"_�']���ޙ~C���!� d�ǥ� ��v|�.��lɁB`=/�i�v�'��M½��-0�qb�T�pƌ�#_ .Θn�C����"U͖�n�~�NΟ ��Mp��o uq1Jc�2��飛 x�\�b��Aa�t1M�����"U�2��W{�W���r�kr�Ƭg$�=��_c*�q�b�u~mk�6���&X��]L?)Ի;5�8ٖ�C[��Bz�c��B�7�X���Ґ>���~�W�����������1����7+Ѳ�&��_�%ؾ���L��~���xR\���mr��^�E���L�(A�����&��1LS_@R����= ��i�\Nm�r�W���p2����A�A,����]�Qe��n�Q o�6Z�D��,����uTK7 :��=���%��i�'�����x��2�o��L��QA�q�F-`f/�9�4Uj�?� ��A&� ��3Qf*��xC-[h6vcY�^���,��#�Kr��t)~(oE���:@6;:���ˋR��ԤVO,D)���S�FXa���$.^�|X6j�x]�n�Џ<�}^ȼy)�yf��n��ӑxV^��"7�k�_�ٽ���Q��Ԕ��Naf�Ϸ*#<���@Ic��8�1����}�B��r,�ȟY=��Eu���ʭ�0d�AzY֫5a����d_9dig��!�7�h"mo6�"���@�10���G� ��4 j����(Do��w�F�1`E� F ﱴ�LS҃Y暙�d*�L�z�!ǘf��rJ�.�u�՜�İ�p&Iw�ݓ�����Fnx|C��4�x��-�Ym�$ē���h,3��9���+��8�����o q��B�o�\��T����$�[�T��6O��i����;�l�}ѫ�Ŝ���� ���e`����;�{^_��.�ؿ^����,���o5$����T �8���b��r�D��;��!TT�JW;�$w)_�QN)��<7 �Q���iܜ�����i��b�{���HP��z�d�����Rf��'�Hj��I&�E�#֣��J�9�n*� �����|z � 0�i"��a������C���� �7���'�'��ei��M2q����X,�ay6G�|l��7$�+�U�ef��� �[.���V��=Wy����a�h�˹nݿͪO{U�>lP1tl+��@��Uc��ŜDk�!I�'_G6�ś27Y�U�?�T8�=؊��I��v���p��}�i�X���GUJ����KHz��P�{M�ψ�A��.���!�͒ ��y[0�Y/�'�)#o\�K��~� A�V)�+��8BJ����XGIۍ[��EH���=�t���@����Wt��$������G_���Y�?]I�� wT�*��c�����v��a�F���U��^P��B����a�+۲M�(�2�Q ���$x���֤.|3� �쩱 4�hNe��`����i:� �Q�M�f~B��X�4;5��-z������� �A+�wHZxRn�U�1E<l�8�%���X�eR�a��g��Zu����t����� ���5���<WI�X9};a�����,0Z��^+��*?3��T�ة�N����PإcyU�+d�\�>�D��%e-_J����>�P�Y�_q^��a����n�����'a4�+l��*��B��)f2���2��D��2 ;qN2�Zv�Te��ߡ�fYOB���.L粬�1�����w����r`�О�ʹ�6�%��NZO�r�?� �5Q���$b��rL��d�Q�Y�|$=F��Mb�;��E�" e��{9��9+��H�NGLJ��ؑ�X����@w�ȉl;M�}CD�w� d�|[.��;���+���J�%K#ϸ�|����l�v��tS*�4��U������l�i �a C��AW�ix���~ ��=3˺�lF������F�8V����M��u�#�e�*Ov���Ām��蹞�;�S�a*�y ��m��q} �2���p^6���������o�I�r!10W��N���|�MAs19afVحf�d1������7| ��[n(�#�G����^�)w����#���8�Cv��W#���#6{e��o�P���%��aH�k�}㍴�Y݉.�YQB�9D o�����|Q8%?�-!��i�VϪ�uX���ۙ�M�R5w ���`r�h�1����h8����7��5�Xڠ���L�P0.���a����#035�1��g�"յxY���#,)8� ���,�Gx�#�)�\?�G�IB( ���ݕT���+?Y+-i+��4�.Њ�������4��Z$a��1�i"skw"3K�.�����+n��ܱ4�c�D����a�cWǂ KC������,l+�Z��z��.��0w-����Fq/��p�KPQ��% 3�K\� �e���6,���x7��g��w�㇓ ��RFVK�S���Df���HI�����@I�W�<��(�������q������ݏ<����%�[Zt��I�Zі�+�%8���@����&j� [b -����j�u^�uT\�`#�N�t+؎%J2� (\��0O��!�Bd+��֭6ϤԽD��a�+$mQ�<i�=�f� 6hnY��������J/�X�P�B�E:#��=����So�2�G\ß�5������g �,�}ut��c���)�J���:��g�M���eD����W^�������l�0n��ie����"Ʒ�𑠞[�8�^��'�8�'��n8,9���������A�͏mQ��� �D����)y��i�[�>.�1~364�B�2D�a5u�Y=o����L�8�iˇ�^��uȩ�j�c�mSt[ϠT�0�`{(,���uE�EV� ]�*�����9S��G9G-c�A_��rr�@;o��^��P�=|S��'�<����;�1�.�a?X@�����Rc����|�����dh[�B y�-P�Y6:��⩾K_뾜y�-p�p���a4ῴ��nJՂ�p)Jo���gF�X0or#��"�N;��2\��u��K� ���+�^��\��[�ٓiȂ:������3`U�:s�x�#'i��_��/�u�����)�M�
