2024-06-09_c9cef239f42fc7008009f20cd855b3a4_megazord

Sharing

Copy URL Twitter E-mail

General

Target

2024-06-09_c9cef239f42fc7008009f20cd855b3a4_megazord
Size

11.5MB
MD5

c9cef239f42fc7008009f20cd855b3a4
SHA1

2a95a427ed4c99729178fd53f6312b277a50d478
SHA256

40e18fbd1151d96ed33e8dba91b66a01b56a5a59f832ca969866dd54ae45890e
SHA512

7b785eefcb844fd2c080d69a65fa670c1f25002efa9ac44a7185210e164df504e9deee3b1ad34266286ca570dcd9d254aefad43be8b9d616e4e260153b00a76c
SSDEEP

98304:W4YLxT+lAXo+5GkJtG7r+CLKIQb/ZXgFE5SNyDwof5m+/rT:W5LxT+lqGkuvPmyyDt

Score

10^/10

Malware Config

Signatures

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-06-09_c9cef239f42fc7008009f20cd855b3a4_megazord

Files

2024-06-09_c9cef239f42fc7008009f20cd855b3a4_megazord
.exe windows:6 windows x64 arch:x64

c08c736502ac2aa204ae28ae526ee182

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

heyz.pdb

Imports

bcryptprimitives

ProcessPrng

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle
WaitOnAddress
WakeByAddressAll

kernel32

HeapSize
HeapValidate
UnmapViewOfFile
GetFileAttributesW
CreateFileW
WaitForSingleObject
CreateMutexW
GetTempPathW
UnlockFileEx
SetEndOfFile
GetFullPathNameA
SetFilePointer
LockFile
OutputDebugStringA
GetDiskFreeSpaceW
WriteFile
GetFullPathNameW
HeapFree
HeapCreate
ReadFile
AreFileApisANSI
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
TryEnterCriticalSection
DeleteCriticalSection
GetCurrentThreadId
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
GetTimeZoneInformation
GetConsoleOutputCP
GetCommandLineA
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
PeekNamedPipe
CreateIoCompletionPort
SetFileCompletionNotificationModes
PostQueuedCompletionStatus
GetQueuedCompletionStatusEx
GetModuleHandleW
GetModuleHandleExW
CreateFileA
LoadLibraryA
WaitForSingleObjectEx
DeleteFileA
FreeLibraryAndExitThread
ExitThread
DeleteFileW
HeapReAlloc
InitializeCriticalSectionAndSpinCount
EncodePointer
GetSystemInfo
LoadLibraryW
HeapAlloc
HeapCompact
HeapDestroy
UnlockFile
Sleep
GetProcAddress
LocalFree
LockFileEx
GetFileSize
GetCurrentProcessId
GetProcessHeap
SystemTimeToFileTime
FreeLibrary
WideCharToMultiByte
GetTempPathA
GetSystemTime
FormatMessageA
CreateFileMappingW
MapViewOfFile
GetTickCount
FormatMessageW
CompareStringW
FlushFileBuffers
LCMapStringW
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
RaiseException
RtlPcToFileHeader
RtlUnwindEx
GetStartupInfoW
IsDebuggerPresent
InitializeSListHead
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
InitializeCriticalSectionEx
SetEvent
CreateEventA
MultiByteToWideChar
QueryPerformanceFrequency
GetSystemDirectoryA
GetModuleHandleA
GetDiskFreeSpaceA
GetFileAttributesA
CreateMutexA
CreateThread
ReadConsoleW
WriteConsoleW
UpdateProcThreadAttribute
MoveFileExA
InitializeProcThreadAttributeList
CreateProcessW
GetWindowsDirectoryW
GetSystemDirectoryW
ReadFileEx
CreateNamedPipeW
ExitProcess
GetModuleFileNameW
GlobalFree
SetStdHandle
GlobalAlloc
FindFirstFileExW
GetTimeFormatW
GetEnvironmentVariableA
SleepEx
GetFileType
VerSetConditionMask
VerifyVersionInfoW
GetConsoleMode
GetFileSizeEx
QueryPerformanceCounter
GetLastError
SetLastError
GetFinalPathNameByHandleW
SetFileInformationByHandle
CloseHandle
GlobalUnlock
CancelIo
GetComputerNameExW
LoadLibraryExW
CopyFileExW
SetFileAttributesW
RtlUnwind
GetFileAttributesExW
OutputDebugStringW
GetSystemTimeAsFileTime
FlushViewOfFile
ReadProcessMemory
FindFirstFileW
CreateDirectoryW
GetFileInformationByHandleEx
GetFileInformationByHandle
FindClose
FindNextFileW
ReleaseMutex
GetSystemTimePreciseAsFileTime
VirtualQueryEx
OpenProcess
GetSystemTimes
GetProcessTimes
GlobalSize
GetExitCodeProcess
GetProcessIoCounters
TerminateProcess
WriteFileEx
GlobalLock
IsValidCodePage
GetStdHandle
SetFilePointerEx
GlobalMemoryStatusEx
GetCommandLineW
SetEnvironmentVariableW
K32GetPerformanceInfo
DeviceIoControl
GetEnvironmentVariableW
GetEnvironmentStringsW
GetACP
GetOEMCP
GetCPInfo
GetNativeSystemInfo
GetStringTypeW
GetCurrentDirectoryW
RtlVirtualUnwind
GetConsoleWindow
GetDateFormatW
lstrlenW
GetDriveTypeW
LoadLibraryExA
CreateEventW
RtlLookupFunctionEntry
RtlCaptureContext
SwitchToThread
GetCurrentThread
GetCurrentProcess
DuplicateHandle
SetHandleInformation
SetThreadStackGuarantee
AddVectoredExceptionHandler
CompareStringOrdinal
DeleteProcThreadAttributeList
FreeEnvironmentStringsW
CreateWaitableTimerA
WaitForMultipleObjects
CancelWaitableTimer
SetWaitableTimer
ResetEvent
VerifyVersionInfoA
GetOverlappedResult
CancelIoEx
IsWow64Process
GetVersionExA
GetQueuedCompletionStatus
TlsFree
TlsGetValue
InitializeConditionVariable
WakeAllConditionVariable
SleepConditionVariableCS
TlsAlloc
TlsSetValue

user32

ShowWindow
SetClipboardData
EmptyClipboard
GetClipboardData
OpenClipboard
CloseClipboard

ws2_32

WSAWaitForMultipleEvents
WSASetEvent
WSAResetEvent
WSAEventSelect
freeaddrinfo
WSACreateEvent
WSACloseEvent
send
getsockopt
WSASetLastError
ioctlsocket
WSAGetLastError
getaddrinfo
ntohs
WSAIoctl
recv
WSAStartup
WSACleanup
getpeername
WSASocketW
setsockopt
socket
__WSAFDIsSet
select
accept
bind
connect
getsockname
htonl
WSAEnumNetworkEvents
listen
closesocket
htons

shell32

CommandLineToArgvW
SHGetKnownFolderPath

crypt32

CertGetCertificateChain
CertFreeCertificateChainEngine
CertCreateCertificateChainEngine
CryptQueryObject
CertGetNameStringA
CertFindExtension
CertFindCertificateInStore
CryptDecodeObjectEx
CertEnumCertificatesInStore
CertAddCertificateContextToStore
PFXImportCertStore
CertOpenStore
CertCloseStore
CryptStringToBinaryA
CertFreeCertificateContext
CertFreeCertificateChain
CryptUnprotectData

ole32

CoInitializeSecurity
CoTaskMemFree
CoInitializeEx
CoCreateInstance
CoSetProxyBlanket

advapi32

CryptReleaseContext
CopySid
GetTokenInformation
GetLengthSid
IsValidSid
OpenProcessToken
GetUserNameW
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptGetHashParam
CryptAcquireContextA
SystemFunction036

oleaut32

SysFreeString
GetErrorInfo
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayAccessData
SafeArrayUnaccessData
VariantClear
SysAllocStringLen
SysStringLen

bcrypt

BCryptGenRandom

pdh

PdhCloseQuery
PdhOpenQueryA
PdhCollectQueryData
PdhGetFormattedCounterValue
PdhAddEnglishCounterW
PdhRemoveCounter

ntdll

NtReadFile
NtDeviceIoControlFile
RtlNtStatusToDosError
NtCancelIoFileEx
NtCreateFile
NtWriteFile
RtlGetVersion
NtQueryInformationProcess
NtQuerySystemInformation

psapi

GetProcessMemoryInfo
GetModuleFileNameExW

powrprof

CallNtPowerInformation

Sections

.text
Size: 8.9MB - Virtual size: 8.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2.0MB - Virtual size: 2.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 173KB - Virtual size: 182KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 450KB - Virtual size: 450KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 500B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 40KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c08c736502ac2aa204ae28ae526ee182

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

bcryptprimitives

api-ms-win-core-synch-l1-2-0

kernel32

user32

ws2_32

shell32

crypt32

ole32

advapi32

oleaut32

bcrypt

pdh

ntdll

psapi

powrprof

Sections

.text Size: 8.9MB - Virtual size: 8.9MB

.rdata Size: 2.0MB - Virtual size: 2.0MB

.data Size: 173KB - Virtual size: 182KB

.pdata Size: 450KB - Virtual size: 450KB

_RDATA Size: 512B - Virtual size: 500B

.reloc Size: 40KB - Virtual size: 39KB

.text
Size: 8.9MB - Virtual size: 8.9MB

.rdata
Size: 2.0MB - Virtual size: 2.0MB

.data
Size: 173KB - Virtual size: 182KB

.pdata
Size: 450KB - Virtual size: 450KB

_RDATA
Size: 512B - Virtual size: 500B

.reloc
Size: 40KB - Virtual size: 39KB