�Z*Q���}�WNߓ�������ފ��!g�I2�e�pz�3�tm�ErJ�b��"ֈ灐����!;3{؆&Pr�������qA�����3@H�����~s��`��Bn<�]������ yx+~ �z��"[�����P�=�MJ�ڶ�JĢ�ʙZJ������͖���e���L]X�,a_��\x����_/�aR��f�U�/qb^���Kf�:Os.�XW�$ � =RCEA��]�(9���a�uk�O�q��.?��a.ҝQ uxVF�����w����n��k��<��B0��[Ik����Y<�ӽ>>ˋ�ˁ^S��}�����|�7�[�����k��ӧn ;.�x e� �)/w變�{-,d��(�Z4��B$BgV���cN�;}��a�xs�|�d����Iڦ�䃈+qxj� � ��'��]i� ����2`Z�t��T�M�87?���^�������҆R8n�r'����%��Z�Ak�F���wІ��zl��(���LM%�:�]�ݷN� ��� �?�s����̈́�^$�j��+f���ߨ��7BU�] cxHt"xH�!9��&��'�i�)'���w��A"��1�}Պ�� 44�%KR�V^d&&S�~��P�������n�l犋�>��u�Lw��1e�zY�na$y�܍�H�O����^�6:O��OENj��c�EK�� �9�cj����M V6�n�^ ̄�;���H��R�I g��LKf�H�:.`���'��n��ՠlA��(gE���n��%��e��q����ME 1��s�$���b ���5�Q���r�r � �O'�i��yW 9u�5��R;�����GY��(�1�� �`(�*fѤ]�<E�ʞѮiz��>�&u�t����a:)<FhÚ%8o�5.���p��1?����.��o�]((�I�!��� �����f '��\�V�C:l�dfe�����g�9aW�WW!���/���"�}��oKxgs1���L^,3�&�n����/�ʸ5�_C#'��d�3�L�mf���2�A���P�%+@�7@��J���|��{_|�`�G��6U� �?��� %�$a��lQo���rq���lk��ca�܉#��>n�iCd+ۍy]r���Z%_zFRO����;!lc6k�U{1?C�����N�)Ӎ��TE�]ֿUv.&Dh��3��m�0N���p�f��o�XGu��eVԍ�;ED�' ;�'N�ǃVP��� �n+�~oo�A����@]<�nK�Fr:�%;u� f4�g7�v�6�|�O��z��G��5c��`�vo���P���E��\7��T[F����ҭAoh�F �����$�1�W��ʾ́C�$�&d?!�1�^��Vщ��-���S�f)�Q�� +2ЉN���\Y�նj�^!��{��l����GF� VΩ���-��Z$꡴�P{�5��h �ݢ"y1�]<�mY�~t�u(-�'��r%�`�,�^u�9�ߍ��]�*b!e5����A�����ѽ�Dw�W�h�Y��$���v�dm��+�w �n@����r�5���lcmB�K�QOw%g��xq(��͔�6d���y� ��VG�4����#y@���+�]�� d@��1�� d�Ń� ��p(k�ݿ��0B�[�,)�n�gґ~�AKk�. >[������v�(&���l��W?���a�l=jb���Y�b�;�$7�7�!5�r�2w�Q��x�0��͋k#��Z�u˼���ad����Ա3�������7_I�i?���YD�5�X���Ok�_�R �l]�[���[�6�� Y'����H�J "��#�!��V�c`�?;��#Jf[ӏ����)[9�Tt:�',��Iv���z�fZ����(��)�PS��牊ekB2=�gxNȀ�SBZΩg�d��I�MepDL ����*��t��PQ�f�j���8���(��;�e�ꇺGRU�� �zIǚ8ٟI4���5�_g����}��P2��N�X!M��Z���P����Ռ�R��W��2�D�((��������N$R�����7��^�ؔZ�Ǵ�]�����]*��j��1Т]��0lSK������g�*� N��5g���N^m��4G�����������* ����X�u�(�>�pbΡ��{����y��ͧ��ɾ�i���� ƶ����f������P� �t����t�)����G��U �Ӕ�Q���ī3����v�H�Z4�xy}&S1��5�ʙS���N�� a#�J?T����KRI�M�����P</��r���B��Ԃ^�o�{��<1.������H(|�����>�+��!����J��%�������d�Z\#'´,V��H���[(���TŐ�l4:U\[�Nʔ���3⠼c��G�$ׁ�{M�i��{8M�[Y;nH� �K�����5^l��xMo�7 D�`���BfO��X��0�]�� l�#���mNQ��u�Ԗ�&��+��� W���v.�ͦ������!�Μ���6�y��2�̼��n �k���Cw�����L�8���_v�GM���E��3�eC��"�- �J5d�P��b *�Pm�#�j�Z��sU��*���1-V��P�4�����D@%�>��z����*<���3��C�܌Y�y�y+T�}�@j��q��|d�H���Yn��6��n�� )��! �5��a>�u�� 1��~|§*ڠ����7RZ��%Ô:r�t�gA��6W�� L��h[(�[�놟��(+��:JA $��6�k� ����b���V�Qo��_�h6V�A��3��L���W�`���9�W_)3�&����L7S���O�1���J��.[� ���p5g�3e{"P~���M=����5�7TF�gF+`�z��ٵ�A��|!�X�>ڿBƊ�^:s�v�B+:g�2��v����f�OfOTYU�"�}����?$����vJ0B��S�}�e�Mk��ZP�`��7�R���X�}T�l�,�<��e���e�����ƀ`dKڻ����ۙ����k@�w���*"�1�P�M�jga��
Behavioral task
behavioral1
Sample
eftclient.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
eftclient.exe
Resource
win10v2004-20240426-en
General
-
Target
eftclient.exe
-
Size
21.8MB
-
MD5
48325646d90c506463a3f58c7864b2b8
-
SHA1
f1b5885318b40eaf38d314e1772cb5c3fe771593
-
SHA256
9763d3b89af143f4501565c92bec5d89b545fc51705a6d9d55a3b33f0fbb66b6
-
SHA512
896d3003818e7b71af22ee27ec084359308a73929ebf4b55c7939adc98834fc30cbbb62bc795e2ad07182f7863392970aff0a84f44ea959e21b4b9050cd07c1c
-
SSDEEP
393216:HaKpJw4WEVJ2zUpVTZ6jMueYzcdx98MfecBQ79VlCInSaGVBKn866F:HaKpJw4WEVkYpl84azcdteMQT8InSaG3
Malware Config
Signatures
-
resource yara_rule sample themida -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource eftclient.exe
Files
-
eftclient.exe.exe windows:6 windows x64 arch:x64
e685f5e832f31232b8168ace1f38df04
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
LoadLibraryA
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
MessageBoxA
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
advapi32
RegCreateKeyA
msvcp140
??1_Lockit@std@@QEAA@XZ
ntdll
RtlInitUnicodeString
winhttp
WinHttpOpen
iphlpapi
IcmpCloseHandle
winmm
timeGetDevCaps
vcruntime140
_local_unwind
vcruntime140_1
__CxxFrameHandler4
api-ms-win-crt-runtime-l1-1-0
_invalid_parameter_noinfo_noreturn
api-ms-win-crt-heap-l1-1-0
_callnewh
api-ms-win-crt-string-l1-1-0
tolower
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vsprintf_s
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
api-ms-win-crt-convert-l1-1-0
strtoul
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-filesystem-l1-1-0
_unlock_file
api-ms-win-crt-utility-l1-1-0
srand
api-ms-win-crt-environment-l1-1-0
getenv
api-ms-win-crt-math-l1-1-0
__setusermatherr
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 421KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 158KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 10.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.themida Size: - Virtual size: 11.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.themida Size: 21.8MB - Virtual size: 21.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