;��`�]�qН��� ������l��B���G��f(y�M����g���P�?!ǀ���SA�{auf5��Ӆ�����ѦC7f��˟qG�����9�e1��s�nC ��A���u��I�z�0�߹���;>|��������kB�Գ6�"�v����ߨ(��]T2J?xXV ���:�YS�� �7 :��k���X��T���������Y���U�EBU<0rJH���`����*= �Md�$���|�n H�Ks۱0at ϗ&�E�݈�x�vͷ�N$�qF)�8#_9�w5:T���E��� ���;6[%a������f����s!�����汍c��Mxc4�K�5ֲ����`{J�X��t����Ú�����+�RĴ��5ߋ���,���.�ܘh�*G�*^��F� zs����x<-~�Ȼ��'ϮOڴ6�{�V8f�~��<�@��<�^Ob����I�s;rt7��bh�����U�X�F�H9X;D����|��i�̌"�"d�,z�2�f���cU���6����c� ����s�dz�_�����p�X���D>���N���;�W����h��0�"g���A�(�3�P�R�^�P��� �X�x��?}�u��Q��2P�N��RP�eXa�&���Ma��ϵ��'��\v���'k��ڂ�������U���c���';<����z���8�~-�2/��S��¹�_Xb���(� �>����=��������y�qd��/�Yj!+y��4x&$n��(��1�Y�?�]�^8%�0�]]��0,41��t�<����K�W�NǶ�j��D>۠^H1v��!d���%ԌC`�kJ�j���|�x�)m��ی�x��#O��3x#A�vm�~��e�1Z�� �(ixz� ��]]dDmm3!��o����Ɍ\t�x���Q�%��-Su �+\.x��Z|�p1p�i��[;���Ih_��T;�v�Qn�K�,&� �9뿊uƎs~���ƥ�Q �>H����BmZ78���m�庯kҿn,�b�LG��>c�o��0��U���&=�@R�=��P�_�i��[�t���@�m&��I�_<a�W&!��D��4�m#���=�����ӝ��Q�����[��:7��H�D�:O�`XE"�zj����EnXq� P��cdL�;AU�Vc��雲i��jK1���%�1�y�m�F�̀$�(�U2���B�j�*1(����WN� ~��}·�`>�ԕ���]4k�!�����.��x �Fv+��0m]�]6T���\�}�v���9^u�j�Hhh3شg������kZ��B��|~g>�Q�i<��� |u7BX�`*p��T7�EL�RW��i��\�؊����kƣ�׆�>q�#���hʄ��v��>@�c���[Ȅ�Ҭ��_U}��b^3���M�N��c,�jd?jɎC����R��˿+Q*g�O[0G��K½�VL3l������`�E�dě,���bupRQഞ�Yǂ}���K��)� ��遠��/�g�X��_�Q�.R0m' ��\Vc)�+k�"�2�65?�٣z~v�pl�@�O�w���=�eB�z0��S��X n��y$��:z?P��qL�UP�P�N�.�51�����C�$���@>�T������m����ۼ2��=����U�r�l��F1N �Dǭ�PrO�x��xC�����k����C�yi�s���h�<2���x �����K�[�u�y&4����*�����L��h��1��"��ADrL�bR�\e�H<q>MQJ��NP��Ɲ!��h5���F�j�X-ڻS=��6ְi6��UV8� ��N�(�Zx��YW��abr���t3Z�Ie� C�d4���"��,V�����$��+;�z��G"� *�&�W�R3���P�n�t�K32��.r�?�I$�ϼ��Uf2(�P� N~v{�Fu��#E.^B�*���[���U{�����c�4�.���؊��P[��3��"9��Y������q�*�J@��T�H��2i���!��h�v��r=cԨ�8�˭�8�������u�8ќ$�և��[���������*��UʊImM�`?�R:W��h��a�5j��U[K@c��%V��wל��М�A�Iv�v���1�LH[����^OU;8AO����{T��A2A���ˊ���-x&8�2�r\�1���UAw��:�ٹќP���N���.������v�5.#�4��y��+h�$(�%���4;��1=! �H6��ۏT�T�"46��7�$۬��5������&:����;�̱��P��|�n�������n�� +˿>\���}*�N�lz�,�NR��|��N*�&NU�e���+���3%�B )3;hB���X�#�SzüY˒�q�n���^��͂�ۿ |P,�t+e�J�Bʤܺ8?�n���i��t��Tǔ��TWX�Z��Ӹ����(&��Ͳ&L]�-��Ϧ`�.��F���s�|�Z�� c� �P*{����^�d��/�$f�V���s�q��9�=���q=[����UC��s[M�X�'��Ya����}���p��3�^QTƧ��������Zt�~�Jaz���,v�G��5�����F+۬��\���~����j��c=���R�����t�3�C�j���D3��ֶ1M]��UI�H��5��혊k?c�T���s�f�+�T7/�B�a��oD�k� ��xY�P%�댬<�i�M�2�ޑ=� �E��8��nՂ<E��2�Clkr�7�� �ig�v�(�6��h��Dp�+թ���>99����b�h��ä����!�)�N�PV��T���� �o��i��O��5��z��]j�I��\�t�}�c�m<�E;i��mI�s���#~zj�5����_�b�������p4��WzG���3�K���3zX�I�˸ca�����*s���j{rò���/�hV�L��}�@���OW��u�ɖKϷ+�<3xhrź�Cl?��5�&���p�M��@�
Static task
static1
Behavioral task
behavioral1
Sample
opium.exe
Resource
win10v2004-20240802-en
General
-
Target
opium.exe
-
Size
10.1MB
-
MD5
d8a8d6275506752ab9e2182e350adfdf
-
SHA1
1d17de15b740a611651d5a33ef7887971934bd1d
-
SHA256
0b6379119778db8979ce22676c6735adcb2712ea1dd55410969f08f642fa5b16
-
SHA512
ee89f84fc5a50b160bfdf690c73ff03ab2ca09e5f8ba58741d6a5989a6d411f1c142f296a98611f853d32ab9fa932b7f17ffc3236d86bb26d6794c09d00457f2
-
SSDEEP
196608:lV6hHl1rtDfz/A6Uhs+E/UhZ6rX6oYhZC5L2BUlQONUfP4KgTr:T6hHTrpfzjU3PhkqoYJmlIo
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource opium.exe
Files
-
opium.exe.exe windows:6 windows x64 arch:x64
f310a555bdf77f94d15e72deafefd207
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
bcrypt
BCryptGenRandom
ws2_32
connect
d3d12
ord101
dxgi
CreateDXGIFactory1
kernel32
GetCurrentProcessId
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
DefWindowProcW
CharUpperBuffW
ole32
CoUninitialize
oleaut32
SysAllocString
d3dcompiler_47
D3DCompile
imm32
ImmReleaseContext
msvcp140
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
vcruntime140_1
__CxxFrameHandler4
vcruntime140
_CxxThrowException
api-ms-win-crt-stdio-l1-1-0
__p__commode
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-string-l1-1-0
strlen
api-ms-win-crt-heap-l1-1-0
free
api-ms-win-crt-convert-l1-1-0
strtoul
api-ms-win-crt-runtime-l1-1-0
terminate
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-filesystem-l1-1-0
_stat64i32
api-ms-win-crt-math-l1-1-0
sqrtf
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
Exports
Exports
Sections
.text Size: - Virtual size: 1001KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 420KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 43KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
opium0 Size: - Virtual size: 7.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
opium1 Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
opium2 Size: 10.1MB - Virtual size: 10.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 469B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