�[����ND�D�z�mCb�u���[�v�v���u`���$`O�9��Cb�98N�+gZW:�*A��קAH1B�GԢ��ں����:��2/�0T4t���{u��GǛ�O�w�c��@��Atv_pBͿ�#�9�hb���cY�"o?�S��<��F� ;�w H�k o�5�3Y��� ��B��:T^k:����Ɨ�ۊ~��4�X7�O��$_�;Vr�mKt? IW���� ן�o�r���#lw����m�T�O4�e� #�J��Qi����wz �!��U�QB�B��o� m'���N�_T��ʪ!BC������$�JZV��)��n,W!���/EK�Ck�j��04'��rwU@n�zv��Z�]N��wt^�qT�=�w�h 4�\@*� ���i[Y ���j�8[�M:��^���in��#qs���Vu��#���ƫ�Q�xBE� ^�Mf GXuT�9"�����jm���WB*��a�C�<'Y)K��;��!&�z{�ĉ,��4NXކ"�>!�/��#]���g���𝁵�Frb����N��#�2�\��9G�y��u ��@ �"cIe%0�_� �m�B��h��w[/h�bI�{�%�p�5 �D���qrD��.E�b���aN�Ep�ru��:���B �X<���- �ٶ�F_��cJSLf�d@Q�^���y��П6}{��ݡ��k�_�s��Lؚ'72!��z�J�U�ѯIF����>aY�k�.^^(*�{�OJ�G�$�8�����IWu1� BcxT���9�.sr��ˊ�|~#�q^�b��� m#`��q�ؒz���DU�m-��G�n��b;�Mۨ�Wƴ¶��){p2vy��r%.�MT�EmeZۉ���5���`l� ��/$��NS���g8]�1,ݗ </.ʂooU�1<��$����q>D˄��]E�����0%�Sl�^t������Fm�����N{� m�(��>��2)*�["D7Ov��p1����|�0�������0S����>��$d;ȧ�;�8��<1n�1,��:�6�v�d=�T���O�?�F�#�R]�?�$����^�*�;�us� %����#�f��Trô����h�� ��j���rm[���f���1��g���#TmU��[���d�6���������HH�"�����*D�����7l9���}�5^���uH����"�5-��xl��* �T�����;R�o�̂�)��;�_�ba�B�%���P��f0�������m�5�K�b5�jw�g?&&���� S�����;��i�{�8�u��)�!�#��.�����p���h� ;��-{�䃋* �ilZQ����u,��4�������Hr���d+IK\�(���(d�j6�6(����<Bo���o���M�u�}��غ��H�F�F��ʶ�!D`,�4d����~�B�[�RHIɊ��O�렛'�����|��[\"Y̍������B�ft���yd��X�� mm��M��14���V��ھ���Ĩ�5&@S����j; ����ں.-��52���s6`�ۄ]��F�a?O��}߭H��,�#Q��8�ɾ:ג�TI�0��� ^� 8@T�^�Mf�m����2]I%= CQ�Jnz�w�*��S����@AWM��!���ن���°��?Q�ݯ:?�|Y��$��v�rU��!��z�룄M�Wc� DŽ!ER.�%�(G����Tx���@_���k�`ʎ.u=( n]��Z\X빨���P��i2�p�|� ]�s&C������=� Ro*ˠo"V� Ӆ��`��>yGY�CM�R˵..�z�X��/�L�P$�p[i�xP���z&c-����t"����-��D��z��*���Օ�R��Wḱn���������0�bu*}��Z[ VsN1B�I�{�Z�'K�N:�h��aGI�tѵ���%��X��t����g��}�������C�I �T�xͫ�a��&"�4�=�c�(�8�����G.B�H��r�MOӡP6K�� ���`o�!v���~QI��$Z��So1;)�:�oUn�x`S��<�/�|���q~hz:��R����y m'!QT��5�D>����s�����R�I���?�W�9aZ��"�A"V���څ��ⱏWQ?�?��[t�)�����l���0Bֈ�AUы��Iצ�SN���h-�6�3�H�[K �e[T��Ь}L3ւ3�-�����2�W�;y���3������g�G�#�������C>w�Y{*&��/��dR/�fQf)Ռ��d�a�Z��@G����o�<9�&���r�*H$�������=����LI�p.5��WRt��i �:H�rJ��Z��E�m �Z?]V ��O>��ݭ��!���F������4;�:�j!�V`5�X��̑`�w�\[�3�� �q�����[�?X�o��dX!@���=M�SH���''t\ٛO�4�e �M�#��˅���E���u�����|�v,y���(�����c) �҆�Dx�'�x)��f���]3�D�͐���h�J�}n;.j�ޗ���/�rO|�><QNr�Y]��D*�X���K�B�|S��8ٕa��W �X��+��D���lo`��5N��zg�&n�Ƅ��>�N���-�^K���gw�my���9��,/#�PmR�hL8B1�f�݄R�{�������G"ָq����u[O�݄�a��Ћ�g���,}_7{I�^n��jTU�vR+�����@���ߏ~�͕{���g�]:$�2�/)�����fՍA�����(MiȻkG��Θ�u��jW 8��S�߰T��< ��κ.�@�YTA5̉���e��a�Yq퇴��1���x_��� ��D]bZ[`=�`S�wn�jJ��î�)�-�b�����a/��]��ā���Ȟ�D�4�K���"I6�C��T�2�Ǘ�sd�Pt�]����<ה2���n�Q2+��[1�Y�U���y��o��_=a꿴b8U.�[�.�ߠn��K�
