2024-06-09_34ed2a9da86ca2f3f4939aa43e5f277d_megazord

Sharing

Copy URL Twitter E-mail

General

Target

2024-06-09_34ed2a9da86ca2f3f4939aa43e5f277d_megazord
Size

4.4MB
MD5

34ed2a9da86ca2f3f4939aa43e5f277d
SHA1

32f2751c2d6e3e3c757952309a773922a14b1f8d
SHA256

42f4124b47edd4f4d1533eb4f0638e516ed9e5cb55a125b0fd45980ead84e6cb
SHA512

cd14934328d5ed6c4d2ac2727c51bd48f11dae0db094b733436fb819db88bbd1461ab5cc7d800a0d6890d01e08673057017d6a895e719561478b4f011eab5c5b
SSDEEP

49152:6ywQ6jG2ksQKfzfhjPi0YIqtllatg/R49WZu6KQRclC+AQc857s8Wm1xhpltFke:KR9b9Te4y06yApP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-06-09_34ed2a9da86ca2f3f4939aa43e5f277d_megazord

Files

2024-06-09_34ed2a9da86ca2f3f4939aa43e5f277d_megazord
.exe windows:6 windows x64 arch:x64

1a63299b59f1586b15fa90b23289cc3c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

advapi32

GetTokenInformation
ImpersonateLoggedOnUser
OpenProcessToken
OpenThreadToken
RegCloseKey
RegEnumKeyExW
RegOpenKeyExW
RegQueryValueExW
RevertToSelf
AdjustTokenPrivileges
LookupPrivilegeValueW

bcrypt

BCryptExportKey
BCryptImportKeyPair
BCryptCloseAlgorithmProvider
BCryptEncrypt
BCryptOpenAlgorithmProvider
BCryptImportKey
BCryptGetProperty
BCryptGenRandom
BCryptDestroyKey
BCryptFinishHash
BCryptDecrypt
BCryptDestroyHash
BCryptSetProperty
BCryptHashData
BCryptCreateHash

crypt32

PFXImportCertStore
PFXExportCertStore
CryptQueryObject
CryptMsgGetParam
CryptMsgClose
CryptImportPublicKeyInfoEx2
CryptFormatObject
CryptFindOIDInfo
CryptDecodeObject
CertVerifyTimeValidity
CertVerifyCertificateChainPolicy
CertSetCertificateContextProperty
CertSerializeCertificateStoreElement
CertSaveStore
CertOpenStore
CertNameToStrW
CertAddCertificateContextToStore
CertAddCertificateLinkToStore
CertCloseStore
CertControlStore
CertCreateCertificateChainEngine
CertDuplicateCertificateContext
CertEnumCertificatesInStore
CertFindCertificateInStore
CertFindExtension
CertFreeCertificateChain
CertFreeCertificateChainEngine
CertFreeCertificateContext
CertGetCertificateChain
CertGetCertificateContextProperty
CertGetIntendedKeyUsage
CertGetNameStringW
CertGetValidUsages

iphlpapi

GetNetworkParams
GetAdaptersAddresses
GetPerAdapterInfo
if_nametoindex

kernel32

RtlPcToFileHeader
RaiseException
RtlUnwindEx
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
TerminateProcess
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
EncodePointer
UnhandledExceptionFilter
CancelIoEx
CancelSynchronousIo
CancelThreadpoolIo
CloseHandle
CloseThreadpoolIo
CloseThreadpoolWait
CloseThreadpoolWork
CreateEventExW
CreateFileW
CreateIoCompletionPort
CreateThread
CreateThreadpoolIo
CreateThreadpoolTimer
CreateThreadpoolWait
CreateThreadpoolWork
DeleteCriticalSection
DeleteFileW
DeviceIoControl
DuplicateHandle
EnterCriticalSection
ExpandEnvironmentStringsW
FileTimeToSystemTime
FlushFileBuffers
FormatMessageW
FreeLibrary
GetCPInfo
GetCPInfoExW
GetConsoleCP
GetConsoleMode
GetConsoleOutputCP
GetCurrentProcess
GetCurrentProcessorNumberEx
GetCurrentThread
GetCurrentThreadId
GetDynamicTimeZoneInformation
GetEnvironmentVariableW
GetFileInformationByHandleEx
GetFileType
GetFullPathNameW
GetLastError
GetLongPathNameW
GetModuleFileNameW
GetOverlappedResult
GetProcAddress
GetStdHandle
GetSystemTime
GetThreadPriority
GetTickCount64
GetTimeZoneInformation
InitializeConditionVariable
InitializeCriticalSection
LeaveCriticalSection
LoadLibraryExW
LocalAlloc
LocalFree
MultiByteToWideChar
OpenThread
QueryPerformanceCounter
QueryPerformanceFrequency
QueryUnbiasedInterruptTime
RaiseFailFastException
ReadConsoleInputW
ReadConsoleW
ReadFile
ResetEvent
ResumeThread
SetConsoleOutputCP
SetEvent
SetFileInformationByHandle
SetLastError
SetThreadErrorMode
SetThreadPriority
SetThreadpoolTimer
SetThreadpoolWait
Sleep
SleepConditionVariableCS
StartThreadpoolIo
SubmitThreadpoolWork
SystemTimeToFileTime
TzSpecificLocalTimeToSystemTime
VirtualAlloc
VirtualFree
WaitForMultipleObjectsEx
WaitForSingleObject
WakeConditionVariable
WideCharToMultiByte
WriteConsoleW
WriteFile
FlushProcessWriteBuffers
WaitForSingleObjectEx
RtlVirtualUnwind
RtlCaptureContext
RtlRestoreContext
AddVectoredExceptionHandler
FlsAlloc
FlsGetValue
FlsSetValue
CreateEventW
SwitchToThread
SuspendThread
GetThreadContext
SetThreadContext
QueryInformationJobObject
GetModuleHandleW
GetModuleHandleExW
GetProcessAffinityMask
InitializeContext
GetEnabledXStateFeatures
SetXStateFeaturesMask
VirtualQuery
GetSystemTimeAsFileTime
InitializeCriticalSectionEx
DebugBreak
SleepEx
GlobalMemoryStatusEx
GetSystemInfo
GetLogicalProcessorInformation
GetLogicalProcessorInformationEx
GetLargePageMinimum
VirtualUnlock
VirtualAllocExNuma
IsProcessInJob
GetNumaHighestNodeNumber
GetProcessGroupAffinity
K32GetProcessMemoryInfo
IsDebuggerPresent
RtlLookupFunctionEntry
InitializeSListHead
GetCurrentProcessId

ncrypt

NCryptImportKey
NCryptDeleteKey
NCryptFreeObject
NCryptGetProperty
NCryptOpenKey
NCryptOpenStorageProvider
NCryptSetProperty

ole32

CoCreateGuid
CoGetApartmentType
CoInitializeEx
CoTaskMemAlloc
CoTaskMemFree
CoUninitialize
CoWaitForMultipleHandles

ws2_32

setsockopt
send
select
shutdown
WSAConnect
recv
ioctlsocket
getsockopt
getpeername
closesocket
bind
WSAStartup
FreeAddrInfoExW
FreeAddrInfoW
GetAddrInfoExW
GetAddrInfoW
GetNameInfoW
WSACleanup
WSASend
WSAEventSelect
WSAGetOverlappedResult
WSAIoctl
WSARecv
WSASocketW

api-ms-win-crt-heap-l1-1-0

malloc
free
calloc
_callnewh
_set_new_mode

api-ms-win-crt-math-l1-1-0

__setusermatherr
ceil
floor
modf
pow

api-ms-win-crt-string-l1-1-0

strcpy_s
wcsncmp
_stricmp
strcmp

api-ms-win-crt-convert-l1-1-0

strtoull

api-ms-win-crt-runtime-l1-1-0

_register_thread_local_exe_atexit_callback
_c_exit
_cexit
__p___wargv
terminate
__p___argc
_exit
_crt_atexit
exit
_register_onexit_function
_initterm_e
_initterm
_get_initial_wide_environment
_initialize_wide_environment
_configure_wide_argv
abort
_set_app_type
_seh_filter_exe
_initialize_onexit_table

api-ms-win-crt-stdio-l1-1-0

__p__commode
_set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Exports

Exports

DotNetRuntimeDebugHeader

Sections

.text
Size: 323KB - Virtual size: 322KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.managed
Size: 2.5MB - Virtual size: 2.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

hydrated
Size: - Virtual size: 927KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 14KB - Virtual size: 97KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 191KB - Virtual size: 190KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 500B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

1a63299b59f1586b15fa90b23289cc3c

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

bcrypt

crypt32

iphlpapi

kernel32

ncrypt

ole32

ws2_32

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

Exports

Exports

Sections

.text Size: 323KB - Virtual size: 322KB

.managed Size: 2.5MB - Virtual size: 2.5MB

hydrated Size: - Virtual size: 927KB

.rdata Size: 1.4MB - Virtual size: 1.4MB

.data Size: 14KB - Virtual size: 97KB

.pdata Size: 191KB - Virtual size: 190KB

_RDATA Size: 512B - Virtual size: 500B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 2KB - Virtual size: 2KB

.text
Size: 323KB - Virtual size: 322KB

.managed
Size: 2.5MB - Virtual size: 2.5MB

hydrated
Size: - Virtual size: 927KB

.rdata
Size: 1.4MB - Virtual size: 1.4MB

.data
Size: 14KB - Virtual size: 97KB

.pdata
Size: 191KB - Virtual size: 190KB

_RDATA
Size: 512B - Virtual size: 500B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 2KB - Virtual size: 2KB