�W�#�Y��y�T���� �l���h�����P�����^"lg6@R�v�%��&,UAL�8°�x��#��Ԃ䖝S�\��1�0L��}��\.�샠k���m�1�1�[]��ܔ3�ov�iٝBn�h>{�w�0j%%O�٢�Z8�$d����@��POi��)��/*Ψ�!"#�yD��3-xP�p�b�����y�KT��U�y*�p���B&jd@g�k���=Y3�R飴Z@�DV��憎Ǵ=o{�����>Y?Ʊ��,�WG�VVdSq1�u� �]M�e?����eK�~kzS���R��#A�0��� "7� ���'������Wl��W�+�6��%&e�{5+h�E˻e�?|>�k�b{n����u���6���"��Q����A����SU��L}%x�J?��#�����(�t*�G��.U���9g��K���-��n��wLS*┮���SK�����B�ɿG�E��/���\f�����+{�1�}U -Qa4" q�&K������AP�T���f�(�Ds ����M���9��!�}���x���.�������唺���x�&��&�*�S�CeQCV� ;P��π'35]y�[7���>�1/dF°2�S�ER�Z1�L��JPq��j��mE �����a�T�,=) ,��-�Q�q��z4���ɺ�S/�+��E0���l�1; M��9R��W��H9}��B�g<� ���Jܞ�`�����Vq�h���oy�K�h��h�+,[I�!Q��8���`��j��(��6}l�cª!H���n�֜��m(�f���mQ͠�`���,�sV��N T�A���X�9�Q�P��0�����"��߰�@��6e&��|=�Up�]�ց�T��br�LL�^&�����n�z�μ]� D�<m���Ja2������{�TJ�l�O|d�G���ۭ������c_� �!�[Z�\�b����FR�:��*�9��@���@���E�XK�#����q仌�e�s=Z�M>����}�0�[j���q*�"Or�s+*�4�Ӄ'�0|*TfSGB�;��֢�*��]=R�ڂϷ�eE$��1��I�)X�\���/x(N�`\;Z�\)z�����o;�AR�mE�Fq |�$D�uku/��[@w�����͇ݎ��.��ٟ?��:4����anGS8L/ wBjv�{�nu���0�)��Y�#A���D��j������Gl%��g&;'�ľ?�B�l��O�D ��ɜ���rg�s%�T��Qɰgy0,���6c�s�MQ8(��*I7��@ ���M��ş����F �_��ē�t��ӆj�ţ�+�w^���� u`��T=I���_�m�29p� }Q�H��)�hX�W���pPƛ ����p�+��q;ͱ�'�$��o�a�aJ(�ܫq� �_I��Ŕ��#9mJ��C�s�A;�#7����,t^�6y�D� "$,$�x�3��cuE���=ݿ>:r��M5$W�8������V�r_I��'�<!��-8gv�>�� ͕;������#����14��-6�c��?���I��-��.��h_&<^��ԗ����U�c�sAv�Ë����r�i���He�1� ��xL:��M�������)��C7�teXfX�(+���.ʧf��3�*h>��Git�1������9�Va�Y/g��~��RTS>��������+6�j&��@�|U����1��� 1��ZhcSL��ϿmQ����,ً�$D���W�T�5��Ok��]m�M�a�_wޗ�Q��g��5a���ݟ��<�#�E$���+p�&��R���15/)�AQ�����sO�_4T��⥿���)SJ25��8��Ql{`́@"Ȩ��K���ч؇�6�K#Ui�en6��/��G&[M���.�=���%Ic�7�V�7�-a���r�_e�Ye f�Y[1*^��Fxw_Ç���ZTax��'��T9Qxv����U�L���"���6�pK}怒3~������� �jEҴ�Z��B]�5F�:EuN$?p3�EԱ�zV�n�);�|�������m�������X0��0���ĕpDJ�R%�lv�VeW�} �|w>v�,��ԝt��� h%y��4���.�L��Ņ����y�g�t�*s���ӥ�mea�[d�ݰ�� (K�?Q���CZ��耄��� T=4>����\z�(ɇ��T�'�V�3��á_�j�i}ſ�|l���1�����q�cۢC>e0�p0�xh� �-�E$+U���F��ŢZ�C *���A�cx(�G���k�7/x��/e��~a���}f�`���@��H���n=��<��y��N���L}�Ѹ��������q%���Su~��FI%T��>X04�����'od����K�S��� ⫭��N�nDc ��z�/�L���`<%Y-�1�q�8���*�c~�%����G['x���IR ��ș���24t���%Y33u0[!�ưJ���c��<��v9���8�p���3<u��`��Uj�����irm�m�%ozY�����i��Ev���C���&�;�]@�����y��PS-��S_��y�-v�ʑ��w��w�u �����S���.1� R�72���K�I0yBV�WªX��E��J�[ã��uQ~*ĊM.Z��H�{��ƥ�t���֞��7���8c�����ք61�ŏ���ſ�aI�I{���Q�r���)Ȓ���Dާ��2��=�)m�X }M�Z}���ˎ��������>�1��)�3�2�C��Z6��ʆܟ�/�,��X���_�ܤVOj9��4����XU]t�N�9�[����a���֣`���(�"#\P[:�]* {�����a� �;U^�C7��v}3�W�Pys�C(��&��9r ���M���̷���shL�yM��B;����+��OД��>�J�zty������?"W����"�[��#v/M�~�a�����S����uݰyv���@�Ŕє��b������� ��r8� ��_�l�R��v���uRb�=`ܮj6����$G�PL�_��$�9tqU���;$@֨!!j�"���P���YB7�$ ��n�ݍ^2�쪿N�Ⱥ��t��&��5�\�������@Ns9o��Y[�G�(zo��������d��)�G��4���o���?��M�J���ȁ��Ŵ�Ҕ� ����Q/on��[B�NM��'3!M�Vne�kH����wF8x����ó5�E�'_���)�O���^�)��t���;�t��wg|�_���j����V,�K�!+� �����#�X�\o���.���=>k��JL�":�9��Ա��6���Wu�JH_��f��-���M���%ݹ�=WT��W�� �<�Q��&gL^;W���iS��
Static task
static1
Behavioral task
behavioral1
Sample
o6k3y26k.rar
Resource
win10v2004-20240802-en
General
-
Target
o6k3y26k.rar
-
Size
6.5MB
-
MD5
a51eb8a79d02a4996d13b30b5b176f2a
-
SHA1
37e4cd494de85b8debd96c3c93263f582ce3bbf8
-
SHA256
1fe2c22d8abf28b30a4b22a6b9c55e68b8766485a002a55fd6c019fe69b5df0c
-
SHA512
ff05712f0673cfa65dbc40d03b861743556227df537ac367e56444b97bd747df3f8fce912eea81074928590096a0bd0b8d07944431b40d72cfcfe24b21c262a2
-
SSDEEP
196608:AuXtwRdw8Omd8gxfA09UJwY+634/zqT1wvTOgDLZh9DM:pOagxfA8UJwY+b2T1OTOKe
Malware Config
Signatures
-
Unsigned PE 3 IoCs
Checks for missing Authenticode signature.
resource unpack001/cod/0Deltrix.dll unpack001/cod/PatchLoader1.exe unpack001/cod/Venom AA.exe
Files
-
o6k3y26k.rar.rar
-
cod/0Deltrix.dll.dll windows:4 windows x86 arch:x86
dae02f32a21e03ce65412f6e56942daa
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
mscoree
_CorDllMain
Sections
.text Size: 908KB - Virtual size: 907KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 996B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
cod/Logs/ErrorLogs.txt
-
cod/PatchLoader1.exe.exe windows:4 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Exports
Exports
Sections
Size: 3KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 297KB - Virtual size: 12.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 3.1MB - Virtual size: 3.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
cod/Venom AA.exe.exe windows:4 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
/6t{' Size: 525KB - Virtual size: 525KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
/6t{' Size: 525KB - Virtual size: 525KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text Size: 2.6MB - Virtual size: 2.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 406KB - Virtual size: 405KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
cod/checkbox_state.txt
-
cod/config.ini
-
cod/credenciais.txt