Â~���9�Q���j��?+��l�\���b�u�����wtL\$�^�5��Щ�h�@W�uE�H�.8B�(�EYE{��XpkJ����d���Ŏ@Q#�uO_�]4ĥ�9"�8�t~�n0G�U�8��ӗ����@2�#��Mim���s�uV�v�} �6�b�gJ&%��C��e�P&�6�"9��5��5�Zf��R�(1����^/�:>>b~mu��+�N�8���]��?��A�%�M�;u���!#�J�%��5�$ f�Vu�d�r �����K�L�������S�x^(�q��*�f���̐Ԫ�췘���������:�O(e���k�o*}���GÃ���v�D.�v�_�dU.eL:b��H�l���d��i�w�S� Ú��J�g�0o CLj�U@ z/~�g�w�=���$Ym�?O̫8�9���K:����l�a�0�O�Z���4��Ϝ!%�?!���s���~��N��*���>o�{Ɯ��~���k{�g;�' t}E]7�'��Iܸv�O��<��/EV�Щ���)f�g%�^ 4]R�֜637C���'&���<�ܲ���ו���йʮ�pH�T{��kv� �0�����q�5&rB����C��_m��ܱ�?��[װ��DC�H'f�xٿ�pU��Z�����J�h��n���~=�m�w+ ���@�8�6�q��c�)�{�߂���84������R�������Z:xR5p�V���G,49�mS�m��e�[ ���0�?u� ��r�m8h��;��za��� M[�b�U�� mW�I���ae�*�/�a����Y��0Q `��+�V��:�40�����]$0q'G_<���g!K�QA�S�����F�J�}B�Ƒ�A�:M$|��x^��)�����t�y��O��#u�����a3�����������䛋�;����.-�:�U� �T����w��y��a�Hj�|>��7��� 2/�L{��9M�3��v{��Yn��t�������AR������q�%���fy��[(�kv�oO�H�!�d�����^??����1�5㋫@��#�7X���Pu�n�|� r�� �2�H�pe���q`V?ƹ���/GMB0�!jՍO�B#Ϻ��� 8SI{�7���nh����'}���ɨ�L�ʖA�۸�%�d�*|y(v�:�T�����3� S=��O���"V����zn����/���ʈ8.J�Jk.Lgc��De�qe6�!�L��5�F�F�#%�U�aA�4��(kW�r�u���� ���v��É�$>>��w����y���/V�"���Vt�F���E�!��%!��%��A��Z? %c?����Ƃ��kv�uɜ_O��Ѵ��π��cD\g�����/$���YO��ۭ~�v�h�fPk�Ư ^-?�Bg�oj�zV��"D)P�[������U�d^7%ϫ�W�3a�C P+9gn�1���S��x^�&��t����B[f�A���{�f����&J�_��x��R_Y�$d��9�a��)�oO̦tM=�\���`�o��.��-@�w��#N�,(=�\���n��������Nnb-��lc�f�>�K(G�W}�Y�m�Ɍ~r!|SP$��*`�X�w�����u,Lu��1�遮����w믩������3�~�OFZQ:�ݿ %1�肁$���[��#�ג2�y�dF��SDO�oU��#����s8}�W���5���j����"j�#C�~v��Fw�����m��31^��eD�z锅��R���$ ��97���O�������@�`��%\.�P\��-������q����f%`�Zp��� &��x?�'����z����C�i�|��ⷳ/�%��zNȃllw������z2U�Z4��`�x�:x ��S��1���������F��IX�ng�,wJ\Iz�*�&v�h^��:�1냠�šC63]ab:U=�1���l�:��Xƀ���U&�T����OK��!Pj��e�nD�P���qUF: �b�����f6g`���S� ҿ�<���X5����co4L��:���(G�՚�<Ӵ�=k"�y�B6�����D%��� �b>�#���@,!�iF�K-��*�����x}����P�Bᠤc�'C�G�����+�g�T�M��ع�KL#�)��`+!$R=7m�u��M6��2����ξ8�7�~���Q��V3;��?�*��}��C���WsV4����>T9Y� ��k��^p�p�7�c��%$�O���5�t&�N6��S�9�� E�|� f������n2�2������6�`d��z�W\v:�w��/�@2Z��m��x�:]���n��֣3[m��<wΥ�}�C�ͯe"TL��-(c��uA�٪4�hG7�O��;P�Ͷ��>W�`� ������Yv/��M�\~�=��l�$���~�A:N�2sz%z�%�"s+��Cv�=���!�UHx=[&��ז�n) ��^�� @�*��8�G��;�ln� >C��B���J�����.�+<���s�.�Q �|L��NW���\�ca��Mrg��T�0V��{F@M���YG���\���k�*xÜ�6ɢ�:�hs��d0� G�l��m�II㗮M��!G�eI��ؐ�)�>[ͿR� <���ܺ�q9����dR�K!%e�t<�LX~(�*6&��Oj��{/'�����ͥƪZ�0���~O,�,��BvH����Uf^%�6��$��T8��S�$� �z5�.�6��A6�,�d�Ch�N#01ސ/�����7!�xll�"���f�ȍ3�\����<��P?��+�'�R�������/2�1/�� ���C���//2<Ss�>?�5��6��`�A���;م��?�S Oy�Xx[O%�J��O��f��v(XD�S���[02Jf��+�\8!4=k�q�J�cF��b����n���wE�7zh*����;�%�Us��Ul$?ŏ.ُ�Vf��P� ���5Ubl���j� @_�W\� ��R�c߄T+?�ӶCr]
Overview
overview
9Static
static
3UB Downloa...ix.bat
windows7-x64
1UB Downloa...ix.bat
windows10-2004-x64
1UB Downloa...h2.exe
windows7-x64
5UB Downloa...h2.exe
windows10-2004-x64
5UB Downloa...ix.bat
windows7-x64
9UB Downloa...ix.bat
windows10-2004-x64
9UB Downloa...ix.bat
windows7-x64
1UB Downloa...ix.bat
windows10-2004-x64
1UB Downloa...b1.exe
windows7-x64
5UB Downloa...b1.exe
windows10-2004-x64
5UB Downloa...ix.bat
windows7-x64
9UB Downloa...ix.bat
windows10-2004-x64
9Static task
static1
Behavioral task
behavioral1
Sample
UB Downloads/UB Silent/bsod fix.bat
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
UB Downloads/UB Silent/bsod fix.bat
Resource
win10v2004-20240709-en
Behavioral task
behavioral3
Sample
UB Downloads/UB Silent/u237cgatAh2.exe
Resource
win7-20240704-en
Behavioral task
behavioral4
Sample
UB Downloads/UB Silent/u237cgatAh2.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral5
Sample
UB Downloads/UB Silent/w11 fix.bat
Resource
win7-20240704-en
Behavioral task
behavioral6
Sample
UB Downloads/UB Silent/w11 fix.bat
Resource
win10v2004-20240709-en
Behavioral task
behavioral7
Sample
UB Downloads/Unlock All/bsod fix.bat
Resource
win7-20240704-en
Behavioral task
behavioral8
Sample
UB Downloads/Unlock All/bsod fix.bat
Resource
win10v2004-20240709-en
Behavioral task
behavioral9
Sample
UB Downloads/Unlock All/nRi28Wtqb1.exe
Resource
win7-20240708-en
Behavioral task
behavioral10
Sample
UB Downloads/Unlock All/nRi28Wtqb1.exe
Resource
win10v2004-20240704-en
Behavioral task
behavioral11
Sample
UB Downloads/Unlock All/w11 fix.bat
Resource
win7-20240704-en
Behavioral task
behavioral12
Sample
UB Downloads/Unlock All/w11 fix.bat
Resource
win10v2004-20240709-en
General
-
Target
UB Downloads.rar
-
Size
10.4MB
-
MD5
270834e7808f06ca7084d7f1d0c381e6
-
SHA1
0be9a2d5a645c284ac401919979301fe3476e50e
-
SHA256
dad5fcc1e2c3e28725f4b55c79f5334a70a81bdd4eee06dbd783eb25a2908c0d
-
SHA512
6da328d5cd6172bd88a0196d7fe46ef4358251f4192f3c13e0423e77009df039328855a53624ba39327766b7d5ff27bfc29d0d19265677c41771c7a16eb3d046
-
SSDEEP
196608:7I6Rnhwyatu6GmzOm4mFibSNQI3q0xqbuRz4c3y9QsluQANg8+lPjW7mUjjwK8p4:U6RhwvFSyFi+QIa0xqbozb3JKW7fjkKx
Malware Config
Signatures
-
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/UB Downloads/UB Silent/u237cgatAh2.exe unpack001/UB Downloads/Unlock All/nRi28Wtqb1.exe
Files
-
UB Downloads.rar.rar
-
UB Downloads/UB Silent/bsod fix.bat
-
UB Downloads/UB Silent/instructions.txt
-
UB Downloads/UB Silent/u237cgatAh2.exe.exe windows:6 windows x64 arch:x64
51235326a5333254d9a2e7b5ce26509f
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
UnmapViewOfFile
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetWindowThreadProcessId
CharUpperBuffW
advapi32
CryptDestroyKey
shell32
ShellExecuteA
msvcp140
?always_noconv@codecvt_base@std@@QEBA_NXZ
