6G�Tt�Uq�rd�ͺ�Ե=���w��g��B���#��wfxa�o����!KGR�0z2@D�ҧ]Sދ����ڟ��b�`�j٫��+�M��t3��ń�H��ޠ�8=Rt̚�@-y�ˇm`�0���`�'>8��t�s&�����HU��/ھH��ʰXZ)���"����*�9v�DR؆��1�����0H���^^��'��˓���"�j�� �,��t�J,�EB��a ?x����v�e@��C������cT- Svmg&GI�״�&Q�\$��{茘�*uJ!oB�r�SV�P����T�0�\��Q]�ru`?��y�3D�0s�D`�-0Р�H���U$��i��( �,X��|��g<��vB!^m:�a+-^T N���F�s���-�}���:�;��C%���T���$kD��mMȺ[鮎�rL��V�oy�SG;�'��}0�&I�\��?4]V$ �2=�r� |4?�H��ō���P��)T]T�@��?0#RPt���郔QqW �&�2*kF��MO~��FM����;<]�e��E����5�,��L�E���3�ÑW�`� ��)Tb��d�^%�;�&։1'���F����t�ڧ<�8;�ꮯ�>��u�c�ȧU������R*Rib�A�V��w��"ij�z��ܸp ]����w4��<Vg>�����*�|a{�f��~����9�x�e����^"{]��vY.��-�Uq�(���dP$�7 b�|Ց�9�^6��]e�n�/8QME ��-����.��ӾK�_��Y-l�Ŷ�'���?�.i��X��z_�7�ۙ�i� �Q�T�l���5L�8@R�T@�y^�1s'Q�'��ݮN+Ib�zWE�I`Z/����+9�r}M�����2y1,4� �����:|I��б��o%���^������x]������^��M��1��fr 7�6@�A�A��+C]�U��:8#�mK�Z,���oI9�?U����͐���qy�"�9����/9���BK��� v�I @�R�k`��o{s�-�L���BN�b��Ɛ�T����]�4���I����}P����،��:��@j�9�j�����E{_gp)^1s��Ou������7M�n v�W������S=2�+��n��d�T����E��l�)[oV]������d�r�h���_O���݁�'�+:z;����X���^�w~dT��s�J�U"�ԏ�ߧt_��jM�z�>=Ғu5�[� P-�YN����rbkO�4T�Z���/K�p�o���F_����4���ju]���#��G�G3#��ɖ*�iP�y8^�;�8��K����/A�w.ɮ���v(]�E������;Mv�g2 w/�9t���M�h�K�t�K�=n���o؉��ת/���r��P`�vz5G8쌴����5`Y\0������~xD�� �Y&�[��~y�7<Ղ�vMV��J���.�p�ԡ%o~��MȼIŪ{�);��.s����<:?��u�{�E̅����Y���8��j�WB��� FУ��e�<�!D�It(�eayJ�6�E@��v��k,T�����~έ u��������·�JpdP5����h��͟�D�I�$�����}�����\F��� &\;Zy��);T��^W���/$AP��N���w�6�Oc�p��5�������e�;$�q��q~�K".�h]���e�}�&癬����������Ó��|�f���+�����A��S�X�F��V�w{%Y�!��>��m����cb)�R-����ϑt�{3�>.ܵ��:}Aו���K�.K�-z�+6ds�{4��S!���%�y`,=B�z���d~�-��J�X�ފ�������8�fAj��Y�[D#�r�K=�Z�E��s'֔�!�P�S��<��şې�~|�E��m4�h�����/Ib�$��%��f�����B)jya|E�͊����6����Ь��~m5�/�k��r->���Ȃ�� 3ͽ7!�'u�Cƙ��}��-W{f��>v�]�,��'� @��� C�D,7�9gB;I-*�mȰM-{��,;A�(�!+��f�˝OЩs�������S�¢� ��u'�'d�E��~�E�o��]D$�L�7�"�Gî���0=O?A-�h�{������>���<��P�����gV�2��p2��E�2��p��`5gz���'�((�G"�S�'��eJ�#� ��b�sW��z�������-Hج�U7�e�\�j��5��r�$n�}�na4���u�/��+�/�@��h!cW �P�L�na0V�)��qG�����23��]��(|}�^�� �@rk1z�6�u���RI��%|.ڈ���oe��x���}���s����6!�}��I�+MC�a&E@��;�M*Fv�&m�᚜rv4H�N5!]S�����=�0���Uf/�#��/��,j�`;[�;�YWt��Y��\ҩ�_��,2Ҥl-{�d7 J����f��(cɭw�f} ����z��-l�#!����ǰ�D����\a+E7n}^L�F���o���@cfrF{A����#��9^����:�4R�J�m��M��"� ���\`'8)7�E��>-lՠ�Bz0^�D�.s'Z����O�S~X���H��HFs2��� ��x��/1� ��2{��J���ͩ0�){��8��o��?Mʁ�/���UJ�� �d/�0?����{qH=ȞO�@�ˤ���1� �Q��9��_����6�,C<7�Κ��}FH^�� A��<�A��h���A��'��~=�d9Eo -|���Z��+:j`6��t�����h��t�a����g����@���� ��SQ�jIv(V��[ @*u�����M^�O=���+)\c9C�����L�q6��49K�9vlc��9#�5��s��$^�6���=��+Dܻ��D��veH ��$�:聅��I~�F'��a�^�ċݿ���%a���M7��朞�+�1�l�9�f|�XTפ���\�y+(I#�w 5М��l�̨K'�1�����'P��AҢ㍒ٸ�1d�$O��6��
