SecuriteInfo[.]com[.]W32[.]Agent[.]YYRR-6760[.]26500[.]18252[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
SecuriteInfo.com.W32.Agent.YYRR-6760.26500.18252.exe
Size 2.1MB
Sample240612-183mlawfrp
SHA256 79cdda55f74f86b846c7705f503ace528ba457a49824be2cbcd03f4016d5d0cd
MD5 30e6796431b3ec382e1a15d02441924c
SHA1 4fe9d402f023a86633054db46e67bbdc2b2cbdc4
SHA512 6d2139591123b836ad5410b7e299a215a22c8478b11c513684a49c586016451138c4f3b50e51a9285387039d3e1b65c65f56e9a486a4d36453119e533c58f80a
SSDEEP 49152:gm05DDY1oeXR/rtkkdWgt/I8CEKvSwoTP2S:gX/IRDeQJt+TST+S
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

SecuriteInfo.com.W32.Agent.YYRR-6760.26500.18252.exe

.exe 2.1MB

SecuriteInfo.com.W32.Agent.YYRR-6760.26500.18252.exe

IMPHASH 7ea4d3b4981577bc540bdfb878a962cf
SHA256 79cdda55f74f86b846c7705f503ace528ba457a49824be2cbcd03f4016d5d0cd
MD5 30e6796431b3ec382e1a15d02441924c
SHA1 4fe9d402f023a86633054db46e67bbdc2b2cbdc4
SHA512 6d2139591123b836ad5410b7e299a215a22c8478b11c513684a49c586016451138c4f3b50e51a9285387039d3e1b65c65f56e9a486a4d36453119e533c58f80a
SSDEEP 49152:gm05DDY1oeXR/rtkkdWgt/I8CEKvSwoTP2S:gX/IRDeQJt+TST+S
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Digest

47:b1:80:42:02:9c:9c:15:f4:3b:fc:14:b3:9c:66:98:72:06:66:38:f4:7c:bd:be:ff:dd:08:b0:a2:fe:45:4d

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Tencent Technology(Shenzhen) Company Limited,O=Tencent Technology(Shenzhen) Company Limited,L=Shenzhen,ST=Guangdong Province,C=CN

Chains

Dec 21, 2021

CN=Tencent Technology(Shenzhen) Company Limited,O=Tencent Technology(Shenzhen) Company Limited,L=Shenzhen,ST=Guangdong Province,C=CN

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

PE Signature issue

Digest

21:7e:34:29:6b:87:f2:73:67:8b:59:bf:0e:88:6a:61:45:44:d5:aa

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Tencent Technology(Shenzhen) Company Limited,O=Tencent Technology(Shenzhen) Company Limited,L=Shenzhen,ST=Guangdong Province,C=CN

Chains

Jun 12, 2024

Subject

CN=Tencent Technology(Shenzhen) Company Limited,O=Tencent Technology(Shenzhen) Company Limited,L=Shenzhen,ST=Guangdong Province,C=CN

Serial Number

0e:33:12:30:52:5a:25:a7:f8:10:e5:34:88:b0:aa:40

Issuer

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Nov 25, 2020 - Feb 22, 2024

Subject

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bd

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Feb 11, 2011 - Feb 10, 2026

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 22, 2013 - Oct 22, 2028

Subject

CN=Tencent Technology(Shenzhen) Company Limited,O=Tencent Technology(Shenzhen) Company Limited,L=Shenzhen,ST=Guangdong Province,C=CN

Serial Number

0e:a7:f6:86:bc:40:35:4a:70:f2:c2:97:c1:31:5e:f6

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Nov 25, 2020 - Feb 22, 2024

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Serial Number

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 1, 2021 - Jan 6, 2031

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 7, 2016 - Jan 7, 2031

Minor OS version

Major OS version

Entry point

81080

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

e:\TXPCGJ\QQPCMgr_proj\13.0.46265.301_for_gf2.0_dev\Source\Setup\PackageTools\product\win32\dbginfo\kpacket.pdb

kernel32

SizeofResource LockResource LoadResource GetTempPathW CreateFileW FindResourceExW GetCurrentProcess GetFileSize GetModuleHandleW ExpandEnvironmentStringsW TerminateProcess GetWindowsDirectoryW FindFirstFileW lstrcmpW GetCurrentDirectoryW SetFileAttributesW DeleteFileW MoveFileExW GetFileAttributesW GetTickCount CreateDirectoryW GetLastError FindNextFileW SetFilePointer FindClose ReadFile RemoveDirectoryW WriteFile CreateProcessW GetModuleFileNameW WaitForSingleObject GetSystemDirectoryW MultiByteToWideChar GetCommandLineW WideCharToMultiByte UnmapViewOfFile SetEndOfFile CreateFileMappingW MapViewOfFile EnterCriticalSection GetCurrentProcessId WaitForMultipleObjects VirtualFree VirtualAlloc DeleteCriticalSection SetEvent InitializeCriticalSection ReleaseSemaphore ResetEvent CreateSemaphoreW CreateEventW GetStdHandle GetFileInformationByHandle CopyFileW SetFileTime MoveFileW GetTempFileNameW GetSystemInfo SystemTimeToFileTime LocalFileTimeToFileTime FileTimeToSystemTime GetLocalTime WriteConsoleW GetConsoleOutputCP WriteConsoleA GetLocaleInfoW CreateFileA CloseHandle FindResourceW GetProcAddress LoadLibraryW LeaveCriticalSection FlushFileBuffers SetStdHandle LoadLibraryA GetConsoleMode GetConsoleCP GetSystemTimeAsFileTime QueryPerformanceCounter GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA GetStartupInfoA GetFileType SetHandleCount GetModuleFileNameA HeapCreate GetStringTypeW RaiseException GetVersionExA HeapDestroy HeapAlloc HeapFree HeapReAlloc HeapSize GetProcessHeap InterlockedExchange GetACP GetLocaleInfoA GetThreadLocale InterlockedIncrement InterlockedDecrement Sleep UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent ExitThread GetCurrentThreadId CreateThread GetStartupInfoW RtlUnwind LCMapStringA LCMapStringW GetCPInfo GetOEMCP IsValidCodePage GetModuleHandleA TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError ExitProcess GetUserDefaultLCID EnumSystemLocalesA IsValidLocale GetStringTypeA

user32

UnregisterClassA CharLowerW CharUpperW GetDesktopWindow

advapi32

RegQueryValueExW RegCloseKey RegOpenKeyExW

ole32

CoUninitialize CoInitialize

oleaut32

SysFreeString SysAllocString VariantClear VariantCopy

shlwapi

PathAddBackslashW PathRemoveFileSpecW PathIsDirectoryW PathAppendW PathFileExistsW

Sharing

General

Malware Config

Signatures

File Explorer

SecuriteInfo.com.W32.Agent.YYRR-6760.26500.18252.exe

PE Signature issue

kernel32

user32

advapi32

ole32

oleaut32

shlwapi

generic