lockbit (1)[.]7z

Sharing

Copy URL

Twitter E-mail

General

Target

lockbit (1).7z
Size

8.8MB
MD5

a1beeabd1bccb8266631e4cce53eea26
SHA1

917975f62cda9bac4badbb09d4f5e99936e5c30e
SHA256

9f3a43ab58c24e5394021009092be2d3ecff413aa57a440542e3b2a827fd9b54
SHA512

b6fe92909419e8eddd1eb3139c11ee968f6b6cd1b95073fde356faa707e46ffec42a819c732016175bcc4aac8da187fd75cea7b857fc1e693c6ff8a86aa1815a
SSDEEP

98304:ciMFZDHZg7++Bfe65+PdBMgV3c2Xi5DyVZD93tNmD/+IV78ZtUV+kIpOjs7D6c6Z:ciIZD2S+BfD5hEtyVGUEOA/+kU5pXn

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

Processes:

resource
unpack001/29.04.20TASKMNGR

Files

lockbit (1).7z
.7z

Password: infected
29.04.20TASKMNGR
.exe windows:5 windows x86 arch:x86

Password: infected

168ea5b327edf5713a2bb8e19a928d13

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

netapi32

NetShareEnum
NetApiBufferFree

iphlpapi

GetAdaptersInfo

ws2_32

ioctlsocket
htons
connect
socket
inet_addr
WSAStartup
select
closesocket
__WSAFDIsSet
WSACleanup
WSAGetLastError

crypt32

CryptBinaryToStringA

gdiplus

GdipDeleteGraphics
GdipDeleteStringFormat
GdipDeleteFont
GdipGetImageGraphicsContext
GdiplusStartup
GdipCreateStringFormat
GdipSetStringFormatAlign
GdipSaveImageToFile
GdipGetImageEncodersSize
GdipCloneBrush
GdipDrawString
GdipDeleteBrush
GdipAlloc
GdipDisposeImage
GdipCreateLineBrushFromRect
GdipSetStringFormatLineAlign
GdipCreateFont
GdipFree
GdipCreateBitmapFromScan0
GdipGetGenericFontFamilySansSerif
GdipDeleteFontFamily
GdipGetImageEncoders
GdipFillRectangle
GdipCreateFontFamilyFromName

shlwapi

PathAddBackslashW
PathFindExtensionW
PathRemoveBackslashW
PathRemoveExtensionA
PathRemoveFileSpecW
StrFormatByteSize64A

mpr

WNetCloseEnum
WNetAddConnection2W
WNetOpenEnumW
WNetGetConnectionW
WNetEnumResourceW

ntdll

RtlEnterCriticalSection
RtlLeaveCriticalSection
RtlDeleteCriticalSection
RtlInitializeCriticalSection
NtSetInformationThread
NtAdjustPrivilegesToken
NtOpenProcessToken
NtQueryInformationToken
RtlGetAce
NtOpenProcess
RtlQueryInformationAcl
RtlAllocateAndInitializeSid
RtlAddAce
RtlLengthSid
NtClose
RtlAdjustPrivilege
RtlFreeSid
RtlAddAccessDeniedAce
NtSetInformationProcess
RtlCreateAcl
NtWaitForSingleObject
NtSetInformationFile
NtCreateIoCompletion
NtRemoveIoCompletion
NtQueryInformationFile
RtlInterlockedPushEntrySList
RtlInitializeSListHead
RtlInterlockedPopEntrySList
RtlInterlockedFlushSList
RtlInitUnicodeString
NtAllocateVirtualMemory
LdrEnumerateLoadedModules
RtlAcquirePebLock
RtlReleasePebLock

msvcrt

malloc
calloc
free

kernel32

SetProcessShutdownParameters
FindFirstFileExW
SetConsoleMode
WriteFile
GetWindowsDirectoryW
MoveFileW
SystemTimeToFileTime
SetFileTime
ReadFile
FindNextVolumeW
GetVolumePathNamesForVolumeNameW
FindVolumeClose
SetConsoleTitleA
SetConsoleTextAttribute
GetModuleHandleA
SetConsoleCtrlHandler
GetConsoleMode
GetLocalTime
SetVolumeMountPointW
FindFirstVolumeW
QueryDosDeviceW
CreateProcessA
lstrcmpiA
GetCurrentProcessId
MoveFileExW
Process32Next
CreateToolhelp32Snapshot
OpenProcess
GetSystemDefaultLangID
TerminateProcess
Process32First
LoadLibraryA
OpenMutexA
CreateMutexA
GetTempFileNameW
GetTempPathW
GetDriveTypeW
lstrcmpiW
ExitProcess
CreateThread
CloseHandle
DeleteFileW
GetDiskFreeSpaceExW
SetFileAttributesW
ExitThread
GetFileAttributesW
CreateFileW
FindClose
SetThreadUILanguage
WaitForMultipleObjects
FindNextFileW
GetProcAddress
GetLogicalDrives
AllocConsole
GetConsoleWindow

user32

GetSystemMenu
IsWindowVisible
DeleteMenu
GetMessageW
ShowWindow
GetWindowThreadProcessId
PeekMessageW
GetWindowLongA
wvsprintfA
RegisterHotKey
FlashWindow
SetLayeredWindowAttributes
EnableMenuItem
CharLowerBuffW
CharUpperA
MessageBoxA
wsprintfW
SystemParametersInfoW
GetSystemMetrics
wsprintfA
SetWindowLongA
GetShellWindow

advapi32

CloseServiceHandle
RegSetValueExA
RegOpenKeyA
RegCloseKey
CryptReleaseContext
InitializeSecurityDescriptor
RegQueryValueExA
OpenProcessToken
DuplicateToken
OpenThreadToken
GetTokenInformation
SetSecurityInfo
GetSecurityInfo
CheckTokenMembership
CreateWellKnownSid
EnumDependentServicesA
SetThreadToken
OpenSCManagerA
RegCreateKeyExA
ControlService
RegSetValueExW
RegDeleteValueW
QueryServiceStatusEx
RegQueryValueExW
OpenServiceA
SetFileSecurityW
CryptAcquireContextW
SetSecurityDescriptorOwner
CryptGenRandom
LookupPrivilegeValueA

shell32

SHEmptyRecycleBinW
ShellExecuteExA
ShellExecuteExW
CommandLineToArgvW

ole32

CoGetObject
CoUninitialize
CoInitializeEx

Sections

.text
Size: 121KB - Virtual size: 121KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 25KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
System Volume Information/IndexerVolumeGuid
System Volume Information/WPSettings.dat
Vacuum_Nanostructuring_Marton.doc.lockbit
snap.78N1BA9-1.200421.144153.tgz
.gz

Password: infected
snap.78N1BA9-1.200421.144153.tgz
.tar

Password: infected
compass/version
compass/vrmf
data/vpd_cluster
dumps/78N1BA9-1.trc
dumps/78N1BA9-1.trc.old
dumps/78N1BA9-2.trc
dumps/78N1BA9-2.trc.old
dumps/acpower.78N1BA9-1.trc
dumps/acpower.78N1BA9-1.trc.old
dumps/acpower.78N1BA9-2.trc
dumps/acpower.78N1BA9-2.trc.old
dumps/auditlog.78N1BA9-1.200421.144153
dumps/cimom/PegasusError.78N1BA9-1
dumps/cimom/PegasusStandard.78N1BA9-1
dumps/cimom/aspengui_trc.78N1BA9-1.log
dumps/cimom/aspengui_trc.78N1BA9-11.log
dumps/cimom/aspengui_trc.78N1BA9-12.log
dumps/cimom/aspengui_trc.78N1BA9-13.log
dumps/cimom/aspengui_trc.78N1BA9-14.log
dumps/cimom/aspengui_trc.78N1BA9-15.log
dumps/cimom/aspengui_trc.78N1BA9-16.log
dumps/cimom/aspengui_trc.78N1BA9-17.log
dumps/cimom/aspengui_trc.78N1BA9-2.log
dumps/cimom/aspengui_trc.78N1BA9-21.log
dumps/cimom/aspengui_trc.78N1BA9-22.log
dumps/cimom/aspengui_trc.78N1BA9-23.log
dumps/cimom/aspengui_trc.78N1BA9-24.log
dumps/cimom/aspengui_trc.78N1BA9-25.log
dumps/cimom/aspengui_trc.78N1BA9-26.log
dumps/cimom/aspengui_trc.78N1BA9-27.log
dumps/cimom/cimMemUse.78N1BA9-1
dumps/cimom/dmp_trc.78N1BA9-1.log
dumps/cimom/dmp_trc.78N1BA9-2.1.log.gz
.gz

Password: infected
dmp_trc.78N1BA9-2.1.log
dumps/cimom/dmp_trc.78N1BA9-2.2.log.gz
.gz

Password: infected
dmp_trc.78N1BA9-2.2.log
dumps/cimom/dmp_trc.78N1BA9-2.log
dumps/cimom/ecfhmon.78N1BA9-1.log
dumps/cimom/ecfhmon.78N1BA9-1.log.1.gz
.gz

Password: infected
ecfhmon.78N1BA9-1.log.1
dumps/cimom/ecfhmon.78N1BA9-1.log.10.gz
.gz

Password: infected
ecfhmon.78N1BA9-1.log.1
dumps/cimom/ecfhmon.78N1BA9-1.log.11.gz
.gz

Password: infected
ecfhmon.78N1BA9-1.log.1
dumps/cimom/ecfhmon.78N1BA9-1.log.12.gz
.gz
dumps/cimom/ecfhmon.78N1BA9-1.log.13.gz
.gz
dumps/cimom/ecfhmon.78N1BA9-1.log.14.gz
.gz
dumps/cimom/ecfhmon.78N1BA9-1.log.15.gz
.gz
dumps/cimom/ecfhmon.78N1BA9-1.log.16.gz
.gz
dumps/cimom/ecfhmon.78N1BA9-1.log.17.gz
.gz
dumps/cimom/ecfhmon.78N1BA9-1.log.18.gz
.gz
dumps/cimom/ecfhmon.78N1BA9-1.log.19.gz
.gz
dumps/cimom/ecfhmon.78N1BA9-1.log.2.gz
.gz
dumps/cimom/ecfhmon.78N1BA9-1.log.20.gz
.gz
dumps/cimom/ecfhmon.78N1BA9-1.log.3.gz
.gz
dumps/cimom/ecfhmon.78N1BA9-1.log.4.gz
.gz
dumps/cimom/ecfhmon.78N1BA9-1.log.5.gz
.gz
dumps/cimom/ecfhmon.78N1BA9-1.log.6.gz
.gz
dumps/cimom/ecfhmon.78N1BA9-1.log.7.gz
.gz
dumps/cimom/ecfhmon.78N1BA9-1.log.8.gz
.gz
dumps/cimom/ecfhmon.78N1BA9-1.log.9.gz
.gz
dumps/cimom/ecfhmon.78N1BA9-2.log
dumps/cimom/ecfhmon.78N1BA9-2.log.1.gz
.gz
dumps/cimom/ecfhmon.78N1BA9-2.log.10.gz
.gz
dumps/cimom/ecfhmon.78N1BA9-2.log.11.gz
.gz
dumps/cimom/ecfhmon.78N1BA9-2.log.12.gz
.gz
dumps/cimom/ecfhmon.78N1BA9-2.log.13.gz
.gz
dumps/cimom/ecfhmon.78N1BA9-2.log.14.gz
.gz
dumps/cimom/ecfhmon.78N1BA9-2.log.15.gz
.gz
dumps/cimom/ecfhmon.78N1BA9-2.log.16.gz
.gz
dumps/cimom/ecfhmon.78N1BA9-2.log.17.gz
.gz
dumps/cimom/ecfhmon.78N1BA9-2.log.18.gz
.gz
dumps/cimom/ecfhmon.78N1BA9-2.log.19.gz
.gz
dumps/cimom/ecfhmon.78N1BA9-2.log.2.gz
.gz
dumps/cimom/ecfhmon.78N1BA9-2.log.20.gz
.gz
dumps/cimom/ecfhmon.78N1BA9-2.log.3.gz
.gz
dumps/cimom/ecfhmon.78N1BA9-2.log.4.gz
.gz
dumps/cimom/ecfhmon.78N1BA9-2.log.5.gz
.gz
dumps/cimom/ecfhmon.78N1BA9-2.log.6.gz
.gz
dumps/cimom/ecfhmon.78N1BA9-2.log.7.gz
.gz
dumps/cimom/ecfhmon.78N1BA9-2.log.8.gz
.gz
dumps/cimom/ecfhmon.78N1BA9-2.log.9.gz
.gz
dumps/cimom/ecmon.78N1BA9-1.log
dumps/cimom/ecmon.78N1BA9-1.log.1.gz
.gz
dumps/cimom/ecmon.78N1BA9-1.log.10.gz
.gz
dumps/cimom/ecmon.78N1BA9-1.log.11.gz
.gz
dumps/cimom/ecmon.78N1BA9-1.log.12.gz
.gz
dumps/cimom/ecmon.78N1BA9-1.log.13.gz
.gz
dumps/cimom/ecmon.78N1BA9-1.log.14.gz
.gz
dumps/cimom/ecmon.78N1BA9-1.log.15.gz
.gz
dumps/cimom/ecmon.78N1BA9-1.log.16.gz
.gz
dumps/cimom/ecmon.78N1BA9-1.log.17.gz
.gz
dumps/cimom/ecmon.78N1BA9-1.log.18.gz
.gz
dumps/cimom/ecmon.78N1BA9-1.log.19.gz
.gz
dumps/cimom/ecmon.78N1BA9-1.log.2.gz
.gz
dumps/cimom/ecmon.78N1BA9-1.log.20.gz
.gz
dumps/cimom/ecmon.78N1BA9-1.log.3.gz
.gz
dumps/cimom/ecmon.78N1BA9-1.log.4.gz
.gz
dumps/cimom/ecmon.78N1BA9-1.log.5.gz
.gz
dumps/cimom/ecmon.78N1BA9-1.log.6.gz
.gz
dumps/cimom/ecmon.78N1BA9-1.log.7.gz
.gz
dumps/cimom/ecmon.78N1BA9-1.log.8.gz
.gz
dumps/cimom/ecmon.78N1BA9-1.log.9.gz
.gz
dumps/cimom/ecmon.78N1BA9-1.log.ecmain_exit
dumps/cimom/ecmon.78N1BA9-2.log
dumps/cimom/ecmon.78N1BA9-2.log.1.gz
.gz
dumps/cimom/ecmon.78N1BA9-2.log.10.gz
.gz
dumps/cimom/ecmon.78N1BA9-2.log.11.gz
.gz
dumps/cimom/ecmon.78N1BA9-2.log.12.gz
.gz
dumps/cimom/ecmon.78N1BA9-2.log.13.gz
.gz
dumps/cimom/ecmon.78N1BA9-2.log.14.gz
.gz
dumps/cimom/ecmon.78N1BA9-2.log.15.gz
.gz
dumps/cimom/ecmon.78N1BA9-2.log.16.gz
.gz
dumps/cimom/ecmon.78N1BA9-2.log.17.gz
.gz
dumps/cimom/ecmon.78N1BA9-2.log.18.gz
.gz
dumps/cimom/ecmon.78N1BA9-2.log.19.gz
.gz
dumps/cimom/ecmon.78N1BA9-2.log.2.gz
.gz
dumps/cimom/ecmon.78N1BA9-2.log.20.gz
.gz
dumps/cimom/ecmon.78N1BA9-2.log.3.gz
.gz
dumps/cimom/ecmon.78N1BA9-2.log.4.gz
.gz
dumps/cimom/ecmon.78N1BA9-2.log.5.gz
.gz
dumps/cimom/ecmon.78N1BA9-2.log.6.gz
.gz
dumps/cimom/ecmon.78N1BA9-2.log.7.gz
.gz
dumps/cimom/ecmon.78N1BA9-2.log.8.gz
.gz
dumps/cimom/ecmon.78N1BA9-2.log.9.gz
.gz
dumps/cimom/ecmon.78N1BA9-2.log.ecmain_exit
dumps/cimom/jvm_javacore.78N1BA9-2.20200415.190823.14436.0001.txt
dumps/cimom/jvm_javacore.78N1BA9-2.20200415.203801.14436.0002.txt
dumps/cimom/mkrepositorylog.78N1BA9-1
dumps/cimom/plfs_client.78N1BA9-1
dumps/cimom/providerAudit.78N1BA9-1
dumps/cimom/providerLog.78N1BA9-1
dumps/cimom/providerTrace.78N1BA9-1
dumps/cimom/providerTrace.78N1BA9-1.bak
dumps/cimom/providerTrace.78N1BA9-2.bak
dumps/cimom/rc.tomcat.78N1BA9-1.log
dumps/cimom/rc.tomcat.78N1BA9-2.log
dumps/cimom/sat_trc.78N1BA9-1.log
dumps/cimom/sat_trc.78N1BA9-2.log
dumps/cimom/tomcat.sh.78N1BA9-1.log
dumps/cimom/tomcat.sh.78N1BA9-2.log
dumps/cimom/tomcat.ws.78N1BA9-1.0.log
dumps/cimom/tomcat.ws.78N1BA9-1.1.log
dumps/cimom/tomcat.ws.78N1BA9-1.2.log
dumps/cimom/tomcat.ws.78N1BA9-1.3.log
dumps/cimom/tomcat.ws.78N1BA9-1.4.log
dumps/cimom/tomcat.ws.78N1BA9-1.5.log
dumps/cimom/tomcat.ws.78N1BA9-1.6.log
dumps/cimom/tomcat.ws.78N1BA9-1.7.log
dumps/cimom/tomcat.ws.78N1BA9-2.0.log
dumps/cimom/tomcat.ws.78N1BA9-2.1.log
dumps/cimom/tomcat.ws.78N1BA9-2.2.log
dumps/cimom/tomcat.ws.78N1BA9-2.3.log
dumps/cimom/tomcat.ws.78N1BA9-2.4.log
dumps/cimom/tomcat.ws.78N1BA9-2.5.log
dumps/cimom/tomcat.ws.78N1BA9-2.6.log
dumps/cimom/tomcat.ws.78N1BA9-2.7.log
dumps/cimom/tomcat_config.sh.78N1BA9-1.log
dumps/cimom/tomcat_config.sh.78N1BA9-2.log
dumps/cimom/tomcat_config_service.78N1BA9-1.log
dumps/cimom/tomcat_config_service.78N1BA9-2.log
dumps/elogs/errlog_78N1BA9-1_200421_144247
dumps/enclosure/enclosuredump_78N1BA9-1_1-1_200415_181709
dumps/enclosure/enclosuredump_78N1BA9-1_1-1_200415_190851
dumps/enclosure/enclosuredump_78N1BA9-1_1-1_200415_203831
dumps/enclosure/enclosuredump_78N1BA9-2_1-2_200415_191018
dumps/enclosure/enclosuredump_78N1BA9-2_1-2_200415_204001
dumps/ethernet.78N1BA9-1.stats
dumps/ethernet.78N1BA9-1.trc
dumps/ethernet.78N1BA9-2.stats
dumps/ethernet.78N1BA9-2.trc
dumps/hpmcheck.78N1BA9-1.200421.144153
dumps/iostats/Nd_stats_78N1BA9-1_200421_104541
.xml
dumps/iostats/Nd_stats_78N1BA9-1_200421_110041
.xml
dumps/iostats/Nd_stats_78N1BA9-1_200421_111541
.xml
dumps/iostats/Nd_stats_78N1BA9-1_200421_113041
.xml
dumps/iostats/Nd_stats_78N1BA9-1_200421_114541
.xml
dumps/iostats/Nd_stats_78N1BA9-1_200421_120041
.xml
dumps/iostats/Nd_stats_78N1BA9-1_200421_121541
.xml
dumps/iostats/Nd_stats_78N1BA9-1_200421_123041
.xml
dumps/iostats/Nd_stats_78N1BA9-1_200421_124541
.xml
dumps/iostats/Nd_stats_78N1BA9-1_200421_130041
.xml
dumps/iostats/Nd_stats_78N1BA9-1_200421_131541
.xml
dumps/iostats/Nd_stats_78N1BA9-1_200421_133041
.xml
dumps/iostats/Nd_stats_78N1BA9-1_200421_134541
.xml
dumps/iostats/Nd_stats_78N1BA9-1_200421_140041
.xml
dumps/iostats/Nd_stats_78N1BA9-1_200421_141541
.xml
dumps/iostats/Nd_stats_78N1BA9-1_200421_143041
.xml
dumps/iostats/Nd_stats_78N1BA9-2_200421_104541
.xml
dumps/iostats/Nd_stats_78N1BA9-2_200421_110041
.xml
dumps/iostats/Nd_stats_78N1BA9-2_200421_111541
.xml
dumps/iostats/Nd_stats_78N1BA9-2_200421_113041
.xml
dumps/iostats/Nd_stats_78N1BA9-2_200421_114541
.xml
dumps/iostats/Nd_stats_78N1BA9-2_200421_120041
.xml
dumps/iostats/Nd_stats_78N1BA9-2_200421_121541
.xml
dumps/iostats/Nd_stats_78N1BA9-2_200421_123041
.xml
dumps/iostats/Nd_stats_78N1BA9-2_200421_124541
.xml
dumps/iostats/Nd_stats_78N1BA9-2_200421_130041
.xml
dumps/iostats/Nd_stats_78N1BA9-2_200421_131541
