b7c2ddf77ff7bcc93ac0e5df3e6d03ec3c15103feff0f3cd96662342a40f273e
- SHA256 b7c2ddf77ff7bcc93ac0e5df3e6d03ec3c15103feff0f3cd96662342a40f273e
Password
infected
Static task
static1
Behavioral task
behavioral1
Sample
3854783710a249c1b8d553d298623ec63cc957281d703af14cf778bf18c06a34.exe
Resource
win7-20240319-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
3854783710a249c1b8d553d298623ec63cc957281d703af14cf778bf18c06a34.exe
Resource
win10v2004-20240412-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral3
Sample
Meanwhiles.ps1
Resource
win7-20240221-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral4
Sample
Meanwhiles.ps1
Resource
win10v2004-20240412-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target b7c2ddf77ff7bcc93ac0e5df3e6d03ec3c15103feff0f3cd96662342a40f273e
- Size 748KB
- Sample240417-rbh29aah46
- SHA256 b7c2ddf77ff7bcc93ac0e5df3e6d03ec3c15103feff0f3cd96662342a40f273e
- MD5 b3882e25a3d6fc74cf68aa24608460e0
- SHA1 c186b5e17e329ff3d7041dbb922281aa51deb611
- SHA512 43ecc39fdb7139609cbf93c5f1d1f20e7d2d4cbedac214a0bd1e98c8ce1f7aef70fb38df87e4bea390d3a21b43b6c14504fdeec9889e5a9f31e258b5f5d8aa1b
- SSDEEP 12288:Sr0HOKm7rd6q6jDrVq3hNO52b+3r311dplUn8TXqaNwJwje90v+UrXrqP:7crd6qXRNwi+3T11nlU82anK6LXWP
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
File Explorer
-
b7c2ddf77ff7bcc93ac0e5df3e6d03ec3c15103feff0f3cd96662342a40f273e.zip 748KB
-
3854783710a249c1b8d553d298623ec63cc957281d703af14cf778bf18c06a34.exe.exe 863KB
-
Depressingness.pan330KB
-
Meanwhiles.Bly.ps1 62KB
-
fdrenegaardes.Afv318KB
-
steelware/Statsgarantier/Gynodioeciously.hjr591KB
-
steelware/Statsgarantier/Midlines.txt464B
-
steelware/Statsgarantier/brandmur.pha421KB
-
steelware/Statsgarantier/nozzle.par403KB
-
steelware/Statsgarantier/padderne.cli741KB
-
steelware/Statsgarantier/unwink.gua493KB
3854783710a249c1b8d553d298623ec63cc957281d703af14cf778bf18c06a34.exe
- IMPHASH 1f23f452093b5c1ff091a2f9fb4fa3e9
- SHA256 3854783710a249c1b8d553d298623ec63cc957281d703af14cf778bf18c06a34
- MD5 80d8911cf9f3ccaa526a6afda63a4ae1
- SHA1 a434e9f052a8c8b5ca0bca099e49317f15033bb3
- SHA512 f2053a6e8dda2eff2b8ddfb1312c150dbe1f66d5a6029abc4284b9d6261817ba165359b83ab5ee99934acc23eb5603987a662aa21d911d9b66a8ad15847958ee
- SSDEEP 12288:hIrQbs3XWa23NQHD9Olb6yboUTMJ2qSpGH8VCX5q//X5M/u1Lr:cuQXWj3NQROlOyboUTin8Vw5MqUr
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
90:fc:88:9b:3a:be:27:34:ba:09:25:ca:d7:ff:0e:49:6d:7d:0d:8f:a1:63:a1:93:67:c5:d6:b4:dc:3c:8c:c1
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Thirtieth,OU=Rulleskjter akkomoderede\ ,O=Thirtieth,L=Manzac-sur-Vern,ST=Nouvelle-Aquitaine,C=FR,1.2.840.113549.1.9.1=#0c1e4c616269616c69736174696f6e40556e70656e657472617465642e456e74
Chains
Mar 15, 2024
Subject
CN=Thirtieth,OU=Rulleskjter akkomoderede\ ,O=Thirtieth,L=Manzac-sur-Vern,ST=Nouvelle-Aquitaine,C=FR,1.2.840.113549.1.9.1=#0c1e4c616269616c69736174696f6e40556e70656e657472617465642e456e74
Serial Number
3d:cc:77:8b:18:14:d7:40:00:46:87:9e:91:37:7a:49:63:a6:17:bb
Issuer
CN=Thirtieth,OU=Rulleskjter akkomoderede\ ,O=Thirtieth,L=Manzac-sur-Vern,ST=Nouvelle-Aquitaine,C=FR,1.2.840.113549.1.9.1=#0c1e4c616269616c69736174696f6e40556e70656e657472617465642e456e74
Timespan
May 7, 2023 - May 6, 2026
Subject
CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Serial Number
7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Issuer
CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 12, 2016 - Jan 11, 2031
Subject
CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Serial Number
7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Issuer
CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 23, 2017 - Mar 22, 2029
Minor OS version
0
Major OS version
4
Entry point
13449
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
ExitProcess
SetFileAttributesW
Sleep
GetTickCount
CreateFileW
GetFileSize
GetModuleFileNameW
GetCurrentProcess
SetCurrentDirectoryW
GetFileAttributesW
SetEnvironmentVariableW
GetWindowsDirectoryW
GetTempPathW
GetCommandLineW
GetVersion
SetErrorMode
lstrlenW
lstrcpynW
CopyFileW
GetShortPathNameW
GlobalLock
CreateThread
GetLastError
CreateDirectoryW
CreateProcessW
RemoveDirectoryW
lstrcmpiA
GetTempFileNameW
WriteFile
lstrcpyA
MoveFileExW
lstrcatW
GetSystemDirectoryW
GetProcAddress
GetModuleHandleA
GetExitCodeProcess
WaitForSingleObject
lstrcmpiW
MoveFileW
GetFullPathNameW
SetFileTime
SearchPathW
CompareFileTime
lstrcmpW
CloseHandle
ExpandEnvironmentStringsW
GlobalFree
GlobalUnlock
GetDiskFreeSpaceW
GlobalAlloc
FindFirstFileW
FindNextFileW
DeleteFileW
SetFilePointer
ReadFile
FindClose
lstrlenA
MulDiv
MultiByteToWideChar
WideCharToMultiByte
GetPrivateProfileStringW
WritePrivateProfileStringW
FreeLibrary
LoadLibraryExW
GetModuleHandleW
user32
GetSystemMenu
SetClassLongW
EnableMenuItem
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongW
SetCursor
LoadCursorW
CheckDlgButton
GetMessagePos
LoadBitmapW
CallWindowProcW
IsWindowVisible
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
ScreenToClient
GetWindowRect
GetDlgItem
GetSystemMetrics
SetDlgItemTextW
GetDlgItemTextW
MessageBoxIndirectW
CharPrevW
CharNextA
wsprintfA
DispatchMessageW
PeekMessageW
ReleaseDC
EnableWindow
InvalidateRect
SendMessageW
DefWindowProcW
BeginPaint
GetClientRect
FillRect
DrawTextW
EndDialog
RegisterClassW
SystemParametersInfoW
CreateWindowExW
GetClassInfoW
DialogBoxParamW
CharNextW
ExitWindowsEx
DestroyWindow
GetDC
SetTimer
SetWindowTextW
LoadImageW
SetForegroundWindow
ShowWindow
IsWindow
SetWindowLongW
FindWindowExW
TrackPopupMenu
AppendMenuW
CreatePopupMenu
EndPaint
CreateDialogParamW
SendMessageTimeoutW
wsprintfW
PostQuitMessage
gdi32
SelectObject
SetBkMode
CreateFontIndirectW
SetTextColor
DeleteObject
GetDeviceCaps
CreateBrushIndirect
SetBkColor
shell32
SHGetSpecialFolderLocation
ShellExecuteExW
SHGetPathFromIDListW
SHBrowseForFolderW
SHGetFileInfoW
SHFileOperationW
advapi32
AdjustTokenPrivileges
RegCreateKeyExW
RegOpenKeyExW
SetFileSecurityW
OpenProcessToken
LookupPrivilegeValueW
RegEnumValueW
RegDeleteKeyW
RegDeleteValueW
RegCloseKey
RegSetValueExW
RegQueryValueExW
RegEnumKeyW
comctl32
ImageList_Create
ImageList_AddMasked
ImageList_Destroy
ord17
ole32
OleUninitialize
OleInitialize
CoTaskMemFree
CoCreateInstance
Name
.text
Size
25KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
128KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.ndata
Size
Virtual Size
124KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
270KB
Virtual Size
270KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=165, id=1, productName=Unmarked objects,
count=15, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=10, id=48, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
Depressingness.pan
- SHA256 5a5656014cb2fcbff61344e9b4c4a0c1fd444f7fac4839661eeca6ae5076e376
- MD5 b58bc632700f045548a1e0904067982f
- SHA1 56ab0a059fd33822bbbcf17845ad75f5535930b6
- SHA512 5ae688a739cd6d307b9de0f740a07bf33f51981b86db8b982d46d092dff2d72beff3f1fcd0980e0490edbb180e3a64fbfe0f1911b591459c156b57501c2eacfa
- SSDEEP 768:am5bz9GowNFFjlSyJTs8nbdTeSPK8kJPwLyWZx+nj3PYaiJ1oGHgn:SIcx
- MD5 SHA1 SHA512 SSDEEP
Meanwhiles.Bly
- SHA256 f15b38a25f98ff312589b715a871359d8008bba74884f3a0f3ba14dffd269af1
- MD5 8ae5a440769b5c5dcd2f0c137fb7e373
- SHA1 45991089539f7aead1367746762b05600c28e40b
- SHA512 04d53e16021b852fb02c558c4ebea9f0966d94bb4695fea982f66cfc36dcc5a306229c97b78501d336ffc42c4ea72e13571d7754a09b20dfa2cff7cd01bcfa2b
- SSDEEP 1536:z2CXD6vF6OlRhR9+8R2cLKuzdLrSRBQHEMoqd:6WaZk8RzThr6+HPd
- MD5 SHA1 SHA512 SSDEEP
fdrenegaardes.Afv
- SHA256 dc8c7bb3485128616bcf2673421cf120dbb07c0f436d094e57fd90b6c77e3ae7
- MD5 1b8d9dc26352bd6794a5adffb9d60af8
- SHA1 629e166140528068f25bc4f1d7f622318f93e93f
- SHA512 05b245eb1249d2ae8cfc6ea4459f1cb63fa74baddb72fade0ab1af5bfd45d0d9f3ff0519c2e1dcb2bc63c0b1124d0d7bd110ea02b353fd5287a7f21208c3d3b6
- SSDEEP 6144:9OCPrPWSrAHh1yUnSUbbzD+Q5jrEcGlf2Xwywi2Y3WJpXg:9JPrPW1xzDlx4pegJiB6pQ
