Behavioral task
behavioral1
Sample
Hunter.exe
Resource
win10v2004-20241007-en
General
-
Target
BitcoinHunter (infected).zip
-
Size
147KB
-
MD5
cc99c5b1f96fe09ab425a914020006fe
-
SHA1
2153e5bcb933c2cdd34f8213fd9b2e08a9320990
-
SHA256
b9e724730282edffa71360eba20d3d461bdda32ec3445571a27a57ea75ef6c81
-
SHA512
4b2b24396f8a6d48ae1801cf8329db75af05f9deb56a00767e552dcdd5d9efdefa12eadc1c769ab2c45a11fbbe544b65a67515fffcf3617659fe69d82881d9ee
-
SSDEEP
3072:gCRqpLqES0GqZps40RyNLNvT8Lie4exFVl+TeTQOvPD6JebfJun:gjjS0RZaRyNLlT8L4K8+D68bfJun
Malware Config
Extracted
darkvision
45.200.148.238
Signatures
-
Darkvision family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Hunter.EXE
Files
-
BitcoinHunter (infected).zip.zip
Password: infected
-
Hunter.EXE.exe windows:5 windows x64 arch:x64
Password: infected
6ec52816fe4a1f404eaae46e8a806d5f
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
WaitForSingleObject
GetWindowsDirectoryW
GetTempPathW
OpenEventW
ExitProcess
lstrcpyA
lstrcpyW
GetModuleHandleW
LocalFree
lstrcmpiW
CreateThread
GetProcAddress
LocalAlloc
FreeLibrary
LoadLibraryW
lstrlenW
GetCurrentProcess
GetSystemDirectoryW
GetModuleFileNameW
CreateProcessW
CloseHandle
GetLastError
Sleep
lstrlenA
WaitForMultipleObjects
CreateEventW
FileTimeToSystemTime
SetEvent
CreateMutexW
OpenMutexW
GetModuleHandleA
VirtualProtect
VirtualAlloc
VirtualFree
LoadLibraryA
lstrcmpA
ReadFile
GetFileSize
CreateFileW
GetTickCount64
GetCurrentProcessId
ReleaseMutex
HeapReAlloc
WriteConsoleW
SetStdHandle
LCMapStringW
GetStringTypeW
HeapSize
MultiByteToWideChar
LeaveCriticalSection
EnterCriticalSection
GetConsoleMode
GetConsoleCP
SetFilePointer
GetSystemTimeAsFileTime
GetTickCount
QueryPerformanceCounter
FlushFileBuffers
RtlLookupFunctionEntry
RtlUnwindEx
RaiseException
RtlPcToFileHeader
GetCommandLineA
GetStartupInfoW
DecodePointer
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlCaptureContext
EncodePointer
TerminateProcess
FlsGetValue
FlsSetValue
FlsFree
SetLastError
GetCurrentThreadId
FlsAlloc
HeapFree
HeapAlloc
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
WriteFile
GetStdHandle
GetModuleFileNameA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
DeleteCriticalSection
HeapSetInformation
GetVersion
HeapCreate
user32
DispatchMessageW
wsprintfW
DefWindowProcW
RegisterClassW
GetMessageW
TranslateMessage
wsprintfA
DestroyWindow
UnregisterClassW
PostMessageW
CreateWindowExW
ole32
CoCreateInstance
oleaut32
VariantClear
VariantInit
SysFreeString
SysAllocString
Sections
.text Size: 223KB - Virtual size: 222KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 45KB - Virtual size: 45KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 172KB - Virtual size: 192KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 752B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