2024-05-25_74ac1825148109702a52be3db0aefa02_megazord

Sharing

Copy URL Twitter E-mail

General

Target
2024-05-25_74ac1825148109702a52be3db0aefa02_megazord
Size 3.9MB
Sample240525-kdkwasbg99
SHA256 2447438e200ce5fbb043278cd27960bb7ad9c8aa2767fc9331b5150d0b184b99
MD5 74ac1825148109702a52be3db0aefa02
SHA1 3c225c5ac67009f0192e0de457c8ea8b69a68462
SHA512 b25d6bf9c14a5fa23686ea73df1af4a17a4e8af44cb1beb7490431473f26eb8ec52ebcb47304ef2a44989bd21bb10cfd98cecdb53acc4db306aeee1094a18071
SSDEEP 49152:DVNUO/YueL2PYCDbLftqxo1XEC2gFuVoPBsE1/HENJ9WvU:62OMLBryJB
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-05-25_74ac1825148109702a52be3db0aefa02_megazord

File Explorer

2024-05-25_74ac1825148109702a52be3db0aefa02_megazord

.exe 3.9MB

2024-05-25_74ac1825148109702a52be3db0aefa02_megazord

IMPHASH 913aa5c7000612b194af7e2685626df1
SHA256 2447438e200ce5fbb043278cd27960bb7ad9c8aa2767fc9331b5150d0b184b99
MD5 74ac1825148109702a52be3db0aefa02
SHA1 3c225c5ac67009f0192e0de457c8ea8b69a68462
SHA512 b25d6bf9c14a5fa23686ea73df1af4a17a4e8af44cb1beb7490431473f26eb8ec52ebcb47304ef2a44989bd21bb10cfd98cecdb53acc4db306aeee1094a18071
SSDEEP 49152:DVNUO/YueL2PYCDbLftqxo1XEC2gFuVoPBsE1/HENJ9WvU:62OMLBryJB
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

434116

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

OpenProcessToken LookupPrivilegeValueW AdjustTokenPrivileges EnumerateTraceGuidsEx EventSetInformation EventUnregister EventActivityIdControl RegCloseKey EventRegister EventWriteTransfer RegEnumKeyExW RegEnumValueW RegOpenKeyExW RegQueryValueExW EventWrite EventEnabled

ncrypt

BCryptGenRandom

kernel32

RtlUnwind TlsFree GetCPInfoExW SetLastError GetConsoleMode GetLastError GetFileType ReadFile ReadConsoleW WriteFile WriteConsoleW GetConsoleOutputCP GetStdHandle MultiByteToWideChar WideCharToMultiByte K32EnumProcessModulesEx CloseHandle IsWow64Process GetExitCodeProcess TerminateProcess OpenProcess K32EnumProcesses K32GetModuleInformation K32GetModuleBaseNameW K32GetModuleFileNameExW GetProcessId DuplicateHandle GetCurrentProcess VirtualProtect VirtualAllocEx CreateProcessW GetConsoleWindow GetProcAddress LocalFree GetCurrentProcessId TzSpecificLocalTimeToSystemTime SystemTimeToFileTime FileTimeToSystemTime GetSystemTime GetCalendarInfoEx CompareStringOrdinal CompareStringEx FindNLSStringEx GetLocaleInfoEx ResolveLocaleName GetUserPreferredUILanguages FindStringOrdinal GetTickCount64 GetCurrentProcessorNumber GetCurrentThread Sleep InitializeCriticalSection InitializeConditionVariable DeleteCriticalSection EnterCriticalSection SleepConditionVariableCS LeaveCriticalSection WakeConditionVariable WaitForMultipleObjectsEx GetFullPathNameW GetLongPathNameW LocalAlloc RaiseFailFastException LocaleNameToLCID LCMapStringEx EnumTimeFormatsEx EnumCalendarInfoExEx ExpandEnvironmentStringsW FindClose FindFirstFileExW FreeLibrary GetFileAttributesExW GetSystemDirectoryW LoadLibraryExW SetThreadErrorMode GetThreadPriority GetDynamicTimeZoneInformation GetTimeZoneInformation SetEvent CreateEventExW GetEnvironmentVariableW FormatMessageW FlushProcessWriteBuffers QueryPerformanceCounter QueryPerformanceFrequency GetCurrentThreadId WaitForSingleObjectEx VirtualQuery RtlCaptureContext RtlRestoreContext AddVectoredExceptionHandler FlsAlloc FlsGetValue FlsSetValue CreateEventW SwitchToThread CreateThread SetThreadPriority SuspendThread ResumeThread GetThreadContext SetThreadContext FlushInstructionCache VirtualAlloc VirtualFree QueryInformationJobObject GetModuleHandleW GetModuleHandleExW GetProcessAffinityMask InitializeContext GetEnabledXStateFeatures SetXStateFeaturesMask InitializeCriticalSectionEx GetSystemTimeAsFileTime ResetEvent DebugBreak WaitForSingleObject SleepEx GlobalMemoryStatusEx GetSystemInfo GetTickCount GetLogicalProcessorInformation GetLogicalProcessorInformationEx GetLargePageMinimum VirtualUnlock GetWriteWatch ResetWriteWatch VirtualAllocExNuma IsProcessInJob GetNumaHighestNodeNumber GetProcessGroupAffinity K32GetProcessMemoryInfo TlsSetValue TlsGetValue TlsAlloc EncodePointer RaiseException RtlPcToFileHeader RtlUnwindEx IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlLookupFunctionEntry InitializeSListHead InitializeCriticalSectionAndSpinCount

ole32

CoCreateGuid CoGetApartmentType CoUninitialize CoInitializeEx CoTaskMemFree CoWaitForMultipleHandles CoTaskMemAlloc

user32

LoadStringW

api-ms-win-crt-heap-l1-1-0

free malloc _callnewh calloc _set_new_mode

api-ms-win-crt-math-l1-1-0

__setusermatherr tan modf ceil cos sin pow floor

api-ms-win-crt-string-l1-1-0

_wcsicmp strcmp strncpy_s strcpy_s _stricmp wcsncmp

api-ms-win-crt-runtime-l1-1-0

_c_exit _register_thread_local_exe_atexit_callback _exit terminate _crt_atexit _register_onexit_function _initialize_onexit_table _cexit __p___wargv __p___argc abort _seh_filter_exe _set_app_type exit _configure_wide_argv _initialize_wide_environment _get_initial_wide_environment _initterm _initterm_e

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vfprintf _set_fmode __p__commode __stdio_common_vsprintf_s __stdio_common_vsscanf __acrt_iob_func

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Name

.text

Size

461KB

Virtual Size

460KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.managed

Size

1.3MB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.6MB

Virtual Size

1.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

147KB

Virtual Size

210KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

126KB

Virtual Size

126KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

348B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

74KB

Virtual Size

74KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

134KB

Virtual Size

134KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2024-05-25_74ac1825148109702a52be3db0aefa02_megazord

advapi32

ncrypt

kernel32

ole32

user32

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic