X0Oc9ePeZr2[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
X0Oc9ePeZr2.exe
Size 17.6MB
Sample240902-nnad4azerg
SHA256 4a215059825f792fcb384de29a3301f3bb8422e5fa56a20e253b94ce754d6908
MD5 1ef3142b6c340077c273ec43158c10d1
SHA1 ca551cfbd17ce8c809b737785154d2cbd2b380c7
SHA512 67d25202168ea3cf083a6a46feb1e4fb94f1294ff26de9206343a5dfc35a74dbf9dd9b7dea056404b9dd3cafc98e1cc1fe9bc788c8e4cb0c3785ecb19ea42412
SSDEEP 393216:YEkZgf8UgP8AxYDX1+TtIiFGuvB5IjWqn6eCz1vyxXUS+d:YRbUbX71QtIZS3ILn6eQyV+d
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

pyinstaller

Malware Config

Signatures

Detects Pyinstaller 1 IoCs

pyinstaller

resource	yara_rule
sample	pyinstaller

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
X0Oc9ePeZr2.exe

File Explorer

X0Oc9ePeZr2.exe

.exe 17.6MB
cstealer.pyc

67KB

X0Oc9ePeZr2.exe

IMPHASH 2bac7f6b8e5f8d21f3b68851fc59879f
SHA256 4a215059825f792fcb384de29a3301f3bb8422e5fa56a20e253b94ce754d6908
MD5 1ef3142b6c340077c273ec43158c10d1
SHA1 ca551cfbd17ce8c809b737785154d2cbd2b380c7
SHA512 67d25202168ea3cf083a6a46feb1e4fb94f1294ff26de9206343a5dfc35a74dbf9dd9b7dea056404b9dd3cafc98e1cc1fe9bc788c8e4cb0c3785ecb19ea42412
SSDEEP 393216:YEkZgf8UgP8AxYDX1+TtIiFGuvB5IjWqn6eCz1vyxXUS+d:YRbUbX71QtIZS3ILn6eQyV+d
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

Detects Pyinstaller

pyinstaller
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

559140

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\VSTUDIO\KDMAPPERSHIT\SLIGHTS\x64\Release\SLIGHTS.pdb

kernel32

GlobalUnlock QueryPerformanceFrequency QueryPerformanceCounter GetModuleFileNameA WriteProcessMemory VirtualProtect SetConsoleTextAttribute SetConsoleTitleA GetCurrentProcess GetStdHandle DeviceIoControl VirtualAlloc TerminateProcess WaitForSingleObject GetModuleHandleA OpenProcess CreateToolhelp32Snapshot Sleep Process32NextW DeleteFileW Process32FirstW HeapReAlloc GetSystemInfo LoadLibraryW CreateThread HeapAlloc Module32FirstW GetWindowsDirectoryW GetProcAddress GetProcessHeap CreateProcessW SetThreadExecutionState GetConsoleWindow Module32NextW GlobalFree lstrcmpiW IsWow64Process IsDebuggerPresent GlobalAlloc WideCharToMultiByte GetFileInformationByHandleEx AreFileApisANSI SetFileInformationByHandle GetFileAttributesExW FindFirstFileW FindClose GetLocaleInfoEx FormatMessageA LocalFree InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext SleepConditionVariableSRW WakeAllConditionVariable AcquireSRWLockExclusive ReleaseSRWLockExclusive GlobalLock MultiByteToWideChar GetModuleFileNameW lstrlenW GetModuleHandleW WaitNamedPipeW GetCurrentProcessId CloseHandle GetLastError CreateFileW PeekNamedPipe WriteFile ReadFile

user32

DefWindowProcW GetWindowLongW GetWindowThreadProcessId GetWindow DestroyWindow IsWindowVisible SetWindowPos MessageBoxW CreateWindowExW GetSystemMetrics UnregisterClassW RegisterClassExW ShowWindow GetAsyncKeyState DispatchMessageW PeekMessageW SetWindowDisplayAffinity GetForegroundWindow SetLayeredWindowAttributes TranslateMessage FindWindowW SetWindowLongW PostQuitMessage SystemParametersInfoW FindWindowA UpdateWindow GetKeyState ScreenToClient GetActiveWindow GetCapture ClientToScreen LoadCursorW SetCapture SetCursor GetClientRect ReleaseCapture SetCursorPos GetCursorPos OpenClipboard CloseClipboard EmptyClipboard GetClipboardData SetClipboardData

advapi32

AllocateAndInitializeSid FreeSid CheckTokenMembership RegCloseKey RegCreateKeyExW RegSetValueExW RegOpenKeyExW RegQueryValueExW

safeguard

?keyAuthenticateUser@SafeGuardSDK@SafeGuard@@QEAA?AW4StatusCode@2@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0@Z ?antiDebugging@SafeGuardSDK@SafeGuard@@QEAA?AW4StatusCode@2@XZ

msvcp140

_Xtime_get_ticks _Cnd_init_in_situ _Query_perf_frequency ?_Throw_Cpp_error@std@@YAXH@Z _Cnd_timedwait _Mtx_lock _Cnd_do_broadcast_at_thread_exit _Query_perf_counter _Mtx_unlock _Cnd_broadcast ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?uncaught_exception@std@@YA_NXZ ?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A ?_Xbad_alloc@std@@YAXXZ ?_Xout_of_range@std@@YAXPEBD@Z ?_Winerror_map@std@@YAHH@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?_Xlength_error@std@@YAXPEBD@Z ?_Syserror_map@std@@YAPEBDH@Z _Thrd_detach ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@PEBX@Z ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??Bios_base@std@@QEBA_NXZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ??Bid@locale@std@@QEAA_KXZ

imm32

ImmGetContext ImmReleaseContext ImmSetCompositionWindow

d3dx9_43

D3DXCreateTextureFromFileInMemory

dwmapi

DwmExtendFrameIntoClientArea

d3d9

Direct3DCreate9Ex

winhttp

WinHttpCloseHandle WinHttpOpen WinHttpReadData WinHttpReceiveResponse WinHttpSendRequest WinHttpConnect WinHttpOpenRequest

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memmove memcmp memchr __std_terminate strstr __std_exception_destroy __std_exception_copy wcsstr __current_exception __current_exception_context __C_specific_handler _CxxThrowException memset memcpy

api-ms-win-crt-runtime-l1-1-0

_c_exit exit __p___argv _beginthreadex terminate abort __p___argc _register_thread_local_exe_atexit_callback _exit _initterm_e _initterm _get_initial_narrow_environment _set_app_type _seh_filter_exe _cexit _crt_atexit _register_onexit_function _initialize_onexit_table _initialize_narrow_environment _configure_narrow_argv system _invalid_parameter_noinfo_noreturn

api-ms-win-crt-string-l1-1-0

strcmp strncpy isprint strcat_s strncmp _wcsicmp wcsncpy_s wcscpy_s

api-ms-win-crt-stdio-l1-1-0

__p__commode ungetc setvbuf fgetpos _fseeki64 _get_stream_buffer_pointers __acrt_iob_func fgetc _set_fmode __stdio_common_vfprintf __stdio_common_vswprintf fsetpos ftell fflush fclose fputc fseek fwrite _wfopen __stdio_common_vsscanf fread __stdio_common_vsprintf __stdio_common_vsprintf_s

api-ms-win-crt-time-l1-1-0

_time64

api-ms-win-crt-heap-l1-1-0

free malloc _set_new_mode _callnewh

api-ms-win-crt-utility-l1-1-0

srand qsort rand

api-ms-win-crt-convert-l1-1-0

atof

api-ms-win-crt-math-l1-1-0

_hypotf asinf fmodf pow powf sin sinf __setusermatherr sqrtf atan2f tanf atanf ceilf cos cosf floorf

api-ms-win-crt-filesystem-l1-1-0

_lock_file _unlock_file rename

api-ms-win-crt-locale-l1-1-0

_configthreadlocale ___lc_codepage_func