Krnl.zip
- SHA256 11202449315d0f2edb567c5f5e3e4bd403ae0985574344ea8ddf474c1b1fb440
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Krnl.zip
Resource
win10v2004-20240226-en
windows10-2004-x64
12 signatures
300 seconds
Behavioral task
behavioral2
Sample
Launcher.bat
Resource
win10v2004-20240508-en
windows10-2004-x64
20 signatures
300 seconds
Behavioral task
behavioral3
Sample
conf
Resource
win10v2004-20240426-en
windows10-2004-x64
0 signatures
300 seconds
Behavioral task
behavioral4
Sample
lua51.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
2 signatures
300 seconds
Behavioral task
behavioral5
Sample
luajit.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
0 signatures
300 seconds
General
- Target Krnl.zip
- Size 460KB
- Sample240607-1jdl6seb55
- SHA256 11202449315d0f2edb567c5f5e3e4bd403ae0985574344ea8ddf474c1b1fb440
- MD5 0a6757a13623c4d9840b0aca6c243b52
- SHA1 35804c36e9bccc5cac2d406d837fcc9e14060ac7
- SHA512 0110dfb0886dcb22b0cc9243f36a1ce60929d00712e31e3eb0e268f9c89d42549ad974377fae8ca0c1919c8b33c1277bdbfe7fb34154f26a5ee0cb7dd9b21e3a
- SSDEEP 12288:LANUGCFJT0fU0Yz3jBL75xwc4XscIFl4zA6fzvBLrkwRC:LAmFJcKjRdxwr81FlQxfDxrk7
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/lua51.dll unpack001/luajit.exe
File Explorer
-
Krnl.zip.zip 460KB
-
Launcher.bat.bat .vbs 724B
-
conf156KB
-
lua51.dll.dll 592KB
-
luajit.exe.exe 89KB
Launcher.bat
- SHA256 f1ed443faa01092320e04e0231327bd59c6df7344ad0f46ca4885d28aa2afd60
- MD5 9edcc8710e562b5daeed73acaa17e2fd
- SHA1 a3d7d0a26c3a058ff0b3a25c64d43397f1823d95
- SHA512 312fec45d3897ecc67285694a73d4fc7ef044b6f3aa1e6a9d5a8cee0b1b70204396b43fe014a4680c539427c070f199ff91f151fbdc2ae8e0d97f1b3fca3cb4a
- MD5 SHA1 SHA512
conf
- SHA256 4464be92e1a9c00e808fe6913afe721743e3e5f7693edb944499e3700ea6a308
- MD5 bdec530c93a6d9dea9fb4ea147f1f44c
- SHA1 c027d59a30392fcc0be410cb921352360bb08f7b
- SHA512 4042aeb8391a61b20f3c9d7581a098e333265583f00f80b70d56a0344c37a60d8c32bd0b9816d499ab27a0aa406e7a3ed3a4a7f87189d8c030de6dc4bfdc773c
- SSDEEP 3072:p43rMpuwyY7tqkLl+UW22qluZwtGXYUfacYY63/KeBGI4Co:pirMpuwyY5qigqQatmYUfv63/sOo
- MD5 SHA1 SHA512 SSDEEP
lua51.dll
- IMPHASH 9466a71df1d3a59794f8605626534abe
- SHA256 ff976f6e965e3793e278fa9bf5e80b9b226a0b3932b9da764bffc8e41e6cdb60
- MD5 3dff7448b43fcfb4dc65e0040b0ffb88
- SHA1 583cdab08519d99f49234965ffd07688ccf52c56
- SHA512 cdcbe0ec9ddd6b605161e3c30ce3de721f1333fce85985e88928086b1578435dc67373c3dc3492ed8eae0d63987cac633aa4099b205989dcbb91cbbfc8f6a394
- SSDEEP 12288:rs7/mj/73RaLHIW5BmUeUhoE4RgiF1q1bPIBKsg4Db0S:rc/u/7IoRnUKfq1Dl4DY
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
343186
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
GetLastError
SetLastError
VirtualAlloc
VirtualFree
VirtualQuery
VirtualProtect
FreeLibrary
GetModuleHandleExA
GetProcAddress
LoadLibraryExA
FormatMessageA
RaiseException
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
WaitForSingleObject
Sleep
CreateThread
RtlUnwind
GetModuleFileNameA
GetModuleHandleA
IsProcessorFeaturePresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
SetEndOfFile
InterlockedFlushSList
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
ExitProcess
GetModuleHandleExW
ReadFile
CloseHandle
DuplicateHandle
CreateProcessA
GetTempPathW
QueryPerformanceFrequency
MultiByteToWideChar
WideCharToMultiByte
HeapFree
HeapAlloc
FlushFileBuffers
WriteFile
GetConsoleCP
GetConsoleMode
GetStdHandle
GetFileType
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
ReadConsoleW
DecodePointer
GetACP
SetFilePointerEx
GetExitCodeProcess
GetFileAttributesExW
CreatePipe
CreateFileW
GetTimeZoneInformation
DeleteFileW
MoveFileExW
FindClose
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
GetProcessHeap
SetStdHandle
GetStringTypeW
HeapSize
HeapReAlloc
WriteConsoleW
luaJIT_profile_dumpstack
luaJIT_profile_start
luaJIT_profile_stop
luaJIT_setmode
luaJIT_version_2_1_0_beta3
luaL_addlstring
luaL_addstring
luaL_addvalue
luaL_argerror
luaL_buffinit
luaL_callmeta
luaL_checkany
luaL_checkinteger
luaL_checklstring
luaL_checknumber
luaL_checkoption
luaL_checkstack
luaL_checktype
luaL_checkudata
luaL_error
luaL_execresult
luaL_fileresult
luaL_findtable
luaL_getmetafield
luaL_gsub
luaL_loadbuffer
luaL_loadbufferx
luaL_loadfile
luaL_loadfilex
luaL_loadstring
luaL_newmetatable
luaL_newstate
luaL_openlib
luaL_openlibs
luaL_optinteger
luaL_optlstring
luaL_optnumber
luaL_prepbuffer
luaL_pushmodule
luaL_pushresult
luaL_ref
luaL_register
luaL_setfuncs
luaL_setmetatable
luaL_testudata
luaL_traceback
luaL_typerror
luaL_unref
luaL_where
lua_atpanic
lua_call
lua_checkstack
lua_close
lua_concat
lua_copy
lua_cpcall
lua_createtable
lua_dump
lua_equal
lua_error
lua_gc
lua_getallocf
lua_getfenv
lua_getfield
lua_gethook
lua_gethookcount
lua_gethookmask
lua_getinfo
lua_getlocal
lua_getmetatable
lua_getstack
lua_gettable
lua_gettop
lua_getupvalue
lua_insert
lua_iscfunction
lua_isnumber
lua_isstring
lua_isuserdata
lua_isyieldable
lua_lessthan
lua_load
lua_loadx
lua_newstate
lua_newthread
lua_newuserdata
lua_next
lua_objlen
lua_pcall
lua_pushboolean
lua_pushcclosure
lua_pushfstring
lua_pushinteger
lua_pushlightuserdata
lua_pushlstring
lua_pushnil
lua_pushnumber
lua_pushstring
lua_pushthread
lua_pushvalue
lua_pushvfstring
lua_rawequal
lua_rawget
lua_rawgeti
lua_rawset
lua_rawseti
lua_remove
lua_replace
lua_resume
lua_setallocf
lua_setfenv
lua_setfield
lua_sethook
lua_setlocal
lua_setmetatable
lua_settable
lua_settop
lua_setupvalue
lua_status
lua_toboolean
lua_tocfunction
lua_tointeger
lua_tointegerx
lua_tolstring
lua_tonumber
lua_tonumberx
lua_topointer
lua_tothread
lua_touserdata
lua_type
lua_typename
lua_upvalueid
lua_upvaluejoin
lua_version
lua_xmove
lua_yield
luaopen_base
luaopen_bit
luaopen_debug
luaopen_ffi
luaopen_io
luaopen_jit
luaopen_math
luaopen_os
luaopen_package
luaopen_string
luaopen_table
Name
.text
Size
479KB
Virtual Size
478KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
96KB
Virtual Size
96KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=60, id=259, version=25203,
count=195, id=261, version=25203,
count=26, id=260, version=25203,
count=3, id=257, version=25203,
count=108, id=1, productName=Unmarked objects,
count=25, id=259, version=25810,
count=23, id=261, version=25810,
count=16, id=260, version=25810,
count=1, productName=Unmarked objects (old),
count=65, id=260, productName=VS2017 v15.5.4 build 25834, version=25834,
count=1, id=256, productName=VS2017 v15.5.4 build 25834, version=25834,
count=1, id=258, productName=VS2017 v15.5.4 build 25834, version=25834,
luajit.exe
- IMPHASH d0264e200554ef617c521261fe8fe2a4
- SHA256 1cf20b8449ea84c684822a5e8ab3672213072db8267061537d1ce4ec2c30c42a
- MD5 dd98a43cb27efd5bcc29efb23fdd6ca5
- SHA1 38f621f3f0df5764938015b56ecfa54948dde8f5
- SHA512 871a2079892b1eb54cb761aebd500ac8da96489c3071c32a3dab00200f74f4e12b9ab6c62623c53aea5b8be3fc031fb1b3e628ffe15d73323d917083240742b0
- SSDEEP 1536:Ee7h7q/J6K3nHC+AGUob2f0DBFPbPWNPWp350NHcHkDsWqxcd2ZPSAv:Ee7oU8HC+AGUu2abPbPWQpO8E0A2tSAv
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
10187
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
lua51
lua_gettop
luaJIT_version_2_1_0_beta3
luaL_openlibs
luaL_traceback
luaL_newstate
luaL_loadbuffer
luaL_loadfile
luaL_where
luaL_callmeta
lua_sethook
lua_concat
lua_error
lua_gc
lua_cpcall
lua_pcall
lua_call
lua_rawseti
lua_setfield
lua_createtable
lua_rawgeti
lua_getfield
lua_gettable
lua_pushboolean
lua_pushcclosure
lua_pushfstring
lua_pushstring
lua_pushlstring
lua_pushnil
lua_objlen
lua_tolstring
lua_toboolean
lua_type
lua_isstring
lua_insert
lua_remove
lua_pushvalue
lua_settop
lua_close
kernel32
TlsAlloc
DecodePointer
ReadConsoleW
ReadFile
WriteConsoleW
CreateFileW
CloseHandle
HeapReAlloc
HeapSize
SetFilePointerEx
GetProcessHeap
GetStringTypeW
SetStdHandle
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCPInfo
GetOEMCP
IsValidCodePage
FindNextFileA
FindFirstFileExA
FindClose
GetConsoleMode
GetConsoleCP
FlushFileBuffers
GetFileType
LCMapStringW
CompareStringW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
RtlUnwind
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
RaiseException
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
SetConsoleCtrlHandler
GetStdHandle
WriteFile
GetModuleFileNameA
MultiByteToWideChar
WideCharToMultiByte
ExitProcess
GetModuleHandleExW
GetCommandLineA
GetCommandLineW
GetACP
HeapFree
HeapAlloc
Name
.text
Size
57KB
Virtual Size
56KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
24KB
Virtual Size
23KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=259, version=25203,
count=139, id=261, version=25203,
count=18, id=260, version=25203,
count=2, id=257, version=25203,
count=18, id=259, version=25810,
count=29, id=261, version=25810,
count=17, id=260, version=25810,
count=3, id=257, productName=VS2017 v15.5.4 build 25834, version=25834,
count=122, id=1, productName=Unmarked objects,
count=1, id=260, productName=VS2017 v15.5.4 build 25834, version=25834,
count=1, id=258, productName=VS2017 v15.5.4 build 25834, version=25834,