loptikmod | 4d036e0a517774ba8bd31df522a8d9e327202548a5753e5de068190582758680

General

Target
4d036e0a517774ba8bd31df522a8d9e327202548a5753e5de068190582758680
Size 1.9MB
Sample250902-nl85mshr2s
SHA256 4d036e0a517774ba8bd31df522a8d9e327202548a5753e5de068190582758680
MD5 893561ff6d17f1e95897b894dde29a2a
SHA1 59269cc2d0c169205ceea420b2b6a1a4dedc1700
SHA512 c854a1fefb5b522ea078ec0ef3c7eaeee0fc89e81e4c455600b583079124960e8ed25899f2c2b948b0102e4b8f142df3f46fa81d60c0a1116d810528b6f0aff5
SSDEEP 49152:mzWZTV9lrBj9du7sIXaYMTxI/QcJlRoqmlX:my9V9lrBjLGfiI/QcjRo/
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

backdoor apt donot loptikmod

Malware Config

Signatures

Detects Loptikmod 1 IoCs

backdoor apt donot

resource	yara_rule
sample	family_loptikmod

Loptikmod family
loptikmod

Untrusted Codesign Signers 1 IoCs

Codesigned binary was signed by an untrusted entity.

resource
4d036e0a517774ba8bd31df522a8d9e327202548a5753e5de068190582758680

File Explorer

4d036e0a517774ba8bd31df522a8d9e327202548a5753e5de068190582758680

.exe 1.9MB

4d036e0a517774ba8bd31df522a8d9e327202548a5753e5de068190582758680

IMPHASH a1062293ea779a62df2064dca1150eb9
SHA256 4d036e0a517774ba8bd31df522a8d9e327202548a5753e5de068190582758680
MD5 893561ff6d17f1e95897b894dde29a2a
SHA1 59269cc2d0c169205ceea420b2b6a1a4dedc1700
SHA512 c854a1fefb5b522ea078ec0ef3c7eaeee0fc89e81e4c455600b583079124960e8ed25899f2c2b948b0102e4b8f142df3f46fa81d60c0a1116d810528b6f0aff5
SSDEEP 49152:mzWZTV9lrBj9du7sIXaYMTxI/QcJlRoqmlX:my9V9lrBjLGfiI/QcjRo/
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Detects Loptikmod

backdoor apt donot
Untrusted Codesign Signers

Codesigned binary was signed by an untrusted entity.

PE Signature issue

Digest

33:d4:3d:e5:b2:fd:f0:03:e5:df:9d:c9:6c:b0:c7:96:db:5e:f6:f1:d2:78:95:60:ee:0b:e1:70:10:a3:41:dd

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

SERIALNUMBER=1136715-3,CN=Ebo Sky Tech Inc,O=Ebo Sky Tech Inc,L=Vancouver,ST=British Columbia,C=CA,1.3.6.1.4.1.311.60.2.1.3=#13024341,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Jan 28, 2025

Subject

CN=SSL.com EV Root Certification Authority RSA R2,O=SSL Corporation,L=Houston,ST=Texas,C=US

Serial Number

56:b6:29:cd:34:bc:78:f6

Issuer

CN=SSL.com EV Root Certification Authority RSA R2,O=SSL Corporation,L=Houston,ST=Texas,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

May 31, 2017 - May 30, 2042

Subject

SERIALNUMBER=1136715-3,CN=Ebo Sky Tech Inc,O=Ebo Sky Tech Inc,L=Vancouver,ST=British Columbia,C=CA,1.3.6.1.4.1.311.60.2.1.3=#13024341,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Serial Number

26:cc:c2:79:db:f5:34:b4:d7:b2:05:b1:a8:49:b8:ec

Issuer

CN=SSL.com EV Code Signing Intermediate CA RSA R3,O=SSL Corp,L=Houston,ST=Texas,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Dec 4, 2024 - Dec 4, 2025

Subject

CN=SSL.com EV Code Signing Intermediate CA RSA R3,O=SSL Corp,L=Houston,ST=Texas,C=US

Serial Number

42:4b:6a:53:ce:c7:66:14:1c:2a:63:b1:a5:1c:41:04

Issuer

CN=SSL.com EV Root Certification Authority RSA R2,O=SSL Corporation,L=Houston,ST=Texas,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Mar 26, 2019 - Mar 22, 2034

Subject

CN=SSL.com Timestamping Unit 2024 E1,O=SSL Corp,L=Houston,ST=Texas,C=US

Serial Number

5a:5a:ac:e8:1a:35:6e:b4:62:86:8d:57:7d:e0:3d:c7

Issuer

CN=SSL.com Timestamping Issuing RSA CA R1,O=SSL Corp,L=Houston,ST=Texas,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Feb 19, 2024 - Feb 16, 2034

Subject

CN=SSL.com Timestamping Issuing RSA CA R1,O=SSL Corp,L=Houston,ST=Texas,C=US

Serial Number

6d:52:18:70:87:e8:23:4d:85:60:00:d0:80:8f:93:56

Issuer

CN=SSL.com Root Certification Authority RSA,O=SSL Corporation,L=Houston,ST=Texas,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Nov 13, 2019 - Nov 12, 2034

Minor OS version

0

Major OS version

6

Entry point

89639

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetModuleHandleExW GetModuleFileNameW CreateMutexW GetCurrentThreadId GetLogicalDriveStringsW MultiByteToWideChar Sleep GetLastError DeleteFileA CloseHandle FreeLibrary WideCharToMultiByte GetConsoleWindow CreateDirectoryA WriteConsoleW HeapSize GetConsoleOutputCP GetModuleHandleW GetProcAddress FlushFileBuffers CreateFileW SetStdHandle GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP WinExec LoadLibraryA ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive QueryPerformanceCounter EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LocalFree GetSystemTimeAsFileTime GetStringTypeW GetCPInfo UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW GetCurrentProcessId InitializeSListHead RtlUnwind RaiseException SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW ExitProcess GetStdHandle WriteFile GetCommandLineA GetCommandLineW HeapFree HeapAlloc GetFileType FlsAlloc FlsGetValue FlsSetValue FlsFree VirtualProtect CompareStringW LCMapStringW CreateDirectoryW SetFilePointerEx GetConsoleMode HeapReAlloc FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP

user32

wsprintfW ShowWindow

ole32

CoCreateInstance CoInitialize CoUninitialize

oleaut32

VariantInit SysFreeString SysAllocString VariantClear

Name

.text

Size

174KB

Virtual Size

174KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

57KB

Virtual Size

56KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1.6MB

Virtual Size

1.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

4d036e0a517774ba8bd31df522a8d9e327202548a5753e5de068190582758680

PE Signature issue

kernel32

user32

ole32

oleaut32

generic