Static task
static1
Behavioral task
behavioral1
Sample
mtk_bypass_rev4.exe
Resource
win7-20240611-en
General
-
Target
mtk_bypass_rev4.exe
-
Size
12.2MB
-
MD5
eb21b4503292a78fb468b7058f4a297e
-
SHA1
bff15878980b289aedd3811e4d1374a7c5fd6503
-
SHA256
001b2dfac98fa69fb8bc402a510a99f2b5a617acadaa59cc9a2ab50264c04dec
-
SHA512
fb4e1b7cd688ce1f445677442a0d6dc57c253289c4980801260c718b2f4878b64d3bb7fded89d564b836b2722dd1897012008c9fc36285548d580bf25e7d3f02
-
SSDEEP
196608:aHI4e4brzsBNVS3/wrPJZ5Nz3EouuhQpGIjoEARm0BD93BVqJomutFHM7ACsabs:aHXLsBDTLvTUOKzjkTjmSsM7ys
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource mtk_bypass_rev4.exe
Files
-
mtk_bypass_rev4.exe.exe windows:5 windows x86 arch:x86
de7a6c777a63c1ad85236d5269828888
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Imports
advapi32
AccessCheck
dwmapi
DwmEnableBlurBehindWindow
gdi32
AddFontMemResourceEx
imm32
ImmAssociateContext
kernel32
AddVectoredExceptionHandler
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
msvcrt
___mb_cur_max_func
netapi32
NetApiBufferFree
ole32
CoCreateGuid
oleaut32
SafeArrayCreateVector
setupapi
SetupDiDestroyDeviceInfoList
shell32
CommandLineToArgvW
user32
AdjustWindowRectEx
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
userenv
GetUserProfileDirectoryW
uxtheme
CloseThemeData
version
GetFileVersionInfoSizeW
winmm
PlaySoundW
ws2_32
WSAAsyncSelect
wtsapi32
WTSFreeMemory
WTSSendMessageW
libusb0
usb_close
Exports
Exports
Sections
.text Size: - Virtual size: 13.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 60KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 4.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.qtmetad Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.eh_fram Size: - Virtual size: 2.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.bss Size: - Virtual size: 5KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.CRT Size: - Virtual size: 56B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 8B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.အမ� Size: - Virtual size: 3.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.အမ� Size: 12.0MB - Virtual size: 12.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 161KB - Virtual size: 161KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE