Static task
static1
Behavioral task
behavioral1
Sample
2024-06-01_046096593ddd81a6194c7a9cdec805fb_megazord.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
2024-06-01_046096593ddd81a6194c7a9cdec805fb_megazord.exe
Resource
win10v2004-20240426-en
General
-
Target
2024-06-01_046096593ddd81a6194c7a9cdec805fb_megazord
-
Size
66.7MB
-
MD5
046096593ddd81a6194c7a9cdec805fb
-
SHA1
7a91cda1c3638bfe2b9d7044c8fd60741a618120
-
SHA256
f4acf86196b5b28eed18ffb0bfca451d2fc19d9008d61219c318b12144a6a2f7
-
SHA512
0d6bc26dbfbf39f61cfc39e0dece85cd47284bbb2deed535bce4da34ea6828aaedfa04ed2a6ca9c0b22216e45c33d656c199761416ecf3549a928c841e3ac2f4
-
SSDEEP
786432:J6GPSSiDcNQptDUYUpBXHhGg0eiPhIaR04axqpGyqA336PD5:wSSSiDcNQp7UL3YiiZB04aUpWw6d
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-06-01_046096593ddd81a6194c7a9cdec805fb_megazord
Files
-
2024-06-01_046096593ddd81a6194c7a9cdec805fb_megazord.exe windows:6 windows x64 arch:x64
128f3fd9de92fde8c27d050343ec1fd5
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
ws2_32
WSASend
send
recv
shutdown
getsockopt
listen
ioctlsocket
connect
bind
WSASocketW
getsockname
accept
getpeername
recvfrom
WSACleanup
WSAStartup
setsockopt
WSAIoctl
WSAGetLastError
socket
freeaddrinfo
getaddrinfo
sendto
closesocket
kernel32
QueryPerformanceCounter
QueryPerformanceFrequency
ReleaseSemaphore
WaitForSingleObject
CreateThread
ExitThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
CreateSemaphoreA
CreateWaitableTimerA
GetModuleHandleA
GetEnvironmentVariableW
SetCurrentDirectoryW
GetCurrentDirectoryW
CreateDirectoryW
CreateFileW
FindClose
FindFirstFileExW
FindNextFileW
FlushFileBuffers
GetDriveTypeW
GetFileAttributesW
GetFileInformationByHandle
GetFileType
GetFinalPathNameByHandleW
SetFileInformationByHandle
SetFileTime
DuplicateHandle
SetLastError
Sleep
GetSystemTime
GetSystemInfo
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
GetModuleFileNameW
MoveFileExW
SystemTimeToFileTime
MultiByteToWideChar
WideCharToMultiByte
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
GetStdHandle
GetCommandLineW
FindFirstFileW
GetProcessTimes
GetNativeSystemInfo
FormatMessageA
GetConsoleScreenBufferInfo
SetConsoleTextAttribute
DeleteCriticalSection
TryEnterCriticalSection
LeaveCriticalSection
LCMapStringW
SearchPathW
TerminateProcess
GetExitCodeProcess
CreateProcessW
CreateJobObjectW
AssignProcessToJobObject
SetInformationJobObject
EnterCriticalSection
CreateFileA
GetFileAttributesA
SetFilePointerEx
WriteFile
MapViewOfFileEx
CreateFileMappingA
GetTempPathA
GetTempFileNameA
CompareStringW
GetLocaleInfoA
SetConsoleMode
RaiseException
GetCurrentThreadId
HeapCreate
HeapDestroy
SetStdHandle
GetEnvironmentVariableA
SetUnhandledExceptionFilter
RtlCaptureContext
InitializeCriticalSection
GetProcAddress
LoadLibraryW
SetConsoleCtrlHandler
VerifyVersionInfoW
VerSetConditionMask
GetModuleHandleW
IsDebuggerPresent
GetTimeFormatW
GetDateFormatW
GetCommandLineA
TzSpecificLocalTimeToSystemTime
SystemTimeToTzSpecificLocalTime
GetTimeZoneInformation
GetModuleHandleExW
SetThreadErrorMode
ConnectNamedPipe
LocalFree
WaitNamedPipeW
CreateNamedPipeW
DisconnectNamedPipe
FormatMessageW
RtlVirtualUnwind
EnumSystemLocalesW
GetFileSizeEx
IsValidCodePage
FileTimeToSystemTime
GetCurrentThread
GetLastError
SetThreadPriority
HeapSize
VirtualQuery
LoadLibraryExW
LocalAlloc
GetOEMCP
FreeLibrary
OutputDebugStringW
GetCurrentProcess
ReadFile
GetConsoleMode
TryAcquireSRWLockExclusive
AcquireSRWLockShared
ReleaseSRWLockShared
SleepConditionVariableSRW
ReleaseSRWLockExclusive
RegisterWaitForSingleObject
UnregisterWaitEx
FreeLibraryAndExitThread
PeekNamedPipe
HeapWalk
HeapValidate
SetEndOfFile
GetConsoleOutputCP
RtlUnwind
SetHandleInformation
RtlUnwindEx
GetCPInfo
GetStringTypeW
PostQueuedCompletionStatus
CreateIoCompletionPort
CancelIoEx
GetOverlappedResult
GetQueuedCompletionStatusEx
SetFileCompletionNotificationModes
SetConsoleCursorInfo
SetConsoleCursorPosition
WaitForMultipleObjects
CreateConsoleScreenBuffer
SetConsoleActiveScreenBuffer
CreateSemaphoreW
FillConsoleOutputCharacterA
FillConsoleOutputAttribute
WriteConsoleW
ReadConsoleInputW
GetNumberOfConsoleInputEvents
GetFileInformationByHandleEx
FreeEnvironmentStringsW
DeleteProcThreadAttributeList
CompareStringOrdinal
AddVectoredExceptionHandler
SetThreadStackGuarantee
SwitchToThread
CreateWaitableTimerExW
SetWaitableTimer
RtlLookupFunctionEntry
GetEnvironmentStringsW
SetEnvironmentVariableW
AcquireSRWLockExclusive
WriteFileEx
SleepEx
WakeAllConditionVariable
WakeConditionVariable
HeapFree
DecodePointer
HeapReAlloc
ReleaseMutex
GetProcessHeap
HeapAlloc
DeleteFileW
RemoveDirectoryW
CreateEventW
EncodePointer
LCMapStringEx
SleepConditionVariableCS
ExitProcess
GetFullPathNameW
ReadFileEx
GetSystemDirectoryW
GetWindowsDirectoryW
InitializeProcThreadAttributeList
UpdateProcThreadAttribute
ReadConsoleW
GetSystemTimeAsFileTime
WaitForSingleObjectEx
LoadLibraryA
CreateMutexA
InitializeConditionVariable
GetExitCodeThread
InitializeCriticalSectionEx
CloseHandle
GetACP
InitializeSRWLock
InitOnceExecuteOnce
RtlPcToFileHeader
GetStartupInfoW
InitializeSListHead
GetCurrentProcessId
IsProcessorFeaturePresent
UnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
SetEvent
ResetEvent
psapi
GetModuleInformation
EnumProcessModules
GetModuleFileNameExW
advapi32
IsValidSid
SystemFunction036
CryptAcquireContextW
SetSecurityDescriptorGroup
SetSecurityDescriptorOwner
AddAce
GetAce
InitializeAcl
GetAclInformation
CopySid
GetSidLengthRequired
GetSidSubAuthorityCount
SetSecurityDescriptorSacl
SetSecurityDescriptorDacl
GetSecurityDescriptorGroup
GetSecurityDescriptorOwner
GetSecurityDescriptorSacl
GetSecurityDescriptorDacl
RegOpenKeyExW
RegQueryValueExW
InitializeSecurityDescriptor
RegCloseKey
FreeSid
SetSecurityDescriptorControl
GetSecurityDescriptorControl
CryptReleaseContext
CryptGenRandom
crypt32
CertVerifyTimeValidity
CertGetEnhancedKeyUsage
CertFreeCertificateContext
CertCloseStore
CertOpenStore
CertDuplicateCertificateContext
CertEnumCertificatesInStore
iphlpapi
GetIpForwardTable
GetAdaptersAddresses
shell32
SHGetKnownFolderPath
ole32
CoTaskMemFree
user32
ToUnicodeEx
GetKeyboardLayout
GetWindowThreadProcessId
GetForegroundWindow
CharUpperW
bcrypt
BCryptGenRandom
ntdll
NtCancelIoFileEx
RtlNtStatusToDosError
NtWriteFile
NtReadFile
NtDeviceIoControlFile
NtCreateFile
Sections
.text Size: 34.5MB - Virtual size: 34.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 28.8MB - Virtual size: 28.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1.8MB - Virtual size: 2.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 1.1MB - Virtual size: 1.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: 512B - Virtual size: 244B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 139KB - Virtual size: 139KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 245KB - Virtual size: 245KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