MRON AIO 5.1.zip
- SHA256 75697be3bbb65ed5c37be91b0508ab7783f633a33f894622087b73a283d6eb78
Password
mron
Static task
static1
1 signatures
General
- Target MRON AIO 5.1.zip
- Size 2.2MB
- Sample250211-z7tgvs1raw
- SHA256 75697be3bbb65ed5c37be91b0508ab7783f633a33f894622087b73a283d6eb78
- MD5 9aadb74e549dc6ae73e7e44d10f37fac
- SHA1 c98798b4631a4b1dfdb89b6dc095272ec5e35db7
- SHA512 797c0f988f7e04eaa79ddd8cfbc00c30fc534789b2c23727da2e3450c08395151239ff0b7fa625ab8e6d3bbb70bf7edcf5ee78607d2428db74feab9134927aad
- SSDEEP 49152:4UWaPJkD89DghazxUsycEg3PlsEyDYdwiJuycAwX:4nYkDcDJYvg3POEyDYdwWuycz
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/Sewi.exe unpack001/cheat.dll
File Explorer
-
MRON AIO 5.1.zip.zip 2.2MB
-
How To Use.txt1KB
-
Script/commandslist.txt1KB
-
Script/script.gscbin5KB
-
Sewi.exe.exe 2.1MB
-
cheat.dll.dll 3.1MB
-
pak_magma1.xpaklist266B
How To Use.txt
- SHA256 e9765ebd0d665c363738c76b1c7f74fc71f285e5750a45fb1be8b40b7f831287
- MD5 bfacd355c11fff5125ceee5762e86ce5
- SHA1 77a089d977472b0e72ccbb7dd1f2eab4fe7babd9
- SHA512 a609e9257c6463a05e75264a7aa4c20321fcea6cc07d6d25f4f779bd0453cb4854871f5c6cf405d1b3cf133f17375ddc4f6bc94d73121b5bde3acbe76509e68f
- MD5 SHA1 SHA512
Script/commandslist.txt
- SHA256 6dc1f5655e42230294cfc02f57dffc6a3e1fa87dc3fdf7af78303edf0faa5fa6
- MD5 f840c68466828cae33f35f409169c77a
- SHA1 d2336a81c69ba47e2a25e7bcb3a4b12b4a51cca7
- SHA512 656ab05ef9c719693558d79dc57a519f5e9ebd62e36bc4dfa55c7f8a9affb8efb18f60b2f4225c8e6a78c0a7716ad143319938be4eb0d23a22021e7121e71db3
- MD5 SHA1 SHA512
Script/script.gscbin
- SHA256 71fcad086e9782aa502577cab6e97e990e89a21d726ba80b61a0e5760c7048d9
- MD5 29460aa6d21735019f473523e02095d9
- SHA1 72419290e8f91fc3a9d6a918dddd3d7deab63f4f
- SHA512 8a768d854849d0c827e3da2ccf6a7031bf5b904d7caa07923c186f3a62063d36851502a280a44443d693960442379c26744e00223f86d339347d9356b2d4a69f
- SSDEEP 48:dR9pDhQJUa9PHi+0Gb4DvquQ7LBKRNQ9egzhKA1ZwnKR/CWRhd8TQSEe4UFXVYeL:iu0X07rquytKRSrh12nEjf6QeL/zrKyD
- MD5 SHA1 SHA512 SSDEEP
Sewi.exe
- IMPHASH d34eed44db328d2e496951f9c30d2670
- SHA256 29bdf43af7fce4a48a4699f01ba35a9d23ec72109f9a8d59b84788610066b715
- MD5 2ca19d0f12d1f16f6d08b34c48593826
- SHA1 eb8a5beea1177a71a2123d666638233da57146ad
- SHA512 d9217fd4f397f1a0a81447332f563ece283db881e693034135524937775b7fbb75f97bde586d12f29b3841c4d9811d1b36d64c266fcf08983e2ea83c63d5adbd
- SSDEEP 49152:MKJhzckSniODlvlLyE/r9NCbm1M7nvUoJC+O93+x:M2zckSniCRCbm1MVCru
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Password
mron
Minor OS version
0
Major OS version
6
Entry point
39568
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\tha8b\OneDrive\Desktop\new injectors\MW2019 AIO DEV LOADER - Copy\x64\Release\zim.pdb
kernel32
ReadFile
WriteFile
Beep
GetLastError
Sleep
GetCurrentProcess
GetWindowsDirectoryW
VirtualAlloc
VirtualFree
FreeLibrary
GetProcAddress
LoadLibraryExA
GetFileSize
LoadLibraryW
CreateToolhelp32Snapshot
Process32First
Process32Next
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
DeleteFileW
DeviceIoControl
CloseHandle
LoadLibraryA
CreateFileW
GetModuleHandleW
CreateEventW
WaitForSingleObjectEx
ResetEvent
SetEvent
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
InitializeSListHead
user32
IsWindowVisible
PostThreadMessageA
GetWindowThreadProcessId
GetWindow
EnumWindows
UnhookWindowsHookEx
SetWindowsHookExA
shell32
ShellExecuteW
msvcp140
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?uncaught_exception@std@@YA_NXZ
