qX��V�l�a�a�&>i�s\j��|���:�9(:�au�H�@4���{�+P3xp��}�1���j�D��&l�*���u��!H�Df�E:e���p E��_Z�0BQX[%B���3l������e\*��uK���l18�3P�P�n��,G_xC�T3a��)�������������h��>�]�fB� S���,Eu��)���K`�U���C�� ����}�$N��9����)��D��df�[r��w0?��:_�xb��n��`���Ԡ�j��@�ܐ����d�2x �G«儀pAZK{��Do�}~�5������y*��F��l.�F���TGhiw��{����,�_�C���l�W��7��G��j�����T$"�)�{�W%���N�k 1!�|�#)��P�$�B�%�P3�mo�& h¹F���oѧF��arfؙ�\?��'V��E$l'�^_?�Ḁ_���p�B%$ Qy��({lb��t.s��(-ii�)]����ugm�|�����Q�C�_W���#���Ț���f�F����`3h�3�pv{^��b~L]�ݟ���� 9<<��@�Iw!�`[�Lz,�di}����/� ��{ =��"���wba� ��FB��wdu�J��@�j��S��+���(�}�7y�zQxC$���ss�8����%��]�rVO���a�Z��� �E�{.pm{��8mml�zWDl�����]�j{6�7��y��p�کh&ɑ{=.u���ݥ������@��P��A����J��9�t �+ ��Zڂ��w��¸�,{H ��R�:�݄̯�I�z�i �2�9�.@K[Z{q5,�6���'a�NFCt*���I")�0(�.�gU���O�3WT=KL�I/!�q��x�4�{u8��'�M'4hz'p����c����B;E�qՃc�O��0M�8�&h��Fu}��z;o2�`�TL�lWy�� ��� e� ���U�R��C�A���7�(W@�:{����������cH\���^P��W���{8U �Hf�@Oɧ�T�[a��h����:��G|i���U�Z���E�ҲS�'�,_?��%t�zuH�|�3�Lm#ќK����$�Pj��y��r������I��+�:�+���%�L�f�m���s�ԩ��1dz���Mj�]�<��{�˪�.�����m�2%��&>DT�����{��:�pHR� -*D�[f�����\=*W�����@����^�Î�+����Z~���F��M���:Y�P�F���1R'@,�O-_Pr�7���8r���'?Ȣ�얟d�<�����g�i�Op�`9-�9T�a��g�S�ը�H��].��H��j1���>�#���d��6J�ψ�dh�^�%K���\`�e������bu��Ȅu�BT���ƍ�5���������ɾ���]���9xf?�3�D�m[n�?�P'�M5�����<�ط+t�P*�����ňe��F�Ǣ�k��3qW��t��L�%�/M��g`�U� 7}�/4�GlԒ��uI,�t猜2-+0��M��d�\z��t����§��̰S��.�~]V^�<�?\Ï2*�`�!��Z�q��|GeZ���0�Hoͩ��ҕ#�_�tto�C� �n+V���3��2�s!n��̹�M��d��>���Y�C�lt!' J;]�B�b��o�� ���~T�^��Q��h��P���II�ƣd��DN#(5��R��)@�=k�Jjr�$��w�Ђ�A�T1+�7:��dh�'�"��[�y���u������)YR㤅���i���g��ʍ��*�� ;��6'�W�"lC����;9��������X����!N���"�P���W�K99c��YZ�8�0/���S���!{�Q�o�"kZt�:I$SZ08�����aJA���a߯�=��M>�p��SG\'Sx��C\-b���6���`yr�e{W��'������v gT�#Q� &�l��&����m��͕�e�X�a���u�?��79.Ũ H�>��o�YG�ї8�N�2*���0c�����K�6���]�(jxM)H9�"X����.0�{ 4��/E]kߙ �y/��a pm��w�g��; ^ �"�hu�`@��-��'���n���2~�b���4�˦�GT�^M�/HP&cб��E��&�4��<dz��[E{w��Lߋ3S�Z�:���\}�����aćy��ό�K� �1�v��¢$O���4lQ��8O��gp�Յ_p'̤�^,��$EҴ�b�X?��l��d��+GO�3\��XS�ڙdoԀUJL��ǩ��rl4>�"W�l��%��`�x�W�gS�̸ժ|G���&<0ə�ŷң�$���[�:K�=`ÄF`���<��ݎj�xn+I��� _�Gx� 9ߴ7Q{�7,�;7��~���c��d�����$�h����U�$`����K���!u�'��������������:[Xњl@<�C��#p`����e���7cCkdb6�`���U�ͳ�{+)>q�Eۊ瑇c*N��v9Ҙ��Z��/�dZTxD{��ݤ݇[0-B]e�G�����e�L8CU`ص�k:��~��o���#ߢ��ug��cXv0�:���Y\F��I�!Uf��p2�d��9����:<M���f���S�#�פ�ߚ ٨��|'}�Pļ����R5��!�R���&n�c�%[�h��u�?�=�1F�vk�.�{�]��:86��YL f��L����M͓�퀝�\���vji�V�n�n��2�4��\'�LI�G9?}�eɘ�$��,F���^�]�x[I՟Jn�ma�H:�&�!����̝a ���a.#b��/�Qf�p��Y\߄C�9�RQ�Rq�����M����6!Aҋ�ZO%��CYЌ��W9Ѥj�{�6"�+ٖ|�g��tS�G퐴����|P�$�x�0�d�3NBQ�}��)}�����G��ϛ(��-z� �s�<�Nz�hH]e$to�θ,�WA���Z���({��z�K����շ��`K�����'�$����h�,#�)�����q9�
