Static task
static1
Behavioral task
behavioral1
Sample
CS2CONFIG.json
Resource
win11-20240802-en
Behavioral task
behavioral2
Sample
Loader.exe
Resource
win11-20240802-en
Behavioral task
behavioral3
Sample
readme.txt
Resource
win11-20240802-en
General
-
Target
Release.rar
-
Size
11.9MB
-
MD5
02ee2fbd5eda0706ecfaa88cf84a2ec5
-
SHA1
803a529a55efbf4c2cb751cd4d8ea43431dd221d
-
SHA256
817f53abf90541a2541fa135e82d6be075e0829e5882132761384249a1ac211a
-
SHA512
6c846da7b78c24afbb71eb36f3f0d2132d28a09794950cbd6c12b985218aaea0c67c2a07f5c67e2e0f9dae044e8f35dec9378a0ab16b1cdce2847b5b53cb59e4
-
SSDEEP
196608:8likUtsmlOWk3SXtdRhlm2MiVJFNz/xlU+xprT3v9WnYWQctqwmmyYmdMppnq3q:8liR+yu323hlm2/bVlzprTf4LNmxdMn
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Loader.exe
Files
-
Release.rar.rar
Password: 123
-
CS2CONFIG.json
-
Loader.exe.exe windows:6 windows x64 arch:x64
Password: 123
f2d62e0365e97148d838efd28aa39cc1
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
winmm
PlaySoundW
kernel32
GlobalUnlock
GetSystemTimeAsFileTime
HeapAlloc
HeapFree
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
SetCursorPos
advapi32
RegSetKeyValueW
dwmapi
DwmExtendFrameIntoClientArea
msvcp140
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
ws2_32
recv
imm32
ImmSetCompositionWindow
ntdll
RtlVirtualUnwind
d3d9
Direct3DCreate9Ex
vcruntime140_1
__CxxFrameHandler4
vcruntime140
memcmp
api-ms-win-crt-heap-l1-1-0
_set_new_mode
api-ms-win-crt-stdio-l1-1-0
ftell
api-ms-win-crt-string-l1-1-0
strncmp
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-convert-l1-1-0
atof
api-ms-win-crt-runtime-l1-1-0
system
api-ms-win-crt-filesystem-l1-1-0
_lock_file
api-ms-win-crt-time-l1-1-0
_localtime64
api-ms-win-crt-math-l1-1-0
acosf
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
Sections
.text Size: - Virtual size: 518KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 115KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.~$? Size: - Virtual size: 7.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.\A^ Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.<,O Size: 13.4MB - Virtual size: 13.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 296B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
readme.txt