GmRemote[.]7z | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

GmRemote.7z
Size

3.2MB
MD5

9c77429adda346dfedc408f35c1a65e6
SHA1

6039969eb0b07cbe9e50ff105bf803a9b59c79b0
SHA256

0c5359f0bf2662aec517a172d5aea118face4ea4313d23a91c9e8d4a0855f3ea
SHA512

4f86b89b294c823650cc3677a92f00ff4dfaff9f8f51a2445741e05a35e119b41bd20f2c6cc9292469de2594b6869c9682400a429e8af6524cfaec9fc6bc78ab
SSDEEP

98304:Ape2nYijFtmyleLCbmkM1v3Xk1FvxGYkOJTR6:cpnYijeyeuKkMlHk1FM46

Score

1^/10

Malware Config

Signatures

Files

GmRemote.7z
.7z
GmRemote.exe
.exe windows:6 windows x86 arch:x86

15ad7db86b6051e69aa3c16e5539c4a5

Code Sign

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

25/05/2021, 00:00

Not After

31/12/2028, 23:59

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:d7:08:a8:91:40:53:19:e2:a5:bb:d3:39:b9:ad:6e
Certificate

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Not Before

22/03/2021, 00:00

Not After

21/03/2036, 23:59

Subject

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

29:a3:db:93:49:54:8f:02:1c:3f:e0:bd:24:96:83:bf
Certificate

Issuer

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

Not Before

15/01/2025, 00:00

Not After

15/01/2028, 23:59

Subject

SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024445

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3a:52:6a:2c:84:ce:55:e6:1d:65:fc:cc:12:d8:e9:89
Certificate

Issuer

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Not Before

15/01/2024, 00:00

Not After

14/04/2035, 23:59

Subject

CN=Sectigo Public Time Stamping Signer R35,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

7a:23:ae:da:53:69:96:0f:91:c8:3e:5c:f4:c7:e3:3f
Certificate

Issuer

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Not Before

22/03/2021, 00:00

Not After

21/03/2036, 23:59

Subject

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

22/03/2021, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

ce:94:cf:9a:6a:2e:de:db:d1:9d:a2:27:e2:e7:09:a9:f9:90:f0:ba:da:b3:0a:12:35:4e:74:e1:74:12:99:ca
Signer

Actual PE Digest

ce:94:cf:9a:6a:2e:de:db:d1:9d:a2:27:e2:e7:09:a9:f9:90:f0:ba:da:b3:0a:12:35:4e:74:e1:74:12:99:ca

Digest Algorithm

sha256

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

barbqqikrymslznvzum.pdb

Imports

crypt32

CertGetNameStringW
CertCloseStore
CryptQueryObject
CertFreeCertificateContext
CertFindCertificateInStore
CryptMsgGetParam
CryptMsgClose

kernel32

K32GetModuleFileNameExW
WaitForSingleObject
GetCurrentThreadId
ReleaseMutex
FormatMessageW
GetLastError
OutputDebugStringW
WaitForSingleObjectEx
OpenSemaphoreW
CloseHandle
HeapAlloc
GetProcAddress
CreateMutexExW
GetCurrentProcessId
GetProcessHeap
GetModuleHandleW
WideCharToMultiByte
DebugBreak
IsDebuggerPresent
CreateFileW
GetCurrentProcess
DuplicateHandle
Sleep
SetEvent
LocalFree
FormatMessageA
CreateSemaphoreA
CreateEventA
WaitForMultipleObjects
GetUserDefaultLocaleName
CreateEventW
OpenProcess
LoadLibraryA
FreeLibrary
GetConsoleScreenBufferInfo
SetConsoleTextAttribute
SetLastError
WriteConsoleA
WriteFile
GetDynamicTimeZoneInformation
GetModuleFileNameW
GetFileAttributesA
ReadFile
WaitNamedPipeA
PeekNamedPipe
CreateFileA
CreateMutexW
GetTickCount64
LoadLibraryW
HeapSize
ReadConsoleW
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
GetFileSizeEx
DeleteFileW
GetConsoleOutputCP
FlushFileBuffers
GetTimeZoneInformation
SetFilePointerEx
HeapReAlloc
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
GetFileType
SetStdHandle
FreeLibraryAndExitThread
ExitThread
CreateThread
GetModuleHandleExW
GetConsoleMode
HeapFree
CreateSemaphoreExW
GetModuleFileNameA
ReleaseSemaphore
GetStdHandle
ExitProcess
VirtualQuery
VirtualProtect
VirtualAlloc
LoadLibraryExW
RtlUnwind
QueryPerformanceCounter
QueryPerformanceFrequency
ResetEvent
WaitForMultipleObjectsEx
OpenEventA
SetWaitableTimer
ResumeThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemInfo
GetModuleHandleA
CreateWaitableTimerA
WriteConsoleW
GetLocaleInfoEx
CreateDirectoryW
FindClose
FindFirstFileExW
FindNextFileW
GetFullPathNameW
AreFileApisANSI
MoveFileExW
MultiByteToWideChar
RaiseException
InitializeSRWLock
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
TryAcquireSRWLockExclusive
GetExitCodeThread
GetNativeSystemInfo
InitializeConditionVariable
WakeConditionVariable
WakeAllConditionVariable
SleepConditionVariableSRW
GetStringTypeW
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
EncodePointer
DecodePointer
LCMapStringEx
GetSystemTimeAsFileTime
CompareStringEx
GetCPInfo
InitializeCriticalSectionAndSpinCount
IsProcessorFeaturePresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
GetStartupInfoW
InitializeSListHead
SetEndOfFile