?_Xout_of_range@std@@YAXPEBD@Z
?_Xlength_error@std@@YAXPEBD@Z
ntdll
RtlLookupFunctionEntry
RtlCaptureContext
RtlImageNtHeader
RtlVirtualUnwind
vcruntime140
__current_exception
__C_specific_handler
__std_exception_copy
memcmp
__std_terminate
memset
memmove
memcpy
_CxxThrowException
__std_exception_destroy
__current_exception_context
vcruntime140_1
__CxxFrameHandler4
api-ms-win-crt-runtime-l1-1-0
_initialize_onexit_table
_register_onexit_function
_crt_atexit
_cexit
_invalid_parameter_noinfo_noreturn
_initialize_narrow_environment
_set_app_type
_configure_narrow_argv
_get_initial_narrow_environment
_initterm
_initterm_e
_exit
__p___argc
__p___argv
_c_exit
_register_thread_local_exe_atexit_callback
_seh_filter_exe
exit
terminate
api-ms-win-crt-string-l1-1-0
_stricmp
strcpy_s
api-ms-win-crt-heap-l1-1-0
_set_new_mode
free
malloc
_callnewh
api-ms-win-crt-stdio-l1-1-0
__p__commode
_set_fmode
api-ms-win-crt-utility-l1-1-0
rand
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
Name
.text
Size
39KB
Virtual Size
38KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1.8MB
Virtual Size
1.8MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
275KB
Virtual Size
277KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
15KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
140B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=18, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=123, version=2207,
count=1, id=253, version=31935,
count=10, id=260, version=31935,
count=3, id=259, version=31935,
count=31, id=261, version=31935,
count=6, id=257, version=31935,
count=13, id=257, version=29395,
count=194, id=1, productName=Unmarked objects,
count=5, id=261, version=32216,
count=1, id=255, version=32216,
count=1, id=151,
count=1, id=258, version=32216,
cheat.dll
- IMPHASH 45662861f01c9e08a1efeafde067cdc0
- SHA256 9e6baa5077bb2fa51bcce401b393d94b7bf72fdb62c80140e3537d94d5dce503
- MD5 9b2bdfc733da54f795f6c4c3a1df99d0
- SHA1 62fa610664a1c2b189878dcc2613bfc8162321b3
- SHA512 7f7b73ce608989b9a2e227e1f96ef16cf25d6f85f3868b56e5cb0f45973f513493146e90d44d480e817f4db4a25cfc8369821a8e440a85451939a41b9106027e
- SSDEEP 49152:IiJHIyRHRElb6LDa4Krk2l5fCxlyAsPUwFB0P:IHlb6n12lUwFB
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Password
mron
Minor OS version
0
Major OS version
6
Entry point
1592360
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
kernel32
HeapFree
HeapSize
GetProcessHeap
InitializeCriticalSectionEx
DeleteCriticalSection
WaitForSingleObject
CreateEventA
Sleep
WaitForMultipleObjects
OpenProcess
GetModuleHandleA
K32GetModuleFileNameExA
GetCurrentProcess
FlushInstructionCache
VirtualAlloc
VirtualProtect
VirtualFree
GlobalAlloc
GlobalUnlock
GlobalLock
GlobalFree
MultiByteToWideChar
WideCharToMultiByte
QueryPerformanceCounter
QueryPerformanceFrequency
GetProcAddress
VirtualQuery
GetCommandLineA
TerminateProcess
FreeLibrary
GetModuleFileNameW
HeapReAlloc
VirtualProtectEx
ReadProcessMemory
WriteProcessMemory
CreateToolhelp32Snapshot
Process32First
Process32Next
WriteConsoleW
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetOEMCP
GetACP
IsValidCodePage
GetTimeZoneInformation
DeleteFileW
SetStdHandle
ReadConsoleW
GetFileSizeEx
GetConsoleMode
GetConsoleOutputCP
WriteFile
FlushFileBuffers
GetStdHandle
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
ExitProcess
ReadFile
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
PeekNamedPipe
HeapAlloc
GetLastError
CloseHandle
RaiseException
GetCurrentProcessId
DecodePointer
RtlPcToFileHeader
InitializeSRWLock
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
EnterCriticalSection
LeaveCriticalSection
TryEnterCriticalSection
GetCurrentThreadId
InitializeConditionVariable
WakeConditionVariable
WakeAllConditionVariable
SleepConditionVariableCS
SleepConditionVariableSRW
LocalFree
FormatMessageA
GetCurrentDirectoryW
CreateDirectoryW
CreateFileW
FindClose
FindFirstFileExW
FindNextFileW
GetFileAttributesExW
GetFileInformationByHandle
GetFullPathNameW
SetEndOfFile
SetFilePointerEx
AreFileApisANSI
GetFileInformationByHandleEx
InitOnceBeginInitialize
InitOnceComplete
FreeLibraryWhenCallbackReturns
CreateThreadpoolWork
SubmitThreadpoolWork
CloseThreadpoolWork
GetModuleHandleExW
IsProcessorFeaturePresent
WaitForSingleObjectEx
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
GetSystemTimeAsFileTime
GetModuleHandleW
EncodePointer
LCMapStringEx
GetStringTypeW
GetCPInfo
InitializeCriticalSectionAndSpinCount
SetEvent
ResetEvent
CreateEventW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetStartupInfoW
InitializeSListHead
HeapCreate
Thread32Next
Thread32First
SuspendThread
ResumeThread
GetThreadContext
SetThreadContext
OpenThread
GetSystemInfo
OutputDebugStringW
RtlUnwindEx
InterlockedFlushSList
LoadLibraryExW
SetLastError
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetDriveTypeW
GetFileType
RtlUnwind
user32
UnregisterClassA
GetWindowThreadProcessId
EnumWindows
MessageBoxA
DestroyWindow
CreateWindowExA
RegisterClassExA
DefWindowProcA
LoadCursorA
ScreenToClient
ClientToScreen
GetCursorPos
SetCursor
SetCursorPos
GetClientRect
ReleaseCapture
SetCapture
GetCapture
GetKeyState
IsChild
EmptyClipboard
GetClipboardData
SetClipboardData
CloseClipboard
OpenClipboard
SetWindowLongPtrW
MessageBoxW
GetForegroundWindow
GetSystemMetrics
GetAsyncKeyState
shell32
SHGetFolderPathA
d3d12
D3D12SerializeRootSignature
imm32
ImmSetCompositionWindow
ImmReleaseContext
ImmGetContext
ImmSetCandidateWindow
?present_hk@@YAJPEAUIDXGISwapChain3@@II@Z
Name
.text
Size
1.9MB
Virtual Size
1.9MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
785KB
Virtual Size
784KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
337KB
Virtual Size
666KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
112KB
Virtual Size
112KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.msvcjmc
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
_RDATA
Size
512B
Virtual Size
348B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
248B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=22, id=259, version=30795,
count=189, id=261, version=30795,
count=25, id=260, version=30795,
count=2, id=261, productName=VS2022 v17.1.0 pre 1.0 build 30818, version=30818,
count=4, id=264, version=31332,
count=17, id=260, version=31328,
count=97, id=261, version=31328,
count=12, id=259, version=31328,
count=13, id=257, version=30795,
count=242, id=1, productName=Unmarked objects,
count=24, id=261, version=31332,
count=1, id=259, version=33523,
count=1, id=256, version=31332,
count=1, id=255, version=31332,
count=1, id=258, version=31332,
pak_magma1.xpaklist
- SHA256 d7ee2310c360d2c6f11b9e7b12a63c3181d26da314332fb05a4790cf51f795fb
- MD5 6ca388225b956b976aa455cc4d9e0c1a
- SHA1 6930597601d80580028baa4de368e8110876b892
- SHA512 c953a6d18c9c0ddd6ee68cd06d64e0433e9b1cabb86db1c9b331580b45d89ee778ecac4b49f96dda4fbe719f285ad35eedf5c2de0da1a463ffba95c51933e018
- MD5 SHA1 SHA512