�~�;�h�S��%z'�Qt������,!&�¾�'�]�j���"4E�9I!���A}l�jOLϠw:��� i)���fd��=Zu������P�3�w|dz8�V��5zTؤ��^ ���#���5�M��gV'̼8e.�zȍ��u�����C�v/��U��G����<6��B��/a~fQZ*�Ή"�GITa�Ϋ��U��l=db���{��\�#ޔ�>#�5�0����k�����;V��VD#�zXP�3�,�Yg�I�����(�Ӄ2�:� n��K T�.DՅk�ٹby����!�� �ߙ��%�w����4c��;��M.>�P���7I�ösb���sA9 ҷ�+3Q���_XIG�TPD�o��$��/��Uz��G�i� ���uK�}V8��(����B��Y��|�!�lߝ�w�V�_��v�%`-�M�QYj������M���e$�o��P~���R����v첼Bx*E�(��w3&����x���:�R�Re֬q9���V,̵QW慒�����LHLg�o�ɡ�g{�|uT �����C8��(�7G�U�{=���w���4�����B�d��aX@b� 1�M���n���@�Ի.SO�k�u�O�Ȥ��#ӳ\o����$������;^UT�a��~���9V_xNc��,P�7t�G���j��O�/�$��!� ������g@�qUۗ�oTN���#�'�ӣw�ɤ�������SH�����<���������M�����y��c�������Tm���s�XЦ����ElU<�رJ�$�\.�Ec"#�S�����ޯĦ���Q�V �w��I0�1�=�/I��e+�,�����Z-K���Zκ����I�m ��R)����u��l��H��+�Fr�4f� KC�ι�U������![�G��ycG�^�nw*�U�x�Ƒ\g��d[�$����>���.KR��b�gx��hPF�2w���c ��n������{ g(U*�/��{Ez}e�zU�Pp��FDY?�(o�����ȴJws���u ���n������t���������ѿ䥤$%}�����\���eJ��8W� ��haP�'�ҋ4��z�{_v�\�梾P@9�%E~"*���tB�Aϲp�$�|5�1c��^IQ����(2��o1r٣~Z����.��+!O`98W-<�Ku3�{^�J݇4�!9�p��PNUX���NU���i+��Nj����V���Cmx���M�^�I�1G-u�����͟L�$�1����]�!��2���?���~�]�t<��#�K^���4��:���=L�<�31�7�gU���%�f�U4|rf}�+,:U�̓E��M'�H ��J��H�������u�e��Cj�c?��1j�cp���ѫ��p��A�B,�n�����<d$����Q�,����i`![����l1�XaJh���l�f���j�I�s�5�c�q%���H����5��P��c�ޘȔ�������gTKRN\Y��L�&��V�]�n\�~��66��p<�I�4����s(x���\LY[ƨ���+O��ٽt�k�V�,��`�k�s� �EOI�D ]���ܱ�D Ы�.s�,4N������4��W�����3�N��f�T\�V���9���fCgz� ���L�+c�pw���a���wր9X���;G�v���g��9�Ӑ�"��BMX3�k������f�E�&x�n�51Ϫi�s�p��l�4z(W�β܊/نj�4�3�._sF�%��WjT�i!�侤)�S�N��s�V����ML��d&�O5��.}��:�������2<�� ��EH��LG��+Rf���*/"�@h%�0�k�}@r���\���GB�o���jm0̴�Ɣ3�ݛ<�T�v����˽�&�.�%]�����4��SwΒ�����!d_���:��ɬ�(fm�zÀ�<���K��?����T�\9�z_�Lpõ.�%������L~�+&�\�rvR�w�ǧ���"��vc��h�r�k��1{H��[ܰ���oxl�F8I�#D�Ș���E`K�f���!ܿoQ?>I-��;[9��':���w[�Q{Oih��d ���M�\@�qϗ�"Hu&h�̐��]^r`�t Fg\ ٦���tlE�t�)��^�&2�6�G�X����[��N;�`AeP�H,���]DX�C�{�O>����g+.X�u��ph�X�����¯M��aZO��A���:I��"1���H���8�B��@Q�5l5���5�A�=��.(�&��������i���"a`�08�\��(�dkV��:v�7�=� t�z�RX�%X�~�~^E}��4�pt����Q�7����d�ϴ���.�SO��sc�T6��Vԏ�I�� 6k����"D�X�<d%�(�"�1�azM:96'�[u�y�.(� [����*.Q��8>s��.�����:IV�[�$�j���<��)����`�WoD���ܻ�+cpzl�jW�@/{����U�}y��E%�^�Z_9��D{��Lc�#��%߈�۹��`@i���S��ya��M� 3��K�;)M�:�.BZ�f7e��P�J��u�F��.�W�z���O9�F���$�-:�� ���<i�'n�Q_�����ِ糿[�D�y�%h�ȺQJb4E�|��bEd�?l��_�f4��}g;9��s7j &7����G�x�,F�������h�R�4�,20%�� ���2C�������d��β��^���pR���C䴊D��^�st�6��Od�W��Z�!�,��˖�{�����g #u�ӑ��k(L l�JQ���k��rڶ���qP0��?Ǫ_��<"P����_U�� �P}� kiB0�J������2����la�P�O@(����9Ǿ��F�e��݁��&֕�l�X�Z�yK��8r1��cԱ��%+�n�7�@�u���l���t#��b���g?[�}Rn��Rj����5n���o)�2 ���_�a�{���g'���6��4��
