General

  • Target
    fb7e1b897266a5ce65e6dc6a2aa4371ac0075e9f372c57152c0fbbb53885920b.bin
  • Size 19.2MB
  • Sample251104-ssc31avkdl
  • SHA256 fb7e1b897266a5ce65e6dc6a2aa4371ac0075e9f372c57152c0fbbb53885920b
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • hijackloader

Attributes
  • directory

    %APPDATA%\RstMwServ

  • inject_dll

    %windir%\SysWOW64\rasapi32.dll

xor.hex

Signatures

  • Detects HijackLoader (aka IDAT Loader) 1 IoCs
  • Hijackloader family
  • Detects Pyinstaller 1 IoCs
  • Insecure Codesign Algorithm 2 IoCs

    File was Codesigned using an insecure algorithm.

  • Unsigned PE 2 IoCs

    Checks for missing Authenticode signature.

  • Untrusted Codesign Signers 3 IoCs

    Codesigned binary was signed by an untrusted entity.

File Explorer

  • fb7e1b897266a5ce65e6dc6a2aa4371ac0075e9f372c57152c0fbbb53885920b.bin
    .zip 19.2MB
  • Crondchandshieb.ffn
    800KB
  • Crookwebcron.maty
    13KB
  • SQLite.Interop.dll
    .dll 1.5MB
  • Setup.exe
    .exe 10.9MB
  • cura_app.pyc
    4KB
  • VCRUNTIME140.dll
    .dll 99KB
  • python310.dll
    .dll 4.7MB
  • updater/AISuite3.exe
    .exe 2.1MB
  • updater/AsRoutineController.exe
    .exe 2.8MB
  • updater/MiscTool.exe
    .exe 997KB
  • updater/NvStWiz.prx
    .exe 432KB
  • updater/RegSchdTask.exe
    .exe 792KB
  • updater/Splash.exe
    .exe 1.1MB
  • updater/manager/ks_tyres.ini
    9KB
  • x64/trading_api64.dll
    .dll 282KB
  • x64/tradingnetworkingsockets.dll
    .dll 4.1MB
  • x86/api-ms-win-core-processthreads-l1-1-1.dll
    .dll 17KB
  • x86/api-ms-win-core-profile-l1-1-0.dll
    .dll 16KB
  • x86/api-ms-win-core-rtlsupport-l1-1-0.dll
    .dll 17KB
  • x86/api-ms-win-core-string-l1-1-0.dll
    .dll 17KB
  • x86/api-ms-win-core-synch-l1-1-0.dll
    .dll 19KB
  • x86/api-ms-win-core-synch-l1-2-0.dll
    .dll 17KB
  • x86/api-ms-win-core-sysinfo-l1-1-0.dll
    .dll 18KB
  • x86/api-ms-win-core-timezone-l1-1-0.dll
    .dll 17KB
  • x86/api-ms-win-core-util-l1-1-0.dll
    .dll 17KB
  • x86/api-ms-win-crt-conio-l1-1-0.dll
    .dll 18KB
  • x86/api-ms-win-crt-convert-l1-1-0.dll
    .dll 21KB
  • x86/api-ms-win-crt-environment-l1-1-0.dll
    .dll 17KB
  • x86/api-ms-win-crt-filesystem-l1-1-0.dll
    .dll 19KB
  • x86/api-ms-win-crt-heap-l1-1-0.dll
    .dll 18KB
  • x86/api-ms-win-crt-locale-l1-1-0.dll
    .dll 17KB
  • x86/api-ms-win-crt-math-l1-1-0.dll
    .dll 26KB
  • x86/api-ms-win-crt-multibyte-l1-1-0.dll
    .dll 25KB
  • x86/api-ms-win-crt-private-l1-1-0.dll
    .dll 68KB
  • x86/api-ms-win-crt-process-l1-1-0.dll
    .dll 18KB

fb7e1b897266a5ce65e6dc6a2aa4371ac0075e9f372c57152c0fbbb53885920b.bin

  • SHA256 fb7e1b897266a5ce65e6dc6a2aa4371ac0075e9f372c57152c0fbbb53885920b
  • MD5 SHA1 SHA512 SSDEEP