Static task
static1
Behavioral task
behavioral1
Sample
ReleseX64.zip
Resource
win11-20241007-en
Behavioral task
behavioral2
Sample
ReadME.txt
Resource
win11-20241007-en
Behavioral task
behavioral3
Sample
ReleseeBoostrapper.zip
Resource
win11-20241007-en
Behavioral task
behavioral4
Sample
ReleseeBoostrapper/BoostrappersN.exe
Resource
win11-20241007-en
General
-
Target
ReleseX64.zip
-
Size
1.6MB
-
MD5
5d6337940718b7e78ad131e4ddd6455d
-
SHA1
4249e0bb7a0ba0836183a5f4651d46bd37343abc
-
SHA256
5ce41c02b91fd082db2e4142305e6e31f435631a8571e16ba82b802b2a7a5209
-
SHA512
6a24336e390d723d51aeac6c4477f766ccb10b3b3b017e0f20bd704d3ea6a28376a380ebff32f6697e2a20545b25231be160112be124ecb3f521f9c5e70f9bb6
-
SSDEEP
49152:EjUL7HufYGaJYv/y7RLrnRxFVY7Tk3iMuYg3jfF:gUHBGaJYnaNnR3Vmk3iyg3Z
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack002/ReleseeBoostrapper/BoostrappersN.exe
Files
-
ReleseX64.zip.zip
Password: 1414
-
ReadME.txt
-
ReleseeBoostrapper.zip.zip
Password: 1414
-
ReleseeBoostrapper/BoostrappersN.exe.exe windows:4 windows x86 arch:x86
Password: 1414
ba5e829ee8d48b69cd4808369db6927d
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Imports
advapi32
EqualSid
OpenProcessToken
OpenThreadToken
RegDeleteKeyW
RegDeleteValueW
RegOpenKeyExW
RegQueryValueExW
RegQueryValueW
RegSetValueExW
SetKernelObjectSecurity
gdi32
BitBlt
CreateDIBSection
CreateEllipticRgn
CreateRectRgnIndirect
DeleteObject
ExtSelectClipRgn
FillRgn
GetBkColor
GetStockObject
GetWindowExtEx
LPtoDP
RectVisible
SelectObject
SetROP2
kernel32
CloseHandle
ConvertDefaultLocale
CreateEventW
CreateFileW
CreateMutexW
CreateProcessW
DeleteCriticalSection
EnterCriticalSection
ExitProcess
FileTimeToSystemTime
FreeEnvironmentStringsW
FreeLibrary
GetConsoleMode
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetDateFormatA
GetFileType
GetFullPathNameW
GetLastError
GetLocalTime
GetLocaleInfoA
GetLocaleInfoW
GetModuleHandleA
GetModuleHandleW
GetOEMCP
GetProcAddress
GetStartupInfoA
GetStartupInfoW
GetStringTypeW
GetSystemInfo
GetSystemTimeAsFileTime
GetThreadLocale
GetTickCount
GetVersionExA
GetVolumeInformationW
GlobalAlloc
GlobalFree
GlobalLock
HeapAlloc
HeapFree
HeapReAlloc
HeapSetInformation
InitializeCriticalSection
IsDBCSLeadByteEx
LeaveCriticalSection
LoadLibraryA
LoadLibraryW
LoadResource
LocalAlloc
LocalFree
LocalReAlloc
LockFile
MultiByteToWideChar
RaiseException
ResetEvent
SetHandleCount
SetStdHandle
SetUnhandledExceptionFilter
Sleep
TlsAlloc
TlsFree
TlsGetValue
UnhandledExceptionFilter
VirtualAlloc
VirtualProtect
VirtualQuery
WaitForSingleObject
WideCharToMultiByte
WriteConsoleW
WriteFile
lstrcmpA
lstrlenW
msimg32
TransparentBlt
msvcrt
__getmainargs
__p___initenv
__p___mb_cur_max
__p__commode
__p__fmode
__p__iob
__set_app_type
__setusermatherr
_amsg_exit
_cexit
_errno
_initterm
_lock
_unlock
abort
atexit
atoi
calloc
exit
fprintf
fputc
free
fwrite
localeconv
malloc
memcpy
memset
setlocale
signal
strchr
strerror
strlen
strncmp
vfprintf
wcslen
ole32
CoGetClassObject
CoInitialize
CoRegisterClassObject
CoRegisterMessageFilter
CoTaskMemAlloc
CoUninitialize
OleUninitialize
StgOpenStorageOnILockBytes
shell32
DragQueryFileW
SHFileOperationW
SHGetSpecialFolderPathW
ShellExecuteW
shlwapi
PathFindFileNameW
PathIsDirectoryEmptyW
user32
CallNextHookEx
CreatePopupMenu
DeferWindowPos
DestroyWindow
DrawFocusRect
DrawIcon
EndDeferWindowPos
EndPaint
ExitWindowsEx
GetCursorPos
GetDesktopWindow
GetFocus
GetKeyState
GetMenuCheckMarkDimensions
GetMenuItemID
GetMenuState
GetMessageTime
GetNextDlgGroupItem
GetScrollInfo
GetSysColor
GetSysColorBrush
GetSystemMetrics
GetWindowDC
GetWindowLongW
GetWindowPlacement
GetWindowTextLengthW
InvalidateRect
InvalidateRgn
IsRectEmpty
LoadAcceleratorsW
LoadBitmapW
LoadMenuW
LockWindowUpdate
MapDialogRect
OffsetRect
PostThreadMessageW
PtInRect
ReleaseDC
ReuseDDElParam
ScreenToClient
SendDlgItemMessageA
SendDlgItemMessageW
SetForegroundWindow
SetMenu
SetPropW
SetScrollInfo
SetWindowPos
SetWindowTextW
SetWindowsHookExW
ShowWindow
SystemParametersInfoA
UnpackDDElParam
wininet
InternetAttemptConnect
Sections
.text Size: 2.6MB - Virtual size: 2.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 863KB - Virtual size: 863KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 282KB - Virtual size: 282KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.eh_fram Size: 148KB - Virtual size: 147KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.bss Size: - Virtual size: 2KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.CRT Size: 512B - Virtual size: 48B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 8B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 310KB - Virtual size: 310KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