sysEXEC.zip
- SHA256 1b0f8b7a56eedd6416a91dff43c83a15ae2e4ddb966412e5abdc1acefeb8f6c2
Behavioral task
behavioral1
Sample
sysEXEC.zip
Resource
win7-20240419-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
sysEXEC.zip
Resource
win10v2004-20240508-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target sysEXEC.zip
- Size 18.8MB
- Sample240618-hrd9kasalg
- SHA256 1b0f8b7a56eedd6416a91dff43c83a15ae2e4ddb966412e5abdc1acefeb8f6c2
- MD5 b64337c77cb62ff48d87955db53a863f
- SHA1 e3c23ab913f0fbe28e2be66f643085b3cdb57e55
- SHA512 c5b1e678b65b485daf313541e43de1ae57a55ee06e48e9b6084c8dfb9702248ffd2f9d976a525ad4acaf486d05cad764c77231ad952635bf36a969f75d3bee89
- SSDEEP 393216:7oZJFDY1RYfK3/ayMJ/sK43Z7/oSQlo0ztn17fOq:7oZJq1RYfKDMJ/sK4pTobllzt17Wq
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- An infostealer written in Python and packaged with PyInstaller. 1 IoCs
resource yara_rule static1/unpack002/Creal.pyc crealstealer - Crealstealer family
- Detects Pyinstaller 1 IoCs
resource yara_rule static1/unpack001/sysEXEC/sysEXEC.exe pyinstaller - Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/sysEXEC/sysEXEC.exe
File Explorer
-
sysEXEC.zip.zip 18.8MB
-
sysEXEC/bootstrapper/b0x.dll.jpg 3KB
-
sysEXEC/bootstrapper/curl.dll.png 158KB
-
sysEXEC/deter.dll2.4MB
-
sysEXEC/quickDrop.dll2.0MB
-
sysEXEC/sysEXEC.exe.exe 14.5MB
-
Creal.pyc82KB
sysEXEC/bootstrapper/b0x.dll
- SHA256 9efb1018fb6edff77c2396383b1eaa386fd448a19d3cba540abfc1f76e13024f
- MD5 1626aaec1aab4f2fbd1dd1af7639c216
- SHA1 fd74daa709a3f55612e045cd6fbd00dd62a8ee1d
- SHA512 edfab477e6633aff046a7bcd3e8f2f492f5fb35d038f43b9d557f7744acc3b224072028a8479c998b3ed747d29fe3462c8241c5036a579425bb38bd3d9ac3c7b
- MD5 SHA1 SHA512
sysEXEC/bootstrapper/curl.dll
- SHA256 dc715417d7eaff6b621fbbacd94471e3ced2e4f4b70ba4dbc3ec00f655fe301b
- MD5 7f5344e42af2fb868ab54894d022bb45
- SHA1 524e1ae9c4995973587f6eca9f574a8bec23a565
- SHA512 573265aacd7add8147fcf6863c1c370ebb86faf37280d95a77336865b4f138a0b53efb4b09854a300bb824d481227684e95653b4fe1e2edb8115531b6191dc90
- SSDEEP 3072:uXSlX3QHNU4tvpl7y4HJEVqoa90c+gfDXcPqU7R3wTYNbOXPPT74blg:gSl3YrNpVy8yqoa99FXcF7MYIXnP4by
- MD5 SHA1 SHA512 SSDEEP
sysEXEC/deter.dll
- SHA256 77f70788f86eb2118c62505b12857fc9ecec67ddda00c9ae763e30f4d2001973
- MD5 e0035f1415ad57390e035a1924e66699
- SHA1 aea268dd8cde0f81847b5faf31914e5def3e3905
- SHA512 dae404a831f3acb504210aecf24838ee4a86f46ff389c090dce85d7f3dcd23395cd4f475143b619b142319e0b610a063d07ab51a26aa3a5b08d48e41112e6a53
- SSDEEP 49152:fQB8FXngzuLOerj6QSKFsZ+5xtRvBZmYxx3zpWSkdP1uYMOD6Gy2MS:fQB8lgzu9f6QSKFnBp/P9xs1uYMy6dy
- MD5 SHA1 SHA512 SSDEEP
sysEXEC/quickDrop.dll
- SHA256 dafbdacac1b68e0d615bd5d6550a472800e37f1c8cbda9064c61cefb4c29435d
- MD5 0911c00b81b90ea126d46a1bd5c2933f
- SHA1 bf59ae80d8b72ad1d805ee806803d932bb02044a
- SHA512 43442e93725024c0b98c6d958f995830436adb676ab1d6b12e9fbf9b6bf78dc02b9ce7ddeef957b61105440349b1b7d88c8db4951ad344796b891d2baf113bf9
- SSDEEP 24576:AqTkBkEU283mDQYaL/el5XOgE3LWC1MsDvHKuzPgqf/r4MOKbcQzKhkziZ68EbaN:lmkE6Wgel5XGZvRPLNO5QzK3g8EehHik
- MD5 SHA1 SHA512 SSDEEP
sysEXEC/sysEXEC.exe
- IMPHASH 2ac23c52e7647c5bbea38e98bb68c652
- SHA256 1302f2c7054ea7194ce07428af0c2fa00c46e2d27fb96e7734f09cdab139b1a5
- MD5 02d12d780b93209fad2a6dc29716b278
- SHA1 d425f1c11190044e07be7c87845a0a89203fec9e
- SHA512 6f9c5a62742049f0218ddcf59ef880f231809010cbad3954197616036828839893b2af38137c419732f2a3dda8f41b32a8ad4845b48c1bb506f52ad0448241b1
- SSDEEP 393216:LEkZQ0dQuslSq99oWOv+9fgWtRT7k3he:LhQ0dQuSDorvSYWtl74h
- MD5 SHA1 SHA512 SSDEEP
-
Detects Pyinstaller
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
2
Major OS version
5
Entry point
48672
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
user32
CreateWindowExW
PostMessageW
GetMessageW
MessageBoxW
MessageBoxA
SystemParametersInfoW
DestroyIcon
SetWindowLongPtrW
GetWindowLongPtrW
GetClientRect
InvalidateRect
ReleaseDC
GetDC
DrawTextW
GetDialogBaseUnits
EndDialog
DialogBoxIndirectParamW
MoveWindow
SendMessageW
comctl32
ord380
kernel32
GetACP
IsValidCodePage
GetStringTypeW
GetFileAttributesExW
SetEnvironmentVariableW
FlushFileBuffers
GetCurrentDirectoryW
GetOEMCP
GetCPInfo
GetModuleHandleW
MulDiv
GetLastError
FormatMessageW
GetModuleFileNameW
SetDllDirectoryW
CreateSymbolicLinkW
GetProcAddress
CreateDirectoryW
GetCommandLineW
GetEnvironmentVariableW
GetEnvironmentStringsW
DeleteFileW
FindClose
FindFirstFileW
FindNextFileW
GetDriveTypeW
RemoveDirectoryW
GetTempPathW
CloseHandle
WaitForSingleObject
Sleep
GetCurrentProcess
GetExitCodeProcess
CreateProcessW
GetStartupInfoW
FreeLibrary
LoadLibraryExW
LocalFree
SetConsoleCtrlHandler
CreateFileW
FindFirstFileExW
GetFinalPathNameByHandleW
MultiByteToWideChar
WideCharToMultiByte
FreeEnvironmentStringsW
GetProcessHeap
GetTimeZoneInformation
HeapSize
HeapReAlloc
WriteConsoleW
SetEndOfFile
ExpandEnvironmentStringsW
QueryPerformanceCounter
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
RtlUnwindEx
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
EncodePointer
RaiseException
RtlPcToFileHeader
GetCommandLineA
GetFileInformationByHandle
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
ReadFile
GetFullPathNameW
SetStdHandle
GetStdHandle
WriteFile
ExitProcess
GetModuleHandleExW
HeapFree
GetConsoleMode
ReadConsoleW
SetFilePointerEx
GetConsoleOutputCP
GetFileSizeEx
HeapAlloc
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
CompareStringW
LCMapStringW
advapi32
OpenProcessToken
GetTokenInformation
ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertSidToStringSidW
gdi32
SelectObject
DeleteObject
CreateFontIndirectW
Name
.text
Size
164KB
Virtual Size
163KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
73KB
Virtual Size
73KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
110KB
Virtual Size
110KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=7, id=259, version=30795,
count=180, id=261, version=30795,
count=10, id=260, version=30795,
count=3, id=253, version=33731,
count=9, id=259, version=33731,
count=17, id=260, version=33731,
count=40, id=261, version=33731,
count=11, id=257, version=30795,
count=143, id=1, productName=Unmarked objects,
count=25, id=260, version=33811,
count=1, id=258, version=33811,
Creal.pyc
- SHA256 6bdebac7fd9cd105c7d52cdc99e88e1dd486882509fccfcd2aed92a51ab17379
- MD5 85b513e06d60766bf9d2e324fcce2108
- SHA1 ba1af8ec4aac32f5333f39a73d16cc8da7307399
- SHA512 01df4739559d10b2b840103b5d3a003ce4afbb42fe5fed18c43a1d894b8719cfb92813d370f21c1fbfca09c02ff5f6715479b23b8dfc3a43407576b241784b25
- SSDEEP 1536:MupDrbe3uzTZMB7aK1ieL7iVX9hcuhFwNfb2GJjOZRJ:bpDve3uz0BkSGN9iOzOjsP
- MD5 SHA1 SHA512 SSDEEP
-
An infostealer written in Python and packaged with PyInstaller.