2024-05-22_85512b7e475a2703a369d63337beb305_megazord

Sharing

Copy URL

Twitter E-mail

General

Target

2024-05-22_85512b7e475a2703a369d63337beb305_megazord
Size

20.9MB
MD5

85512b7e475a2703a369d63337beb305
SHA1

ffa5175e0385331f4977d131653321d5e0a259f2
SHA256

778b8c6d5b41bcedf758d033d52824a781b34214297676422299ead8a243a6ec
SHA512

3a35120796bc3659e4671c3b67a82255f6371475071d45b6926057a2d281578787a3cd7f17aa77cd0383d41aba96651e140040159c5bd237d05e3fe2814c98f8
SSDEEP

196608:HiCYHjVSzK4Z/Zk4gzcXqKdaK0b1Gs1eU:HXYHjVSzRL/aKdaVb1eU

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

Processes:

resource
2024-05-22_85512b7e475a2703a369d63337beb305_megazord

Files

2024-05-22_85512b7e475a2703a369d63337beb305_megazord
.exe windows:6 windows x64 arch:x64

6db98f691c23018042e41a85c52dd695

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

vrc_get_gui.pdb

Imports

bcryptprimitives

ProcessPrng

api-ms-win-core-synch-l1-2-0

WakeByAddressAll
WaitOnAddress
WakeByAddressSingle

kernel32

TlsFree
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WakeAllConditionVariable
TlsSetValue
SleepConditionVariableSRW
CloseHandle
ReleaseMutex
CreateMutexW
GetLastError
GetModuleHandleW
GetCurrentThreadId
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
GetCurrentProcess
GetProcAddress
WaitForSingleObjectEx
LoadLibraryA
GetCurrentProcessId
CreateMutexA
lstrlenW
GetUserPreferredUILanguages
LoadLibraryExA
FreeLibrary
CreateEventW
SetEvent
WaitForSingleObject
GetProcessHeap
HeapFree
HeapAlloc
FormatMessageW
CloseThreadpoolIo
GetStdHandle
RaiseFailFastException
TzSpecificLocalTimeToSystemTime
SystemTimeToFileTime
FileTimeToSystemTime
GetSystemTime
GetTickCount64
GetCurrentThread
Sleep
DeleteCriticalSection
LocalFree
EnterCriticalSection
SleepConditionVariableCS
LeaveCriticalSection
WakeConditionVariable
QueryPerformanceCounter
InitializeCriticalSection
InitializeConditionVariable
WaitForMultipleObjectsEx
CreateThreadpoolWork
CloseThreadpoolWork
SubmitThreadpoolWork
QueryPerformanceFrequency
SetLastError
GetFullPathNameW
GetLongPathNameW
LocalAlloc
GetConsoleOutputCP
WideCharToMultiByte
CreateIoCompletionPort
CreateFileW
CreateThreadpoolIo
StartThreadpoolIo
CancelThreadpoolIo
DeleteFileW
DeviceIoControl
ExpandEnvironmentStringsW
FindClose
FindFirstFileExW
FlushFileBuffers
GetFileAttributesExW
GetFileInformationByHandleEx
GetFileType
GetModuleFileNameW
GetOverlappedResult
LoadLibraryExW
ReadFile
SetFileAttributesW
SetFileInformationByHandle
SetThreadErrorMode
CreateThread
ResumeThread
DuplicateHandle
GetThreadPriority
SetThreadPriority
GetDynamicTimeZoneInformation
GetTimeZoneInformation
WriteFile
GetCurrentProcessorNumberEx
ResetEvent
CreateEventExW
GetEnvironmentVariableW
GetCPInfoExW
GetConsoleMode
ReadConsoleW
WriteConsoleW
MultiByteToWideChar
RtlRestoreContext
AddVectoredExceptionHandler
FlsAlloc
FlsGetValue
FlsSetValue
TerminateProcess
SwitchToThread
SuspendThread
GetThreadContext
SetThreadContext
FlushInstructionCache
VirtualAlloc
VirtualProtect
VirtualFree
QueryInformationJobObject
GetModuleHandleExW
GetProcessAffinityMask
InitializeContext
GetEnabledXStateFeatures
SetXStateFeaturesMask
FlushProcessWriteBuffers
InitializeCriticalSectionEx
GetSystemTimeAsFileTime
VirtualQuery
DebugBreak
SleepEx
GlobalMemoryStatusEx
GetSystemInfo
GetLogicalProcessorInformation
GetLogicalProcessorInformationEx
GetLargePageMinimum
VirtualUnlock
VirtualAllocExNuma
IsProcessInJob
GetNumaHighestNodeNumber
GetProcessGroupAffinity
K32GetProcessMemoryInfo
GetTimeZoneInformationForYear
GetModuleHandleA
GetNativeSystemInfo
GetUserDefaultLocaleName
SetFileTime
GetUserDefaultUILanguage
LCIDToLocaleName
LoadLibraryW
GetFileAttributesW
OutputDebugStringA
OutputDebugStringW
RegisterWaitForSingleObject
UnregisterWaitEx
SetHandleInformation
GetQueuedCompletionStatusEx
PostQueuedCompletionStatus
SetFileCompletionNotificationModes
GetFileInformationByHandle
MoveFileExW
FreeEnvironmentStringsW
DeleteProcThreadAttributeList
CompareStringOrdinal
SetThreadStackGuarantee
CreateWaitableTimerExW
SetWaitableTimer
GetCurrentDirectoryW
GetEnvironmentStringsW
SetEnvironmentVariableW
GetCommandLineW
SetFilePointerEx
WriteFileEx
GetExitCodeProcess
GetSystemTimePreciseAsFileTime
HeapReAlloc
FindNextFileW
CreateDirectoryW
FindFirstFileW
RemoveDirectoryW
CreateSymbolicLinkW
CreateHardLinkW
GetFinalPathNameByHandleW
CopyFileExW
CancelIo
ExitProcess
CreateNamedPipeW
ReadFileEx
WaitForMultipleObjects
GetSystemDirectoryW
GetWindowsDirectoryW
CreateProcessW
InitializeProcThreadAttributeList
UpdateProcThreadAttribute
GetTempPathW
InitializeSListHead
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
EncodePointer
IsDebuggerPresent
UnhandledExceptionFilter
RaiseException
RtlPcToFileHeader
RtlUnwindEx
IsProcessorFeaturePresent
SetUnhandledExceptionFilter

user32

GetClientRect
PostMessageW
RedrawWindow
SetMenu
IsIconic
MapVirtualKeyW
CreateWindowExW
GetMessageW
GetAncestor
TranslateAcceleratorW
TranslateMessage
GetAsyncKeyState
DispatchMessageW
PostThreadMessageW
DefWindowProcW
EnumChildWindows
RegisterClassExW
GetCursorPos
ReleaseCapture
GetKeyboardState
ToUnicodeEx
GetKeyState
ClientToScreen
ChangeDisplaySettingsExW
MapVirtualKeyExW
PeekMessageW
SetWindowPlacement
GetWindowPlacement
SetWindowPos
InvalidateRgn
GetKeyboardLayout
CreateIcon
LoadCursorW
SetCursor
GetRawInputData
FindWindowW
SystemParametersInfoA
PostQuitMessage
SendMessageW
CreateAcceleratorTableW
AppendMenuW
CreateMenu
VkKeyScanW
GetMessageA
SetMenuItemInfoW
GetActiveWindow
SendInput
SetForegroundWindow
FlashWindowEx
GetWindowTextW
GetWindowTextLengthW
SetWindowTextW
DestroyAcceleratorTable
DestroyIcon
IsProcessDPIAware
GetDC
IsWindowVisible
GetForegroundWindow
GetWindowRect
MonitorFromPoint
EnumDisplayMonitors
SetWindowDisplayAffinity
GetMenu
ShowCursor
ClipCursor
GetClipCursor
SetWindowLongW
GetSystemMenu
DispatchMessageA
ShowWindow
SetCursorPos
GetWindowLongPtrW
SetWindowLongPtrW
GetUpdateRect
ValidateRect
GetMonitorInfoW
MonitorFromWindow
AdjustWindowRectEx
CloseTouchInputHandle
ScreenToClient
GetTouchInputInfo
TrackMouseEvent
MonitorFromRect
GetWindowLongW
CheckMenuItem
EnableMenuItem
SetCapture
MsgWaitForMultipleObjectsEx
RegisterRawInputDevices
RegisterWindowMessageA
RegisterTouchWindow
GetSystemMetrics
IsWindow
DestroyWindow

advapi32

RegSetValueExW
RegCreateKeyExW
EventSetInformation
EventWriteTransfer
RegGetValueW
LookupPrivilegeValueW
AdjustTokenPrivileges
OpenProcessToken
EventUnregister
EventRegister
SystemFunction036
RegEnumKeyExW
RegCloseKey
RegQueryValueExW
RegOpenKeyExW

comctl32

DefSubclassProc
SetWindowSubclass
TaskDialogIndirect
RemoveWindowSubclass

gdi32

CreateRectRgn
DeleteObject
GetDeviceCaps

dwmapi

DwmEnableBlurBehindWindow

ole32

CoWaitForMultipleHandles
CoGetApartmentType
RegisterDragDrop
OleInitialize
CoCreateInstance
CoTaskMemFree
CoCreateGuid
CoUninitialize
CoInitializeEx
RevokeDragDrop
CreateStreamOnHGlobal
CoTaskMemAlloc

shell32

SHGetKnownFolderPath
SHAppBarMessage
ShellExecuteW
SHCreateItemFromParsingName
DragQueryFileW
DragFinish

oleaut32

SysFreeString
SysStringLen
SetErrorInfo
GetErrorInfo

bcrypt

BCryptGenRandom

ws2_32

freeaddrinfo
getaddrinfo
WSACleanup
WSAStartup
WSAGetLastError
WSAIoctl
setsockopt
send
recv
shutdown
getsockopt
ioctlsocket
connect
bind
WSASocketW
getpeername
getsockname
closesocket
WSASend

secur32

FreeContextBuffer
AcceptSecurityContext
InitializeSecurityContextW
DecryptMessage
EncryptMessage
ApplyControlToken
QueryContextAttributesW
AcquireCredentialsHandleA
FreeCredentialsHandle
DeleteSecurityContext

crypt32

CertDuplicateCertificateChain
CertFreeCertificateChain
CertVerifyCertificateChainPolicy
CertGetCertificateChain
CertFreeCertificateContext
CertEnumCertificatesInStore
CertAddCertificateContextToStore
CertOpenStore
CertCloseStore
CertDuplicateStore
CertGetEnhancedKeyUsage
CertVerifyTimeValidity
CertDuplicateCertificateContext

uxtheme

SetWindowTheme

ntdll

NtDeviceIoControlFile
RtlNtStatusToDosError
NtCreateFile
NtReadFile
NtWriteFile
NtCancelIoFileEx

api-ms-win-crt-string-l1-1-0

_wcsicmp
strlen
_stricmp
wcsncmp
strcpy_s
wcslen
strcmp

api-ms-win-crt-math-l1-1-0

pow
log
modf
ceil
floor
round
__setusermatherr
trunc

api-ms-win-crt-heap-l1-1-0

malloc
free
calloc
_set_new_mode
_callnewh

api-ms-win-crt-convert-l1-1-0

strtoull
wcstol
_ultow_s

api-ms-win-crt-runtime-l1-1-0

_crt_atexit
terminate
_register_onexit_function
_seh_filter_exe
_set_app_type
_configure_narrow_argv
_initialize_onexit_table
_initialize_narrow_environment
_get_initial_narrow_environment
_initterm
_initterm_e
exit
_register_thread_local_exe_atexit_callback
abort
_exit
_c_exit
__p___argc
__p___argv
_cexit

api-ms-win-crt-stdio-l1-1-0

__p__commode
_set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Exports

Exports

DotNetRuntimeDebugHeader

Sections

.text
Size: 12.4MB - Virtual size: 12.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.managed
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

hydrated
Size: - Virtual size: 611KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 6.3MB - Virtual size: 6.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 30KB - Virtual size: 126KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 755KB - Virtual size: 754KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 500B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 45KB - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 80KB - Virtual size: 80KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6db98f691c23018042e41a85c52dd695

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

bcryptprimitives

api-ms-win-core-synch-l1-2-0

kernel32

user32

advapi32

comctl32

gdi32

dwmapi

ole32

shell32

oleaut32

bcrypt

ws2_32

secur32

crypt32

uxtheme

ntdll

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

Exports

Exports

Sections

.text Size: 12.4MB - Virtual size: 12.4MB

.managed Size: 1.2MB - Virtual size: 1.2MB

hydrated Size: - Virtual size: 611KB

.rdata Size: 6.3MB - Virtual size: 6.3MB

.data Size: 30KB - Virtual size: 126KB

.pdata Size: 755KB - Virtual size: 754KB

_RDATA Size: 512B - Virtual size: 500B

.rsrc Size: 45KB - Virtual size: 44KB

.reloc Size: 80KB - Virtual size: 80KB

.text
Size: 12.4MB - Virtual size: 12.4MB

.managed
Size: 1.2MB - Virtual size: 1.2MB

hydrated
Size: - Virtual size: 611KB

.rdata
Size: 6.3MB - Virtual size: 6.3MB

.data
Size: 30KB - Virtual size: 126KB

.pdata
Size: 755KB - Virtual size: 754KB

_RDATA
Size: 512B - Virtual size: 500B

.rsrc
Size: 45KB - Virtual size: 44KB

.reloc
Size: 80KB - Virtual size: 80KB