SlaveOfGod[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

SlaveOfGod.exe
Size

8.7MB
MD5

2dfc677a02a3f38bfb3b995303c84d34
SHA1

b65a645db15b5e53783bc43369cae5db2ad24181
SHA256

7c690be6e3e0a8824fa322091912b35c529f96134ce1d63c0a4643b7a3d78670
SHA512

66778ee664b863b7a35af7145e6a8c3a94663ec4de9752a4c65f86568852a0f38c77033719cd7d14c8392f6663532370e65147f7050b61e2915853814eb522d7
SSDEEP

196608:x+OllRNuNUo87zziW9OZKx+j3Vq/anFU/Dm7K2ePwG51rKTW:LhuNUbfziWqKx+j3hUPwi1z

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
SlaveOfGod.exe

Files

SlaveOfGod.exe
.exe windows:5 windows x86 arch:x86

dab54414381d1086a40cf56d5c22668d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\BuildAgent\work\14194e8ce88cdf47\build\WindowsStandalonePlayer\UnityPlayer_Symbols.pdb

Imports

kernel32

SetLastError
ReadProcessMemory
GetEnvironmentVariableA
GetFileAttributesA
GetModuleFileNameA
GetCurrentDirectoryA
ResumeThread
GetThreadContext
SuspendThread
GetCurrentThread
IsBadReadPtr
SetEvent
CreateEventA
ResetEvent
GetTickCount
CopyFileW
MoveFileExW
FileTimeToDosDateTime
FileTimeToLocalFileTime
lstrlenA
GetFileTime
VirtualQuery
GlobalMemoryStatus
GetSystemTimeAsFileTime
CreateProcessW
IsDebuggerPresent
SetErrorMode
WritePrivateProfileStringW
HeapValidate
SetThreadAffinityMask
TerminateThread
WaitForMultipleObjects
GlobalAlloc
GlobalLock
GlobalUnlock
FindFirstFileW
FindNextFileW
RemoveDirectoryW
DeleteFileW
FindClose
GetConsoleOutputCP
WriteConsoleA
SetEnvironmentVariableA
CompareStringW
CompareStringA
GetLocaleInfoW
GetProcessHeap
GetStringTypeW
GetStringTypeA
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
FlushFileBuffers
WriteFile
SetStdHandle
InitializeCriticalSectionAndSpinCount
SetHandleCount
IsValidCodePage
GetOEMCP
GetACP
HeapSize
HeapCreate
GetCPInfo
LCMapStringW
LCMapStringA
GetTimeZoneInformation
GetConsoleMode
SetConsoleMode
ReadConsoleInputA
GetDriveTypeA
PeekNamedPipe
GetFileInformationByHandle
GetCurrentProcessId
WriteConsoleW
GetStartupInfoA
GetCommandLineA
OutputDebugStringA
ExitThread
TerminateProcess
ExitProcess
UnhandledExceptionFilter
SetConsoleCtrlHandler
RtlUnwind
HeapFree
HeapReAlloc
HeapAlloc
InterlockedDecrement
InterlockedIncrement
CreateSemaphoreW
CreateMutexW
GetModuleHandleW
SignalObjectAndWait
GetThreadLocale
GetProcessAffinityMask
FlushConsoleInputBuffer
FindFirstFileA
GetStdHandle
GetFileType
GetVersion
GetSystemDirectoryA
OpenEventA
VirtualAlloc
VirtualFree
UnmapViewOfFile
CreateFileA
CreateFileMappingA
MapViewOfFile
GetFileAttributesW
SetFileAttributesW
GetFileSize
GetLastError
ReadFile
CreateFileW
SetEndOfFile
SetFilePointer
GetCurrentThreadId
SleepEx
CreateThread
SetThreadPriority
RaiseException
ReleaseMutex
WaitForSingleObject
CreateMutexA
TryEnterCriticalSection
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
QueryPerformanceFrequency
QueryPerformanceCounter
FormatMessageA
LocalFree
GetFullPathNameW
ReleaseSemaphore
WaitForSingleObjectEx
Sleep
CloseHandle
CreateSemaphoreA
LoadLibraryW
LoadLibraryA
GetProcAddress
FreeLibrary
WideCharToMultiByte
CreateDirectoryW
MultiByteToWideChar
TlsSetValue
lstrcmpiA
GetFullPathNameA
InterlockedExchange
InterlockedCompareExchange
GetComputerNameW
GetTempPathW
GetUserDefaultLangID
GlobalMemoryStatusEx
GetSystemInfo
GetVersionExA
GetModuleHandleA
GetCurrentProcess
ExpandEnvironmentStringsA
CreateEventW
DuplicateHandle
SetUnhandledExceptionFilter
TlsGetValue
TlsFree
TlsAlloc
GetOverlappedResult
CancelIo
lstrlenW
GetCommandLineW
lstrcpynW
lstrcpyA
lstrcpynA
FileTimeToSystemTime
GetModuleFileNameW
GetConsoleCP
InterlockedExchangeAdd
HeapWalk

