2024-05-21_66ee2714cb88cd03fd8808efea384d63_megazord

Sharing

Copy URL Twitter E-mail

General

Target

2024-05-21_66ee2714cb88cd03fd8808efea384d63_megazord
Size

20.9MB
MD5

66ee2714cb88cd03fd8808efea384d63
SHA1

5faf972cfc3c537514b47f7722e00cface47f3af
SHA256

64883ae29629e23e4664a4b622afa9ed10b0df37d7040efbfb010a70b2268730
SHA512

61fbbf7c94434f2fa613df1c6557275daa299d4476769f4d7396549017ce2576b38e8002128e8a13495a28503d75d2f5118c78b4ffc750f7d88a9037c74bc272
SSDEEP

196608:yNUNc1DeKSxh7sm8DPRIN36/tx82E4pqdjFv:yAc1DeKSOCKFx82E4pqBF

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-05-21_66ee2714cb88cd03fd8808efea384d63_megazord

Files

2024-05-21_66ee2714cb88cd03fd8808efea384d63_megazord
.exe windows:6 windows x64 arch:x64

d5523bcacb5fe62c7b95161c40d9aca3

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

vrc_get_gui.pdb

Imports

bcryptprimitives

ProcessPrng

api-ms-win-core-synch-l1-2-0

WakeByAddressAll
WaitOnAddress
WakeByAddressSingle

kernel32

TlsFree
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WakeAllConditionVariable
TlsSetValue
SleepConditionVariableSRW
CloseHandle
GetCurrentThreadId
GetModuleHandleW
ReleaseMutex
CreateMutexW
GetLastError
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
GetCurrentProcess
GetProcAddress
WaitForSingleObjectEx
LoadLibraryA
GetCurrentProcessId
CreateMutexA
lstrlenW
GetUserPreferredUILanguages
LoadLibraryExA
FreeLibrary
CreateEventW
SetEvent
WaitForSingleObject
GetProcessHeap
HeapFree
HeapAlloc
FormatMessageW
CloseThreadpoolIo
GetStdHandle
RaiseFailFastException
TzSpecificLocalTimeToSystemTime
SystemTimeToFileTime
FileTimeToSystemTime
GetSystemTime
GetTickCount64
GetCurrentThread
Sleep
DeleteCriticalSection
LocalFree
EnterCriticalSection
SleepConditionVariableCS
LeaveCriticalSection
WakeConditionVariable
QueryPerformanceCounter
InitializeCriticalSection
InitializeConditionVariable
WaitForMultipleObjectsEx
CreateThreadpoolWork
CloseThreadpoolWork
SubmitThreadpoolWork
QueryPerformanceFrequency
SetLastError
GetFullPathNameW
GetLongPathNameW
LocalAlloc
GetConsoleOutputCP
WideCharToMultiByte
CreateIoCompletionPort
CreateFileW
CreateThreadpoolIo
StartThreadpoolIo
CancelThreadpoolIo
DeleteFileW
DeviceIoControl
ExpandEnvironmentStringsW
FindClose
FindFirstFileExW
FlushFileBuffers
GetFileAttributesExW
GetFileInformationByHandleEx
GetFileType
GetModuleFileNameW
GetOverlappedResult
LoadLibraryExW
ReadFile
SetFileAttributesW
SetFileInformationByHandle
SetThreadErrorMode
CreateThread
ResumeThread
DuplicateHandle
GetThreadPriority
SetThreadPriority
GetDynamicTimeZoneInformation
GetTimeZoneInformation
WriteFile
GetCurrentProcessorNumberEx
ResetEvent
CreateEventExW
GetEnvironmentVariableW
GetCPInfoExW
GetConsoleMode
ReadConsoleW
WriteConsoleW
MultiByteToWideChar
RtlRestoreContext
AddVectoredExceptionHandler
FlsAlloc
FlsGetValue
FlsSetValue
TerminateProcess
SwitchToThread
SuspendThread
GetThreadContext
SetThreadContext
FlushInstructionCache
VirtualAlloc
VirtualProtect
VirtualFree
QueryInformationJobObject
GetModuleHandleExW
GetProcessAffinityMask
InitializeContext
GetEnabledXStateFeatures
SetXStateFeaturesMask
FlushProcessWriteBuffers
InitializeCriticalSectionEx
GetSystemTimeAsFileTime
VirtualQuery
DebugBreak
SleepEx
GlobalMemoryStatusEx
GetSystemInfo
GetLogicalProcessorInformation
GetLogicalProcessorInformationEx
GetLargePageMinimum
VirtualUnlock
VirtualAllocExNuma
IsProcessInJob
GetNumaHighestNodeNumber
GetProcessGroupAffinity
K32GetProcessMemoryInfo
GetTimeZoneInformationForYear
GetModuleHandleA
GetNativeSystemInfo
GetUserDefaultLocaleName
SetFileTime
GetUserDefaultUILanguage
LCIDToLocaleName
LoadLibraryW
GetFileAttributesW
OutputDebugStringA
OutputDebugStringW
RegisterWaitForSingleObject
UnregisterWaitEx
SetHandleInformation
GetQueuedCompletionStatusEx
PostQueuedCompletionStatus
SetFileCompletionNotificationModes
GetFileInformationByHandle
MoveFileExW
FreeEnvironmentStringsW
DeleteProcThreadAttributeList
CompareStringOrdinal
SetThreadStackGuarantee
CreateWaitableTimerExW
SetWaitableTimer
GetCurrentDirectoryW
GetEnvironmentStringsW
SetEnvironmentVariableW
GetCommandLineW
SetFilePointerEx
WriteFileEx
GetExitCodeProcess
GetSystemTimePreciseAsFileTime
HeapReAlloc
FindNextFileW
CreateDirectoryW
FindFirstFileW
RemoveDirectoryW
CreateSymbolicLinkW
CreateHardLinkW
GetFinalPathNameByHandleW
CopyFileExW
CancelIo
ExitProcess
CreateNamedPipeW
ReadFileEx
WaitForMultipleObjects
GetSystemDirectoryW
GetWindowsDirectoryW
CreateProcessW
InitializeProcThreadAttributeList
UpdateProcThreadAttribute
GetTempPathW
InitializeSListHead
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
EncodePointer
RaiseException
RtlPcToFileHeader
RtlUnwindEx
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent

user32

IsIconic
MapVirtualKeyW
RedrawWindow
GetMessageW
GetAncestor
TranslateAcceleratorW
TranslateMessage
DispatchMessageW
PostThreadMessageW
DefWindowProcW
EnumChildWindows
GetAsyncKeyState
PostMessageW
GetCursorPos
ReleaseCapture
ClientToScreen
ChangeDisplaySettingsExW
PeekMessageW
SetWindowPlacement
GetKeyboardState
ToUnicodeEx
GetKeyState
GetWindowPlacement
SetWindowPos
MapVirtualKeyExW
InvalidateRgn
LoadCursorW
SetCursor
SetCursorPos
GetActiveWindow
GetKeyboardLayout
CreateIcon
FlashWindowEx
GetForegroundWindow
GetRawInputData
GetClientRect
SystemParametersInfoA
SetMenu
PostQuitMessage
CreateAcceleratorTableW
AppendMenuW
CreateMenu
VkKeyScanW
GetMessageA
SetMenuItemInfoW
IsWindow
SendInput
SetForegroundWindow
GetSystemMetrics
GetWindowTextW
GetWindowTextLengthW
SetWindowTextW
DestroyIcon
DestroyAcceleratorTable
IsProcessDPIAware
GetDC
IsWindowVisible
RegisterTouchWindow
GetWindowRect
MonitorFromPoint
EnumDisplayMonitors
SetWindowDisplayAffinity
GetMenu
ShowCursor
ClipCursor
GetClipCursor
SetWindowLongW
GetSystemMenu
DispatchMessageA
ShowWindow
CreateWindowExW
GetWindowLongPtrW
SetWindowLongPtrW
SendMessageW
RegisterClassExW
FindWindowW
GetUpdateRect
ValidateRect
GetMonitorInfoW
MonitorFromWindow
AdjustWindowRectEx
CloseTouchInputHandle
ScreenToClient
GetTouchInputInfo
TrackMouseEvent
MonitorFromRect
GetWindowLongW
CheckMenuItem
EnableMenuItem
SetCapture
MsgWaitForMultipleObjectsEx
RegisterRawInputDevices
RegisterWindowMessageA
DestroyWindow

comctl32

DefSubclassProc
SetWindowSubclass
RemoveWindowSubclass
TaskDialogIndirect

gdi32

CreateRectRgn
GetDeviceCaps
DeleteObject

dwmapi

DwmEnableBlurBehindWindow

ole32

CoUninitialize
CoInitializeEx
CoWaitForMultipleHandles
CoCreateInstance
CoCreateGuid
RevokeDragDrop
RegisterDragDrop
OleInitialize
CreateStreamOnHGlobal
CoTaskMemFree
CoTaskMemAlloc
CoGetApartmentType

shell32

SHGetKnownFolderPath
SHAppBarMessage
ShellExecuteW
SHCreateItemFromParsingName
DragQueryFileW
DragFinish

advapi32

EventSetInformation
EventWriteTransfer
RegGetValueW
LookupPrivilegeValueW
AdjustTokenPrivileges
OpenProcessToken
EventUnregister
EventRegister
SystemFunction036
RegEnumKeyExW
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
RegCreateKeyExW
RegSetValueExW

oleaut32

GetErrorInfo
SetErrorInfo
SysFreeString
SysStringLen

bcrypt

BCryptGenRandom

ws2_32

freeaddrinfo
getaddrinfo
WSACleanup
WSAStartup
WSAGetLastError
WSAIoctl
setsockopt
send
recv
shutdown
getsockopt
ioctlsocket
connect
bind
WSASocketW
getpeername
getsockname
closesocket
WSASend

secur32

FreeContextBuffer
EncryptMessage
ApplyControlToken
DeleteSecurityContext
QueryContextAttributesW
AcceptSecurityContext
InitializeSecurityContextW
DecryptMessage
FreeCredentialsHandle
AcquireCredentialsHandleA

crypt32

CertFreeCertificateChain
CertVerifyCertificateChainPolicy
CertGetCertificateChain
CertAddCertificateContextToStore
CertEnumCertificatesInStore
CertDuplicateCertificateChain
CertOpenStore
CertCloseStore
CertDuplicateStore
CertGetEnhancedKeyUsage
CertVerifyTimeValidity
CertDuplicateCertificateContext
CertFreeCertificateContext

uxtheme

SetWindowTheme

ntdll

NtReadFile
NtCreateFile
NtWriteFile
NtDeviceIoControlFile
RtlNtStatusToDosError
NtCancelIoFileEx

api-ms-win-crt-math-l1-1-0

floor
log
ceil
modf
pow
round
__setusermatherr
trunc

api-ms-win-crt-string-l1-1-0

_wcsicmp
strlen
wcslen
_stricmp
wcsncmp
strcpy_s
strcmp

api-ms-win-crt-heap-l1-1-0

free
calloc
_callnewh
_set_new_mode
malloc

api-ms-win-crt-convert-l1-1-0

strtoull
wcstol
_ultow_s

api-ms-win-crt-runtime-l1-1-0

_register_onexit_function
_initialize_onexit_table
terminate
_seh_filter_exe
_set_app_type
_configure_narrow_argv
_register_thread_local_exe_atexit_callback
_initialize_narrow_environment
_crt_atexit
_c_exit
_cexit
_get_initial_narrow_environment
_initterm
abort
_initterm_e
exit
_exit
__p___argv
__p___argc

api-ms-win-crt-stdio-l1-1-0

_set_fmode
__p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Exports

Exports

DotNetRuntimeDebugHeader

Sections

.text
Size: 12.4MB - Virtual size: 12.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.managed
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

hydrated
Size: - Virtual size: 611KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 6.3MB - Virtual size: 6.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 30KB - Virtual size: 126KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 754KB - Virtual size: 754KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 500B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 45KB - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 80KB - Virtual size: 80KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d5523bcacb5fe62c7b95161c40d9aca3

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

bcryptprimitives

api-ms-win-core-synch-l1-2-0

kernel32

user32

comctl32

gdi32

dwmapi

ole32

shell32

advapi32

oleaut32

bcrypt

ws2_32

secur32

crypt32

uxtheme

ntdll

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

Exports

Exports

Sections

.text Size: 12.4MB - Virtual size: 12.4MB

.managed Size: 1.2MB - Virtual size: 1.2MB

hydrated Size: - Virtual size: 611KB

.rdata Size: 6.3MB - Virtual size: 6.3MB

.data Size: 30KB - Virtual size: 126KB

.pdata Size: 754KB - Virtual size: 754KB

_RDATA Size: 512B - Virtual size: 500B

.rsrc Size: 45KB - Virtual size: 44KB

.reloc Size: 80KB - Virtual size: 80KB

.text
Size: 12.4MB - Virtual size: 12.4MB

.managed
Size: 1.2MB - Virtual size: 1.2MB

hydrated
Size: - Virtual size: 611KB

.rdata
Size: 6.3MB - Virtual size: 6.3MB

.data
Size: 30KB - Virtual size: 126KB

.pdata
Size: 754KB - Virtual size: 754KB

_RDATA
Size: 512B - Virtual size: 500B

.rsrc
Size: 45KB - Virtual size: 44KB

.reloc
Size: 80KB - Virtual size: 80KB