ChaserTempCRACKED.zip
- SHA256 c037429f30412b9308880840a0a5ee836ddd685e1af97c67853fed62308516c7
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Morphine.exe
Resource
win7-20240708-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
Morphine.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral3
Sample
bypassed.exe
Resource
win7-20240704-en
windows7-x64
8 signatures
150 seconds
General
- Target ChaserTempCRACKED.zip
- Size 4.5MB
- Sample240903-rtlabsyhnm
- SHA256 c037429f30412b9308880840a0a5ee836ddd685e1af97c67853fed62308516c7
- MD5 110ef86686ba4be41314e43de2462cd8
- SHA1 3b9e33319f8693d32ac3fe1a0a75b0afb478de1a
- SHA512 e5d94bbb8fe50f03391bf37c609d015d4653f1c055c4d15cd93a7ed167271afd3a08530be73d6d62198970e49c2909bff9345ffeff122f313494fcf5f56921ee
- SSDEEP 98304:D8JQ9csmb+XU5lemYidFoJjNKdSkGa72mqE2mTgbNJNLzxQcgwH382I/nnD:D8JQWFb5ThvouAbBDnDgi82IfD
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/Morphine.exe unpack001/bypassed.exe
File Explorer
-
ChaserTempCRACKED.zip.zip 4.5MB
-
Instructions.txt99B
-
Morphine.exe.exe 5.8MB
-
bypassed.exe.exe 90KB
-
certificate.crt1KB
Instructions.txt
- SHA256 5e7e978df60bf6ac0953e9dc3a5865edf884cc10747181b63659230be617bd9a
- MD5 378d8ddbc344f0711eb1c610f10ffe53
- SHA1 962346ec837aa2f095eb7487282df5e7a3ee7759
- SHA512 1bfd3380aa2e568a181d56a6bce2e9006c038db0541dd433035d512db736fa21d4ad99723dc74a54310419b30a992e8979b65dfa308c13e5ce4dd0c770cf3145
- MD5 SHA1 SHA512
Morphine.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 b4af9f34ccb4774459d6586598e0c32e7ffcd5efb45226e2d47da7def44dcc83
- MD5 c61fbe172730e0e221f4abe4069dd8e9
- SHA1 f0b7f3d5b45537c3250db2ce7f15bc74e545cab3
- SHA512 f03559718dbba771620269ac5a5c0a1aefdf74e37f3fdf84c6bab39f4cc859494fd053763642debe19c99ce3f356513c23d42eb2c8c33aa5e8447b864ba70490
- SSDEEP 98304:EQga0jRCaCW6ndTqZoQjc5SpMI0IT4bNJFY3OqtA/TmnZgVuNxL8IZ:3gH0ZW0dTqnc52CjBHYUTmnqVCV8q
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
6079662
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
5.8MB
Virtual Size
5.8MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
bypassed.exe
- IMPHASH 2c5f2513605e48f2d8ea5440a870cb9e
- SHA256 049ea73a545bf2c262f03a53e2c54020dbf3314b694d37d0d0255768c73cbcf1
- MD5 5d046cd83e8e4bbb64ca82a250e90ea8
- SHA1 231c777db2aaa5677953a275137e8959ecc447ff
- SHA512 6c6f5ab99735353b65eed9efd7b3f5cd90f5879cdc67856384be9aa22022377404632bea26b7c26ae771f07515251a67c360da7d3d76e76091a729d2d4bfeb87
- SSDEEP 1536:j7fbN3eEDhDPA/pICdUkbBtW7upvaLU0bI5taxKo0IOlnToIfNw3ON:/7DhdC6kzWypvaQ0FxyNTBfNr
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4096
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
msvcrt
memset
wcsncmp
memmove
wcsncpy
wcsstr
_wcsnicmp
_wcsdup
free
_wcsicmp
wcslen
wcscpy
wcscmp
wcscat
memcpy
tolower
malloc
kernel32
GetModuleHandleW
HeapCreate
GetStdHandle
SetConsoleCtrlHandler
HeapDestroy
ExitProcess
WriteFile
GetTempFileNameW
LoadLibraryExW
EnumResourceTypesW
FreeLibrary
RemoveDirectoryW
EnumResourceNamesW
GetCommandLineW
LoadResource
SizeofResource
FreeResource
FindResourceW
GetNativeSystemInfo
GetShortPathNameW
GetWindowsDirectoryW
GetSystemDirectoryW
EnterCriticalSection
CloseHandle
LeaveCriticalSection
InitializeCriticalSection
WaitForSingleObject
TerminateThread
CreateThread
GetProcAddress
GetVersionExW
Sleep
WideCharToMultiByte
HeapAlloc
HeapFree
LoadLibraryW
GetCurrentProcessId
GetCurrentThreadId
GetModuleFileNameW
PeekNamedPipe
TerminateProcess
GetEnvironmentVariableW
SetEnvironmentVariableW
GetCurrentProcess
DuplicateHandle
CreatePipe
CreateProcessW
GetExitCodeProcess
SetUnhandledExceptionFilter
HeapSize
MultiByteToWideChar
CreateDirectoryW
SetFileAttributesW
GetTempPathW
DeleteFileW
GetCurrentDirectoryW
SetCurrentDirectoryW
CreateFileW
SetFilePointer
TlsFree
TlsGetValue
TlsSetValue
TlsAlloc
HeapReAlloc
DeleteCriticalSection
InterlockedCompareExchange
InterlockedExchange
GetLastError
SetLastError
UnregisterWait
GetCurrentThread
RegisterWaitForSingleObject
user32
CharUpperW
CharLowerW
MessageBoxW
DefWindowProcW
DestroyWindow
GetWindowLongW
GetWindowTextLengthW
GetWindowTextW
UnregisterClassW
LoadIconW
LoadCursorW
RegisterClassExW
IsWindowEnabled
EnableWindow
GetSystemMetrics
CreateWindowExW
SetWindowLongW
SendMessageW
SetFocus
CreateAcceleratorTableW
SetForegroundWindow
BringWindowToTop
GetMessageW
TranslateAcceleratorW
TranslateMessage
DispatchMessageW
DestroyAcceleratorTable
PostMessageW
GetForegroundWindow
GetWindowThreadProcessId
IsWindowVisible
EnumWindows
SetWindowPos
gdi32
GetStockObject
comctl32
InitCommonControlsEx
shell32
ShellExecuteExW
SHGetFolderLocation
SHGetPathFromIDListW
winmm
timeBeginPeriod
ole32
CoInitialize
CoTaskMemFree
shlwapi
PathAddBackslashW
PathRenameExtensionW
PathQuoteSpacesW
PathRemoveArgsW
PathRemoveBackslashW
Name
.code
Size
14KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.text
Size
54KB
Virtual Size
54KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
13KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
certificate.crt
- SHA256 dfea79c5653186395f8c5c06942471144d1528a2bb0a270321b1a53bcab32f58
- MD5 e3eff8b29b2d04da7a2e09e214f0949b
- SHA1 34a05a3e6a8fc1710d22b9fb891f6c7a400c5701
- SHA512 bd7207bed45d100a522228ed21d1bee079e4cbd449369f114a9feda56d0ca7df1fc05c8451454f60b77ae27a12a1467eae667c9f1a992a9dab755dcd7f3344c5
- MD5 SHA1 SHA512