2024-06-12_c4c4ed18b449fa7366639ff76806a07e_megazord

Sharing

Copy URL Twitter E-mail

General

Target

2024-06-12_c4c4ed18b449fa7366639ff76806a07e_megazord
Size

15.6MB
MD5

c4c4ed18b449fa7366639ff76806a07e
SHA1

1bd5e29af46904f5ab6b41d1c188d24c755e3c46
SHA256

9934151ab414bad94d46d2d9091ac2f5c10cf3b5acb74b1125a70cc3dfe22675
SHA512

59b315b4bf28639219af9abcd071e92c4c924792b2c5cb58b4795f375f33a24423b2f9f47a6328742780b1a487022cf07cab42d6c7c2e149c76382196b23218f
SSDEEP

98304:7FzYIa1RgSi/1HqSbpJAlhpBgVlWAulhB7Gs1Sb95q2H+sScpui8EKiZAv6gga5I:79YIa+HqSggIhB7Gskb/HyL4

Score

10^/10

Malware Config

Signatures

Detects executables referencing many base64-encoded IR and analysis tools names 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_References_SecTools_B64Encoded

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-06-12_c4c4ed18b449fa7366639ff76806a07e_megazord

Files

2024-06-12_c4c4ed18b449fa7366639ff76806a07e_megazord
.exe windows:6 windows x64 arch:x64

b46dca107d01295f1e75599a333c23b6

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

api-ms-win-core-synch-l1-2-0

WakeByAddressAll
WakeByAddressSingle
WaitOnAddress

bcryptprimitives

ProcessPrng

advapi32

RegCloseKey
CredReadW
RegQueryValueExW
RegOpenKeyExW
SystemFunction036
ImpersonateAnonymousToken
RevertToSelf

kernel32

ReleaseSRWLockExclusive
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
CreateThread
LoadLibraryExW
HeapFree
HeapReAlloc
GetConsoleMode
SetConsoleMode
GetLastError
GetConsoleScreenBufferInfo
SetConsoleTextAttribute
SwitchToThread
CloseHandle
GetTimeZoneInformationForYear
GetCurrentThread
GlobalUnlock
GetStdHandle
GetFileInformationByHandleEx
SetConsoleCursorPosition
FillConsoleOutputCharacterA
FillConsoleOutputAttribute
SetConsoleCursorInfo
GetConsoleCursorInfo
ReadConsoleInputW
GetNumberOfConsoleInputEvents
lstrlenW
FormatMessageW
WideCharToMultiByte
AddVectoredExceptionHandler
SetThreadStackGuarantee
GetSystemInfo
WaitForMultipleObjects
ResetEvent
MoveFileExW
DeleteFileW
CopyFileExW
FindFirstFileW
FindClose
SetEnvironmentVariableW
GetEnvironmentStringsW
FreeEnvironmentStringsW
CompareStringOrdinal
RegisterWaitForSingleObject
CreateIoCompletionPort
SetFileCompletionNotificationModes
GetQueuedCompletionStatusEx
Sleep
GetModuleHandleA
GetProcAddress
GlobalLock
GlobalSize
WriteConsoleW
LockFileEx
SetFileInformationByHandle
UnlockFile
WaitForSingleObject
MultiByteToWideChar
SetLastError
QueryPerformanceFrequency
GetModuleHandleW
GetCurrentDirectoryW
WaitForSingleObjectEx
LoadLibraryA
GetCurrentProcess
GetCurrentProcessId
CreateMutexA
ReleaseMutex
RtlCaptureContext
RtlVirtualUnwind
RtlLookupFunctionEntry
GetEnvironmentVariableW
GetModuleFileNameW
GetCommandLineW
CreateFileW
GetFileInformationByHandle
GetFullPathNameW
GetFinalPathNameByHandleW
SetFilePointerEx
CreateDirectoryW
ReadConsoleW
GetSystemDirectoryW
GetWindowsDirectoryW
CreateProcessW
GetFileAttributesW
DuplicateHandle
InitializeProcThreadAttributeList
UpdateProcThreadAttribute
DeleteProcThreadAttributeList
CreateNamedPipeW
AcquireSRWLockExclusive
ReadFileEx
SleepEx
WriteFileEx
ExitProcess
GetExitCodeProcess
QueryPerformanceCounter
GetSystemTimePreciseAsFileTime
HeapAlloc
GetProcessHeap
GetFileType
SetHandleInformation
UnregisterWaitEx
TerminateProcess
PostQueuedCompletionStatus
FindNextFileW
FlushInstructionCache
VirtualAlloc
VirtualProtect
VirtualFree
RtlAddFunctionTable
RtlDeleteFunctionTable
WakeAllConditionVariable
FreeLibrary
TlsFree
SleepConditionVariableSRW
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
EncodePointer
RaiseException
RtlPcToFileHeader
RtlUnwindEx

ole32

CoTaskMemFree

shell32

SHGetKnownFolderPath

user32

OpenClipboard
CloseClipboard
GetClipboardData

bcrypt

BCryptGenRandom

ws2_32

freeaddrinfo
WSAStartup
accept
listen
bind
connect
getaddrinfo
WSAIoctl
socket
WSASocketW
getsockname
WSAGetLastError
getpeername
WSACleanup
closesocket
setsockopt
recv
send
WSASend
shutdown
ioctlsocket
getsockopt

ntdll

NtDeviceIoControlFile
NtReadFile
NtWriteFile
RtlNtStatusToDosError
NtCancelIoFileEx
NtCreateFile

api-ms-win-crt-math-l1-1-0

fminf
pow
fmod
fmodf
cosf
sinf
round
roundf
asinf
ceilf
floorf
trunc
fmaxf
__setusermatherr
truncf
_dsign
ceil
log2f
atan2f
tanh
tan
sqrt
sinh
sin
log2
log10
log
floor
exp
cosh
cos
atan2
atan
asin
acos
modf
frexp
ldexp

api-ms-win-crt-runtime-l1-1-0

_crt_atexit
terminate
_register_onexit_function
_initialize_onexit_table
_wassert
_register_thread_local_exe_atexit_callback
_c_exit
_cexit
__p___argv
__p___argc
_exit
exit
abort
strerror
_initterm_e
_initterm
_get_initial_narrow_environment
_initialize_narrow_environment
_invalid_parameter_noinfo_noreturn
_configure_narrow_argv
_set_app_type
_seh_filter_exe
_errno

api-ms-win-crt-string-l1-1-0

strcmp
strcpy_s
strncat
strlen
isalpha
isupper
islower
isdigit
isxdigit
isspace
ispunct
strspn
strcspn
isalnum
isgraph
iscntrl
toupper
strpbrk
tolower
strncpy
strnlen
wcsncmp

api-ms-win-crt-heap-l1-1-0

_set_new_mode
_aligned_malloc
_aligned_free
_callnewh
realloc
calloc
malloc
free

api-ms-win-crt-utility-l1-1-0

_rotl64

api-ms-win-crt-stdio-l1-1-0

__p__commode
__acrt_iob_func
__stdio_common_vsprintf
fwrite
_set_fmode

api-ms-win-crt-convert-l1-1-0

strtoul
strtoull
atoi
strtod

api-ms-win-crt-time-l1-1-0

strftime
_localtime64_s
clock
_gmtime64_s
_difftime64
_time64

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

msvcp140

?_Xlength_error@std@@YAXPEBD@Z
?_Xout_of_range@std@@YAXPEBD@Z

Sections

.text
Size: 10.4MB - Virtual size: 10.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4.6MB - Virtual size: 4.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 27KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 499KB - Virtual size: 499KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 500B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 74KB - Virtual size: 73KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b46dca107d01295f1e75599a333c23b6

Headers

DLL Characteristics

File Characteristics

Imports

api-ms-win-core-synch-l1-2-0

bcryptprimitives

advapi32

kernel32

ole32

shell32

user32

bcrypt

ws2_32

ntdll

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-locale-l1-1-0

msvcp140

Sections

.text Size: 10.4MB - Virtual size: 10.4MB

.rdata Size: 4.6MB - Virtual size: 4.6MB

.data Size: 27KB - Virtual size: 29KB

.pdata Size: 499KB - Virtual size: 499KB

_RDATA Size: 512B - Virtual size: 500B

.reloc Size: 74KB - Virtual size: 73KB

.text
Size: 10.4MB - Virtual size: 10.4MB

.rdata
Size: 4.6MB - Virtual size: 4.6MB

.data
Size: 27KB - Virtual size: 29KB

.pdata
Size: 499KB - Virtual size: 499KB

_RDATA
Size: 512B - Virtual size: 500B

.reloc
Size: 74KB - Virtual size: 73KB