2024-05-23_4d44281d369e84305f28e8c62fec217d_megazord

Sharing

Copy URL Twitter E-mail

General

Target

2024-05-23_4d44281d369e84305f28e8c62fec217d_megazord
Size

6.0MB
MD5

4d44281d369e84305f28e8c62fec217d
SHA1

76d55c1d6ffce6fba027153ef93d399e5bbf9520
SHA256

d6310e39bb2a031e2c7718599d52a18a85d2631860ae4346cd0615e16abb4fdb
SHA512

89aa57b747de36b4b92c97ff74eff04516f15751eeeb12c3e9a2823f438e00e62d8bd4b7c6253268c68f9b110a0a6430534126d4a2a4274d1b4384bae500e74f
SSDEEP

49152:NpRUcsUFnutXor/sSmgT6fZHKGndQh6Y8bwnezTokpYPydv4EJSNpT5vLREQhsCT:PUs/U1j4N5HyCwFA4GB

Score

10^/10

Malware Config

Signatures

Detects executables containing URLs to raw contents of a Github gist 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-05-23_4d44281d369e84305f28e8c62fec217d_megazord

Files

2024-05-23_4d44281d369e84305f28e8c62fec217d_megazord
.exe windows:6 windows x64 arch:x64

124e01e489f2fea8e85caf7f074a598a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

komorebic.pdb

Imports

bcryptprimitives

ProcessPrng

api-ms-win-core-synch-l1-2-0

WakeByAddressAll
WakeByAddressSingle
WaitOnAddress

ntdll

RtlNtStatusToDosError
NtWriteFile
NtDeviceIoControlFile
RtlVirtualUnwind
NtCreateFile
RtlLookupFunctionEntry
RtlCaptureContext
NtQuerySystemInformation
NtCancelIoFileEx
RtlUnwindEx
RtlPcToFileHeader
RtlGetVersion
NtQueryInformationProcess
NtReadFile

kernel32

GetOverlappedResult
WriteFile
SetFileCompletionNotificationModes
GetStringTypeW
SetStdHandle
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindFirstFileExW
GetCommandLineA
GetModuleHandleExW
QueryPerformanceFrequency
QueryPerformanceCounter
GetCurrentProcessId
LoadLibraryExW
CreateFileW
TlsFree
GetProcessTimes
VirtualQueryEx
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
ReadFile
GlobalMemoryStatusEx
K32GetPerformanceInfo
GetExitCodeProcess
GetQueuedCompletionStatusEx
GetProcessHeap
HeapFree
OpenProcess
GetSystemTimes
GetProcessIoCounters
EncodePointer
HeapAlloc
ReadProcessMemory
RaiseException
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
InitializeSListHead
MultiByteToWideChar
CreateIoCompletionPort
IsDebuggerPresent
CompareStringW
CreateEventW
GetLastError
WaitForSingleObject
LoadLibraryExA
GetProcAddress
FreeLibrary
PostQueuedCompletionStatus
CloseHandle
LCMapStringW
FormatMessageW
SetLastError
GetFullPathNameW
GetCurrentThread
CreateThread
WriteConsoleW
UpdateProcThreadAttribute
InitializeProcThreadAttributeList
CreateProcessW
GetModuleHandleW
GetWindowsDirectoryW
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
WaitForMultipleObjects
ReadFileEx
GetFileType
GetFinalPathNameByHandleW
GetFileInformationByHandleEx
HeapReAlloc
TerminateProcess
SleepEx
WriteFileEx
DuplicateHandle
SetFileInformationByHandle
SetEnvironmentVariableW
GetEnvironmentVariableW
SetWaitableTimer
CreateWaitableTimerExW
AddVectoredExceptionHandler
CompareStringOrdinal
DeleteProcThreadAttributeList
GetTimeZoneInformationForYear
GetStdHandle
CreateMutexA
LoadLibraryA
GetCurrentProcess
ReleaseMutex
SetThreadStackGuarantee
GetModuleFileNameW
FindClose
GetTempPathW
HeapSize
GetSystemTimePreciseAsFileTime
GetConsoleOutputCP
SetHandleInformation
GetSystemInfo
GetModuleHandleA
SetFilePointerEx
GetFileInformationByHandle
WaitForSingleObjectEx
CancelIo
GetConsoleScreenBufferInfo
SetConsoleTextAttribute
GetConsoleMode
SetConsoleMode
FindNextFileW
FindFirstFileW
FlushFileBuffers
CreateNamedPipeW
LocalFree
Sleep
GetCurrentThreadId
lstrlenW
GlobalFree
GlobalAlloc
CreateDirectoryW
DeleteFileW
GetSystemTimeAsFileTime
WideCharToMultiByte
ExitProcess
GetBinaryTypeW
GetCommandLineW
GetCurrentDirectoryW
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetFileAttributesW
SwitchToThread
GetStartupInfoW
GetSystemDirectoryW

user32

ShowWindow

secur32

InitializeSecurityContextW
AcceptSecurityContext
FreeContextBuffer
FreeCredentialsHandle
ApplyControlToken
DeleteSecurityContext
AcquireCredentialsHandleA
DecryptMessage
QueryContextAttributesW
EncryptMessage

ws2_32

getpeername
ioctlsocket
WSAStartup
getsockname
connect
WSACleanup
shutdown
WSASocketW
getaddrinfo
freeaddrinfo
bind
closesocket
getsockopt
WSAGetLastError
WSAIoctl
setsockopt
WSASend
send
recv

advapi32

RegCloseKey
OpenProcessToken
GetTokenInformation
IsValidSid
GetLengthSid
CopySid
RegQueryValueExW
RegOpenKeyExW

crypt32

CertGetCertificateChain
CertDuplicateCertificateChain
CertFreeCertificateChain
CertEnumCertificatesInStore
CertVerifyCertificateChainPolicy
CertFreeCertificateContext
CertDuplicateCertificateContext
CertAddCertificateContextToStore
CertDuplicateStore
CertCloseStore
CertOpenStore

pdh

PdhCollectQueryData
PdhAddEnglishCounterW
PdhGetFormattedCounterValue
PdhRemoveCounter
PdhOpenQueryA
PdhCloseQuery

powrprof

CallNtPowerInformation

ole32

CoTaskMemFree

oleaut32

GetErrorInfo
SysFreeString
SysStringLen

psapi

GetModuleFileNameExW
GetProcessMemoryInfo

shell32

CommandLineToArgvW
SHGetKnownFolderPath

Sections

.text
Size: 4.1MB - Virtual size: 4.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.7MB - Virtual size: 1.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 187KB - Virtual size: 187KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 500B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 26KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

124e01e489f2fea8e85caf7f074a598a

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

bcryptprimitives

api-ms-win-core-synch-l1-2-0

ntdll

kernel32

user32

secur32

ws2_32

advapi32

crypt32

pdh

powrprof

ole32

oleaut32

psapi

shell32

Sections

.text Size: 4.1MB - Virtual size: 4.1MB

.rdata Size: 1.7MB - Virtual size: 1.7MB

.data Size: 12KB - Virtual size: 16KB

.pdata Size: 187KB - Virtual size: 187KB

_RDATA Size: 512B - Virtual size: 500B

.reloc Size: 26KB - Virtual size: 26KB

.text
Size: 4.1MB - Virtual size: 4.1MB

.rdata
Size: 1.7MB - Virtual size: 1.7MB

.data
Size: 12KB - Virtual size: 16KB

.pdata
Size: 187KB - Virtual size: 187KB

_RDATA
Size: 512B - Virtual size: 500B

.reloc
Size: 26KB - Virtual size: 26KB