Behavioral task
behavioral1
Sample
66.exe
Resource
win10-20240611-en
Behavioral task
behavioral2
Sample
Bat To Exe Converter/Bat_To_Exe_Converter.exe
Resource
win10-20240611-en
Behavioral task
behavioral3
Sample
Bat To Exe Converter/help.chm
Resource
win10-20240404-en
Behavioral task
behavioral4
Sample
DeathInstaller.cmd
Resource
win10-20240404-en
Behavioral task
behavioral5
Sample
DeathInstaller.exe
Resource
win10-20240404-en
Behavioral task
behavioral6
Sample
mover.exe
Resource
win10-20240404-en
General
-
Target
DeathInstaller.zip
-
Size
5.0MB
-
MD5
0d77c116f8bf43dc9d5eafe2f755f9ec
-
SHA1
72e873e06ece37b23d04f77c4317f978a391bc89
-
SHA256
2f8d95f63f3e53e15f6badc567b13bbb664c135bf749c56cece346b66e254e52
-
SHA512
c3866edea2149c7d4d120515833d2d2549aa7fa317d42791e68e177042d9802399d6869d2794522695b5c6d11813dc7783555d22de45dd91bab0ab65dfe55996
-
SSDEEP
98304:RNvgjhel51t9C99qHd7y5Z2NS3w4KKpNGr3RElZIoJbyS99w0zFmTnT8O7SAgNaP:rgjW1t9C99ky5Zxw6bK3RCZIsuqLzFYB
Malware Config
Signatures
-
resource yara_rule static1/unpack001/Bat To Exe Converter/Bat_To_Exe_Converter.exe upx static1/unpack001/DeathInstaller.exe upx -
Unsigned PE 4 IoCs
Checks for missing Authenticode signature.
resource unpack001/66.exe unpack001/Bat To Exe Converter/Bat_To_Exe_Converter.exe unpack001/DeathInstaller.exe unpack001/mover.exe
Files
-
DeathInstaller.zip.zip
-
5ycaeP.jpg.jpg
-
66.exe.exe windows:4 windows x86 arch:x86
2cdb5118ade9e194fb3c02df82290ccf
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
_CIcos
_adj_fptan
__vbaFreeVarList
_adj_fdiv_m64
_adj_fprem1
_adj_fdiv_m32
ord595
_adj_fdiv_m16i
_adj_fdivr_m16i
_CIsin
__vbaChkstk
EVENT_SINK_AddRef
_adj_fpatan
EVENT_SINK_Release
_CIsqrt
EVENT_SINK_QueryInterface
__vbaExceptHandler
_adj_fprem
_adj_fdivr_m64
__vbaFPException
_CIlog
_adj_fdiv_m32i
_adj_fdivr_m32i
_adj_fdivr_m32
_adj_fdiv_r
ord100
__vbaVarDup
_CIatan
_allmul
_CItan
_CIexp
Sections
.text Size: 8KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
66/Form1.frm
-
66/Project1.vbp
-
66/Project1.vbw
-
Aha-Soft-Desktop-Halloween-Skull-and-bones.ico
-
Bat To Exe Converter/Bat_To_Exe_Converter.exe.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 548KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 396KB - Virtual size: 400KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 47KB - Virtual size: 48KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
Bat To Exe Converter/help.chm.chm
-
Bat To Exe Converter/settings.ini
-
DeathInstaller.cmd
-
DeathInstaller.exe.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 1.4MB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 2.0MB - Virtual size: 2.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 204KB - Virtual size: 204KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
die.bmp
-
mover.exe.exe windows:5 windows x64 arch:x64
80af4ee28260afc10b852a42f1578c0f
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
Imports
kernel32
GetModuleHandleA
GetProcAddress
wsock32
WSACleanup
version
VerQueryValueW
winmm
timeGetTime
comctl32
ImageList_Remove
mpr
WNetUseConnectionW
wininet
FtpOpenFileW
psapi
GetProcessMemoryInfo
iphlpapi
IcmpSendEcho
userenv
LoadUserProfileW
uxtheme
IsThemeActive
user32
GetDC
gdi32
LineTo
comdlg32
GetOpenFileNameW
advapi32
GetAce
shell32
DragFinish
ole32
CoGetObject
oleaut32
UnRegisterTypeLi
Sections
�1��ers Size: 539KB - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
�2��ers Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
�3��ers Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE