Overview
overview
7Static
static
73739d14235...4a.exe
windows11-21h2-x64
7$PLUGINSDI...ol.dll
windows11-21h2-x64
5$PLUGINSDI...ns.dll
windows11-21h2-x64
3$PLUGINSDI...em.dll
windows11-21h2-x64
3$PLUGINSDI...fo.dll
windows11-21h2-x64
3$PLUGINSDI...al.ini
windows11-21h2-x64
3$PLUGINSDI...er.bmp
windows11-21h2-x64
3$PLUGINSDI...rd.bmp
windows11-21h2-x64
3AVStrike.exe
windows11-21h2-x64
6AVStrike.exe.config
windows11-21h2-x64
3CButtonLib.dll
windows11-21h2-x64
1Common Tools.dll
windows11-21h2-x64
1Core.dll
windows11-21h2-x64
1Interop.IW...ry.dll
windows11-21h2-x64
1KernelBase.dll
windows11-21h2-x64
3LumenWorks...IO.dll
windows11-21h2-x64
1System.Dat...te.dll
windows11-21h2-x64
3TaskScheduler.dll
windows11-21h2-x64
1Uninstall.exe
windows11-21h2-x64
7$PLUGINSDI...em.dll
windows11-21h2-x64
3db/AVStrikeDB.ldb
windows11-21h2-x64
3db/AVStrikeDB.ldb.bak
windows11-21h2-x64
3db/bytecode.cld
windows11-21h2-x64
3db/daily.cld
windows11-21h2-x64
3db/main.cld
windows11-21h2-x64
3db/mirrors.dat
windows11-21h2-x64
3libclamav.dll
windows11-21h2-x64
3libclamavd.dll
windows11-21h2-x64
3log4net.dll
windows11-21h2-x64
1scandll.dll
windows11-21h2-x64
3update_db.exe
windows11-21h2-x64
Analysis
-
max time kernel
298s -
max time network
205s -
platform
windows11-21h2_x64 -
resource
win11-20241007-en -
resource tags
arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system -
submitted
07/11/2024, 10:46
Behavioral task
behavioral1
Sample
3739d14235ff791ab9f138b769613880d3426004e42eb8c96da33cc00b18f14a.exe
Resource
win11-20241007-en
Behavioral task
behavioral2
Sample
$PLUGINSDIR/AccessControl.dll
Resource
win11-20241007-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win11-20241007-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win11-20241023-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/UserInfo.dll
Resource
win11-20241007-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/ioSpecial.ini
Resource
win11-20241007-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/modern-header.bmp
Resource
win11-20241007-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/modern-wizard.bmp
Resource
win11-20241007-en
Behavioral task
behavioral9
Sample
AVStrike.exe
Resource
win11-20241007-en
Behavioral task
behavioral10
Sample
AVStrike.exe.config
Resource
win11-20241007-en
Behavioral task
behavioral11
Sample
CButtonLib.dll
Resource
win11-20241007-en
Behavioral task
behavioral12
Sample
Common Tools.dll
Resource
win11-20241023-en
Behavioral task
behavioral13
Sample
Core.dll
Resource
win11-20241007-en
Behavioral task
behavioral14
Sample
Interop.IWshRuntimeLibrary.dll
Resource
win11-20241007-en
Behavioral task
behavioral15
Sample
KernelBase.dll
Resource
win11-20241007-en
Behavioral task
behavioral16
Sample
LumenWorks.Framework.IO.dll
Resource
win11-20241007-en
Behavioral task
behavioral17
Sample
System.Data.SQLite.dll
Resource
win11-20241007-en
Behavioral task
behavioral18
Sample
TaskScheduler.dll
Resource
win11-20241007-en
Behavioral task
behavioral19
Sample
Uninstall.exe
Resource
win11-20241007-en
Behavioral task
behavioral20
Sample
$PLUGINSDIR/System.dll
Resource
win11-20241007-en
Behavioral task
behavioral21
Sample
db/AVStrikeDB.ldb
Resource
win11-20241007-en
Behavioral task
behavioral22
Sample
db/AVStrikeDB.ldb.bak
Resource
win11-20241007-en
Behavioral task
behavioral23
Sample
db/bytecode.cld
Resource
win11-20241007-en
Behavioral task
behavioral24
Sample
db/daily.cld
Resource
win11-20241023-en
Behavioral task
behavioral25
Sample
db/main.cld
Resource
win11-20241007-en
Behavioral task
behavioral26
Sample
db/mirrors.dat
Resource
win11-20241007-en
Behavioral task
behavioral27
Sample
libclamav.dll
Resource
win11-20241007-en
Behavioral task
behavioral28
Sample
libclamavd.dll
Resource
win11-20241007-en
Behavioral task
behavioral29
Sample
log4net.dll
Resource
win11-20241007-en
Behavioral task
behavioral30
Sample
scandll.dll
Resource
win11-20241007-en
Behavioral task
behavioral31
Sample
update_db.exe
Resource
win11-20241007-en
General
-
Target
AVStrike.exe
-
Size
1.0MB
-
MD5
625ceb491ee54a693bfcf4ae7338bf3e
-
SHA1
e0eca9a959fc54c6adf8cb0fe168496ae1982916
-
SHA256
55eb603c027d50a86699391522ce35c3d03c67fa5820ee3755444bb927bb18cd
-
SHA512
1a8c8a0ba6653bf6988c851ca095b80113346ec5612f1f479977aa893eb4464a7bd76b9ef0fbd34ab3754ebd99b82688aa8a95645ba680569153cb23cc39ddad
-
SSDEEP
12288:krviYh666pVpgSPKmAjhfsixJkMHm+2ZDcLeKWhgvAgpwyhV2WpcjgaydRsF:+i7HgSC/1PUaQdcLeKWyzRcjKd
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000\Software\Microsoft\Windows\CurrentVersion\Run\AVStrike = "C:\\Users\\Admin\\AppData\\Local\\Temp\\AVStrike.exe" AVStrike.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AVStrike.exe