53e97123c11bcfbad50aea988cebc5268f16f58f228f3977465d017ad01fa43a
- SHA256 53e97123c11bcfbad50aea988cebc5268f16f58f228f3977465d017ad01fa43a
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
Zoogonous.exe
Resource
win7-20240708-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
Zoogonous.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win7-20241010-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
3 signatures
150 seconds
General
- Target 53e97123c11bcfbad50aea988cebc5268f16f58f228f3977465d017ad01fa43a
- Size 676KB
- Sample241016-t2dasszbpc
- SHA256 53e97123c11bcfbad50aea988cebc5268f16f58f228f3977465d017ad01fa43a
- MD5 e2c231920f777ce2d543beaf67a51ec4
- SHA1 d86d921bc90bd5868670e5d1d8ef1421d6d752c9
- SHA512 1e14490036e0dd1432dbe225e632af760e36c34e6f17b01dd36447dfded4e6cfcad6a95a039a486e6d20da467382664fa8a0cfe88bf7c1d1396d31cb0a491e7e
- SSDEEP 12288:h7JbqOfHnG94zUExBqHz2b8WF7hBgagD6CXKou/shhQTV8c2WEm7E726L/4:55qmG92xPsz+9gXpXAAQTVGj2674
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack002/$PLUGINSDIR/System.dll - NSIS installer 2 IoCs
resource yara_rule static1/unpack001/Zoogonous.exe nsis_installer_1 static1/unpack001/Zoogonous.exe nsis_installer_2
File Explorer
-
53e97123c11bcfbad50aea988cebc5268f16f58f228f3977465d017ad01fa43a.rar 676KB
-
Zoogonous.exe.exe 705KB
-
$PLUGINSDIR/System.dll.dll 12KB
-
Levitates/hampton.ant359KB
-
Levitates/phytosociologically.txt358B
-
Nedskringens165.bge387KB
-
Pharmacodynamical.Ove201KB
-
Unridably.opr323KB
-
Upisland.Svr423KB
-
dimpsy.clu327KB
Zoogonous.exe
- IMPHASH 671f2a1f8aee14d336bab98fea93d734
- SHA256 9597bd14654101c85ee4953e5b9f0217531666497c26f1fdf4e837ce27186733
- MD5 756290c288c847bd7bda9b670a207d01
- SHA1 c57c35680a475a3a77b6ec1fa5bb2fbdb9cfcae9
- SHA512 b6d8516918529005cfb0c6e7d1d41e8af3301422e0e95e18da2a51f28a751c233c80810ad8a22106e087c5b09262216d411b757538dc700442ef9cddb87d1d3c
- SSDEEP 12288:VrgjBLiIK2WVy/YqpuY7loQAde7MXg1HIbB2ugcYhua4Kw/hXhXmmwMRzcLSIH65:V0jBiIK2R/5puzQ7oQlIbBnyuiwDXjZp
- MD5 SHA1 SHA512 SSDEEP
-
NSIS installer
PE Signature issue
Digest
f8:cb:f2:64:c8:dd:84:c9:e9:92:66:39:fa:d4:27:02:be:90:07:db:aa:79:64:86:f7:02:fe:b3:cb:30:85:c0
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Ubarmhjertigheds,O=Ubarmhjertigheds,L=La Chapelle-Gaugain,C=FR
Chains
Oct 14, 2024
PE Signature issue
Digest
f8:89:8b:b7:58:c9:e2:b8:8f:d7:b5:3a:9a:aa:a1:1a:be:79:a6:f6
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Ubarmhjertigheds,O=Ubarmhjertigheds,L=La Chapelle-Gaugain,C=FR
Chains
Oct 14, 2024
Subject
CN=Ubarmhjertigheds,O=Ubarmhjertigheds,L=La Chapelle-Gaugain,C=FR
Serial Number
1e:7d:1b:48:f9:7a:4f:ed:c8:c4:dd:92:0f:d8:82:c5:e6:6c:5e:ee
Issuer
CN=Ubarmhjertigheds,O=Ubarmhjertigheds,L=La Chapelle-Gaugain,C=FR
Timespan
Aug 25, 2024 - Aug 25, 2027
Subject
CN=Ubarmhjertigheds,O=Ubarmhjertigheds,L=La Chapelle-Gaugain,C=FR
Serial Number
1e:7d:1b:48:f9:7a:4f:ed:c8:c4:dd:92:0f:d8:82:c5:e6:6c:5e:ee
Issuer
CN=Ubarmhjertigheds,O=Ubarmhjertigheds,L=La Chapelle-Gaugain,C=FR
Timespan
Aug 25, 2024 - Aug 25, 2027
Minor OS version
0
Major OS version
4
Entry point
13186
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
advapi32
RegEnumValueA
RegEnumKeyA
RegQueryValueExA
RegSetValueExA
RegCloseKey
RegDeleteValueA
RegDeleteKeyA
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
RegOpenKeyExA
RegCreateKeyExA
shell32
SHGetPathFromIDListA
SHBrowseForFolderA
SHGetFileInfoA
SHFileOperationA
ShellExecuteExA