Behavioral task
behavioral1
Sample
SecuriteInfo.com.W64.Trojan.IGM.gen.Eldorado.20589.29305.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
SecuriteInfo.com.W64.Trojan.IGM.gen.Eldorado.20589.29305.exe
Resource
win10v2004-20240802-en
General
-
Target
SecuriteInfo.com.W64.Trojan.IGM.gen.Eldorado.20589.29305.exe
-
Size
5.5MB
-
MD5
d6529f043820328167fc5dd9078b1e3e
-
SHA1
d18cfd43b140aae3ddeb01e586afe5f84cb3f0e9
-
SHA256
b35821066b1a466078ea66a50dba59a2ff3c202ca007f9787a9addc2bd6e3751
-
SHA512
893d6b0776c14f4ed2ff9757138283bd0a75b7b5973126dfb65cf3839be24b5235bd63764f73adddd81de2f5bde5475effddf92aa18a22658e8741cb2aa9abe5
-
SSDEEP
98304:2C1v8Vv9GXpATne2zB37rn5VQEyhIv/V59aWK7QKktJb2XImiwtIsNP2L7lK6Vr:2YwQ58n7zB3Pn5qCKQhthHmlBI7lp
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource SecuriteInfo.com.W64.Trojan.IGM.gen.Eldorado.20589.29305.exe
Files
-
SecuriteInfo.com.W64.Trojan.IGM.gen.Eldorado.20589.29305.exe.exe windows:6 windows x64 arch:x64
454b0040e82e3e121e42a56e1e47dc0f
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
TerminateProcess
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
FindWindowW
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
advapi32
GetTokenInformation
msvcp140
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
crypt32
CertOpenStore
normaliz
IdnToAscii
wldap32
ord41
ws2_32
getsockname
rpcrt4
UuidCreate
psapi
GetModuleInformation
userenv
UnloadUserProfile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__C_specific_handler
api-ms-win-crt-runtime-l1-1-0
_set_app_type
api-ms-win-crt-stdio-l1-1-0
_set_fmode
api-ms-win-crt-heap-l1-1-0
calloc
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-string-l1-1-0
strncmp
api-ms-win-crt-filesystem-l1-1-0
_unlock_file
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-convert-l1-1-0
strtod
api-ms-win-crt-locale-l1-1-0
localeconv
api-ms-win-crt-math-l1-1-0
__setusermatherr
shell32
ShellExecuteA
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 426KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 107KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 3.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 5.5MB - Virtual size: 5.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 212B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