5eddfcfbde12dfd59c1ddd866546c9604f392d350ebc83a0ef58f5026e4fea4d

Sharing

Copy URL Twitter E-mail

General

Target
5eddfcfbde12dfd59c1ddd866546c9604f392d350ebc83a0ef58f5026e4fea4d
Size 790KB
Sample240619-bdv7lavekn
SHA256 5eddfcfbde12dfd59c1ddd866546c9604f392d350ebc83a0ef58f5026e4fea4d
MD5 2749ea6fa4478739201ed37fac824210
SHA1 fcc3a4277bb5426f242cd4c6078efac6b531f5d4
SHA512 b61847f6de5dd8b90c9f58d2da37519fd57a34f4e21bc7180252f6c6d2fa473dec363d86da9d0e992913437b506ba6bf00d072e16ef85fb5355dd47570bed0b4
SSDEEP 24576:4oz3UXV6wnJPVR42psbwy/5+LOm4/QZ20EtU:4M3mhDps0L54/XbtU
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

Malware Config

Signatures

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
static1/unpack001/2eeedb8129877d2cff8bfca258974786448f4babb12a1e44651735e675f09ca1.exe	autoit_exe

Unsigned PE 3 IoCs

Checks for missing Authenticode signature.

resource
unpack001/2eeedb8129877d2cff8bfca258974786448f4babb12a1e44651735e675f09ca1.exe
unpack001/92e0a7687dbabbecadf58d3f706e383909637c8ea4b0f49824f4c3929ff53435.exe
unpack001/a9fef3bf43ae17b1ea2361ea59c5584caf762bd450dc8f120fdbf7f9fe523e96.exe

File Explorer

5eddfcfbde12dfd59c1ddd866546c9604f392d350ebc83a0ef58f5026e4fea4d

.zip 790KB
2eeedb8129877d2cff8bfca258974786448f4babb12a1e44651735e675f09ca1.exe

.exe 1.1MB
68f3f6a8e2c034cfa63a5083aa214e6973ec425313e52d78ce5f4360e00d9867.elf

.elf 16KB
76a5d5651a6bb05f67e88fb646e969963c8f3baeda763a86649d4cd2f2ff967b.js

.js 1KB
8be322fd5399068e2db918866ec0011882c308226f9c8065df643dbcd4d7e998.vbs

132KB
92e0a7687dbabbecadf58d3f706e383909637c8ea4b0f49824f4c3929ff53435.exe

.exe 55KB
967059c927f066a79905cf5a2f99562ca72409238322098e8ac93c905e75a1af.rtf

.rtf 4KB
a9fef3bf43ae17b1ea2361ea59c5584caf762bd450dc8f120fdbf7f9fe523e96.exe

.exe 59KB
bbb50d99d2286fd78099998d4b3f17e441927cfa1e3951893e7acecf77fee1d5.js

.js 1KB

5eddfcfbde12dfd59c1ddd866546c9604f392d350ebc83a0ef58f5026e4fea4d

SHA256 5eddfcfbde12dfd59c1ddd866546c9604f392d350ebc83a0ef58f5026e4fea4d
MD5 2749ea6fa4478739201ed37fac824210
SHA1 fcc3a4277bb5426f242cd4c6078efac6b531f5d4
SHA512 b61847f6de5dd8b90c9f58d2da37519fd57a34f4e21bc7180252f6c6d2fa473dec363d86da9d0e992913437b506ba6bf00d072e16ef85fb5355dd47570bed0b4
SSDEEP 24576:4oz3UXV6wnJPVR42psbwy/5+LOm4/QZ20EtU:4M3mhDps0L54/XbtU
MD5 SHA1 SHA512 SSDEEP

Password

infected

2eeedb8129877d2cff8bfca258974786448f4babb12a1e44651735e675f09ca1.exe

IMPHASH eb97e4fc5518ac300a92a11673825e0b
SHA256 2eeedb8129877d2cff8bfca258974786448f4babb12a1e44651735e675f09ca1
MD5 9e4c975a08c32f87ff086024ba780bd0
SHA1 dbc81c855977fdff4f4a1cf99c0be1b984dab109
SHA512 4903268f884e4dde313d3d088050674aadbd9fdb93f79539a5312e33d24498520c389d18ce99e84874ba399c1782d5242872f7f9a95fbbaec717e21e3a0f3b8d
SSDEEP 24576:8AHnh+eWsN3skA4RV1Hom2KXMmHaxsBAhLuqFfs3quI5:bh+ZkldoPK8YaxsShLHgqB
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

AutoIT Executable

AutoIT scripts compiled to PE executables.
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

