zeta-updater-1[.]0[.]1[.]exe

Resubmissions

19-07-2024 19:26

240719-x5x16awdjp 10

19-07-2024 19:22

240719-x3gamawcjq 8

19-07-2024 19:19

240719-x1lsbszapb 8

19-07-2024 19:16

240719-xyvx8azajf 7

Sharing

Copy URL

Twitter E-mail

General

Target

zeta-updater-1.0.1.exe
Size

3.1MB
MD5

b10ed91a7fe5a422d9c2f9aff5696a19
SHA1

c83105f812109e5f6a26564c197f49d61b2ef403
SHA256

94c0a829b34030f4b279c794962627eb422cd3ce3f969eb8ca330ca0c9f82635
SHA512

fc0d5149ce62ba67755732e5a0004a158bb36ec4e166fcbd734a89c9bde855e71ccf06ee5c7ff9df0834397178c90b9da40769b0275ea487d41c8201f7007c25
SSDEEP

49152:5wSHmvR05JIoEe/avRAvUP5v8R3Lkvrd2o8FEOrJUjnjv/kFE2fSAeFa5J9dxSFw:bOAvsU0D/IE5AeFWxxSFw

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
zeta-updater-1.0.1.exe

Files

zeta-updater-1.0.1.exe
.exe windows:6 windows x64 arch:x64

19712784508f23d78d419e6e69d04a0a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

zeta.pdb

Imports

bcryptprimitives

ProcessPrng

advapi32

RegQueryValueExW
RegOpenKeyExW
RegCloseKey

kernel32

GetModuleHandleA
CloseHandle
GetStdHandle
GetConsoleMode
SetConsoleTitleA
LocalFree
SetHandleInformation
CreateIoCompletionPort
GetQueuedCompletionStatusEx
PostQueuedCompletionStatus
SetFileCompletionNotificationModes
FreeEnvironmentStringsW
DeleteProcThreadAttributeList
GetCurrentThread
CompareStringOrdinal
GetLastError
AddVectoredExceptionHandler
SetThreadStackGuarantee
SwitchToThread
CreateWaitableTimerExW
SetWaitableTimer
WaitForSingleObject
Sleep
QueryPerformanceCounter
RtlCaptureContext
RtlVirtualUnwind
RtlLookupFunctionEntry
SetLastError
GetCurrentDirectoryW
GetEnvironmentStringsW
GetEnvironmentVariableW
GetCommandLineW
SetFileInformationByHandle
GetCurrentProcess
DuplicateHandle
SetFilePointerEx
GetCurrentProcessId
WriteFileEx
SleepEx
QueryPerformanceFrequency
HeapFree
HeapReAlloc
lstrlenW
ReleaseMutex
GetProcessHeap
HeapAlloc
FindClose
CreateFileW
GetFileInformationByHandle
GetFileInformationByHandleEx
CreateDirectoryW
FindFirstFileW
DeleteFileW
GetFinalPathNameByHandleW
GetFileType
GetModuleHandleW
FormatMessageW
GetModuleFileNameW
ExitProcess
CreateNamedPipeW
ReadFileEx
GetSystemDirectoryW
GetWindowsDirectoryW
CreateProcessW
GetFileAttributesW
InitializeProcThreadAttributeList
UpdateProcThreadAttribute
MultiByteToWideChar
WriteConsoleW
CreateThread
GetFullPathNameW
IsProcessorFeaturePresent
GetProcAddress
WaitForSingleObjectEx
LoadLibraryA
CreateMutexA
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId

api-ms-win-core-synch-l1-2-0

WakeByAddressAll
WakeByAddressSingle
WaitOnAddress

ws2_32

getaddrinfo
freeaddrinfo
WSACleanup
WSAStartup
WSAGetLastError
WSAIoctl
setsockopt
WSASend
send
recv
shutdown
getsockopt
ioctlsocket
connect
bind
closesocket
WSASocketW
getsockname
getpeername

secur32

EncryptMessage
DeleteSecurityContext
DecryptMessage
QueryContextAttributesW
AcquireCredentialsHandleA
FreeCredentialsHandle
InitializeSecurityContextW
AcceptSecurityContext
FreeContextBuffer
ApplyControlToken

crypt32

CertGetCertificateChain
CertVerifyCertificateChainPolicy
CertDuplicateCertificateChain
CertFreeCertificateChain
CertDuplicateCertificateContext
CertFreeCertificateContext
CertCloseStore
CertDuplicateStore
CertAddCertificateContextToStore
CertOpenStore
CertEnumCertificatesInStore

ntdll

NtReadFile
NtCancelIoFileEx
RtlNtStatusToDosError
NtWriteFile
NtDeviceIoControlFile
NtCreateFile

vcruntime140

memcmp
memset
_CxxThrowException
__CxxFrameHandler3
memcpy
__C_specific_handler
__current_exception_context
__current_exception
memmove

api-ms-win-crt-runtime-l1-1-0

_cexit
_c_exit
_register_thread_local_exe_atexit_callback
_exit
_initterm
exit
__p___argv
_register_onexit_function
_crt_atexit
terminate
_set_app_type
_configure_narrow_argv
_initialize_onexit_table
_initterm_e
_seh_filter_exe
_initialize_narrow_environment
__p___argc
_get_initial_narrow_environment

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

_set_fmode
__p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

free
_set_new_mode

Sections

.text
Size: 1.8MB - Virtual size: 1.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 104KB - Virtual size: 103KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 117KB - Virtual size: 116KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 19KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

Files

19712784508f23d78d419e6e69d04a0a

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

bcryptprimitives

advapi32

kernel32

api-ms-win-core-synch-l1-2-0

ws2_32

secur32

crypt32

ntdll

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

Sections

.text Size: 1.8MB - Virtual size: 1.8MB

.rdata Size: 1.1MB - Virtual size: 1.1MB

.data Size: 12KB - Virtual size: 12KB

.pdata Size: 104KB - Virtual size: 103KB

.rsrc Size: 117KB - Virtual size: 116KB

.reloc Size: 19KB - Virtual size: 19KB

.text
Size: 1.8MB - Virtual size: 1.8MB

.rdata
Size: 1.1MB - Virtual size: 1.1MB

.data
Size: 12KB - Virtual size: 12KB

.pdata
Size: 104KB - Virtual size: 103KB

.rsrc
Size: 117KB - Virtual size: 116KB

.reloc
Size: 19KB - Virtual size: 19KB