Static task
static1
Behavioral task
behavioral1
Sample
Atlantis CS2/Atlantis.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
Atlantis CS2/Atlantis.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
Atlantis CS2/Atlantis.exe
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
Atlantis CS2/Atlantis.exe
Resource
win10v2004-20240802-en
General
-
Target
Atlantis CS2.zip
-
Size
259KB
-
MD5
4c376dab839490a847369ba5772845fb
-
SHA1
8c5b91c97dd72c5ef1bd8ab76b285e009e2ad749
-
SHA256
e798de1da876df9e65d94641cccdb5c215e3dbe1cd804888a0d5bff349d36960
-
SHA512
e63a9c02eea8d5902bb5df747b5e3aaaa5dbd349fea057b2f27d5173bb8df7a600b55e0a28fa00ca9d01be94f79bf9b8e03fd4bff2ed252473596dd1ff8c5a7d
-
SSDEEP
6144:NRwWbeXh4eAtG7VT8vsrdz7YGgZ9gM2XvgqaqDU/KLz:NRwWSR4eAE7p8ErdwGgZ9uDaTKn
Malware Config
Signatures
-
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/Atlantis CS2/Atlantis.dll unpack001/Atlantis CS2/Atlantis.exe
Files
-
Atlantis CS2.zip.zip
-
Atlantis CS2/Atlantis.dll.dll windows:6 windows x64 arch:x64
0abcbeba6a48d998a1951a536be7bc74
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
Imports
kernel32
QueryPerformanceCounter
VirtualFree
VirtualAlloc
GetSystemInfo
VirtualQuery
HeapCreate
VirtualProtect
HeapFree
GetCurrentProcess
Thread32Next
Thread32First
GetCurrentThreadId
SuspendThread
ResumeThread
CreateToolhelp32Snapshot
Sleep
HeapReAlloc
CloseHandle
HeapAlloc
GetThreadContext
GetCurrentProcessId
WideCharToMultiByte
VerSetConditionMask
OpenThread
DisableThreadLibraryCalls
CreateThread
GlobalLock
InitializeSListHead
GetSystemTimeAsFileTime
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
SleepConditionVariableSRW
WakeAllConditionVariable
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
GlobalFree
GlobalAlloc
FreeLibrary
GetProcAddress
QueryPerformanceFrequency
LoadLibraryA
SetThreadContext
GlobalUnlock
MultiByteToWideChar
FlushInstructionCache
GetModuleHandleA
user32
GetSystemMetrics
CallWindowProcA
SetWindowLongPtrA
GetWindowLongW
AdjustWindowRectEx
GetKeyState
LoadCursorA
DestroyWindow
GetDC
SetWindowPos
MonitorFromWindow
EnumDisplayMonitors
ScreenToClient
SetWindowTextW
WindowFromPoint
ShowWindow
GetCapture
SetWindowLongA
ClientToScreen
IsChild
TrackMouseEvent
SetWindowLongW
GetMonitorInfoA
GetForegroundWindow
DefWindowProcA
CreateWindowExA
SetLayeredWindowAttributes
SetFocus
BringWindowToTop
SetCapture
SetCursor
GetAsyncKeyState
GetClientRect
UnregisterClassA
mouse_event
GetCursorPos
SetClipboardData
GetClipboardData
EmptyClipboard
CloseClipboard
OpenClipboard
ReleaseDC
SetCursorPos
IsIconic
SetForegroundWindow
ReleaseCapture
RegisterClassExA
gdi32
GetDeviceCaps
msvcp140
_Thrd_detach
?_Throw_Cpp_error@std@@YAXH@Z
?_Xlength_error@std@@YAXPEBD@Z
_Mtx_lock
_Mtx_unlock
_Query_perf_frequency
_Query_perf_counter
imm32
ImmAssociateContextEx
ImmSetCompositionWindow
ImmReleaseContext
ImmGetContext
ImmSetCandidateWindow
d3dcompiler_47
D3DCompile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
memset
_CxxThrowException
__current_exception_context
__current_exception
__C_specific_handler
memcpy
strstr
__std_terminate
memmove
memcmp
memchr
__std_exception_copy
__std_exception_destroy
__std_type_info_destroy_list
api-ms-win-crt-heap-l1-1-0
malloc
free
calloc
_callnewh
api-ms-win-crt-runtime-l1-1-0
_crt_atexit
_invalid_parameter_noinfo_noreturn
terminate
_seh_filter_dll
_initterm_e
_initterm
_cexit
_beginthreadex
_execute_onexit_table
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
api-ms-win-crt-stdio-l1-1-0
ftell
__acrt_iob_func
fflush
fclose
fseek
__stdio_common_vfprintf
__stdio_common_vsscanf
__stdio_common_vsprintf
_wfopen
fwrite
fread
api-ms-win-crt-string-l1-1-0
strcmp
strncpy
strncmp
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-convert-l1-1-0
atof
api-ms-win-crt-math-l1-1-0
cosf
ceilf
atan2f
acosf
_hypotf
powf
sinf
sqrtf
fmodf
Sections
.text Size: 359KB - Virtual size: 358KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 59KB - Virtual size: 58KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1024B - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 15KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 240B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
Atlantis CS2/Atlantis.exe.exe windows:6 windows x64 arch:x64
a7813427e446dc5799e5e20e54aa17c9
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
WriteProcessMemory
GetModuleHandleA
Sleep
GetLastError
LoadLibraryA
CloseHandle
GetProcAddress
VirtualAllocEx
ReadProcessMemory
VirtualFreeEx
Process32First
OpenProcess
CreateToolhelp32Snapshot
Process32Next
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetModuleHandleW
RtlCaptureContext
msvcp140
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z
?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ
??7ios_base@std@@QEBA_NXZ
?always_noconv@codecvt_base@std@@QEBA_NXZ
??Bid@locale@std@@QEAA_KXZ
?uncaught_exceptions@std@@YAHXZ
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAHXZ
?good@ios_base@std@@QEBA_NXZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1_Lockit@std@@QEAA@XZ
??0_Lockit@std@@QEAA@H@Z
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
?_Xlength_error@std@@YAXPEBD@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z
wininet
InternetCloseHandle
InternetOpenUrlA
InternetOpenA
InternetReadFile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__current_exception
_CxxThrowException
__C_specific_handler
__current_exception_context
__std_exception_copy
__std_exception_destroy
memmove
memcmp
memcpy
__std_terminate
memset
api-ms-win-crt-stdio-l1-1-0
setvbuf
fgetpos
fwrite
fsetpos
_fseeki64
fgetc
fclose
fflush
fputc
ungetc
_get_stream_buffer_pointers
__p__commode
_set_fmode
fread
api-ms-win-crt-filesystem-l1-1-0
_lock_file
_unlock_file
api-ms-win-crt-runtime-l1-1-0
__p___argv
_seh_filter_exe
_c_exit
_register_thread_local_exe_atexit_callback
_set_app_type
_exit
exit
_initialize_onexit_table
_register_onexit_function
_crt_atexit
terminate
_initterm_e
_initterm
_get_initial_narrow_environment
_invalid_parameter_noinfo_noreturn
_initialize_narrow_environment
__p___argc
_configure_narrow_argv
_cexit
api-ms-win-crt-string-l1-1-0
isspace
api-ms-win-crt-heap-l1-1-0
_set_new_mode
malloc
_callnewh
free
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
Sections
.text Size: 22KB - Virtual size: 21KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 14KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1024B - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 164B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