Behavioral task
behavioral1
Sample
eftclient.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
eftclient.exe
Resource
win10v2004-20240226-en
General
-
Target
eftclient.exe
-
Size
22.4MB
-
MD5
99eb52f43cb2eda4b8ec31acbcd8cee9
-
SHA1
e39b61383725cf624ec34aaf019baaf95a7a42de
-
SHA256
8f97811b103768484b1aca478a19a0165e0e43a86b2065020fd86aaddf70f6d6
-
SHA512
a6f64d770171a7fb33844dd371d940a3b91d0c14cbc0c3d15fa008141a177215b9081b5a37ef7fecec9e59977f859b783cc436a167421f9d9e37499e287bbabc
-
SSDEEP
393216:LfCYnMLoUDNC0bLCq4SjOdv2xH0THPsRWkWplYJAHga3Lo3+fr1E:LfCypGBt4lhTH0cvpCr0LPy
Malware Config
Signatures
-
resource yara_rule sample themida -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource eftclient.exe
Files
-
eftclient.exe.exe windows:6 windows x64 arch:x64
e685f5e832f31232b8168ace1f38df04
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
LoadLibraryA
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
MessageBoxA
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
advapi32
RegCreateKeyA
msvcp140
??1_Lockit@std@@QEAA@XZ
ntdll
RtlInitUnicodeString
winhttp
WinHttpOpen
iphlpapi
IcmpCloseHandle
winmm
timeGetDevCaps
vcruntime140
_local_unwind
vcruntime140_1
__CxxFrameHandler4
api-ms-win-crt-runtime-l1-1-0
_invalid_parameter_noinfo_noreturn
api-ms-win-crt-heap-l1-1-0
_callnewh
api-ms-win-crt-string-l1-1-0
tolower
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vsprintf_s
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
api-ms-win-crt-convert-l1-1-0
strtoul
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-filesystem-l1-1-0
_unlock_file
api-ms-win-crt-utility-l1-1-0
srand
api-ms-win-crt-environment-l1-1-0
getenv
api-ms-win-crt-math-l1-1-0
__setusermatherr
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 427KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 158KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 10.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.themida Size: - Virtual size: 12.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.themida Size: 22.4MB - Virtual size: 22.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