Behavioral task
behavioral1
Sample
上兴远程控制20090405破解版/rejoice.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
上兴远程控制20090405破解版/rejoice.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
上兴远程控制20090405破解版/新云软件.url
Resource
win7-20231129-en
Behavioral task
behavioral4
Sample
上兴远程控制20090405破解版/新云软件.url
Resource
win10v2004-20240508-en
General
-
Target
01a60f1a2afbb41360fe52265569b831_JaffaCakes118
-
Size
1.5MB
-
MD5
01a60f1a2afbb41360fe52265569b831
-
SHA1
00a9cc7375d3451b372fa5ead6ccfda65729727d
-
SHA256
89d9a52a64597af57e54c7da60160cc1575ceb52a347eb65b3c97d4cecb3fca4
-
SHA512
8bdec15d994a915580f27e963b2a18ec9c5e9ecb2b38ebceff279c46db48b25467b95d1ea21ba7cca21bd4159f496073cc78fd9d7a9b3ee2734df52e50cf8daf
-
SSDEEP
24576:k37F538LpenXUnM4XQgS2MX8ODdIWbEKHZ/ErA75Z0Rol8Rzpyns9m2IgYK1qF86:U7F5MLQnXUbxODCBrI5Zxns93Xa86
Malware Config
Signatures
-
ModiLoader Second Stage 1 IoCs
Processes:
resource yara_rule static1/unpack001/上兴远程控制20090405破解版/rejoice.exe modiloader_stage2 -
Modiloader family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource unpack001/上兴远程控制20090405破解版/rejoice.exe
Files
-
01a60f1a2afbb41360fe52265569b831_JaffaCakes118.rar
-
上兴远程控制20090405破解版/QQWry.Dat
-
上兴远程控制20090405破解版/rejoice.exe.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Sections
CODE Size: 1.7MB - Virtual size: 1.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: 326KB - Virtual size: 325KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 14KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 13KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 16B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: - Virtual size: 103KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 312KB - Virtual size: 312KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
上兴远程控制20090405破解版/sound/offline.wav
-
上兴远程控制20090405破解版/sound/online.wav
-
上兴远程控制20090405破解版/新云软件.url.url
-
上兴远程控制20090405破解版/配置参考图.gif.gif