LK Permv2[.]0[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
LK Permv2.0.zip
Size 43.4MB
Sample241104-k4pbea1kar
SHA256 f92901fbb791ac5a261c4e4faa25fba634624b0f049430cc45b902e1c9ef6a29
MD5 2e243f4ae5ea44be2bfd86e9ec915f61
SHA1 5a06a9adb71e8779ec59d9b7b56cdb5e279eb041
SHA512 2040c66f46f347056f50d46767b7b2ff6f1156b04b03ba4c20fde4298d27dbb9d3c19ecf78fa18e671458fb07d242528804e69678ebd41d35456bf085883f7a0
SSDEEP 786432:ORONoIDNlY+Nj3gsDn7bgQdCF0puF/lUBU9eHgrYMNPutoAa8/EB18QcWSEpXJJ:vXNlzjZXlMF/OBUOgrYTmUEB1FX
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 4 IoCs

Checks for missing Authenticode signature.

resource
unpack001/LKPerm.exe
unpack001/plugin/plugin.exe
unpack001/plugin/sdp.exe
unpack001/plugin/svchost.exe

File Explorer

LK Permv2.0.zip

.zip 43.4MB
LKPerm.exe

.exe 11.4MB
UPDATE LOG

403B
plugin/plugin.exe

.exe 8.5MB
plugin/sdp.exe

.exe 12.6MB
plugin/svchost.exe

.exe 11.4MB

LK Permv2.0.zip

SHA256 f92901fbb791ac5a261c4e4faa25fba634624b0f049430cc45b902e1c9ef6a29
MD5 2e243f4ae5ea44be2bfd86e9ec915f61
SHA1 5a06a9adb71e8779ec59d9b7b56cdb5e279eb041
SHA512 2040c66f46f347056f50d46767b7b2ff6f1156b04b03ba4c20fde4298d27dbb9d3c19ecf78fa18e671458fb07d242528804e69678ebd41d35456bf085883f7a0
SSDEEP 786432:ORONoIDNlY+Nj3gsDn7bgQdCF0puF/lUBU9eHgrYMNPutoAa8/EB18QcWSEpXJJ:vXNlzjZXlMF/OBUOgrYTmUEB1FX
MD5 SHA1 SHA512 SSDEEP

LKPerm.exe

IMPHASH 988a317897d6e3c5ac236596db50b863
SHA256 2e0ac0a8a23139017573192f49e0687aca269dffa3607f9be6c34b21f8f0dd94
MD5 a33562619984d5359a50689dd01f1708
SHA1 c19149ea8237955f751b7d4bc38fa77dbe92d252
SHA512 428837b46121b81d1fd9c7133b6f773ba9f56cf142a839ae6e34a14d771452bbff08a94f85421b8bf7aaff2e1541fed603b8737162b49f5685062563f6a4fce6
SSDEEP 196608:BJvJJBaCHnQD49SYbL1A8vlCFl9lG4+QoQwB2os/2UCzb3OiBigH32:BrJVjSuLaulCFRG4of2+Ua3h3
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4342

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

kernel32

CloseHandle CopyFileW CreateDirectoryW CreateFileMappingW CreateFileW CreateProcessW DeleteCriticalSection DeleteFileW EnterCriticalSection FindResourceA FormatMessageA FreeLibrary GetCommandLineW GetCurrentProcessId GetEnvironmentVariableW GetExitCodeProcess GetFileAttributesW GetFileSize GetLastError GetModuleFileNameW GetModuleHandleA GetProcAddress GetStartupInfoW GetStdHandle GetSystemTimeAsFileTime GetTempPathW InitializeCriticalSection IsDBCSLeadByteEx LeaveCriticalSection LoadLibraryA LoadResource LockResource MapViewOfFile MultiByteToWideChar ReadFile SetConsoleCtrlHandler SetEnvironmentVariableW SetUnhandledExceptionFilter SizeofResource Sleep TerminateProcess TlsGetValue UnmapViewOfFile VirtualProtect VirtualQuery WaitForSingleObject WideCharToMultiByte WriteFile

msvcrt

__C_specific_handler ___lc_codepage_func ___mb_cur_max_func __iob_func __set_app_type __setusermatherr __wargv __wgetmainargs __winitenv _amsg_exit _cexit _commode _errno _fmode _initterm _lock _onexit _unlock _wcmdln _wcsdup _wcsicmp _wrename abort calloc exit fprintf fputc free fwrite localeconv malloc mbstowcs memcpy memmove memset puts signal strerror strlen strncmp strncpy vfprintf wcschr wcscmp wcslen wcsncmp

shell32

CommandLineToArgvW SHFileOperationW SHGetFolderPathW

Name

.text

Size

143KB

Virtual Size

143KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

272B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

23KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.eh_fram

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

151KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

96B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

11.2MB

Virtual Size

11.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

152B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

plugin/plugin.exe

IMPHASH 988a317897d6e3c5ac236596db50b863
SHA256 971a051d8ee51447fb8d545ec3d58d4529510b71cd1a456d24051df01ff70d62
MD5 38b287fb149f2b89b516ee0c4ea120e3
SHA1 85e147501558ff7c0eabdd6500a882e62f96a679
SHA512 ae81060b59f8a824372d7c89f4ca8470e2fc4a1c1a78a377d71c10e3ea6aeb5cdf2c3a36e3481c7d5461c5d198e146aa2b595a02d99e25bc04009b243a7fd4e7
SSDEEP 196608:DORRVLRrxKRGYcA2DEONjhcZ8y0lUVBTHFGYhWqt1QF4h:iRRVdrxKRluEON1A0lIB7FGT+lh
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4342