ole32
OleUninitialize
OleInitialize
IIDFromString
CoCreateInstance
CoTaskMemFree
comctl32
ImageList_Destroy
ord17
ImageList_AddMasked
ImageList_Create
user32
SetDlgItemTextA
GetSystemMetrics
CreatePopupMenu
AppendMenuA
OpenClipboard
EmptyClipboard
SetClipboardData
CloseClipboard
IsWindowVisible
CallWindowProcA
GetMessagePos
CheckDlgButton
LoadCursorA
SetCursor
GetSysColor
SetWindowPos
GetWindowLongA
IsWindowEnabled
SetClassLongA
GetSystemMenu
EnableMenuItem
GetWindowRect
ScreenToClient
EndDialog
RegisterClassA
SystemParametersInfoA
CreateWindowExA
GetDlgItemTextA
DialogBoxParamA
CharNextA
ExitWindowsEx
DestroyWindow
CreateDialogParamA
SetTimer
SetWindowTextA
PostQuitMessage
SetForegroundWindow
ShowWindow
wsprintfA
SendMessageTimeoutA
FindWindowExA
IsWindow
GetDlgItem
SetWindowLongA
LoadImageA
GetDC
ReleaseDC
EnableWindow
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
EndPaint
MessageBoxIndirectA
CharPrevA
PeekMessageA
GetClassInfoA
DispatchMessageA
TrackPopupMenu
gdi32
GetDeviceCaps
SetBkColor
SelectObject
DeleteObject
CreateBrushIndirect
CreateFontIndirectA
SetBkMode
SetTextColor
kernel32
CreateFileA
GetTempFileNameA
ReadFile
RemoveDirectoryA
CreateProcessA
CreateDirectoryA
GetLastError
CreateThread
GlobalLock
GlobalUnlock
GetDiskFreeSpaceA
lstrcpynA
SetErrorMode
GetVersionExA
lstrlenA
GetCommandLineA
GetTempPathA
GetWindowsDirectoryA
WriteFile
ExitProcess
CopyFileA
GetCurrentProcess
GetModuleFileNameA
GetFileSize
GetTickCount
Sleep
SetFileAttributesA
GetFileAttributesA
SetCurrentDirectoryA
MoveFileA
GetFullPathNameA
GetShortPathNameA
SearchPathA
CompareFileTime
SetFileTime
CloseHandle
lstrcmpiA
lstrcmpA
ExpandEnvironmentStringsA
GlobalFree
GlobalAlloc
GetModuleHandleA
LoadLibraryExA
FreeLibrary
MultiByteToWideChar
WritePrivateProfileStringA
GetPrivateProfileStringA
SetFilePointer
FindClose
FindNextFileA
FindFirstFileA
DeleteFileA
MulDiv
lstrcpyA
MoveFileExA
lstrcatA
WideCharToMultiByte
GetSystemDirectoryA
GetProcAddress
GetExitCodeProcess
WaitForSingleObject
SetEnvironmentVariableA
Name
.text
Size
25KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
105KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.ndata
Size
Virtual Size
96KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
149KB
Virtual Size
148KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=158, id=1, productName=Unmarked objects,
count=15, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=10, id=48, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
$PLUGINSDIR/System.dll
- IMPHASH 240ca92ecc1c291801c451c447e16c12
- SHA256 7fb0f8d452fefaac789986b933df050f3d3e4feb8a8d9944ada995f572dcdca1
- MD5 dd87a973e01c5d9f8e0fcc81a0af7c7a
- SHA1 c9206ced48d1e5bc648b1d0f54cccc18bf643a14
- SHA512 4910b39b1a99622ac8b3c42f173bbe7035ac2f8d40c946468e7db7e2868a2da81ea94da453857f06f39957dd690c7f1ba498936a7aaa0039975e472376f92e8f
- SSDEEP 192:VFiQJ77pJp17C8F1A5xjGNxrgFOgb7lrT/993:97pJp48F2exrg5F/9
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
10673
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
GlobalAlloc
GlobalFree
GlobalSize
lstrcpynA
lstrcpyA
GetProcAddress
VirtualFree
FreeLibrary
lstrlenA
LoadLibraryA
GetModuleHandleA
MultiByteToWideChar
WideCharToMultiByte
VirtualAlloc
VirtualProtect
GetLastError
user32
wsprintfA
ole32
StringFromGUID2
CLSIDFromString
Alloc
Call
Copy
Free
Get
Int64Op
Store
StrAlloc
Name
.text
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1024B
Virtual Size
867B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
104B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
1024B
Virtual Size
654B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=7, id=14, version=7299,
count=19, id=1, productName=Unmarked objects,
count=7, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=4, id=48, version=9044,
count=1, id=42, version=8803,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
Levitates/hampton.ant
- SHA256 9025a4909bf51d92657b21f3dfa849f3e337f44b7abdaadb0b568c654f7ac1ec
- MD5 ccf68c7d2a707b209f7464de6bac1365
- SHA1 69bf3873438a9f0d1b3655cf9ea6006a0f0f4823
- SHA512 af6471d4204524031dd136f436e1a173e4e7997e8f8d373d6335c176f5aef83922105635e200033ec7381939d0e50158a47c9df8dc61824104f8640694c76c90
- SSDEEP 768:k7dV2NN1kXUyo0VKmim7+aMTGMKFMMp1qo9s1s8rFT10vi/5CKyhZ9cb6EIipueG:QgEMqMbFAFy0Gy6t2N9mvT/X4
- MD5 SHA1 SHA512 SSDEEP
Levitates/phytosociologically.txt
- SHA256 5b770847a5ca554185d21dee630bc3aae4f9d185c0f2cbd803afdfa10b30c750
- MD5 600be4ac955fb7547eca07fb12946717
- SHA1 07e53393bb0591c274599e56657c760e00a0e84b
- SHA512 12b81430df0d4c57e9ba803ce1228752ae2b127fb4fed07767107466b5283b9a1cb91966305aab2a5e65a7771729676d5c16c040ab30393a2748a115205e779d
- MD5 SHA1 SHA512
Nedskringens165.bge
- SHA256 50dcd403ad710f799dffce77387dbf1dbdf3c492f6e85cad64b2976c580ad6ad
- MD5 e3606943070abdcfc961e47d90699607
- SHA1 c7615dd3745f445d94087b280417cfa44c0195f6
- SHA512 e81b420fb5f4957bbf1e1e24799752d4b74d946a9ffb6b76bd1aeb0cbd460c53a40546f52fd27ef4e219bf85f59f573243de85ac637e73aabb7403653adac86a
- SSDEEP 768:qj7bYltCvcTH7BDyPMckurYNhx/s6/eyoEkhfh8aPCdz0e7RmeHEQ0SuKFkB5hta:II9RlafRn0m6XRihTSSy+pdyTgQjZ
- MD5 SHA1 SHA512 SSDEEP
Pharmacodynamical.Ove
- SHA256 d9662f60d6713f9f70fff5974ace674cb2d38ceb85ec7d49f8d9fc06df2f6689
- MD5 a23a0e9b441c43003d010003f8e58b63
- SHA1 51ce6a1bc3b724de3611aa6f1b5243097627c5ff
- SHA512 b928d39394425009bb48429228afc65f6f62b86e9edaa0da9d88a91fa9d72808a7865cbe3ff42d88269329e12985e786c2ef3c27e447dd2a373ad8c3d29921bb
- SSDEEP 3072:1Qe9DozNmQYMbe+MsWKOnh23E7A0H8KTBXmy+oOdOmW+Esa3LRgDJyLmK1sRkX3Y:T9Mx4TpbzOe+EhgJK1Aiprw0FDQ/
- MD5 SHA1 SHA512 SSDEEP
Unridably.opr
- SHA256 05e2f5a6672eb9cbca87996dbe4056240d85cc7c621d83e1bf75ade12df408ef
- MD5 6b0ae74c9a26839f4b5f590b755a5f3b
- SHA1 6d7ba6a29f41f8f64dab2154b2ba674a48d25414
- SHA512 7cc1be717acbf2b9892861a0e64d11dff78fd16cec53487e96f95a2c75a772d9fb5ec94399f4340f8bc240d1c527eb3a563e000ea062661212d649676b96d4a0
- SSDEEP 768:Ew9lwmgRX7sLbY0/b+aE40Z1KnruDG0Y/kwQKC0qawAWMvKTnGHjCxqScBN3PRtI:EMs6OXAI87Pm1ybjaCFrY+6
- MD5 SHA1 SHA512 SSDEEP
Upisland.Svr
- SHA256 0ee4b815476a4887a7770d7cb34277e32b4d3fc070debd837b10042de6e72851
- MD5 5e27b0788ef73a9a51728f2e8d4bb6c5
- SHA1 e3a3627fcb939cc4aa497b0c2dce95063106b55c
- SHA512 8cd11710ba170cd882ac0d4dd249f93ba84f325c54f0f1efca2069594bfe299c7bb3f04effce53545e77df29a4e711d1ddb06451b27ce5698fdc7b6fc5abe8fa
- SSDEEP 3072:+S9JlhAfuKsGgVMqEh7MPueS+QxIuASVJ6:79zhA2KsNVVEh7MWeExIB0J6
- MD5 SHA1 SHA512 SSDEEP
dimpsy.clu
- SHA256 03761a54bc2b3fdc0dd33d3d2304f8adda40a0c326b1b5ab317bfbf73c369d8c
- MD5 9683a3d88606c03220ac0a80ca991bb1
- SHA1 7873ccd42b97fac0b15398d79d5824a88e342817
- SHA512 791194e2fae49ff19132b49beb955bb53f827dbbe3c52c7217cf6e66f63b6f66d906311fa534ae3d1f7c54a454f34a4cea750b21396b203310315c8e328d2c1a
- SSDEEP 768:oD5IBGP0UgqsHHEUxUr9KPtXwRQ9q3QtsXS361zv1+r6TKExsQ5PN61wlRZQL/6L:VFWSeckPmawPZWsrQTM+qlRrZNc
- MD5 SHA1 SHA512 SSDEEP