.xml
dumps/iostats/Nd_stats_78N1BA9-2_200421_133041
.xml
dumps/iostats/Nd_stats_78N1BA9-2_200421_134541
.xml
dumps/iostats/Nd_stats_78N1BA9-2_200421_140041
.xml
dumps/iostats/Nd_stats_78N1BA9-2_200421_141541
.xml
dumps/iostats/Nd_stats_78N1BA9-2_200421_143041
.xml
dumps/iostats/Nm_stats_78N1BA9-1_200421_104541
.xml
dumps/iostats/Nm_stats_78N1BA9-1_200421_110041
.xml
dumps/iostats/Nm_stats_78N1BA9-1_200421_111541
.xml
dumps/iostats/Nm_stats_78N1BA9-1_200421_113041
.xml
dumps/iostats/Nm_stats_78N1BA9-1_200421_114541
.xml
dumps/iostats/Nm_stats_78N1BA9-1_200421_120041
.xml
dumps/iostats/Nm_stats_78N1BA9-1_200421_121541
.xml
dumps/iostats/Nm_stats_78N1BA9-1_200421_123041
.xml
dumps/iostats/Nm_stats_78N1BA9-1_200421_124541
.xml
dumps/iostats/Nm_stats_78N1BA9-1_200421_130041
.xml
dumps/iostats/Nm_stats_78N1BA9-1_200421_131541
.xml
dumps/iostats/Nm_stats_78N1BA9-1_200421_133041
.xml
dumps/iostats/Nm_stats_78N1BA9-1_200421_134541
.xml
dumps/iostats/Nm_stats_78N1BA9-1_200421_140041
.xml
dumps/iostats/Nm_stats_78N1BA9-1_200421_141541
.xml
dumps/iostats/Nm_stats_78N1BA9-1_200421_143041
.xml
dumps/iostats/Nm_stats_78N1BA9-2_200421_104541
.xml
dumps/iostats/Nm_stats_78N1BA9-2_200421_110041
.xml
dumps/iostats/Nm_stats_78N1BA9-2_200421_111541
.xml
dumps/iostats/Nm_stats_78N1BA9-2_200421_113041
.xml
dumps/iostats/Nm_stats_78N1BA9-2_200421_114541
.xml
dumps/iostats/Nm_stats_78N1BA9-2_200421_120041
.xml
dumps/iostats/Nm_stats_78N1BA9-2_200421_121541
.xml
dumps/iostats/Nm_stats_78N1BA9-2_200421_123041
.xml
dumps/iostats/Nm_stats_78N1BA9-2_200421_124541
.xml
dumps/iostats/Nm_stats_78N1BA9-2_200421_130041
.xml
dumps/iostats/Nm_stats_78N1BA9-2_200421_131541
.xml
dumps/iostats/Nm_stats_78N1BA9-2_200421_133041
.xml
dumps/iostats/Nm_stats_78N1BA9-2_200421_134541
.xml
dumps/iostats/Nm_stats_78N1BA9-2_200421_140041
.xml
dumps/iostats/Nm_stats_78N1BA9-2_200421_141541
.xml
dumps/iostats/Nm_stats_78N1BA9-2_200421_143041
.xml
dumps/iostats/Nn_stats_78N1BA9-1_200421_104541
.xml
dumps/iostats/Nn_stats_78N1BA9-1_200421_110041
.xml
dumps/iostats/Nn_stats_78N1BA9-1_200421_111541
.xml
dumps/iostats/Nn_stats_78N1BA9-1_200421_113041
.xml
dumps/iostats/Nn_stats_78N1BA9-1_200421_114541
.xml
dumps/iostats/Nn_stats_78N1BA9-1_200421_120041
.xml
dumps/iostats/Nn_stats_78N1BA9-1_200421_121541
.xml
dumps/iostats/Nn_stats_78N1BA9-1_200421_123041
.xml
dumps/iostats/Nn_stats_78N1BA9-1_200421_124541
