entropy.rar
- SHA256 5b49adb0e97c0c26a2e391c0e0f452ab33f26e070c053c85c5e01bbeb2a2bb34
Password
entropy
Behavioral task
behavioral1
Sample
entropy/entropy.dll
Resource
win7-20240903-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
entropy/entropy.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
entropy/entropy.exe
Resource
win7-20240903-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
entropy/entropy.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
22 signatures
150 seconds
Behavioral task
behavioral5
Sample
entropy/entropyloader.dll
Resource
win7-20240708-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
entropy/entropyloader.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
0 signatures
150 seconds
General
- Target entropy.rar
- Size 23.2MB
- Sample240914-3qpdcsterf
- SHA256 5b49adb0e97c0c26a2e391c0e0f452ab33f26e070c053c85c5e01bbeb2a2bb34
- MD5 15ec05cdc176dbab41a59bbc6669384b
- SHA1 1fe7aad71aa5fbab853ead759281ce9ac58458c0
- SHA512 9ab1186695c896892d719d422644e883abd89bde40fad2d3ce429f5419d8c9fcea4c5574bff0baa2e2818cbf2846c4962ddbf15d3a8a4e9ac0121110d83fb4bd
- SSDEEP 393216:upm9b8IdRGA6HVL70qvAP56u3jaqAc6YVb0a7+xQwtfVGCCa0Oo4jq/eCp7l3:Am2L70fR6uTaBYFnJCM9a0Oo4jqf3
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Extracted
Family
-
skuld
C2
-
https://ptb.discord.com/api/webhooks/1284129975246524467/2KIQ0y_EKuR-2Ekg7DykajQRxBZ2HFJZflNz40zZOjAKjmmmVSa64WpWtZe6io39h_Dl
Signatures
- Skuld family
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/entropy/entropy.exe
File Explorer
-
entropy.rar.rar 23.2MB
-
entropy/entropy.dll177KB
-
entropy/entropy.exe.exe 14.2MB
-
entropy/entropyloader.dll8.8MB
entropy/entropy.dll
- SHA256 f4865f3256200d374367ef844a1f10d83748d2be2f0fbc50052020960977fd2d
- MD5 d3375b53754f3c8deaaf436737e25007
- SHA1 2cf3278e9179effc39826141fd5add61fd4e93d9
- SHA512 3a25e45613d710de33a8d80a8b04e6a8c35b3ba6e26ac8c6b0f5a48cde025b51e71269d7e2a2cf1b9d8adeecf1b500e51e7f0877ad8a6cbf66f54db36aa5c7cb
- SSDEEP 3072:B8X8PLYlycIHp6pgoUUctnRKNJsPLPRdVb3pr9o/oIGQHMdVA0Ya:B+8ztupyU6PBbNC/zGQHMdGa
- MD5 SHA1 SHA512 SSDEEP
entropy/entropy.exe
- IMPHASH c2d457ad8ac36fc9f18d45bffcd450c2
- SHA256 5929e86ccecf62ecfc34ce92cfaed3b21471411bd0459ce6d492a960e432710e
- MD5 398fa5adc59c205bb8f15f9ba5c8e67a
- SHA1 f9c361ccf67754ece3ef4e69bfbed9e16448a3e3
- SHA512 c4842f34b049be1a7df0faedb9bd7a6e3f2a225fd599435e76e54b54c6c09081e1524c74c851cb5bfe8b48691e26d1d4d82e8c72464be08ff93f0a54c81686f4
- SSDEEP 196608:CWJafoL/tUoTX4ZSbh1Yf0k7Ma/rkFlgdTaUrPPbdfw:CWsfm/7bh1lkSFCdTauZo
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Password
entropy
Minor OS version
1
Major OS version
6
Entry point
450560
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
kernel32
WriteFile
WriteConsoleW
WerSetFlags
WerGetFlags
WaitForMultipleObjects
WaitForSingleObject
VirtualQuery
VirtualFree
VirtualAlloc
TlsAlloc
SwitchToThread
SuspendThread
SetWaitableTimer
SetProcessPriorityBoost
SetEvent
SetErrorMode
SetConsoleCtrlHandler
RtlVirtualUnwind
RtlLookupFunctionEntry
ResumeThread
RaiseFailFastException
PostQueuedCompletionStatus
LoadLibraryW
LoadLibraryExW
SetThreadContext
GetThreadContext
GetSystemInfo
GetSystemDirectoryA
GetStdHandle
GetQueuedCompletionStatusEx
GetProcessAffinityMask
GetProcAddress
GetErrorMode
GetEnvironmentStringsW
GetCurrentThreadId
GetConsoleMode
FreeEnvironmentStringsW
ExitProcess
DuplicateHandle
CreateWaitableTimerExW
CreateThread
CreateIoCompletionPort
CreateFileA
CreateEventA
CloseHandle
AddVectoredExceptionHandler
AddVectoredContinueHandler
Name
.text
Size
4.6MB
Virtual Size
4.6MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4.2MB
Virtual Size
4.2MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
463KB
Virtual Size
1.0MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
107KB
Virtual Size
107KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.xdata
Size
512B
Virtual Size
180B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
/4
Size
512B
Virtual Size
297B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/19
Size
891KB
Virtual Size
890KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/32
Size
166KB
Virtual Size
165KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/46
Size
512B
Virtual Size
48B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/65
Size
1.7MB
Virtual Size
1.7MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/78
Size
1.0MB
Virtual Size
1.0MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/90
Size
318KB
Virtual Size
317KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.idata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
64KB
Virtual Size
63KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.symtab
Size
682KB
Virtual Size
682KB
Characteristics
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
entropy/entropyloader.dll
- SHA256 037e1ef19688f46bf91cc040e2e5127fcb10a14afad7accd7d987d1de4f0c59a
- MD5 9f7288c05669282f9f5f650446283325
- SHA1 a9cb48f24fb89c01b69feedaa2d5807331715eb0
- SHA512 60114acba85bca451c826cd545c5e28f06dbe1a6f059fa573a2eed821873c5089983a1d20826b9e5533004fc850e87cffe421b0b115f3e604d5792ca6084c15e
- SSDEEP 196608:UmmmmmmmRG6SQEAKW3P1IFsrTYfSXqRqr9PxaZcIBWiopQgWddgKmH0:UmmmmmmmRG6oAPdIF08fSXqkRm4MLddJ
- MD5 SHA1 SHA512 SSDEEP