f:\programming\coretemp\coretemp\alsysio\source\lib\amd64\ALSysIO64.pdb
Static task
static1
Behavioral task
behavioral1
Sample
Device/HarddiskVolume3/Users/admin.user/AppData/Local/Temp/ALSysIO64.sys
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
Device/HarddiskVolume3/Users/admin.user/AppData/Local/Temp/ALSysIO64.sys
Resource
win10v2004-20240412-en
General
-
Target
ALSysIO64.sys
-
Size
23KB
-
MD5
64af80e9a7b719cde4f5e54bd07463d3
-
SHA1
07e8a72643d5a3aa03cb33aff22b558a920b5697
-
SHA256
41708ecf315abb58005a7f1ac3a6b8367380f8c372662c308615cb82dfeaa424
-
SHA512
02f337342325b539f5eeabc24d71e189b0a4c2aebd9e7b81409a33d0952b6160a7f4eb400eb530f11b0dc7cf785693366ce7f5a466af8e17482f0dadafd7313f
-
SSDEEP
384:N5wsbVlMI8HkJlQpqtN71Z1Xj6qgj30Rv2iLgpC1a+EaTvSvrTASvZ3qL/u0Nnh:NdbPKEJ6pqtN71fXOq5RvNscd5vSDrKz
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Device/HarddiskVolume3/Users/admin.user/AppData/Local/Temp/ALSysIO64.sys
Files
-
ALSysIO64.sys.zip
Password: ow&b!54X6x_#4gT@9BT4
-
Device/HarddiskVolume3/Users/admin.user/AppData/Local/Temp/ALSysIO64.sys.sys windows:6 windows x64 arch:x64
2f7ea575cf15da16c8f117eee37046d8
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
ntoskrnl.exe
IoDeleteDevice
ZwClose
IofCompleteRequest
IoCreateSymbolicLink
IoCreateDevice
IoBuildDeviceIoControlRequest
RtlAnsiStringToUnicodeString
MmGetSystemRoutineAddress
KeInitializeEvent
RtlInitAnsiString
RtlFreeUnicodeString
IoGetDeviceObjectPointer
KeWaitForSingleObject
MmIsAddressValid
ObfDereferenceObject
RtlInitUnicodeString
IofCallDriver
ExAllocatePoolWithTag
ExFreePoolWithTag
KeLeaveCriticalRegion
strstr
MmUnmapIoSpace
KeEnterCriticalRegion
MmMapIoSpace
PsGetVersion
ExAllocatePoolWithQuotaTag
ZwQuerySystemInformation
KeBugCheckEx
__C_specific_handler
DbgPrint
IoDeleteSymbolicLink
hal
HalGetBusDataByOffset
Sections
.text Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 428B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
PAGE Size: 512B - Virtual size: 376B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 928B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
manifest.json