer
InterlockedIncrement
GetQueuedCompletionStatus
InterlockedDecrement
QueryPerformanceCounter
InterlockedCompareExchange
SleepEx
WriteFile
InitializeCriticalSection
TlsSetValue
TerminateThread
InitializeCriticalSectionAndSpinCount
GetTickCount
GetProcessHeap
HeapAlloc
CreateEventA
GetCurrentProcess
HeapFree
WaitForSingleObject
SetEvent
Sleep
GetSystemTimeAsFileTime
LeaveCriticalSection
ReadFile
lstrcat
InterlockedExchange
GetLastError
SetLastError
GetProcAddress
QueueUserAPC
EnterCriticalSection
InterlockedExchangeAdd
LocalAlloc
PostQueuedCompletionStatus
WaitForMultipleObjects
GetModuleFileNameA
CreateIoCompletionPort
GetModuleHandleA
DeleteCriticalSection
GetVersionExA
TlsAlloc
CloseHandle
CreateWaitableTimerA
LocalFree
TlsFree
DeleteFileA
CreateThread
FreeLibrary
LoadLibraryA
DeviceIoControl
HeapSize
GetModuleHandleW
GetModuleFileNameW
SetEndOfFile
CreateFileW
ReadConsoleW
FlushFileBuffers
WriteConsoleW
SetStdHandle
HeapReAlloc
OutputDebugStringW
SetFilePointerEx
LCMapStringW
GetStdHandle
GetStringTypeW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetFileType
GetConsoleMode
GetConsoleCP
FormatMessageA
OpenEventA
ReleaseSemaphore
GetCurrentProcessId
GetCurrentThreadId
ResetEvent
ResumeThread
EncodePointer
DecodePointer
ExitThread
LoadLibraryExW
GetCommandLineA
RaiseException
RtlUnwind
IsDebuggerPresent
IsProcessorFeaturePresent
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
MultiByteToWideChar
ExitProcess
GetModuleHandleExW
AreFileApisANSI
WideCharToMultiByte
user32
wsprintfA
shell32
SHGetSpecialFolderPathA
ws2_32
ioctlsocket
WSAStringToAddressA
connect
inet_ntoa
WSAStartup
ntohl
inet_addr
ntohl
getaddrinfo
WSARecv
WSASend
select
ntohs
ntohs
getsockname
shutdown
setsockopt
WSACleanup
freeaddrinfo
WSASetLastError
closesocket
getsockopt
WSASocketA
WSAGetLastError
Sections
.text Size: 152KB - Virtual size: 152KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 48KB - Virtual size: 48KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 24KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 412KB - Virtual size: 412KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE