General

  • Target
    SATUP.zip
  • Size 24.0MB
  • Sample251029-ry24mszrbs
  • SHA256 4f6681ace6a9e711c8bf2072fa7b34e82d38af3edc730da7fe582eb25dcca8ca
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10

Malware Config

Extracted

Family
  • hijackloader

Attributes
  • directory

    %APPDATA%\gateway_grpc_rel

  • inject_dll

    %windir%\SysWOW64\rasapi32.dll

xor.hex

Signatures

  • Detects HijackLoader (aka IDAT Loader) 1 IoCs
  • Hijackloader family
  • ASPack v2.12-2.42 1 IoCs

    Detects executables packed with ASPack v2.12-2.42

  • Codesign digest Mismatch 1 IoCs

    File was altered after it was signed.

  • Unsigned PE 9 IoCs

    Checks for missing Authenticode signature.

  • Untrusted Codesign Signers 8 IoCs

    Codesigned binary was signed by an untrusted entity.

File Explorer

  • SATUP.zip
    .zip 24.0MB
  • Aidhalaend.vvce
    928KB
  • Brerjeas.dhf
    21KB
  • Library/ASLFoundation.dll
    .dll 507KB
  • Library/AdbePM.dll
    .dll 710KB
  • Library/CppCoreCheck.dll
    .dll 1.0MB
  • Library/ImBatchContextMenuHandler-X64.dll
    .dll 510KB
  • Library/Microsoft.Azure.Management.ResourceManager.Fluent.dll
    .dll 1.3MB
  • Library/Microsoft.Data.Edm.dll
    .dll 654KB
  • Library/Microsoft.Developer.IdentityService.GitHubProvider.UI.dll
    .dll 200KB
  • Library/Microsoft.ProgramSynthesis.Compound.Split.dll
    .dll 510KB
  • Library/Microsoft.TeamFoundation.Controls.dll
    .dll 1.3MB
  • Library/Microsoft.VisualStudio.Modeling.Sdk.Shell.dll
    .dll 448KB
  • Library/Microsoft.VisualStudio.ProjectSystem.Managed.resources.dll
    .dll .ps1 273KB
  • Library/Microsoft.VisualStudio.TeamTest.TestGeneration.Cci.dll
    .dll 366KB
  • Library/Microsoft.VisualStudio.Text.Internal.dll
    .dll 280KB
  • Library/Microsoft.WebTools.ProjectSystem.Components.dll
    .dll 860KB
  • Library/MpCommu.dll
    .dll 341KB
  • Library/NAudio.WinForms.dll
    .dll 48KB
  • Library/NLog.dll
    .dll 697KB
  • Library/NuGet.VisualStudio.Implementation.dll
    .dll 272KB
  • Library/PInvoke.Windows.Core.dll
    .dll 266KB
  • Library/PocoZip.dll
    .dll 429KB
  • Library/System.Windows.Forms.VisualStudio.15.0.dll
    .dll 771KB
  • Library/VGX.dll
    .dll 1000KB
  • Library/VideoFrame.dll
    .dll 693KB
  • Library/WzWXFdbox64.dll
    .dll 640KB
  • Library/XIMAGE3B.DLL
    .dll 1.1MB
  • Library/asprlib.dll
    .dll 602KB
  • Library/clrgc.dll
    .dll 646KB
  • Library/cpfecl.Clang.Windows.arm64.dll
    .dll 432KB
  • Library/dvatransport.dll
    .dll 684KB
  • Library/libdirect3d11_filters_plugin.dll
    .dll 195KB
  • Library/libfaad_plugin.dll
    .dll 298KB
  • Library/libp11-kit-0.dll
    .dll 1.0MB
  • Library/libprotocd.dll
    .dll 3.6MB
  • Library/mc_dec_aac.dll
    .dll 503KB
  • Library/microsoft_shell_integration.dll
    .dll 426KB
  • Library/msemp.dll
    .dll 437KB
  • Library/msys-svn_client-1-0.dll
    .dll 582KB
  • Library/vrfauto.dll
    .dll 227KB
  • Library/zlib1.dll
    .dll 204KB
  • Resource/002.phpt
    .js 681B
  • Resource/HTMLDocument_fromFile_parser_warning_libxml_get_last_error.phpt
    616B
  • Resource/array_addition_not_commutative.phpt
    229B
  • Resource/array_fill_variation6.phpt
    .js 347B
  • Resource/assign_dim.phpt
    209B
  • Resource/assign_op_005.phpt
    331B
  • Resource/backed-mismatch.phpt
    .js 843B
  • Resource/bug13142.phpt
    619B
  • Resource/bug14293.phpt
    572B
  • Resource/bug24980.phpt
    1KB
  • Resource/bug39458.phpt
    545B
  • Resource/bug50158.phpt
    697B
  • Resource/bug60099.phpt
    190B
  • Resource/bug73157.phpt
    512B
  • Resource/bug79188.phpt
    .js 407B
  • Resource/bug79467.phpt
    226B
  • Resource/dba_cdb_make.phpt
    1KB
  • Resource/decrement_001.phpt
    374B
  • Resource/exception_handler_004.phpt
    .js 521B
  • Resource/frontcontroller9.phar.inc
    475B
  • Resource/gh10568.phpt
    .js 503B
  • Resource/gh15821.phpt
    524B
  • Resource/imagetypes_bmp.phpt
    161B
  • Resource/is_null.phpt
    4KB
  • Resource/iterable_alias_redundancy_array_2.phpt
    207B
  • Resource/mysqli_incomplete_initialization.phpt
    394B
  • Resource/mysqli_stmt_get_result_metadata_fetch_field.phpt
    3KB
  • Resource/mysqli_stmt_init.phpt
    .js 1KB
  • Resource/mysqlnd_read_buffer.h
    1KB
  • Resource/new_self_parent.phpt
    .js 641B
  • Resource/nls_ru.c
    217B
  • Resource/readcdf.c
    15KB
  • Resource/rename_variation8.phpt
    1KB
  • Resource/round4_groupH_simple_rpcenc.wsdl
    .xml 12KB
  • Resource/schema033.phpt
    1KB
  • Resource/shuffle_basic1.phpt
    2KB
  • Resource/uasort_variation3.phpt
    1KB
  • UpdateLogs/CMAKE_VS_VERSION_BUILD_NUMBER_COMPONENTS.txt
    514B
  • UpdateLogs/DisplayLanguageNames.ar_OM.txt
    32KB
  • UpdateLogs/DisplayLanguageNames.uk.txt
    33KB
  • UpdateLogs/German.txt
    956B
  • UpdateLogs/README_pa_IN.txt
    594B
  • UpdateLogs/README_pl.txt
    26KB
  • UpdateLogs/cover_blank_func_decl.txt
    385B
  • UpdateLogs/example.com_printversion_v1.0.0.txt
    1001B
  • UpdateLogs/hi.txt
    17KB
  • UpdateLogs/i18n.txt
    21B
  • UpdateLogs/mod_all.txt
    13KB
  • UpdateLogs/mod_e.txt
    3KB
  • UpdateLogs/mod_get_pseudo_other_branch.txt
    1KB
  • UpdateLogs/mod_get_sum_noroot.txt
    503B
  • UpdateLogs/mod_perm.txt
    412B
  • UpdateLogs/model_0.txt
    1.3MB
  • UpdateLogs/os_qnx.txt
    .vbs 3KB
  • UpdateLogs/pi_netrw.txt
    .js 177KB
  • UpdateLogs/rsc.io_quote_v3_v3.0.0.txt
    1KB
  • UpdateLogs/run_hello_pkg.txt
    186B
  • UpdateLogs/test_match_only_example.txt
    583B
  • UpdateLogs/test_ppc64le_cgo_inline_plt.txt
    719B
  • UpdateLogs/todo.txt
    304KB
  • UpdateLogs/usr_04.txt
    .js 18KB
  • Updates/InkDiv.dll
    .dll 350KB
  • Updates/Microsoft.ExtendedReflection.Reasoning.dll
    .dll 1.1MB
  • Updates/Microsoft.IdentityModel.Tokens.dll
    .dll 951KB
  • Updates/Microsoft.VisualStudio.TabDesigner.Implementation.dll
    .dll 486KB
  • Updates/NuGet.Packaging.dll
    .dll 761KB
  • Updates/RF_RSSITool.exe
    .exe 286KB
  • Updates/TfsProviderStub.dll
    .dll 340KB
  • Updates/bin/ArmouryLiveUpdate.exe
    .exe 563KB
  • Updates/bin/PreUninstallArmourySocketServer.exe
    .exe 212KB
  • Updates/bin/aujla - Shortcut.lnk
    .lnk 750B
  • Updates/bin/blocked-file-util.exe
    .exe 47KB
  • Updates/bin/kcpytkt.exe
    .exe 18KB
  • Updates/bin/mobile_backup_status_server.exe
    .exe 2.1MB
  • Updates/cpfecl.Android.x86.dll
    .dll 426KB
  • Updates/vrfauto.dll
    .dll 227KB
  • Updates/webres64.dll
    .dll 987KB
  • Updates/wzvinfo64.dll
    .dll 340KB
  • hoshi - Shortcut.lnk
    .lnk 750B
  • libeay32.dll
    .dll 10.0MB
  • setup.exe
    .exe 10.1MB
  • ssleay32.dll
    .dll 377KB

SATUP.zip

  • SHA256 4f6681ace6a9e711c8bf2072fa7b34e82d38af3edc730da7fe582eb25dcca8ca
  • MD5 SHA1 SHA512 SSDEEP