Static task
static1
Behavioral task
behavioral1
Sample
Boost Tool.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
Boost Tool.exe
Resource
win10v2004-20240419-en
General
-
Target
Rebrand_Koxzy.rar
-
Size
11.8MB
-
MD5
5f253d11b0e8c232a042f624ec9359e3
-
SHA1
555bf50eb5ee5bcc403882a5a91cbe6fef2f5077
-
SHA256
d32c6e72597dea4c373cfff7d6fca8d819849f2486ce2dd1b83c70556247eb18
-
SHA512
36febdb5a3ea47e851b00ac7bd746bf5fe1eb7a5106c3038c6d0896725916721702d402ba7bf89741cee36f16967e0eb5b072768e53f98a2fa67b2e62c7ee416
-
SSDEEP
196608:5YIkjc8yy9w9cVxBXoJclcPUg9bp9zFg/W1PjQwLEGmEmDkA8hpB7RHm3ByHUe99:NEBw9S4JcexiiswLw4pB1HSoX91L
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Boost Tool.exe
Files
-
Rebrand_Koxzy.rar.rar
-
Boost Tool.exe.exe windows:6 windows x64 arch:x64
9cfc7e5db1974002df63adc9ba2c0f75
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
WriteFile
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
CharUpperBuffW
Exports
Exports
Sections
.text Size: - Virtual size: 4.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 3.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 946KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 87KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.xdata Size: - Virtual size: 168B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.zdebug_ Size: - Virtual size: 297B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.zdebug_ Size: - Virtual size: 662KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.zdebug_ Size: - Virtual size: 140KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.debug_g Size: - Virtual size: 48B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.zdebug_ Size: - Virtual size: 1.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.zdebug_ Size: - Virtual size: 839KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.zdebug_ Size: - Virtual size: 236KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.ydq Size: - Virtual size: 72KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.symtab Size: - Virtual size: 638KB
IMAGE_SCN_MEM_READ
.s!6 Size: - Virtual size: 3.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.hJ` Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.U8s Size: 12.1MB - Virtual size: 12.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 192B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 107KB - Virtual size: 107KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
Data/Output/orders.json
-
config.json