wininet
InternetOpenUrlA
normaliz
IdnToAscii
wldap32
ord79
crypt32
CertFreeCertificateChain
ws2_32
WSAGetLastError
rpcrt4
RpcStringFreeA
psapi
GetModuleInformation
userenv
UnloadUserProfile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__std_exception_destroy
api-ms-win-crt-runtime-l1-1-0
_initialize_narrow_environment
api-ms-win-crt-stdio-l1-1-0
fseek
api-ms-win-crt-heap-l1-1-0
free
api-ms-win-crt-filesystem-l1-1-0
_lock_file
api-ms-win-crt-utility-l1-1-0
rand
api-ms-win-crt-math-l1-1-0
_dclass
api-ms-win-crt-time-l1-1-0
strftime
api-ms-win-crt-convert-l1-1-0
strtod
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
api-ms-win-crt-string-l1-1-0
strncmp
Exports
Exports
Sections
.text Size: - Virtual size: 456KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 111KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.lol0 Size: - Virtual size: 3.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.lol1 Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.lol2 Size: 5.6MB - Virtual size: 5.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 224B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
UB Downloads/UB Silent/w11 fix.bat
-
UB Downloads/Unlock All/bsod fix.bat
-
UB Downloads/Unlock All/instructions.txt
-
UB Downloads/Unlock All/nRi28Wtqb1.exe.exe windows:6 windows x64 arch:x64
51235326a5333254d9a2e7b5ce26509f
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
UnmapViewOfFile
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetWindowThreadProcessId
CharUpperBuffW
advapi32
CryptDestroyKey
shell32
ShellExecuteA
msvcp140
?always_noconv@codecvt_base@std@@QEBA_NXZ
wininet
InternetOpenUrlA
normaliz
IdnToAscii
wldap32
ord79
crypt32
CertFreeCertificateChain
ws2_32
WSAGetLastError
rpcrt4
RpcStringFreeA
psapi
GetModuleInformation
userenv
UnloadUserProfile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__std_exception_destroy
api-ms-win-crt-runtime-l1-1-0
_initialize_narrow_environment
api-ms-win-crt-stdio-l1-1-0
fseek
api-ms-win-crt-heap-l1-1-0
free
api-ms-win-crt-filesystem-l1-1-0
_lock_file
api-ms-win-crt-utility-l1-1-0
rand
api-ms-win-crt-math-l1-1-0
_dclass
api-ms-win-crt-time-l1-1-0
strftime
api-ms-win-crt-convert-l1-1-0
strtod
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
api-ms-win-crt-string-l1-1-0
strncmp
Exports
Exports
�F��=j����@�>�4+��ج������;aG����iC�A�a� �)@���Ň�1�i���A �5mx����u�"�ov�p�u�l��G�4�u$5�b_�'�d������%E j���CJK��J@:�������OCO��\>�kk�۽>��6�ݮd�w��}���Jx���n%5� �A�*z[ 7We>T������h3_y˾�g'�s5�����s�A��[�CT� 5�ĉ����S�Y~�d3�Z0ӫ����o�e�5�cE$��{�U��y�*�_�F����B9`��5_@Š`��ć�뚙od� ��66��Q/��w���8]&�-�^�e�<P�C,��f��N��ϲq���*FN�^M���UR�|���6@2��t:�)����'n����o�NA�>��4��h3�;<��>/�(�p� n��������H����s��T�T� յ���@�y�3���:���T2�f"���>�Mnneq8*$�����%q`ǣ�&x�9ɤ]Q�d%08���/�NO��fNIm�DH6 V�"�n��xzE������bcK|_{��>�PZ�4}��$>%e�=S r�?�h&1�]�� �P� *o\�y�J��2�*�8��r��3{�U���+� ��27��Ԭ���1b�cͩ��~˯it3�s"�q+Y!��y�az�jse1k"X��?f)~�C�#?��WY�������W۶${�a�z>{���h-7���删q�m�-(ݴ�$Mo�>��D��rR�jh�EDʪ�&f[���BnnjD��C�����1E�� � m|z��e�W���|�݈s�;�R%���V��Z�埁�3�����T����Lb�.�?�MK��t��kEdXU!D�Je�xD�<�g�B�L���D4�K��~G��`s&�"QM��iȅ2r�@d�|T��WsQ� ���!&�9�;�e�-��UU�;�[��P��"�ML5<:_���LjI���F�8V�݁�x �J��͟���_������p5]9��ZރޞfpM��=S�:VD��0تX��MZwF��!��T����i���Ev6+���;QoRL��P|���S���a��$|�,5��4_?T-oB���k�����qo~P⾢H�4��J7wgf���V���ZC2�5��KE�S�m��~-��Ve������:C �w�#\�%���=�Cj%:����W�S�'�y�x=lM��gHŋT�������O��k��?"Úɶ�:/��m�%.��qc�kG~6{.]+A�2[O8��O��S�<ỽ��Y��֦NY����g�͕�Pf)�Py�������J!�ĥ7���{�P-��8��0�7ǵ*�z�鐫LxխPB��j�*l*#�f�h�&�Ov��%�����!Đ��*3��˫�ւ=0O�|�n�_��U�p!�tĴ��ݷ�9��r�稶�V�@��!�q�B��yg{(��vI)e�2��#G��^��{,��˿fA2�ⱌ,`h���WG'�a �����������a�7G�U�W�_H�1> v�>���xX��~��h��*(���9@��f-��h�}� ��� �)���ĭ��q�/֪��Yj����S5�_����T�����&FP�a/� o2�� �~V���r�z]t��# �X�&"��<��������b�=҇b*6T����$��Q�ш��OM��i�-W�W��ؑ��i��*8X��v�8'�ٛ1`�L�k_7�s'.�y�=y�o�Ż�w��y�F ��<`�i���8�_~���ٞ�y0��)<��������b�˞ba��:�O�cm^m���˭�`*Tn��[�z�bڭ_W_��D��d�R���ӯy`����@wR5�tk�| ���@���o�f�!)4��/]̆<�F(�V���_�ww�>^�]r(��ǃ�����k�lτY!����z�t�����k�}�{1�\��6�GpT��F�*���������a��dF�Mj�(��(��Fsv���r2��i�I���7�<��ÚN@�eL�Z�����᧵!�Oa �e�'d�^������(����n�~#�U��3�9`3ζ���Z���9.��Ӿ��d������[<��t7�b��'$hn��s�Q�UF�c�ۅ(���R{m���g��M�%{d��l6���F~.#���CT&�>���@i�Xêt�D���p���Ѐ}8��<���t����a� �(�=�Co�����R�i�`Q�UӰ�.��ޯe-���4�4���O��#�==?.M�U@u��L���g�c[�Kq�T��3��?]˰}<���TX���d�h`z���}��k���8�Z�%~iP;�(ky� w�8�l�I�PE���;��B�n$L�)72�Ӳ���0������d]-��'��J��dJҳ_/[ϊl����P�H�D��l}��K����c���:�JU��r�J҄��h��s|�z/��NPcM$%��i ��(�������j��dg��`�r;�Aa]�L���DK�[|Ю;�/��cV�|�c~}J����h��� ,�Y6p,��X#l��ܰH����BE*A����Fz<��W$�4s��,(�q����/��&��c��t`+�A�C�ѵ]'���� {�D̅��H��TS��Y9�&&X %�a�_BA�8��<��W����1<S�ޢX�-[x���G���� �'3�!�h�3MU�ylU��h�"Ǜ���4��ܔ��C��J��/��|�d�C�τre�6d;m��Ryq��jFL���'�99>L~�hP�jкA�L9k���FD?lQE�V,b��X�(Ɉ��|��6I6,�x9�Ng��A[9 = �6��'=d'h����_ g)��� �����#X�F����Y�g��*�e�s+s`1t�t���tQ�n���Ȋ���,-ѵ�KjT+�qɅ���n=�гV��<R�E���5-*� �X2���f��O5Fa����5��!��+I�^��d�������-�����A����y��51�%!���������Z��D��,���Ő�5����k��!
Sections
.text Size: - Virtual size: 456KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 111KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.lol0 Size: - Virtual size: 3.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.lol1 Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.lol2 Size: 5.6MB - Virtual size: 5.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 212B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
UB Downloads/Unlock All/w11 fix.bat