q�E�ubf�n1�X���5{�pv)b�j���N�e,}�N&:�>g����'�ذ��3k�|[�%~Q8�B �P�K���,�kʆJ�jq� �;'�o�uF�Ɔ�K��,<����:v 7�����!YL���S�<�v���a��6-~�n��#?����Ni�T�$�}��D�����a��f{Ε[�m��e�F.�ޮ��M���M#Ml�������,��q;�@�*� ����� ʮvʅ�i� �v�E�4/���[�RV�u��G�cb)�:�T�I��53vn�|@,NA����J/�nŚ�4�2�S������}k.Œ( sn퇆"�;��^J�������*���wt��G����#��im�ƑBo���Ӽ`:m���6��RASV��b[��\'8%@�r�(�TfKjg�]�Yy������n{�/���~w�X� P��F�P}���I+h��`���һw D��Ѱ,�p�$������Vq�T`�Y�&w���u��0�@���dU�:κ�Kd��w�H�=(�20dh���-4t�m�0Q�$Ls��<� �W������_h> :Gt���4,��r�S+�+�[�_k��Z�gu"�"�di�' ��ͮ�ޓ��3T#�S�7��mH�K�P�,e�7}/ �X͇y*���ժ����S��d��R����U+PW��7FƖ�ːM�I�zp�(�yƪ�=�8U�&Z��|n��K�qXu�V�w"=9�]s�6KDzGɢ��г��i�(�������>����^���PE��J�I���5Dl��\.�_|��0���D�6Vs�����26[P���8@���7.�B���^U�9m�KSf-���x��#�Z�L�4��ўl���pa���ZaS��A�u�k@M�=��D+zv!m軆��E`��ج<�Υ[�I�?��B���D�K��/`�3�rl�[�89q�/��(a<3���� �Q�]?Nu���R]-a+l��v�Bsh�)\je|���d 52���"z�{/-c�2I�S!���@E"4����_��7[!��Y*�Y"v��$��E����S~絠I3rSPa,�G���=p E�;��n�Ó���hml�x�K�^��X*;���I�yl��iR��Cz��U�MMsR:�����R��%rT�N�R2��_�Y{�0h�o����E���<��4���úR��@���q��/���� ��&�t}_�b�O�Iɣ9<�P�O������Q\��I.�7��P�U^8��ki�m�Xf炮nv������{��zS����^���x��;(�QKz�%����`L˯)J�ې~�h�����w�"`c-f�C�/>d�o�0\�ήz�ߙ���2��Ɛ�����X��^�C{��0�f�\X҉��$-r`���9o����v�L>f���+r1�Y�{O\���6�KP��+*`����u$�5CC>�Ͱ�ЅN�Y�A�1�dl���º+*���� y�����4�წ��������D���LhT���D�A,��a��n٢-��PD��^5��\�Rh��싋�mU�p�� f�"^�0�$/ �9��Z6F��������U�^`~v�X�>���\�u�dޣ���c�nL�������G#�`��h�T��PJ����8'4�fHMX���m����$�M�۰s`ܺ��,��)�}�Z����a�u��K:���>⪉U���ѱ���3��S 8gS��[`��T{�$H,���h�p\r^$�`#�v�p�(��^�YUF�Yu� ���q�w2sƍ,��ׂ=����mq{��H��x����������K��<(���4M\O�]}sA�!��m״�rnV�;��OD��R2?����&j��tO����Oe�l�����A$e��Z���������zC��4�s������o#��Ђ��L���Ƴ7`�d�J칗ǯ$��Q}I�� ��Wp��ƕQwH�a�]l���=:S7+�Dڸ6(�ك{��_~;� s��������! ]W�Pâ���!6��q�:A~�{p`V�߈ђ3�U�o�Haa�� ���^��a�I;�� Th�$�h��{�����pѰB'�8���M����;,@�sʢ�BĜ�[��,w"��J%Q �s�Xw��'�(%�4y#���.���BYe,���uM1��t{&]^�ӕ ��g"��V����5�)v��������j�⿂���Uin�4 K�<� ʢ7�6�)G�*M�|�e�X�C������M�IO0n�-�^��#��z�bӎ��VA�+��� ���L�mp��|O6j��x�l)����uF�溔:Oy�W�D�3Ľ<�)? [ra���� ұ������b?�~7<����b�[��{��r^�x�u_3r��KoN�[�� A���!RJ���Q����N�Gm��r�ک��0^�`1��V�F�����Qp&M4����wj��o^\\�w���_w�r�<Q���Oj]�ud�>���pbD25\M�-ą��6���[E��Y{��� ��p�a��6�S�T��V�j�X$��T_����ğ�$[/7or�}��)�S�-�q�<0�����3��g��X��]dƑ�q- �$^1:Ќ]��\�!9�ߣ�*����>H�8�y��yZ��3�n#�Dy=yw�tb�ޖ���Ţ�T���Rt�#�/_�,�NT��WE�ҍ�5����;~�?��~KO�&?n���͈�^��|�� Xi��5�|���#!Kc��5�l9�cӸ�J�l��&���k�j�q���P̓y��sn�z�)ym�l��s���ȜغQ��F�����r�<�yy����{����[?=��MА����#����٣@�G�O]��#m��#�Љ�=��]�68�������I�0��rCI�v9ηa���L����jr}��2LX��]� 8�K�B��_����z��u�����8�22��02���s��B���>~�*�p�PPd1�1UQp(�V״S�Y�?s�p� �SnG_\�������1&U�EN�p$�f��w%ٖT��}/d�m*TSIi�
Behavioral task
behavioral1
Sample
EZTEAM.exe
Resource
win7-20240705-en
General
-
Target
EZTEAM.exe
-
Size
37.3MB
-
MD5
7eaf55204fb856f6e23485cb903a5c44
-
SHA1
b6c5286480147884022e2e2e8b8660673fced26f
-
SHA256
11359e7ced83131c238dc45e06f4b4a9bdeee9b3c82f26afb819d1c480cde6e8
-
SHA512
c0b35d55799d36cd02f6319b6d7e6470b0c13db393b0766d90c39664012aabeeef0868611518b8f02ceb801590447e80688cc20bf1890412f38547460fab23b6
-
SSDEEP
786432:oEc+Or04+YdRSRgJdXu8mLO6Vvz6HJ9fBW:zvOr0wdRVdXu8mRVGrp
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource EZTEAM.exe
Files
-
EZTEAM.exe.exe windows:5 windows x86 arch:x86
Password: 123
c628ea34d4c8d513317049fd9025fadf
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
shlwapi
PathFindFileNameA
kernel32
LockResource
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
CreateWindowExA
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 53KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 34.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 37.3MB - Virtual size: 37.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 41KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE