��f;�ls��i�Y�`���\4Ai�SD���p�98��V"�gX[�S�;���SF�Z�ȻP�a8����Lpo���|,PH�K~�r�N�yƏG����*#S����T�-o�ᮛ�E�Fuu�b�@�F�a�%�g��U`�ۡ3��8�n ��`�B�vV[���� Z&_�gk�v��_�H��w�U��)����eި-.���HF� [�2n눨 {��;�5�%|f!��e�h��`q�����g�+�6���U��!i#l׃%I�f7S O����� ���B��Z��,*��G�����LT�_�9C����E���$���l�x+qM�����X5�z���r����\��goy˭�����w�)H1���]`9�ID.�<V��d��(��ߛS�}�Zb����B�~���2�Ӛ�̫���:9p�,U�D����M�EP ��]����%����_�;���@����A�0'{6���K��Q"�;���yæ;��P��tRuOQ��G���0�H�G!V�y��?����Y�BĚ�@o �����z���'t��o ���"���Y;}�Я�rB)A����*��v9X�z���2:Fvދ����8�K!Q�h���[����J3x�5YO,]];�|׀���n��� ��sڙ��3Y������&E�ߔ�1]Ƴ�t�� �"N��})���,�;<s�� ��W��H,M�#�2�Pǣ���U�eܸ�&):�X_p��|��#��%`-����8��yЙ����a:��<��l� ���J. H>�PM��Ȍ������NCr�z��n��T���f�v��E���*���X}�p�����fR(#̈́T �-7Ja/A=� �!���ADܳ��dt��aJF�Ld1ht��]}�Pk� �8���;^�>��Uݏ���MF��n�s�p��{��hǞѓ��=(���@\�|�%`R��l@�bi��;U�Y�Oi� ���I��\�&ȅ�%Wz����=/8(���O�A�ƎIk8.�8�f��ܦ`�pg5{;Ѡ��L���ѡ��m�Α6�S��)W�Xc��b�仺���>���hw�0y*��ţ:��P��/O�r��Dh��~"������ �!�@�zQa����� W�==�ď��=F�g&�X�f;��n`V�@�N�%�b�@XT�|P�O�}���� +�i9�y��Ơ�|"�������?�U!�_q� W ���N�Hy��.���vǠ�u�z��RJG���Ku��\�������#{3v��.�f�l�%̨��O� ����jH�LL���H��%0�%���k��B����t���$o�B5��KXtw�F,G2��h=.�M�ld��_����xn�%��#����訒�d�}��o��0+�u����a�� �ݪG���+A�,Tl�Y2�+ψn��q��=E�`|�P6�6J���[P1���ז J`�82].��ڞ�x?|��}&��|~W���SB� >[_��J�MU�_��v&,`�j2�fǩBQ�)��oӋ���e�2 �Y#�����ڑ�C!6Ѥ�P��7��7��vOzqY;�K��,�Vɀ">��`� ����X�3����$;XV��,M�P6r.�n��eV�ӽS�Y۶�"������Z�5����b����h2�U��ի*��E�s��<�q*�C"��m�k[c����9�2:x[���Ⱦf{̆�c�9p#L"�� � ����EdClJO'��'��`�c���kg��nH��q��%n������a���D}��Y4R�������-�!?���Ő'�3W]F��#7�ߦ��Y�Ӷ�Y��9aY ��[�������_:���Q�7���j�a2(:�@�b�q�@0����9�qC����-�2�=ໍ���T!CD��g��/��ɗ9~ � �����x�ʘ�Ҫ�2�ʕ��ݐ��)�ۂ���z}���K��[\����D)U{ �_L�{ĭ]- o��O(w�"V:9��]�|��g�m�6u4�y� �jor�M�`-o��[���� �����(�~�qKLu fֻ�8�D����gno��2¤(�/P�ug����d����y�'��$�Q}my����SHָ�_�j�[ ,�^�Qt�/���+�FU�ߋU�@��\?,n����]^�ܘmQ��1Ј�`���n�W5�)���Xw=�����zG�o}=s!ơ�I�kG�ۑ�kE�5�K��lk2���o�@���T�Ć�����صp�� ����Z�9������1���>vl�Q��eX��\[h��>��+#�0̹�5�}di<</�!��b�~v�J3�����\�4XM'f5�ʮК�o6z��ҡ'��u?�I�KN�M�;�e&�w0h7��Ij,�W���Ǟe�8������]o�[>���'���G��ιz��G����1�|�OnՉE��ަ��Ɵ��)Hc�����@+� ���,Y+/Ly�3i��V3�T.G���7�kVQ&�!K��>c�7$�6�ԔV�*���\�y\�#���$ P8(p�����.��S��V��'(-V�h=����^�Շ]��}DPL�EC�!���w���"�Z1�ν}���-��h(E���\�eZ���|�����Y��t��8}���RN�Y�pYގ�A���T|@;�.����+ ��JZަ-aK��}n�.�� ]<��o凖-���6p����C�(UiCS� ���p���Y4+ PU��-� |W�>4Y����YZ�ߝ���-��F��h�뼁��=��Aؔλō(Ȇl"�[ɤE�����[��/Ğ$d�Q���;��!�9��/Ý�_n'`�ܲ���������jE�����@>��"I�� ����� �M�H��N �ebi2I��h��f����aN�ϻ�L'�}��&P��#xUO$�t_|5��2��c�]�`��[���t�=q+�Шr�����)w��f�M�j"�ebL��}N?UQq�2���Hh�A\��|pڒ���Tܓ�W��6��x^2�a/ȿ�vvmc{�����ѳ+�f�Wy��kڴ;
General
-
Target
EZTEAM.exe
-
Size
35.8MB
-
MD5
12241926b4d4ca8c87e04150d7ec399b
-
SHA1
89e50d112e9be0f83d0334520d8f8f4e3047c311
-
SHA256
d1f1e88a4400377d8821e2017ce70a9613308fae3e75a798fa86bef97477c587
-
SHA512
36486de872f59274374010a3a28f33fa3d1233091bde72fad604e5fabf301c7946378eab66182f9ed7ab9ff0df088e06d22713be881b146446974119440d4a59
-
SSDEEP
786432:E7ZazzqWUQJmWt1FqyYbphXT0FbZ6t7km5dFTve:E7QzzqWUQJmA1FqyY1hXQNu79LT
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource EZTEAM.exe
Files
-
EZTEAM.exe.exe windows:5 windows x86 arch:x86
c628ea34d4c8d513317049fd9025fadf
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
shlwapi
PathFindFileNameA
kernel32
LockResource
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
CreateWindowExA
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 53KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 33.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 35.7MB - Virtual size: 35.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 41KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE