Overview
overview
3Static
static
3PoineSpoof...]_.zip
windows10-1703-x64
1PoineSpoof...]_.zip
windows10-2004-x64
1PoineSpoof...]_.zip
windows11-21h2-x64
1Startup.nsh
windows10-1703-x64
3Startup.nsh
windows10-2004-x64
3Startup.nsh
windows11-21h2-x64
3afuefix64.dll
windows10-1703-x64
1afuefix64.dll
windows10-2004-x64
1afuefix64.dll
windows11-21h2-x64
1amideefix64.dll
windows10-1703-x64
1amideefix64.dll
windows10-2004-x64
1amideefix64.dll
windows11-21h2-x64
1efi/boot/BOOTX64.dll
windows10-1703-x64
1efi/boot/BOOTX64.dll
windows10-2004-x64
1efi/boot/BOOTX64.dll
windows11-21h2-x64
1efi/boot/a...64.dll
windows10-1703-x64
1efi/boot/a...64.dll
windows10-2004-x64
1efi/boot/a...64.dll
windows11-21h2-x64
1efi/boot/startup.nsh
windows10-1703-x64
3efi/boot/startup.nsh
windows10-2004-x64
3efi/boot/startup.nsh
windows11-21h2-x64
3Resubmissions
24-08-2024 21:59
240824-1waq2ssamb 3Static task
static1
Behavioral task
behavioral1
Sample
PoineSpoof_[unknowncheats.me]_.zip
Resource
win10-20240404-en
Behavioral task
behavioral2
Sample
PoineSpoof_[unknowncheats.me]_.zip
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
PoineSpoof_[unknowncheats.me]_.zip
Resource
win11-20240802-en
Behavioral task
behavioral4
Sample
Startup.nsh
Resource
win10-20240611-en
Behavioral task
behavioral5
Sample
Startup.nsh
Resource
win10v2004-20240802-en
Behavioral task
behavioral6
Sample
Startup.nsh
Resource
win11-20240802-en
Behavioral task
behavioral7
Sample
afuefix64.dll
Resource
win10-20240404-en
Behavioral task
behavioral8
Sample
afuefix64.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
afuefix64.dll
Resource
win11-20240802-en
Behavioral task
behavioral10
Sample
amideefix64.dll
Resource
win10-20240404-en
Behavioral task
behavioral11
Sample
amideefix64.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral12
Sample
amideefix64.dll
Resource
win11-20240802-en
Behavioral task
behavioral13
Sample
efi/boot/BOOTX64.dll
Resource
win10-20240404-en
Behavioral task
behavioral14
Sample
efi/boot/BOOTX64.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral15
Sample
efi/boot/BOOTX64.dll
Resource
win11-20240802-en
Behavioral task
behavioral16
Sample
efi/boot/amideefix64.dll
Resource
win10-20240611-en
Behavioral task
behavioral17
Sample
efi/boot/amideefix64.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral18
Sample
efi/boot/amideefix64.dll
Resource
win11-20240802-en
Behavioral task
behavioral19
Sample
efi/boot/startup.nsh
Resource
win10-20240404-en
Behavioral task
behavioral20
Sample
efi/boot/startup.nsh
Resource
win10v2004-20240802-en
Behavioral task
behavioral21
Sample
efi/boot/startup.nsh
Resource
win11-20240802-en
General
-
Target
PoineSpoof_[unknowncheats.me]_.zip
-
Size
779KB
-
MD5
0306977bc6d3acc8fd16d4d97a420982
-
SHA1
e8d1fd80f97c786d240abeaed574d97933b73c2f
-
SHA256
94bc7ad806d6edb809722c04f368908c29cd5ebf3f216838425b6f8f23133bea
-
SHA512
3c51532bac49365ac0903824f4245952ed46035a1e8a95ce745dfe8f48d28035faa63d6e781187546335b310c8c4dfdc22dd4f447c4f5a53ae8ec0e3536810b7
-
SSDEEP
24576:lWLAkp9aKu6kMDzDig/WY/Z4UkoPLrdqpvLbG:4Lf0Kx/XikWM4Ukmr4M
Malware Config
Signatures
-
Unsigned PE 4 IoCs
Checks for missing Authenticode signature.
resource unpack001/afuefix64.efi unpack001/amideefix64.efi unpack001/efi/boot/BOOTX64.efi unpack001/efi/boot/amideefix64.efi
Files
-
PoineSpoof_[unknowncheats.me]_.zip.zip
Password: Grissino96
-
Startup.nsh
-
afuefix64.efi.dll windows:0 windows x64 arch:x64
Password: Grissino96
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
Sections
.text Size: 572KB - Virtual size: 572KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 50KB - Virtual size: 50KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 19KB - Virtual size: 1.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 23KB - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.CRT Size: 512B - Virtual size: 176B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
amideefix64.efi.dll windows:0 windows x64 arch:x64
Password: Grissino96
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
Sections
.text Size: 342KB - Virtual size: 342KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.CRT Size: 160B - Virtual size: 136B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.xdata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
efi/boot/BOOTX64.efi.dll windows:0 windows x64 arch:x64
Password: Grissino96
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
Sections
.text Size: 421KB - Virtual size: 421KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 499KB - Virtual size: 499KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 10KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.xdata Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
efi/boot/amideefix64.efi.dll windows:0 windows x64 arch:x64
Password: Grissino96
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
Sections
.text Size: 342KB - Virtual size: 342KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.CRT Size: 160B - Virtual size: 136B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.xdata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
efi/boot/startup.nsh