lact.zip
- SHA256 2f3dd9fe96b27664d4ac558c6c538f59a04db5a3f7d1923b83473b5f7603d187
Overview
overview
10Static
static
10lact/1364-...ed.dll
windows7-x64
1lact/1364-...ed.dll
windows10-2004-x64
10lact/1636-...ed.dll
windows7-x64
1lact/1636-...ed.dll
windows10-2004-x64
10lact/1684-...ed.dll
windows7-x64
1lact/1684-...ed.dll
windows10-2004-x64
10lact/1944-...ed.dll
windows7-x64
1lact/1944-...ed.dll
windows10-2004-x64
10lact/2092-...ry.dll
windows7-x64
1lact/2092-...ry.dll
windows10-2004-x64
1lact/2100-...ed.dll
windows7-x64
1lact/2100-...ed.dll
windows10-2004-x64
10lact/2324-...ed.dll
windows7-x64
1lact/2324-...ed.dll
windows10-2004-x64
10lact/2956-...ed.dll
windows7-x64
1lact/2956-...ed.dll
windows10-2004-x64
10Behavioral task
behavioral1
Sample
lact/1364-1-0x0000020751220000-0x0000020751234000-memory_unmapped.dll
Resource
win7-20240221-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
lact/1364-1-0x0000020751220000-0x0000020751234000-memory_unmapped.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral3
Sample
lact/1636-0-0x00000000003A0000-0x00000000003B3000-memory_unmapped.dll
Resource
win7-20240221-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral4
Sample
lact/1636-0-0x00000000003A0000-0x00000000003B3000-memory_unmapped.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral5
Sample
lact/1684-0-0x0000000001D20000-0x0000000001D34000-memory_unmapped.dll
Resource
win7-20240221-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral6
Sample
lact/1684-0-0x0000000001D20000-0x0000000001D34000-memory_unmapped.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral7
Sample
lact/1944-1-0x000001FE0BA80000-0x000001FE0BA93000-memory_unmapped.dll
Resource
win7-20240319-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral8
Sample
lact/1944-1-0x000001FE0BA80000-0x000001FE0BA93000-memory_unmapped.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral9
Sample
lact/2092-0-0x0000000000150000-0x0000000000163000-memory.dll
Resource
win7-20240221-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral10
Sample
lact/2092-0-0x0000000000150000-0x0000000000163000-memory.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral11
Sample
lact/2100-2-0x00000000003A0000-0x00000000003B3000-memory_unmapped.dll
Resource
win7-20240221-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral12
Sample
lact/2100-2-0x00000000003A0000-0x00000000003B3000-memory_unmapped.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral13
Sample
lact/2324-0-0x0000000000130000-0x0000000000144000-memory_unmapped.dll
Resource
win7-20240220-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral14
Sample
lact/2324-0-0x0000000000130000-0x0000000000144000-memory_unmapped.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral15
Sample
lact/2956-0-0x0000000001B60000-0x0000000001B74000-memory_unmapped.dll
Resource
win7-20240221-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral16
Sample
lact/2956-0-0x0000000001B60000-0x0000000001B74000-memory_unmapped.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
8 signatures
150 seconds
General
- Target lact.zip
- Size 617KB
- Sample240408-aj39qaba64
- SHA256 2f3dd9fe96b27664d4ac558c6c538f59a04db5a3f7d1923b83473b5f7603d187
- MD5 32d69bb674f227a955330418eaa3e1f8
- SHA1 0611088598e651977926606cfa90649e9934c241
- SHA512 5d961464fba8f815cd59265fffff623a0e86699c9d41f52e4415d7ea68021834f11e4b512f18c250ccd6ed625c03c8b460ef15c7c74c3df009b0e47cfbd68bba
- SSDEEP 12288:8HmycLEK72WDEiSx1oXtOkQbufc81N6W3svWN8wSdDG/NzMUrrP:NycJ9Sx1o9X1NKw4G/NzB/
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Extracted
Family
-
latrodectus
C2
-
https://titnovacrion.top/live/
-
https://grunzalom.fun/live/
-
https://plwskoret.top/live/
-
https://miistoria.com/live/
-
https://aytobusesre.com/live/
-
https://scifimond.com/live/
-
https://mazdakrichest.com/live/
-
https://riverhasus.com/live/
-
https://fluraresto.me/live/
-
https://mastralakkot.live/live/
-
https://peermangoz.me/live/
-
https://aprettopizza.world/live/
-
https://drifajizo.fun/live/
-
https://zumkoshapsret.com/live/
-
https://jertacco.com/live/
Signatures
- Detect larodectus Loader variant 1 4 IoCs
resource yara_rule static1/unpack001/lact/1636-0-0x00000000003A0000-0x00000000003B3000-memory_unmapped.dmp family_latrodectus_v1 static1/unpack001/lact/1944-1-0x000001FE0BA80000-0x000001FE0BA93000-memory_unmapped.dmp family_latrodectus_v1 static1/unpack001/lact/2092-0-0x0000000000150000-0x0000000000163000-memory.dmp family_latrodectus_v1 static1/unpack001/lact/2100-2-0x00000000003A0000-0x00000000003B3000-memory_unmapped.dmp family_latrodectus_v1 - Detect larodectus Loader variant 2 4 IoCs
resource yara_rule static1/unpack001/lact/1364-1-0x0000020751220000-0x0000020751234000-memory_unmapped.dmp family_latrodectus_v2 static1/unpack001/lact/1684-0-0x0000000001D20000-0x0000000001D34000-memory_unmapped.dmp family_latrodectus_v2 static1/unpack001/lact/2324-0-0x0000000000130000-0x0000000000144000-memory_unmapped.dmp family_latrodectus_v2 static1/unpack001/lact/2956-0-0x0000000001B60000-0x0000000001B74000-memory_unmapped.dmp family_latrodectus_v2 - Latrodectus family
- Unsigned PE 8 IoCs
Checks for missing Authenticode signature.
resource unpack001/lact/1364-1-0x0000020751220000-0x0000020751234000-memory_unmapped.dmp unpack001/lact/1636-0-0x00000000003A0000-0x00000000003B3000-memory_unmapped.dmp unpack001/lact/1684-0-0x0000000001D20000-0x0000000001D34000-memory_unmapped.dmp unpack001/lact/1944-1-0x000001FE0BA80000-0x000001FE0BA93000-memory_unmapped.dmp unpack001/lact/2092-0-0x0000000000150000-0x0000000000163000-memory.dmp unpack001/lact/2100-2-0x00000000003A0000-0x00000000003B3000-memory_unmapped.dmp unpack001/lact/2324-0-0x0000000000130000-0x0000000000144000-memory_unmapped.dmp unpack001/lact/2956-0-0x0000000001B60000-0x0000000001B74000-memory_unmapped.dmp
File Explorer
-
lact.zip.zip 617KB
-
lact/1364-1-0x0000020751220000-0x0000020751234000-memory_unmapped.dmp.dll 80KB
-
lact/1636-0-0x00000000003A0000-0x00000000003B3000-memory_unmapped.dmp.dll 76KB
-
lact/1636-0-0x00000000003A0000-0x00000000003B3000-memory_unmapped.dmp.i64932KB
-
lact/1636-0-0x00000000003A0000-0x00000000003B3000-memory_unmapped.dmp.id0680KB
-
lact/1636-0-0x00000000003A0000-0x00000000003B3000-memory_unmapped.dmp.id1232KB
-
lact/1636-0-0x00000000003A0000-0x00000000003B3000-memory_unmapped.dmp.id23KB
-
lact/1636-0-0x00000000003A0000-0x00000000003B3000-memory_unmapped.dmp.nam16KB
-
lact/1636-0-0x00000000003A0000-0x00000000003B3000-memory_unmapped.dmp.til669B
-
lact/1684-0-0x0000000001D20000-0x0000000001D34000-memory_unmapped.dmp.dll 80KB
-
lact/1944-1-0x000001FE0BA80000-0x000001FE0BA93000-memory_unmapped.dmp.dll 76KB
-
lact/2092-0-0x0000000000150000-0x0000000000163000-memory.dmp.dll 76KB
-
lact/2100-2-0x00000000003A0000-0x00000000003B3000-memory_unmapped.dmp.dll 76KB
-
lact/2324-0-0x0000000000130000-0x0000000000144000-memory_unmapped.dmp.dll 80KB
-
lact/2956-0-0x0000000001B60000-0x0000000001B74000-memory_unmapped.dmp.dll 80KB
lact/1364-1-0x0000020751220000-0x0000020751234000-memory_unmapped.dmp
- IMPHASH db7aeb75528663639689f852fd366243
- SHA256 5562c6ad5765792def276e009395a57a6bf841c87cddefb6f8e8d75b74076e83
- MD5 7a1a48e5526e096dad8a155bd009ea94
- SHA1 90c423f7af788937665fb7c28dc03468be15b064
- SHA512 dd7c9fd8b6bc84ffec49aac30c5d060ee34d05bee6a5b21ea90bcf1547d10f7cd2fc20bdf0efc4848ec2bd8d0cc448c332192e00bd2113c3f312124516c514e8
- SSDEEP 768:ai0IIO99dKJKbAoQVuyQw4n4mjlQmLvniWiMfDeDvf1v:WpO9CJKjQF4n4mjltqTMKD1
- MD5 SHA1 SHA512 SSDEEP
-
Detect larodectus Loader variant 2
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
15484
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
kernel32
PeekNamedPipe
GetLastError
CreateMutexW
user32
MessageBeep
MessageBoxA
extra
follower
run
scub
Name
.text
Size
49KB
Virtual Size
48KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
5KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=5, id=203, version=65501,
count=5, id=1, productName=Unmarked objects,
count=12, id=260, version=24247,
count=1, id=256, version=24247,
count=1, id=258, version=24247,
lact/1636-0-0x00000000003A0000-0x00000000003B3000-memory_unmapped.dmp
- IMPHASH db7aeb75528663639689f852fd366243
- SHA256 9e7fdc17150409d594eeed12705788fbc74b5c7f482a64d121395df781820f46
- MD5 7d3984674aec72426e2dcbd38539c54a
- SHA1 3548610228011247d1e2edc962219466cca9a1a9
- SHA512 4cfc28c58d4b30de125b43af0558ccdce07531c91c2fb3a405122736c1f429c3b9dd8d44899058eb4e7409cb1231ce82c104ee32b094de025cb40547099ca2b5
- SSDEEP 768:UiC/DyfvDF9JN137zub7+IJSuCMajTiAmPbjQL5Nhs1+igyX9MDy:7C/DivXBOJSuwjFmz0Lvhs13gyX9MG
- MD5 SHA1 SHA512 SSDEEP
-
Detect larodectus Loader variant 1
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
13532
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
kernel32
PeekNamedPipe
GetLastError
CreateMutexW
user32
MessageBeep
MessageBoxA
scab
Name
.text
Size
46KB
Virtual Size
45KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
5KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=5, id=203, version=65501,
count=5, id=1, productName=Unmarked objects,
count=12, id=260, version=24247,
count=1, id=256, version=24247,
count=1, id=258, version=24247,
lact/1636-0-0x00000000003A0000-0x00000000003B3000-memory_unmapped.dmp.i64
- SHA256 52a16095f72cb392dfcdfa85947c9f9d555f8ccc9edd3ae4d44cee4fb8392305
- MD5 3a3b2182b0ca2828b83e06256fd20fba
- SHA1 cdf3edd062e02232b4876ec3965aa40d5db9e3b3
- SHA512 39f0f0422236f0d2f68085f49bd0f875770a012d31b8180449bfb5ed1994c5297b01f95d1ff1c940b273290fb48edbd73a570c385b36eba27178eb97d352fc72
- SSDEEP 12288:nfkW2XMm8OGZ30PwmudVCVmCRz09cPLRJGYbPPOX:fkW2XMm8OGZ30PwmudMc
- MD5 SHA1 SHA512 SSDEEP
lact/1636-0-0x00000000003A0000-0x00000000003B3000-memory_unmapped.dmp.id0
- SHA256 d4fa09cd1ff479a7eb6c9b0f690ffbeeec5de31a4d4f08c600d6788adeb87945
- MD5 20b960d38cb4b2ca8ef766b0c8aea057
- SHA1 404788373a5f516cccc7d183f375b7e5b9fea90e
- SHA512 867be050ce703ef71eac5c0d5f45881d4573cc675c485b14d41e6c583643ec89e7e02e4bdc563045171874e0575f61be0499004c4c5fd7f370907076a3f96976
- SSDEEP 12288:hfkW2XMm8OGZ30PwmudVCVmCRz09cPLRJGYb1:BkW2XMm8OGZ30PwmudM3
- MD5 SHA1 SHA512 SSDEEP
lact/1636-0-0x00000000003A0000-0x00000000003B3000-memory_unmapped.dmp.id1
- SHA256 f223b5deaf81b407910b302280fbac963f9abf356439aa8b070d38eb2a6e54d3
- MD5 704c457285d78e320f7e2a0734b53e96
- SHA1 c45241aa148dd31022306aa2b0bb9d03f8320983
- SHA512 c663ec0d0fa436b8732c41008914d265f0d89a40173babc085ff5859502af77b7705d5e9f584b5fa3549672134a30c67c35bb40a8f74e69e29028d36113defa7
- SSDEEP 6144:ieFS53FWjSWmtAnypqQr1l98mjOog1WEPxNlv74kVmzBvUm473dr6iXkO33YXb6k:WPO
- MD5 SHA1 SHA512 SSDEEP
lact/1636-0-0x00000000003A0000-0x00000000003B3000-memory_unmapped.dmp.id2
- SHA256 05433dcd2f5ba92cb3222af4c3ed5f5e9bc60e7a48a3dcc8615afb2ef8159a32
- MD5 b147d3dea722c90c02d70a8ee4e96c60
- SHA1 5e09fd438a806d2c1e194369c7d4260a1b1aa532
- SHA512 f30343f373d53ce1ffb6d8b88f61704435234a7c32c3a78bbf411f71467d801fa398bf9e9eb298fa4d4294f08fb6d1077002816236a3f77a7a3a6b643e6c2233
- MD5 SHA1 SHA512
lact/1636-0-0x00000000003A0000-0x00000000003B3000-memory_unmapped.dmp.nam
- SHA256 5c6a6dde20d18699e249b43b6bdd94d708e4480cc0384e854490344f6e570984
- MD5 27591114de2d7d5a2cb72c5b6778fbea
- SHA1 0095177a97c4eb901ad05b35e4f2cb9574598863
- SHA512 49488ea039f83afce9e2dbab047b54944c725a409f958cf4d480dff1bda04586ce092932c3f6bfe3f3bfed119dc22c8dd796d723a71bad5bafe749735b481ef6
- SSDEEP 3:p+Xt/nfllnIXsXfdH/ldv/lUl3lcZSp3zt/jtlytul/El/Ml/7tOl/saE+l/OVlO:p+9Y3lco+k/M/k/7E/b7/OPc/bL/2P2
- MD5 SHA1 SHA512 SSDEEP
lact/1636-0-0x00000000003A0000-0x00000000003B3000-memory_unmapped.dmp.til
- SHA256 31f6d4b8dd99c76c07ad0e748b4c2a6e961df0f0e1cbc9f4181009413229c9ce
- MD5 189affbc7bb7ba11a79a89b3688988a2
- SHA1 4d401afb88a2efed3ebc93fdfdb4159644496ae2
- SHA512 ae9b36c0c53242572257d15659c279ec4068d177bb0582f519248dd5e2d188b6ec358a5ba0ec6a53089431e796d4c7c3a5b57f0203a519f210e784fd0752f149
- MD5 SHA1 SHA512
lact/1684-0-0x0000000001D20000-0x0000000001D34000-memory_unmapped.dmp
- IMPHASH db7aeb75528663639689f852fd366243
- SHA256 5edc39cbd89d3ba70a4737f823933af93f3c182134af8e34e0af9a316afaaca8
- MD5 3553028b63b5608c0aff42b067977b7e
- SHA1 fb1354c019ec345144e26aebfc3cf6f3a6a0a8d2
- SHA512 6f0d89dedd62cecc62b06ee21b818aa16706b40f3133aaba2967bef944299285056bc17f915a777468ad1cba455cc41f6d3e09850684b24996715097c77d05e9
- SSDEEP 768:0oWfTLO3B5YC0YbGuRPv87BZILqSdE8TWz7MUYqw8:UfO3ornBZdGSMNy
- MD5 SHA1 SHA512 SSDEEP
-
Detect larodectus Loader variant 2
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
15484
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
kernel32
PeekNamedPipe
GetLastError
CreateMutexW
user32
MessageBeep
MessageBoxA
extra
follower
run
scub
Name
.text
Size
48KB
Virtual Size
48KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
5KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=5, id=203, version=65501,
count=5, id=1, productName=Unmarked objects,
count=12, id=260, version=24247,
count=1, id=256, version=24247,
count=1, id=258, version=24247,
lact/1944-1-0x000001FE0BA80000-0x000001FE0BA93000-memory_unmapped.dmp
- IMPHASH db7aeb75528663639689f852fd366243
- SHA256 9fad77b6c9968ccf160a20fee17c3ea0d944e91eda9a3ea937027618e2f9e54e
- MD5 80a0b619884a185d0abdffda3918cb33
- SHA1 b2edde7d7cd7b01d9cec7644e45ec3246afda077
- SHA512 9f6e546060cab0de8450027f1a8d471d483f1e60bd13b3ed4224210abdbcce9e2d0c628617abca9eb0e5bf6a1a6b5682a47b419a0858bf4dcfb90ca45b92341d
- SSDEEP 768:8xO+qDlWGT9NVu48up+g5KFNhhlJwb9LfpwThs1GSy:8k+qD4Ud/5KFhrmVfOhs1GSy
- MD5 SHA1 SHA512 SSDEEP
-
Detect larodectus Loader variant 1
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
13532
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
kernel32
PeekNamedPipe
GetLastError
CreateMutexW
user32
MessageBeep
MessageBoxA
scab
Name
.text
Size
46KB
Virtual Size
45KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
5KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=5, id=203, version=65501,
count=5, id=1, productName=Unmarked objects,
count=12, id=260, version=24245,
count=1, id=256, version=24245,
count=1, id=258, version=24245,
lact/2092-0-0x0000000000150000-0x0000000000163000-memory.dmp
- SHA256 d855daede0b97277d68e04c73ef0f2a36690faa77539914aa7948ee045427042
- MD5 74db78c91de3e13c82182b06d0c82c75
- SHA1 22f86c8dc095698b9374e5956a871a20be5171cf
- SHA512 220ed7a6199ba7a61d3d2b830336a357787dcb37a2e38de07f55e16c0a76b31974905fadfe2733228cf1e6913e13d1c76419f6fdd8d040bc0d6ef6f22f471f8d
- SSDEEP 768:wiC/DyfvDF9JN1a7zub7+IJSuCMajTiAmPbjQLz5Hhs1WaaUbDy:3C/DivXAOJSuwjFmz0LZhs1ZbG
- MD5 SHA1 SHA512 SSDEEP
-
Detect larodectus Loader variant 1
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
13532
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
Name
.text
Size
46KB
Virtual Size
1.3MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1KB
Virtual Size
1.4MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
5KB
Virtual Size
1.4MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
2KB
Virtual Size
1.4MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
1.4MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=5, id=203, version=65501,
count=5, id=1, productName=Unmarked objects,
count=12, id=260, version=24247,
count=1, id=256, version=24247,
count=1, id=258, version=24247,
lact/2100-2-0x00000000003A0000-0x00000000003B3000-memory_unmapped.dmp
- IMPHASH db7aeb75528663639689f852fd366243
- SHA256 d8b902568386f588fb2d42a77cd39062ada13c9a3fed0adf20ab6510f3b4a681
- MD5 644a7a3e8ba5b6bad4e3e194bdd09e21
- SHA1 a4d12b22991572b5f01cd352f9ebe5d6738e1de6
- SHA512 0d4ee8bd838a3d3f6c5a9786b59b1f899df361e1334208489b534aac93f7d1f7804cfbb833f529175aa9385a7bf1cc36d5ba3daa65588770e6176e277f1e32f7
- SSDEEP 768:cO+qDlWGT9NVv48up+g5KFNhhlJwb9Lf2hs1z+Wvvy:v+qD4U2/5KFhrmVf2hs1zdvy
- MD5 SHA1 SHA512 SSDEEP
-
Detect larodectus Loader variant 1
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
13532
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
kernel32
PeekNamedPipe
GetLastError
CreateMutexW
user32
MessageBeep
MessageBoxA
scab
Name
.text
Size
46KB
Virtual Size
45KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
5KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=5, id=203, version=65501,
count=5, id=1, productName=Unmarked objects,
count=12, id=260, version=24247,
count=1, id=256, version=24247,
count=1, id=258, version=24247,
lact/2324-0-0x0000000000130000-0x0000000000144000-memory_unmapped.dmp
- IMPHASH db7aeb75528663639689f852fd366243
- SHA256 a94693776f14544219fca02959c2d2d095014a9ef2dd0deb4a68af4f39fb44bb
- MD5 43bc0dab9e308ffb529d7ddc873063d5
- SHA1 fbebdfc69ce47adfda18bf72c759672639968f89
- SHA512 22a5fd1d8735182d5f1ac1ada2a03b84e736244bc2d5bbd313ef95a8f7a43dc93b6dd4c40a12dfe18e375f840828025eb6eec0c9da009dad7b6d3ac27d64c358
- SSDEEP 768:MoWfTLO3B5YC0YbwuRPv87BZILqSdE8TWz7MUjhl0B/5:cfO3orNBZdGSMSy5
- MD5 SHA1 SHA512 SSDEEP
-
Detect larodectus Loader variant 2
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
15484
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
kernel32
PeekNamedPipe
GetLastError
CreateMutexW
user32
MessageBeep
MessageBoxA
extra
follower
run
scub
Name
.text
Size
48KB
Virtual Size
48KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
5KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=5, id=203, version=65501,
count=5, id=1, productName=Unmarked objects,
count=12, id=260, version=24247,
count=1, id=256, version=24247,
count=1, id=258, version=24247,
lact/2956-0-0x0000000001B60000-0x0000000001B74000-memory_unmapped.dmp
- IMPHASH db7aeb75528663639689f852fd366243
- SHA256 1bed9c089a3c1dd81a17834827129022f8cf417e86e6f9f15bd43ed3ac62e303
- MD5 37d62d215bc14f55d10afde96d91d1b6
- SHA1 9fd938b06ed73134a8ded13b0224ed80275b534b
- SHA512 3a35395abda1314f7aab3a9539f86634e20dfce7fd432f7123aa57a49c34c37743d0351c498dff4130f9efd03171648af76d4901bcbe3ff55cb6529f2f5e211f
- SSDEEP 768:foWfTLO3B5YC0YbluRPv87BZILqSdE8TWz7MUfx9k0zioX:bfO3orQBZdGSMM9k0zi4
- MD5 SHA1 SHA512 SSDEEP
-
Detect larodectus Loader variant 2
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
15484
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
kernel32
PeekNamedPipe
GetLastError
CreateMutexW
user32
MessageBeep
MessageBoxA
extra
follower
run
scub
Name
.text
Size
48KB
Virtual Size
48KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
5KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=5, id=203, version=65501,
count=5, id=1, productName=Unmarked objects,
count=12, id=260, version=24247,
count=1, id=256, version=24247,
count=1, id=258, version=24247,