- MD5 SHA1 SHA512 SSDEEP
steelware/Statsgarantier/Gynodioeciously.hjr
- SHA256 590da31e2e55a5e240a3ced27182a8940b1e4257db52cefe0cdc9c14351680be
- MD5 fc23a1d590f2a1693f8779fe2ff38b9d
- SHA1 d852560a8a3f06a8fb933e50ff3af17bca4ff0ef
- SHA512 1f1bc148ed3bbdb52788d1754610b50b2a7415d031f06147f21bb52f26e920b537ff586f956373cd71df44215f28c05e02064e2ad23ef1db539b453f6abcdb38
- SSDEEP 768:Y874cUOnHTenwIahjU3EODe9mAStHy3vCo0RCXqwUGvU+CbiWdL4KZCNmIaeHVly:wPxb8vf8
- MD5 SHA1 SHA512 SSDEEP
steelware/Statsgarantier/Midlines.txt
- SHA256 60e5db53024a7462646673dcc4305ad18876c99a2e293c1dc1cfd274fe39195f
- MD5 bc56e08d19e6a0f6a565430579bc14be
- SHA1 cd3ca1ddda47a39a53a546300d5ec05a8bf7950c
- SHA512 b8d1f8bfca4e3bcfda79c7788e6ed2f2c65f15fa35e4f1b206264aec5558b006a5f2a5687ec23b6719cea8d5b970672703930f57b645df1172463cd4bad30d59
- MD5 SHA1 SHA512
steelware/Statsgarantier/brandmur.pha
- SHA256 76ee475d57c663ee99cf7de187bf505c9ac76059a387e4e11110bac5ed803c6d
- MD5 b23758b8b767048da446da5e058dc195
- SHA1 31328c880608388ba3c75785065ad3df43bc9661
- SHA512 63492a997f4aa27c17b70a22279f44cb90d7c7b7a65caccb531fe6b1542eac6f77e1ebda335061bb72f7eaf98c1380ab2ee3c85e67cbdaf21eea9bebc0fd3625
- SSDEEP 768:X4bZ7B96xNrcaWrCdBsQF/QfhkCxkmH4YO2YdEW9Sp809BD0X2fRv7iXUj2HeHiZ:ccS
- MD5 SHA1 SHA512 SSDEEP
steelware/Statsgarantier/nozzle.par
- SHA256 d74cbb94c54cb9f9df6e18a238c61477264ea2616339c9e511f89634dc8b40ea
- MD5 04fc86126129506141d8cb3e768bd17b
- SHA1 04ba5dc104cab14256231d9c17e30dd427c46027
- SHA512 61847032a1614a7c4ce1fed0052524447b2f5cfc5a812d6d1a140ac88401338a299ce664cf286660ac645bcd7afee8196092ccc93ff139de9ff72ce951fb7b8e
- SSDEEP 768:wAQ/+s9asp+upgyId3QfO2jYNYSQqJEtbyN6zhGFJuhi1A8B7RuR4z:lai
- MD5 SHA1 SHA512 SSDEEP
steelware/Statsgarantier/padderne.cli
- SHA256 8fe7ca276a423ae9e61efc02130a86dbf345d0e17dca2ca319e177e08043d0f2
- MD5 2f7ccf50a0474987eb154f19af78073c
- SHA1 19e2af2009d78694e0987ad36a3f5c7c6bcffd8c
- SHA512 b6ceef1eb6058ead6ef9d662dc499a0cd36cb857318f825bf842adf09b4a830bda63cae3769ea28c452b454542c5e7f3597d2cb217990b996f1394fb7f9152fb
- SSDEEP 768:H1nvtnmC3h4fi6v2WJb6rGUDgqwIEYZq4XcQF5+EeEUYXCKdRtaPOKA7tkKNRqe7:7J/xRb/8JS1
- MD5 SHA1 SHA512 SSDEEP
steelware/Statsgarantier/unwink.gua
- SHA256 6339e90a7c46436334e331186ec23558b92894e8fef2d0b08ca59b0639a43e7f
- MD5 ca7667ccf34a9433457ac2ad5075adcc
- SHA1 17be9093fa552591b2bd33491a009325a1b4697c
- SHA512 2aba5d0ce01628f97c8229f258d599d40a4dc4bb07e300e6734bde066b234b9780e787e2261c9db34d14cf4280aedcde3b64200ae1bde95e4ce29e404dd52ba1
- SSDEEP 768:I4TZoaDeuAh3UrnmfcTVY7kTVIGWI6CEwMgjxy/q1DysCK9wT/Jv/tVYCKcANoQb:/QEZWbPP+Y+T
- MD5 SHA1 SHA512 SSDEEP