Static task
static1
Behavioral task
behavioral1
Sample
2024-06-06_622131f86833cc24052f108f0272031c_megazord.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-06-06_622131f86833cc24052f108f0272031c_megazord.exe
Resource
win10v2004-20240508-en
General
-
Target
2024-06-06_622131f86833cc24052f108f0272031c_megazord
-
Size
66.7MB
-
MD5
622131f86833cc24052f108f0272031c
-
SHA1
9f24a990fe5f48ab74b3244405c18500a0a69992
-
SHA256
bb00ada8da733b73dad1a85ce1e2342710ccd0c511044302b5797aa4ad434803
-
SHA512
cdf2bc3e9d67a11c9354abf111b321976def1f8269a1ad35262c3bef4865890788ab62b3d565810f5105bb491851944384f58faaa0b1693abe1da9fe93c5ffaa
-
SSDEEP
1572864:CJZMeF90EQk3w9k6Adv88xxozyyxoj6d:kZZ9H3w9kv88EGyiud
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-06-06_622131f86833cc24052f108f0272031c_megazord
Files
-
2024-06-06_622131f86833cc24052f108f0272031c_megazord.exe windows:6 windows x64 arch:x64
2c00d6d7ced0b7f65dfa124e1fb6b5e7
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
QueryPerformanceCounter
QueryPerformanceFrequency
ReleaseSemaphore
WaitForSingleObject
CreateThread
ExitThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
CreateSemaphoreA
CreateWaitableTimerA
GetModuleHandleA
GetEnvironmentVariableW
SetCurrentDirectoryW
GetCurrentDirectoryW
CreateDirectoryW
CreateFileW
FindClose
FindFirstFileExW
FindNextFileW
FlushFileBuffers
GetDriveTypeW
GetFileAttributesW
GetFileInformationByHandle
GetFileType
GetFinalPathNameByHandleW
SetFileInformationByHandle
SetFileTime
DuplicateHandle
SetLastError
Sleep
GetSystemTime
GetSystemInfo
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
GetModuleFileNameW
MoveFileExW
SystemTimeToFileTime
MultiByteToWideChar
WideCharToMultiByte
IsValidLocale
GetLocaleInfoW
LCMapStringW
GetStdHandle
GetCommandLineW
FindFirstFileW
GetProcessTimes
GetNativeSystemInfo
FormatMessageA
GetConsoleScreenBufferInfo
SetConsoleTextAttribute
DeleteCriticalSection
TryEnterCriticalSection
LeaveCriticalSection
CompareStringW
SearchPathW
TerminateProcess
GetExitCodeProcess
CreateProcessW
CreateJobObjectW
AssignProcessToJobObject
SetInformationJobObject
EnterCriticalSection
CreateFileA
GetFileAttributesA
SetFilePointerEx
WriteFile
MapViewOfFileEx
CreateFileMappingA
GetTempPathA
GetTempFileNameA
GetTimeFormatW
GetLocaleInfoA
SetConsoleMode
RaiseException
GetCurrentThreadId
HeapCreate
HeapDestroy
SetStdHandle
GetEnvironmentVariableA
SetUnhandledExceptionFilter
RtlCaptureContext
InitializeCriticalSection
GetProcAddress
LoadLibraryW
SetConsoleCtrlHandler
VerifyVersionInfoW
VerSetConditionMask
GetModuleHandleW
IsDebuggerPresent
GetDateFormatW
GetCommandLineA
FreeLibraryAndExitThread
TzSpecificLocalTimeToSystemTime
SystemTimeToTzSpecificLocalTime
GetTimeZoneInformation
GetModuleHandleExW
SetThreadErrorMode
ConnectNamedPipe
LocalFree
WaitNamedPipeW
CreateNamedPipeW
DisconnectNamedPipe
FormatMessageW
RtlVirtualUnwind
GetUserDefaultLCID
EnumSystemLocalesW
GetFileSizeEx
FileTimeToSystemTime
GetCurrentThread
GetLastError
SetThreadPriority
AcquireSRWLockExclusive
GetConsoleMode
VirtualQuery
LocalAlloc
LoadLibraryExW
GetACP
GetOEMCP
FreeLibrary
ReadFile
GetCurrentProcess
OutputDebugStringW
AcquireSRWLockShared
ReleaseSRWLockShared
SleepConditionVariableSRW
CloseHandle
RegisterWaitForSingleObject
UnregisterWaitEx
PeekNamedPipe
HeapWalk
HeapValidate
SetEndOfFile
GetConsoleOutputCP
RtlUnwind
RtlUnwindEx
SetHandleInformation
GetCPInfo
GetStringTypeW
