Behavioral task
behavioral1
Sample
1ffd6559d21470c40dcf9236da51e5823d7ad58c93502279871c3fe7718c901c.exe
Resource
win7-20240903-en
General
-
Target
76d55d16db3037d60655b8f6a4751661c2a0c94b997a28e8497db78a354e7da1.zip
-
Size
198KB
-
MD5
c3b7b243641124ba74c1e96e846b732b
-
SHA1
f4da6268f88db36e459ffebf369ad830c9ccb128
-
SHA256
76d55d16db3037d60655b8f6a4751661c2a0c94b997a28e8497db78a354e7da1
-
SHA512
4bc802199e1ad3967f8aea2582640c2fe6e132e6e42664d8551366ec771fa3ee936ef1f8771d81aae7da51cb0dfa4b9e4d99ea5f5760de703a1369544deca790
-
SSDEEP
6144:i8OeNEGOVrb5JWndlGoxEYwyuTh23vUBTSshUA:i/GARilbuT4KTZ+A
Malware Config
Signatures
-
Detection for the Linux version of Sysjoker cross-platform backdoor 1 IoCs
resource yara_rule static1/unpack001/1ffd6559d21470c40dcf9236da51e5823d7ad58c93502279871c3fe7718c901c.exe family_linux_sysjoker -
Detection for the macOS version of Sysjoker cross-platform backdoor 1 IoCs
resource yara_rule static1/unpack001/1ffd6559d21470c40dcf9236da51e5823d7ad58c93502279871c3fe7718c901c.exe family_macos_sysjoker -
Detection for the windows version of Sysjoker cross-platform backdoor 1 IoCs
resource yara_rule static1/unpack001/1ffd6559d21470c40dcf9236da51e5823d7ad58c93502279871c3fe7718c901c.exe family_sysjoker -
Sysjoker family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/1ffd6559d21470c40dcf9236da51e5823d7ad58c93502279871c3fe7718c901c.exe
Files
-
76d55d16db3037d60655b8f6a4751661c2a0c94b997a28e8497db78a354e7da1.zip.zip
Password: infected
-
1ffd6559d21470c40dcf9236da51e5823d7ad58c93502279871c3fe7718c901c.exe.exe windows:6 windows x86 arch:x86
86f89939b4b0c19157649ce986ae170e
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CreateDirectoryW
SizeofResource
HeapFree
GetModuleFileNameW
InitializeCriticalSectionEx
WaitForSingleObject
HeapSize
MultiByteToWideChar
Sleep
GetLastError
LockResource
DeleteFileW
GlobalFree
HeapReAlloc
RaiseException
FindResourceExW
LoadResource
FindResourceW
HeapAlloc
DecodePointer
HeapDestroy
DeleteCriticalSection
GetProcessHeap
WideCharToMultiByte
SleepEx
WriteConsoleW
CreateFileW
SetStdHandle
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
ReadConsoleW
ReadFile
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetConsoleMode
GetConsoleCP
FlushFileBuffers
GetFileType
SetFilePointerEx
CloseHandle
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
GetModuleHandleW
GetProcAddress
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
EncodePointer
SetLastError
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
CompareStringW
LCMapStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
OutputDebugStringW
RtlUnwind
FreeLibrary
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetStdHandle
WriteFile
GetFileSizeEx
SetEndOfFile
shell32
ShellExecuteW
ShellExecuteExW
ole32
CoCreateInstance
CoUninitialize
CoInitialize
oleaut32
SysAllocStringLen
winhttp
WinHttpGetIEProxyConfigForCurrentUser
WinHttpGetProxyForUrl
WinHttpWriteData
WinHttpReadData
WinHttpSetTimeouts
WinHttpCloseHandle
WinHttpCrackUrl
WinHttpQueryDataAvailable
WinHttpQueryHeaders
WinHttpAddRequestHeaders
WinHttpOpen
WinHttpSetOption
WinHttpConnect
WinHttpReceiveResponse
WinHttpOpenRequest
WinHttpSendRequest
Sections
.text Size: 291KB - Virtual size: 291KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 80KB - Virtual size: 79KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 952B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 14KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