163850

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

wsock32

WSACleanup socket inet_ntoa setsockopt ntohs recvfrom ioctlsocket htons WSAStartup __WSAFDIsSet select accept listen bind closesocket WSAGetLastError recv sendto send inet_addr gethostbyname gethostname connect

version

GetFileVersionInfoW GetFileVersionInfoSizeW VerQueryValueW

winmm

timeGetTime waveOutSetVolume mciSendStringW

comctl32

ImageList_ReplaceIcon ImageList_Destroy ImageList_Remove ImageList_SetDragCursorImage ImageList_BeginDrag ImageList_DragEnter ImageList_DragLeave ImageList_EndDrag ImageList_DragMove InitCommonControlsEx ImageList_Create

mpr

WNetUseConnectionW WNetCancelConnection2W WNetGetConnectionW WNetAddConnection2W

wininet

InternetQueryDataAvailable InternetCloseHandle InternetOpenW InternetSetOptionW InternetCrackUrlW HttpQueryInfoW InternetQueryOptionW HttpOpenRequestW HttpSendRequestW FtpOpenFileW FtpGetFileSize InternetOpenUrlW InternetReadFile InternetConnectW

psapi

GetProcessMemoryInfo

iphlpapi

IcmpCreateFile IcmpCloseHandle IcmpSendEcho

userenv

DestroyEnvironmentBlock UnloadUserProfile CreateEnvironmentBlock LoadUserProfileW

uxtheme

IsThemeActive

kernel32

DuplicateHandle CreateThread WaitForSingleObject HeapAlloc GetProcessHeap HeapFree Sleep GetCurrentThreadId MultiByteToWideChar MulDiv GetVersionExW IsWow64Process GetSystemInfo FreeLibrary LoadLibraryA GetProcAddress SetErrorMode GetModuleFileNameW WideCharToMultiByte lstrcpyW lstrlenW GetModuleHandleW QueryPerformanceCounter VirtualFreeEx OpenProcess VirtualAllocEx WriteProcessMemory ReadProcessMemory CreateFileW SetFilePointerEx SetEndOfFile ReadFile WriteFile FlushFileBuffers TerminateProcess CreateToolhelp32Snapshot Process32FirstW Process32NextW SetFileTime GetFileAttributesW FindFirstFileW SetCurrentDirectoryW GetLongPathNameW GetShortPathNameW DeleteFileW FindNextFileW CopyFileExW MoveFileW CreateDirectoryW RemoveDirectoryW SetSystemPowerState QueryPerformanceFrequency FindResourceW LoadResource LockResource SizeofResource EnumResourceNamesW OutputDebugStringW GetTempPathW GetTempFileNameW DeviceIoControl GetLocalTime CompareStringW GetCurrentProcess EnterCriticalSection LeaveCriticalSection GetStdHandle CreatePipe InterlockedExchange TerminateThread LoadLibraryExW FindResourceExW CopyFileW VirtualFree FormatMessageW GetExitCodeProcess GetPrivateProfileStringW WritePrivateProfileStringW GetPrivateProfileSectionW WritePrivateProfileSectionW GetPrivateProfileSectionNamesW FileTimeToLocalFileTime FileTimeToSystemTime SystemTimeToFileTime LocalFileTimeToFileTime GetDriveTypeW GetDiskFreeSpaceExW GetDiskFreeSpaceW GetVolumeInformationW SetVolumeLabelW CreateHardLinkW SetFileAttributesW CreateEventW SetEvent GetEnvironmentVariableW SetEnvironmentVariableW GlobalLock GlobalUnlock GlobalAlloc GetFileSize GlobalFree GlobalMemoryStatusEx Beep GetSystemDirectoryW HeapReAlloc HeapSize GetComputerNameW GetWindowsDirectoryW GetCurrentProcessId GetProcessIoCounters CreateProcessW GetProcessId SetPriorityClass LoadLibraryW VirtualAlloc IsDebuggerPresent GetCurrentDirectoryW lstrcmpiW DecodePointer GetLastError RaiseException InitializeCriticalSectionAndSpinCount DeleteCriticalSection InterlockedDecrement InterlockedIncrement GetCurrentThread CloseHandle GetFullPathNameW EncodePointer ExitProcess GetModuleHandleExW ExitThread GetSystemTimeAsFileTime ResumeThread GetCommandLineW IsProcessorFeaturePresent IsValidCodePage GetACP GetOEMCP GetCPInfo SetLastError UnhandledExceptionFilter SetUnhandledExceptionFilter TlsAlloc TlsGetValue TlsSetValue TlsFree GetStartupInfoW GetStringTypeW SetStdHandle GetFileType GetConsoleCP GetConsoleMode RtlUnwind ReadConsoleW GetTimeZoneInformation GetDateFormatW GetTimeFormatW LCMapStringW GetEnvironmentStringsW FreeEnvironmentStringsW WriteConsoleW FindClose SetEnvironmentVariableA