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

kernel32

msvcrt

shell32

CommandLineToArgvW SHFileOperationW SHGetFolderPathW

Name

.text

Size

143KB

Virtual Size

143KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

272B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

22KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.eh_fram

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

151KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

96B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

8.3MB

Virtual Size

8.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

152B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

plugin/sdp.exe

IMPHASH 4a79fb177e250a1cece6ddf45232777a
SHA256 9048a2633c6bc06495632bc3d723dded45aea6d91771efa9c69d8b4f5c01d2d5
MD5 82931993909e8d027622f0c6882ce92c
SHA1 61ffd28847249bcceefac719b4cf3fedfca1d7b5
SHA512 74868fce4edc1095550e783c8c1485353fddbabfa8a6686cd7f6d76cebfd10efe7153158513303ed3c930b95d82d1ab060e5e0a01ba29ab71864024c97b5e6fb
SSDEEP 196608:6wSg6ybUmJDT7l7rvQ33lgbe0SlBj5AjtWJgoat/JeSOFn3:a7m5x72qkmQJzatxext
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4389

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

kernel32

CloseHandle CopyFileW CreateDirectoryW CreateFileMappingW CreateFileW CreateProcessW DeleteCriticalSection DeleteFileW EnterCriticalSection FindResourceA FormatMessageA FreeLibrary GetCommandLineW GetCurrentProcessId GetEnvironmentVariableW GetExitCodeProcess GetFileAttributesW GetFileSize GetLastError GetModuleFileNameW GetModuleHandleA GetProcAddress GetStdHandle GetSystemTimeAsFileTime GetTempPathW InitializeCriticalSection IsDBCSLeadByteEx LeaveCriticalSection LoadLibraryA LoadResource LockResource MapViewOfFile MultiByteToWideChar ReadFile SetConsoleCtrlHandler SetEnvironmentVariableW SetUnhandledExceptionFilter SizeofResource Sleep TerminateProcess TlsGetValue UnmapViewOfFile VirtualProtect VirtualQuery WaitForSingleObject WideCharToMultiByte WriteFile

msvcrt

__C_specific_handler ___lc_codepage_func ___mb_cur_max_func __iob_func __set_app_type __setusermatherr __wargv __wgetmainargs __winitenv _amsg_exit _cexit _commode _errno _fmode _initterm _lock _onexit _unlock _wcsdup _wcsicmp _wrename abort calloc exit fprintf fputc free fwrite localeconv malloc mbstowcs memcpy memmove memset puts signal strerror strlen strncmp strncpy vfprintf wcschr wcscmp wcslen wcsncmp

shell32

CommandLineToArgvW SHFileOperationW SHGetFolderPathW

Name

.text

Size

143KB

Virtual Size

142KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

22KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.eh_fram

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

151KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

96B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

12.4MB

Virtual Size

12.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

148B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

plugin/svchost.exe

IMPHASH 988a317897d6e3c5ac236596db50b863
SHA256 33141f7184443f6f138d03fc189477ee966e6918b90caf98b0baba968dcfef53
MD5 05ab3b0a3f4d62c79b4d6d888b920381
SHA1 1583f25930a8501e397623dacff49c37747d66c0
SHA512 328ff0361522c9694ff703ab8cd112a2aa6b542eb444c861950f6d3e457476456ac89178b354b3bdd3e53f196586df321a371f16384b5b0388e7573804eb0b75
SSDEEP 196608:V+8ZLwISqenUndqYqbRfck4I6QtwIj/GONIkM1pJGWBHX7JpjA3S:V+8ZLNanWqrNfcCwIjecIk+46HX7v8C
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4342

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

kernel32

msvcrt

shell32

CommandLineToArgvW SHFileOperationW SHGetFolderPathW

Name

.text

Size

143KB

Virtual Size

143KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

272B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

23KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.eh_fram

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

151KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

96B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

11.2MB

Virtual Size

11.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

152B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

LK Permv2.0.zip

LKPerm.exe

kernel32

msvcrt

shell32

generic

UPDATE LOG

plugin/plugin.exe

kernel32

msvcrt

shell32

generic

plugin/sdp.exe

kernel32

msvcrt

shell32

generic

plugin/svchost.exe

kernel32

msvcrt

shell32

generic