Static task
static1
Behavioral task
behavioral1
Sample
aboba/launcher.exe
Resource
win7-20240508-en
General
-
Target
aboba.rar
-
Size
2.6MB
-
MD5
d587845f8b769923d434ee0b8f2f2a9b
-
SHA1
3ed719735cfbe50615df7441fddd24f7c2e1431e
-
SHA256
62e5a5081f50dffe2d47baf550aed0efc9cb6ca60e267e3050922dcc06897095
-
SHA512
b477f7dbc9c3784f7828be27c51b7edaf9d9915e895c1caf7fd1d4eb458ff8ab5750256cb6edfa11dd4502d2d38dfc3997cf63312be672c034f002212f2adadd
-
SSDEEP
49152:RgQrGr58PS7zW8t/7//p5y24cxoRg0M5QK8VUswbgYEdA0AdN6Kp:mkGr58PS2c5y24KoRgPQ3YgYEddu9
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/aboba/launcher.exe
Files
-
aboba.rar.rar
Password: 1
-
aboba/launcher.exe.exe windows:6 windows x64 arch:x64
Password: 1
fa82770a4f227f689ac1e2945ffc9560
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
SetLastError
GetCurrentProcess
LocalAlloc
GetCurrentProcess
GetCurrentThread
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
GetLastError
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
MessageBoxA
CharUpperBuffW
shell32
ShellExecuteA
oleaut32
VariantClear
msvcp140
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
ntdll
NtRaiseHardError
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__std_terminate
api-ms-win-crt-runtime-l1-1-0
_invalid_parameter_noinfo_noreturn
api-ms-win-crt-stdio-l1-1-0
_set_fmode
api-ms-win-crt-heap-l1-1-0
free
api-ms-win-crt-string-l1-1-0
strncmp
api-ms-win-crt-filesystem-l1-1-0
_lock_file
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
wtsapi32
WTSSendMessageW
advapi32
RegQueryValueExA
OpenSCManagerW
EnumServicesStatusExW
OpenServiceW
QueryServiceConfigW
CloseServiceHandle
Exports
Exports
Sections
.text Size: - Virtual size: 63KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 87KB - Virtual size: 86KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 63KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.mpn0 Size: - Virtual size: 2.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.mpn1 Size: 2.7MB - Virtual size: 2.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 660B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