user32

AdjustWindowRectEx CopyImage SetWindowPos GetCursorInfo RegisterHotKey ClientToScreen GetKeyboardLayoutNameW IsCharAlphaW IsCharAlphaNumericW IsCharLowerW IsCharUpperW GetMenuStringW GetSubMenu GetCaretPos IsZoomed MonitorFromPoint GetMonitorInfoW SetWindowLongW SetLayeredWindowAttributes FlashWindow GetClassLongW TranslateAcceleratorW IsDialogMessageW GetSysColor InflateRect DrawFocusRect DrawTextW FrameRect DrawFrameControl FillRect PtInRect DestroyAcceleratorTable CreateAcceleratorTableW SetCursor GetWindowDC GetSystemMetrics GetActiveWindow CharNextW wsprintfW RedrawWindow DrawMenuBar DestroyMenu SetMenu GetWindowTextLengthW CreateMenu IsDlgButtonChecked DefDlgProcW CallWindowProcW ReleaseCapture SetCapture CreateIconFromResourceEx mouse_event ExitWindowsEx SetActiveWindow FindWindowExW EnumThreadWindows SetMenuDefaultItem InsertMenuItemW IsMenu TrackPopupMenuEx GetCursorPos DeleteMenu SetRect GetMenuItemID GetMenuItemCount SetMenuItemInfoW GetMenuItemInfoW SetForegroundWindow IsIconic FindWindowW MonitorFromRect keybd_event SendInput GetAsyncKeyState SetKeyboardState GetKeyboardState GetKeyState VkKeyScanW LoadStringW DialogBoxParamW MessageBeep EndDialog SendDlgItemMessageW GetDlgItem SetWindowTextW CopyRect ReleaseDC GetDC EndPaint BeginPaint GetClientRect GetMenu DestroyWindow EnumWindows GetDesktopWindow IsWindow IsWindowEnabled IsWindowVisible EnableWindow InvalidateRect GetWindowLongW GetWindowThreadProcessId AttachThreadInput GetFocus GetWindowTextW ScreenToClient SendMessageTimeoutW EnumChildWindows CharUpperBuffW GetParent GetDlgCtrlID SendMessageW MapVirtualKeyW PostMessageW GetWindowRect SetUserObjectSecurity CloseDesktop CloseWindowStation OpenDesktopW SetProcessWindowStation GetProcessWindowStation OpenWindowStationW GetUserObjectSecurity MessageBoxW DefWindowProcW SetClipboardData EmptyClipboard CountClipboardFormats CloseClipboard GetClipboardData IsClipboardFormatAvailable OpenClipboard BlockInput GetMessageW LockWindowUpdate DispatchMessageW TranslateMessage PeekMessageW UnregisterHotKey CheckMenuRadioItem CharLowerBuffW MoveWindow SetFocus PostQuitMessage KillTimer CreatePopupMenu RegisterWindowMessageW SetTimer ShowWindow CreateWindowExW RegisterClassExW LoadIconW LoadCursorW GetSysColorBrush GetForegroundWindow MessageBoxA DestroyIcon SystemParametersInfoW LoadImageW GetClassNameW

gdi32

StrokePath DeleteObject GetTextExtentPoint32W ExtCreatePen GetDeviceCaps EndPath SetPixel CloseFigure CreateCompatibleBitmap CreateCompatibleDC SelectObject StretchBlt GetDIBits LineTo AngleArc MoveToEx Ellipse DeleteDC GetPixel CreateDCW GetStockObject GetTextFaceW CreateFontW SetTextColor PolyDraw BeginPath Rectangle SetViewportOrgEx GetObjectW SetBkMode RoundRect SetBkColor CreatePen CreateSolidBrush StrokeAndFillPath

comdlg32

GetOpenFileNameW GetSaveFileNameW

advapi32

GetAce RegEnumValueW RegDeleteValueW RegDeleteKeyW RegEnumKeyExW RegSetValueExW RegOpenKeyExW RegCloseKey RegQueryValueExW RegConnectRegistryW InitializeSecurityDescriptor InitializeAcl AdjustTokenPrivileges OpenThreadToken OpenProcessToken LookupPrivilegeValueW DuplicateTokenEx CreateProcessAsUserW CreateProcessWithLogonW GetLengthSid CopySid LogonUserW AllocateAndInitializeSid CheckTokenMembership RegCreateKeyExW FreeSid GetTokenInformation GetSecurityDescriptorDacl GetAclInformation AddAce SetSecurityDescriptorDacl GetUserNameW InitiateSystemShutdownExW

shell32

DragQueryPoint ShellExecuteExW DragQueryFileW SHEmptyRecycleBinW SHGetPathFromIDListW SHBrowseForFolderW SHCreateShellItem SHGetDesktopFolder SHGetSpecialFolderLocation SHGetFolderPathW SHFileOperationW ExtractIconExW Shell_NotifyIconW ShellExecuteW DragFinish

ole32

CoTaskMemAlloc CoTaskMemFree CLSIDFromString ProgIDFromCLSID CLSIDFromProgID OleSetMenuDescriptor MkParseDisplayName OleSetContainedObject CoCreateInstance IIDFromString StringFromGUID2 CreateStreamOnHGlobal OleInitialize OleUninitialize CoInitialize CoUninitialize GetRunningObjectTable CoGetInstanceFromFile CoGetObject CoSetProxyBlanket CoCreateInstanceEx CoInitializeSecurity

oleaut32

LoadTypeLibEx VariantCopyInd SysReAllocString SysFreeString SafeArrayDestroyDescriptor SafeArrayDestroyData SafeArrayUnaccessData SafeArrayAccessData SafeArrayAllocData SafeArrayAllocDescriptorEx SafeArrayCreateVector RegisterTypeLi CreateStdDispatch DispCallFunc VariantChangeType SysStringLen VariantTimeToSystemTime VarR8FromDec SafeArrayGetVartype VariantCopy VariantClear OleLoadPicture QueryPathOfRegTypeLi RegisterTypeLibForUser UnRegisterTypeLibForUser UnRegisterTypeLi CreateDispTypeInfo SysAllocString VariantInit

92e0a7687dbabbecadf58d3f706e383909637c8ea4b0f49824f4c3929ff53435.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 92e0a7687dbabbecadf58d3f706e383909637c8ea4b0f49824f4c3929ff53435
MD5 d9d9b943acbbe0394122d68a5ac5919f
SHA1 1befa767e5ae1f06658563cee6520bb7598999aa
SHA512 3ccf9b9050c878f60abeaae5b08b57e631b05d110d70f27788aa7d286e22d7ca40ea4575fb69ef09d305348b529bbfbe8a39a9307b57aa4397595e5a1b2f4780
SSDEEP 1536:6/BsBQBWHVuH4yB9OIBABttaAOeXc5aX2r8I:6/BsBQByV0vB9OIBABttaAOQQeI
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

61174

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

a9fef3bf43ae17b1ea2361ea59c5584caf762bd450dc8f120fdbf7f9fe523e96.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 a9fef3bf43ae17b1ea2361ea59c5584caf762bd450dc8f120fdbf7f9fe523e96
MD5 c1667c76b9835e9ed50cb723a177c596
SHA1 505d31c1543fe7f03da5c536d31d5bf6873a8f5a
SHA512 dfd1b989ed0c6b02cbef586a15cbd0ce13f1e28c44c5135f8e48b2e631f39b03d967c0860e5b33204d56ff4194571e80ed647a33422d5d60b60c10d79c9ee6a1
SSDEEP 1536:jBZB6BqMlDnzYIBq/BHByABByZ+rhihUqq1YjVG0qzrg0:jBZB6BqMlDzYIBq/BHByABAZqwZqSk
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

65716

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

5eddfcfbde12dfd59c1ddd866546c9604f392d350ebc83a0ef58f5026e4fea4d

2eeedb8129877d2cff8bfca258974786448f4babb12a1e44651735e675f09ca1.exe

wsock32

version

winmm

comctl32

mpr

wininet

psapi

iphlpapi

userenv

uxtheme

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

generic

68f3f6a8e2c034cfa63a5083aa214e6973ec425313e52d78ce5f4360e00d9867.elf

76a5d5651a6bb05f67e88fb646e969963c8f3baeda763a86649d4cd2f2ff967b.js

8be322fd5399068e2db918866ec0011882c308226f9c8065df643dbcd4d7e998.vbs

92e0a7687dbabbecadf58d3f706e383909637c8ea4b0f49824f4c3929ff53435.exe

mscoree

dotnet

967059c927f066a79905cf5a2f99562ca72409238322098e8ac93c905e75a1af.rtf

a9fef3bf43ae17b1ea2361ea59c5584caf762bd450dc8f120fdbf7f9fe523e96.exe

mscoree

dotnet

bbb50d99d2286fd78099998d4b3f17e441927cfa1e3951893e7acecf77fee1d5.js