.xml
dumps/iostats/Nn_stats_78N1BA9-1_200421_130041
.xml
dumps/iostats/Nn_stats_78N1BA9-1_200421_131541
.xml
dumps/iostats/Nn_stats_78N1BA9-1_200421_133041
.xml
dumps/iostats/Nn_stats_78N1BA9-1_200421_134541
.xml
dumps/iostats/Nn_stats_78N1BA9-1_200421_140041
.xml
dumps/iostats/Nn_stats_78N1BA9-1_200421_141541
.xml
dumps/iostats/Nn_stats_78N1BA9-1_200421_143041
.xml
dumps/iostats/Nn_stats_78N1BA9-2_200421_104541
.xml
dumps/iostats/Nn_stats_78N1BA9-2_200421_110041
.xml
dumps/iostats/Nn_stats_78N1BA9-2_200421_111541
.xml
dumps/iostats/Nn_stats_78N1BA9-2_200421_113041
.xml
dumps/iostats/Nn_stats_78N1BA9-2_200421_114541
.xml
dumps/iostats/Nn_stats_78N1BA9-2_200421_120041
.xml
dumps/iostats/Nn_stats_78N1BA9-2_200421_121541
.xml
dumps/iostats/Nn_stats_78N1BA9-2_200421_123041
.xml
dumps/iostats/Nn_stats_78N1BA9-2_200421_124541
.xml
dumps/iostats/Nn_stats_78N1BA9-2_200421_130041
.xml
dumps/iostats/Nn_stats_78N1BA9-2_200421_131541
.xml
dumps/iostats/Nn_stats_78N1BA9-2_200421_133041
.xml
dumps/iostats/Nn_stats_78N1BA9-2_200421_134541
.xml
dumps/iostats/Nn_stats_78N1BA9-2_200421_140041
.xml
dumps/iostats/Nn_stats_78N1BA9-2_200421_141541
.xml
dumps/iostats/Nn_stats_78N1BA9-2_200421_143041
.xml
dumps/iostats/Nv_stats_78N1BA9-1_200421_104541
.xml
dumps/iostats/Nv_stats_78N1BA9-1_200421_110041
.xml
dumps/iostats/Nv_stats_78N1BA9-1_200421_111541
.xml
dumps/iostats/Nv_stats_78N1BA9-1_200421_113041
.xml
dumps/iostats/Nv_stats_78N1BA9-1_200421_114541
.xml
dumps/iostats/Nv_stats_78N1BA9-1_200421_120041
.xml
dumps/iostats/Nv_stats_78N1BA9-1_200421_121541
.xml
dumps/iostats/Nv_stats_78N1BA9-1_200421_123041
.xml
dumps/iostats/Nv_stats_78N1BA9-1_200421_124541
.xml
dumps/iostats/Nv_stats_78N1BA9-1_200421_130041
.xml
dumps/iostats/Nv_stats_78N1BA9-1_200421_131541
.xml
dumps/iostats/Nv_stats_78N1BA9-1_200421_133041
.xml
dumps/iostats/Nv_stats_78N1BA9-1_200421_134541
.xml
dumps/iostats/Nv_stats_78N1BA9-1_200421_140041
.xml
dumps/iostats/Nv_stats_78N1BA9-1_200421_141541
.xml
dumps/iostats/Nv_stats_78N1BA9-1_200421_143041
.xml
dumps/iostats/Nv_stats_78N1BA9-2_200421_104541
.xml
dumps/iostats/Nv_stats_78N1BA9-2_200421_110041
.xml
dumps/iostats/Nv_stats_78N1BA9-2_200421_111541
.xml
dumps/iostats/Nv_stats_78N1BA9-2_200421_113041
.xml
dumps/iostats/Nv_stats_78N1BA9-2_200421_114541
.xml
dumps/iostats/Nv_stats_78N1BA9-2_200421_120041
.xml
dumps/iostats/Nv_stats_78N1BA9-2_200421_121541
.xml
dumps/iostats/Nv_stats_78N1BA9-2_200421_123041
.xml
dumps/iostats/Nv_stats_78N1BA9-2_200421_124541
.xml
dumps/iostats/Nv_stats_78N1BA9-2_200421_130041
.xml
dumps/iostats/Nv_stats_78N1BA9-2_200421_131541
.xml
dumps/iostats/Nv_stats_78N1BA9-2_200421_133041
.xml
dumps/iostats/Nv_stats_78N1BA9-2_200421_134541
.xml
dumps/iostats/Nv_stats_78N1BA9-2_200421_140041
.xml
dumps/iostats/Nv_stats_78N1BA9-2_200421_141541
.xml
dumps/iostats/Nv_stats_78N1BA9-2_200421_143041
.xml
dumps/lsfabric.78N1BA9-1.200421.144153
dumps/lsfile.78N1BA9-1.200421.144153
dumps/machinenodeinfo.78N1BA9-1.200421.144153
dumps/nodeinfo.78N1BA9-1.200421.144153
dumps/rtc.race_mq_log.txt.78N1BA9-1.trc
dumps/rtc.race_mq_log.txt.78N1BA9-2.trc
dumps/saout.78N1BA9-1.200421.144153
dumps/saout.78N1BA9-2.200421.144153
dumps/sel.78N1BA9-1.trc
dumps/sel.78N1BA9-2.trc
dumps/selelist.78N1BA9-1.200421.144153
dumps/snap.ietd.200421.144153.tgz
.gz
dumps/svc.config.cron.xml_78N1BA9-1
.xml
dumps/svcout.78N1BA9-1.200421.144153
dumps/svcout.internalstorage.78N1BA9-1.200421.144153
dumps/syslogs/dmesg.78N1BA9-1
dumps/syslogs/dmesg.78N1BA9-2
dumps/syslogs/ec_ntp.trc.78N1BA9-1
dumps/syslogs/ec_ntp.trc.78N1BA9-2
dumps/syslogs/mcelog.78N1BA9-1
dumps/syslogs/mcelog.78N1BA9-2
dumps/syslogs/messages.1.78N1BA9-1
.bz2
dumps/syslogs/messages.1.78N1BA9-2
.bz2
dumps/syslogs/messages.78N1BA9-1
dumps/syslogs/messages.78N1BA9-2
dumps/syslogs/proc_interrupts.78N1BA9-2
dumps/syslogs/proc_interrupts.config_node.78N1BA9-1
dumps/syslogs/sendmail.cf.78N1BA9-1
dumps/syslogs/sendmail.cf.78N1BA9-2
dumps/syslogs/slpd_log.78N1BA9-1
dumps/syslogs/slpd_log.78N1BA9-2
dumps/syslogs/syslog.conf.78N1BA9-1
dumps/syslogs/syslog.conf.78N1BA9-2

Sharing

General

Malware Config

Signatures

Files

Password: infected

Password: infected

168ea5b327edf5713a2bb8e19a928d13

Headers

DLL Characteristics

File Characteristics

Imports

netapi32

iphlpapi

ws2_32

crypt32

gdiplus

shlwapi

mpr

ntdll

msvcrt

kernel32

user32

advapi32

shell32

ole32

Sections

.text Size: 121KB - Virtual size: 121KB

.rdata Size: 25KB - Virtual size: 24KB

.data Size: 512B - Virtual size: 8KB

Password: infected

Password: infected

Password: infected

Password: infected

Password: infected

Password: infected

Password: infected

.text
Size: 121KB - Virtual size: 121KB

.rdata
Size: 25KB - Virtual size: 24KB

.data
Size: 512B - Virtual size: 8KB