user32

GetForegroundWindow
GetSystemMetrics
LoadImageW
GetWindow
GetMessageW
GetLastInputInfo
SendMessageW
DispatchMessageW
TranslateMessage
PostQuitMessage
RegisterWindowMessageW
GetCursorPos
GetWindowLongW
DefWindowProcW
DestroyWindow
CreateWindowExW
RegisterClassExW
LoadIconW
LoadCursorW
SetWindowLongW
PostMessageW
CreatePopupMenu
SetMenuItemBitmaps
TrackPopupMenu
SetMenuDefaultItem
DestroyMenu
AppendMenuW
SetForegroundWindow
LoadStringW
GetWindowThreadProcessId

gdi32

DeleteObject

advapi32

RegCreateKeyExW
RegCloseKey
RegNotifyChangeKeyValue
RegGetValueW

shell32

Shell_NotifyIconW
SHGetKnownFolderPath

ole32

CoTaskMemFree
CoInitialize
CoUninitialize
CoTaskMemAlloc

Sections

.text
Size: 891KB - Virtual size: 891KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 200KB - Virtual size: 200KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 115KB - Virtual size: 120KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3.2MB - Virtual size: 3.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 54KB - Virtual size: 53KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

15ad7db86b6051e69aa3c16e5539c4a5

Code Sign

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16Certificate

Extended Key Usages

Key Usages

33:d7:08:a8:91:40:53:19:e2:a5:bb:d3:39:b9:ad:6eCertificate

Extended Key Usages

Key Usages

29:a3:db:93:49:54:8f:02:1c:3f:e0:bd:24:96:83:bfCertificate

Extended Key Usages

Key Usages

3a:52:6a:2c:84:ce:55:e6:1d:65:fc:cc:12:d8:e9:89Certificate

Extended Key Usages

Key Usages

7a:23:ae:da:53:69:96:0f:91:c8:3e:5c:f4:c7:e3:3fCertificate

Extended Key Usages

Key Usages

36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68Certificate

Extended Key Usages

Key Usages

ce:94:cf:9a:6a:2e:de:db:d1:9d:a2:27:e2:e7:09:a9:f9:90:f0:ba:da:b3:0a:12:35:4e:74:e1:74:12:99:caSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

crypt32

kernel32

user32

gdi32

advapi32

shell32

ole32

Sections

.text Size: 891KB - Virtual size: 891KB

.rdata Size: 200KB - Virtual size: 200KB

.data Size: 115KB - Virtual size: 120KB

.rsrc Size: 3.2MB - Virtual size: 3.2MB

.reloc Size: 54KB - Virtual size: 53KB

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

33:d7:08:a8:91:40:53:19:e2:a5:bb:d3:39:b9:ad:6e
Certificate

29:a3:db:93:49:54:8f:02:1c:3f:e0:bd:24:96:83:bf
Certificate

3a:52:6a:2c:84:ce:55:e6:1d:65:fc:cc:12:d8:e9:89
Certificate

7a:23:ae:da:53:69:96:0f:91:c8:3e:5c:f4:c7:e3:3f
Certificate

36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68
Certificate

ce:94:cf:9a:6a:2e:de:db:d1:9d:a2:27:e2:e7:09:a9:f9:90:f0:ba:da:b3:0a:12:35:4e:74:e1:74:12:99:ca
Signer

.text
Size: 891KB - Virtual size: 891KB

.rdata
Size: 200KB - Virtual size: 200KB

.data
Size: 115KB - Virtual size: 120KB

.rsrc
Size: 3.2MB - Virtual size: 3.2MB

.reloc
Size: 54KB - Virtual size: 53KB