Oxide-client[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

Oxide-client.exe
Size

3.0MB
MD5

f88d4d882585f40a2fb68fbf3c2710b2
SHA1

e41ba29416203c34a48e034c1db9903cc843504f
SHA256

e309a03bf494f02ba756cf9433fc2a126a2479ac1c1bcf1467cd615841f6c77f
SHA512

80dff8afc0fa9bac34e3ed0b55a6c0889a1db69af509afc7f1cbbfb0a5816ca162cb846844bfad2c4b004f3e0a173b4385c9147377e7911a0b02367fada1fed9
SSDEEP

49152:7psee7A0v0PuPmtcIZHSkMLsL6HFFS7LRQShMwwxWuoHr:7p07BhoQx

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Oxide-client.exe

Files

Oxide-client.exe
.exe windows:6 windows x64 arch:x64

16f19ce1660087e989f50c48f5210a16

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

Oxide_client.pdb

Imports

bcryptprimitives

ProcessPrng

api-ms-win-core-synch-l1-2-0

WakeByAddressAll
WaitOnAddress
WakeByAddressSingle

kernel32

PostQueuedCompletionStatus
GetSystemInfo
GetDiskFreeSpaceExW
GetQueuedCompletionStatusEx
CreateIoCompletionPort
GetCurrentProcessId
CreateFileW
LocalFree
GetProcessTimes
VirtualQueryEx
SetHandleInformation
GetSystemTimeAsFileTime
CreateMutexA
LoadLibraryA
GetVolumePathNamesForVolumeNameW
FindFirstVolumeW
FindNextVolumeW
FindVolumeClose
GetDriveTypeW
GetVolumeInformationW
DeviceIoControl
GlobalMemoryStatusEx
K32GetPerformanceInfo
GetModuleHandleA
GetProcessHeap
HeapFree
OpenProcess
GetSystemTimes
GetProcessIoCounters
InitializeSListHead
IsDebuggerPresent
HeapAlloc
GetCurrentThread
ReadProcessMemory
CreateThread
WaitForSingleObjectEx
SetFileCompletionNotificationModes
UnhandledExceptionFilter
SetUnhandledExceptionFilter
CloseHandle
GetCurrentThreadId
WriteConsoleW
IsProcessorFeaturePresent
MultiByteToWideChar
GetLastError
WaitForSingleObject
LoadLibraryExA
GetProcAddress
FreeLibrary
FormatMessageW
AddVectoredExceptionHandler
SetThreadStackGuarantee
SwitchToThread
QueryPerformanceCounter
RtlCaptureContext
RtlVirtualUnwind
RtlLookupFunctionEntry
SetLastError
GetCurrentDirectoryW
GetEnvironmentVariableW
GetCurrentProcess
GetStdHandle
QueryPerformanceFrequency
GetSystemTimePreciseAsFileTime
HeapReAlloc
lstrlenW
ReleaseMutex
GetFinalPathNameByHandleW
GetModuleHandleW
GetConsoleMode

ws2_32

WSASend
send
setsockopt
recv
shutdown
getsockopt
ioctlsocket
connect
bind
WSASocketW
getpeername
getsockname
WSAIoctl
getaddrinfo
freeaddrinfo
WSACleanup
closesocket
WSAStartup
WSAGetLastError

secur32

AcquireCredentialsHandleA
EncryptMessage
ApplyControlToken
QueryContextAttributesW
AcceptSecurityContext
InitializeSecurityContextW
FreeContextBuffer
DeleteSecurityContext
DecryptMessage
FreeCredentialsHandle

advapi32

IsValidSid
GetTokenInformation
OpenProcessToken
RegOpenKeyExW
RegQueryValueExW
GetLengthSid
CopySid
RegCloseKey

crypt32

CertDuplicateCertificateChain
CertGetCertificateChain
CertVerifyCertificateChainPolicy
CertEnumCertificatesInStore
CertAddCertificateContextToStore
CertOpenStore
CertCloseStore
CertFreeCertificateChain
CertDuplicateStore
CertFreeCertificateContext
CertDuplicateCertificateContext

ntdll

NtDeviceIoControlFile
NtCreateFile
RtlNtStatusToDosError
NtCancelIoFileEx
NtQuerySystemInformation
RtlGetVersion
NtWriteFile
NtQueryInformationProcess

pdh

PdhRemoveCounter
PdhOpenQueryA
PdhAddEnglishCounterW
PdhCloseQuery
PdhGetFormattedCounterValue
PdhCollectQueryData

powrprof

CallNtPowerInformation

oleaut32

SysStringLen
SysFreeString
GetErrorInfo

psapi

GetModuleFileNameExW
GetProcessMemoryInfo

shell32

CommandLineToArgvW

vcruntime140

__current_exception_context
__current_exception
__C_specific_handler
_CxxThrowException
memset
memcmp
memmove
memcpy
__CxxFrameHandler3

api-ms-win-crt-string-l1-1-0

wcslen

api-ms-win-crt-math-l1-1-0

__setusermatherr
pow

api-ms-win-crt-heap-l1-1-0

_set_new_mode
free

api-ms-win-crt-runtime-l1-1-0

__p___argc
exit
_cexit
_c_exit
_register_thread_local_exe_atexit_callback
_initterm_e
_initterm
_get_initial_narrow_environment
_initialize_narrow_environment
_initialize_onexit_table
_configure_narrow_argv
_exit
_set_app_type
_seh_filter_exe
_register_onexit_function
__p___argv
_crt_atexit
terminate

api-ms-win-crt-stdio-l1-1-0

_set_fmode
__p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 2.0MB - Virtual size: 2.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 951KB - Virtual size: 950KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 104KB - Virtual size: 103KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

16f19ce1660087e989f50c48f5210a16

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

bcryptprimitives

api-ms-win-core-synch-l1-2-0

kernel32

ws2_32

secur32

advapi32

crypt32

ntdll

pdh

powrprof

oleaut32

psapi

shell32

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 2.0MB - Virtual size: 2.0MB

.rdata Size: 951KB - Virtual size: 950KB

.data Size: 9KB - Virtual size: 9KB

.pdata Size: 104KB - Virtual size: 103KB

.reloc Size: 16KB - Virtual size: 16KB

.text
Size: 2.0MB - Virtual size: 2.0MB

.rdata
Size: 951KB - Virtual size: 950KB

.data
Size: 9KB - Virtual size: 9KB

.pdata
Size: 104KB - Virtual size: 103KB

.reloc
Size: 16KB - Virtual size: 16KB