CreateIoCompletionPort
CancelIoEx
GetOverlappedResult
PostQueuedCompletionStatus
GetQueuedCompletionStatusEx
SetFileCompletionNotificationModes
SetConsoleCursorInfo
SetConsoleCursorPosition
WaitForMultipleObjects
CreateConsoleScreenBuffer
SetConsoleActiveScreenBuffer
CreateSemaphoreW
FillConsoleOutputCharacterA
FillConsoleOutputAttribute
WriteConsoleW
ReadConsoleInputW
GetNumberOfConsoleInputEvents
GetFileInformationByHandleEx
FreeEnvironmentStringsW
DeleteProcThreadAttributeList
CompareStringOrdinal
AddVectoredExceptionHandler
SetThreadStackGuarantee
SwitchToThread
CreateWaitableTimerExW
SetWaitableTimer
RtlLookupFunctionEntry
GetEnvironmentStringsW
SetEnvironmentVariableW
TryAcquireSRWLockExclusive
DecodePointer
WriteFileEx
SleepEx
WakeAllConditionVariable
WakeConditionVariable
HeapFree
EncodePointer
HeapReAlloc
ReleaseMutex
GetProcessHeap
HeapAlloc
DeleteFileW
RemoveDirectoryW
CreateEventW
LCMapStringEx
SleepConditionVariableCS
InitializeConditionVariable
ExitProcess
GetFullPathNameW
ReadFileEx
GetSystemDirectoryW
GetWindowsDirectoryW
InitializeProcThreadAttributeList
UpdateProcThreadAttribute
ReadConsoleW
GetSystemTimeAsFileTime
WaitForSingleObjectEx
LoadLibraryA
CreateMutexA
GetExitCodeThread
InitializeCriticalSectionEx
InitializeSRWLock
ReleaseSRWLockExclusive
IsValidCodePage
InitOnceExecuteOnce
RtlPcToFileHeader
GetStartupInfoW
InitializeSListHead
IsProcessorFeaturePresent
GetCurrentProcessId
UnhandledExceptionFilter
ResetEvent
InitializeCriticalSectionAndSpinCount
SetEvent
HeapSize
ws2_32
WSASend
recv
shutdown
getsockopt
listen
ioctlsocket
connect
bind
WSASocketW
getsockname
accept
getpeername
recvfrom
WSACleanup
WSAStartup
sendto
setsockopt
WSAIoctl
WSAGetLastError
socket
freeaddrinfo
getaddrinfo
closesocket
send
psapi
GetModuleFileNameExW
EnumProcessModules
GetModuleInformation
advapi32
IsValidSid
SystemFunction036
CryptAcquireContextW
SetSecurityDescriptorGroup
SetSecurityDescriptorOwner
AddAce
GetAce
InitializeAcl
GetAclInformation
CopySid
GetSidLengthRequired
GetSidSubAuthorityCount
SetSecurityDescriptorSacl
SetSecurityDescriptorDacl
GetSecurityDescriptorGroup
GetSecurityDescriptorOwner
GetSecurityDescriptorSacl
GetSecurityDescriptorDacl
RegOpenKeyExW
RegQueryValueExW
InitializeSecurityDescriptor
RegCloseKey
FreeSid
SetSecurityDescriptorControl
GetSecurityDescriptorControl
CryptReleaseContext
CryptGenRandom
crypt32
CertVerifyTimeValidity
CertGetEnhancedKeyUsage
CertFreeCertificateContext
CertCloseStore
CertOpenStore
CertDuplicateCertificateContext
CertEnumCertificatesInStore
iphlpapi
GetIpForwardTable
GetAdaptersAddresses
shell32
SHGetKnownFolderPath
ole32
CoTaskMemFree
user32
GetForegroundWindow
GetKeyboardLayout
GetWindowThreadProcessId
ToUnicodeEx
CharUpperW
bcrypt
BCryptGenRandom
ntdll
RtlNtStatusToDosError
NtCancelIoFileEx
NtCreateFile
NtDeviceIoControlFile
NtReadFile
NtWriteFile
Sections
.text Size: 34.6MB - Virtual size: 34.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 28.8MB - Virtual size: 28.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1.8MB - Virtual size: 2.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 1.1MB - Virtual size: 1.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: 512B - Virtual size: 244B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 139KB - Virtual size: 139KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 245KB - Virtual size: 245KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