user32

CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
GetClipboardData
IsClipboardFormatAvailable
SetCapture
ReleaseCapture
GetProcessWindowStation
GetUserObjectInformationW
RegisterDeviceNotificationW
UnregisterDeviceNotification
SystemParametersInfoW
ClientToScreen
DefWindowProcW
DestroyWindow
ReleaseDC
GetDC
CreateWindowExW
MessageBoxW
GetAsyncKeyState
GetKeyState
wsprintfA
RegisterRawInputDevices
GetRawInputData
GetRawInputDeviceList
GetRawInputDeviceInfoW
SendMessageTimeoutA
EnumWindows
SendMessageA
SetForegroundWindow
ShowWindow
IsIconic
RegisterWindowMessageA
GetUserObjectInformationA
GetThreadDesktop
GetParent
GetWindowRect
GetWindowLongA
SetWindowPos
GetClientRect
CreateDialogParamA
IsWindowVisible
GetCursorPos
WindowFromPoint
ScreenToClient
wvsprintfA
MonitorFromWindow
EnumDisplayDevicesA
GetCaretBlinkTime
PeekMessageA
GetMessageA
DispatchMessageA
ValidateRect
LoadImageA
DialogBoxParamA
IsDlgButtonChecked
CheckDlgButton
CreateDialogParamW
EnableWindow
PeekMessageW
IsDialogMessageW
TranslateMessage
DispatchMessageW
MsgWaitForMultipleObjects
SetWindowTextW
RegisterClassW
PostQuitMessage
SetWindowLongW
GetWindowLongW
SetFocus
SetCursorPos
ClipCursor
ShowCursor
GetFocus
LoadCursorA
RegisterClassExW
DialogBoxParamW
EndDialog
LoadIconA
SendDlgItemMessageW
SetDlgItemTextA
SetDlgItemTextW
MessageBoxA
CopyRect
OffsetRect
GetAncestor
UnregisterClassW
GetDesktopWindow
EnumDisplaySettingsA
AdjustWindowRectEx
GetSystemMetrics
ChangeDisplaySettingsA
GetDlgItem
SetWindowLongA

gdi32

GetDeviceCaps
ChoosePixelFormat
SetPixelFormat
GetObjectW
GetGlyphOutlineW
AddFontMemResourceEx
CreateCompatibleDC
GetFontUnicodeRanges
GetObjectA
SetTextAlign
SetTextColor
CreateFontIndirectW
SelectObject
GetTextFaceW
EnumFontFamiliesExW
DeleteDC
DeleteObject
RemoveFontMemResourceEx
SetBkMode
GetBitmapBits
BitBlt
CreateCompatibleBitmap
CreateDCA
SwapBuffers

advapi32

RegisterEventSourceA
ReportEventA
DeregisterEventSource
CryptImportKey
CryptVerifySignatureA
CryptDestroyKey
RegDeleteValueA
GetUserNameA
RegCreateKeyExW
RegQueryValueExW
RegOpenKeyExW
RegSetValueExW
RegCreateKeyA
RegSetValueExA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
CryptAcquireContextA
CryptCreateHash
CryptReleaseContext
CryptHashData
CryptDestroyHash
CryptGetHashParam

shell32

ShellExecuteW
CommandLineToArgvW
SHGetFolderPathW

ole32

CoUninitialize
CoInitialize
CoCreateGuid
StringFromGUID2
CoSetProxyBlanket
CoTaskMemAlloc
CoTaskMemFree
CoCreateInstance

version

GetFileVersionInfoSizeW
VerQueryValueA
GetFileVersionInfoW
GetFileVersionInfoA
GetFileVersionInfoSizeA

opengl32

glStencilFunc
glIsEnabled
glClear
glClearStencil
glClearDepth
glClearColor
glFrontFace
glLoadMatrixf
glMatrixMode
glMultMatrixf
glGetFloatv
glColorMaterial
glLightModeli
glMaterialf
glMaterialfv
glColor4fv
glViewport
glScissor
glTexEnvfv
glBindTexture
glTexGenfv
glTexGeni
glLightfv
glLightf
glLightModelfv
glFogfv
glFogf
glFogi
glDeleteTextures
glFinish
glVertex3f
glNormal3f
glStencilOp
glTexCoord3f
glBegin
glEnd
glReadPixels
glLoadIdentity
glLightModelf
glHint
glTexParameteri
wglDeleteContext
glGenTextures
glTexImage2D
glDrawArrays
glReadBuffer
glDrawBuffer
glCopyTexSubImage2D
glPixelStorei
glTexSubImage2D
glIsTexture
glNormalPointer
glTexCoordPointer
glStencilMask
glDepthFunc
glDepthMask
glCullFace
glPolygonOffset
glColorMask
glDisable
glColorPointer
wglCreateContext
wglMakeCurrent
glGetIntegerv
glEnable
wglGetCurrentContext
wglGetCurrentDC
wglShareLists
wglGetProcAddress
glGetError
glGetString
glDrawElements
glBlendFunc
glAlphaFunc
glTexEnvi
glTexEnvf
glDisableClientState
glEnableClientState
glColor4f
glVertexPointer

winmm

waveOutGetDevCapsW
waveInGetNumDevs
waveOutPrepareHeader
waveInReset
waveInClose
waveInOpen
waveOutGetNumDevs
waveInGetDevCapsW
waveInGetDevCapsA
waveInUnprepareHeader
waveInPrepareHeader
waveInAddBuffer
waveOutGetPosition
waveOutReset
waveOutWrite
waveOutUnprepareHeader
waveOutOpen
waveOutClose
waveInStart
timeGetTime
timeEndPeriod
timeBeginPeriod
waveOutGetDevCapsA

ws2_32

inet_ntoa
WSAStartup
freeaddrinfo
getsockname
WSACleanup
getaddrinfo
closesocket
inet_addr
connect
htons
WSAGetLastError
gethostname
socket
htonl

shlwapi

PathIsDirectoryW
PathFileExistsW
SHDeleteKeyA

oleaut32

SysFreeString
VariantInit
VariantClear
VariantChangeType
SysStringLen
SysAllocString

imm32

ImmGetContext
ImmAssociateContext
ImmAssociateContextEx
ImmGetCompositionStringW
ImmGetConversionStatus
ImmSetOpenStatus
ImmReleaseContext
ImmSetCompositionStringW

dnsapi

DnsFree
DnsQuery_A

iphlpapi

GetIpAddrTable

hid

HidP_GetData
HidD_GetPreparsedData
HidD_GetProductString
HidP_GetCaps
HidP_GetButtonCaps
HidP_GetValueCaps
HidP_MaxDataListLength
HidD_FreePreparsedData
HidD_GetHidGuid

wsock32

inet_ntoa
gethostbyaddr
gethostbyname
recv
send
select
WSACancelAsyncRequest
WSAAsyncGetHostByName
listen
bind
accept
ntohs
getsockopt
getpeername
setsockopt
sendto
recvfrom
__WSAFDIsSet
shutdown
WSASetLastError

msacm32

acmStreamSize
acmStreamPrepareHeader
acmStreamConvert
acmStreamUnprepareHeader
acmFormatSuggest
acmStreamOpen

Exports

Exports

AgPmDestroySourceConnection
AgPmEventEnabled
AgPmEventLoggingEnabled
AgPmSubmitEvent
NxCreateCoreSDK

Sections

.text
Size: 7.1MB - Virtual size: 7.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 154KB - Virtual size: 698KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.trace
Size: 25KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 348KB - Virtual size: 347KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

dab54414381d1086a40cf56d5c22668d

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

version

opengl32

winmm

ws2_32

shlwapi

oleaut32

imm32

dnsapi

iphlpapi

hid

wsock32

msacm32

Exports

Exports

Sections

.text Size: 7.1MB - Virtual size: 7.1MB

.rdata Size: 1.1MB - Virtual size: 1.1MB

.data Size: 154KB - Virtual size: 698KB

.trace Size: 25KB - Virtual size: 24KB

.rsrc Size: 348KB - Virtual size: 347KB

.text
Size: 7.1MB - Virtual size: 7.1MB

.rdata
Size: 1.1MB - Virtual size: 1.1MB

.data
Size: 154KB - Virtual size: 698KB

.trace
Size: 25KB - Virtual size: 24KB

.rsrc
Size: 348KB - Virtual size: 347KB