castleloader | 7e0f4292f779c40f8f1900d891994541045209c7e465cdb28828f64d2a1c09a7

General

Target
7e0f4292f779c40f8f1900d891994541045209c7e465cdb28828f64d2a1c09a7
Size 222KB
Sample260129-vptmpaaw4a
SHA256 7e0f4292f779c40f8f1900d891994541045209c7e465cdb28828f64d2a1c09a7
MD5 029bebfd30f6e58b0614398879cea4f8
SHA1 d9e940b9fb9e1ccb9c1afc6a59b06a5c83f521f9
SHA512 05c86097727745216171fc54c63a6306fbcc19ab29f134f40f39ee58e402e2f9b14de1cc5e17856b908d1e997cff2892da407fa24bf799a67c5bf0d2a7055a9c
SSDEEP 3072:lKtlcSDLohnckcHx2wgDAEls/4VA8lmh1PwVwJVTV85YXzwiZk1+1YeEYg:czUhn55wghW/oktwWJdV8KXMMg
TLSH
T14A248C217680C57BD4620AB115E8D6F64239BD354B2419CB73C83F7AAE748D2473AE3B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

tag_150 castleloader

Malware Config

Signatures

Castleloader family
castleloader

Detects CastleLoader payload 1 IoCs

tag_150

resource	yara_rule
sample	family_castleloader

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
7e0f4292f779c40f8f1900d891994541045209c7e465cdb28828f64d2a1c09a7

File Explorer

7e0f4292f779c40f8f1900d891994541045209c7e465cdb28828f64d2a1c09a7

.exe 222KB

7e0f4292f779c40f8f1900d891994541045209c7e465cdb28828f64d2a1c09a7

IMPHASH bdf7575fcc0b17ceb288719b350b3b25
SHA256 7e0f4292f779c40f8f1900d891994541045209c7e465cdb28828f64d2a1c09a7
MD5 029bebfd30f6e58b0614398879cea4f8
SHA1 d9e940b9fb9e1ccb9c1afc6a59b06a5c83f521f9
SHA512 05c86097727745216171fc54c63a6306fbcc19ab29f134f40f39ee58e402e2f9b14de1cc5e17856b908d1e997cff2892da407fa24bf799a67c5bf0d2a7055a9c
SSDEEP 3072:lKtlcSDLohnckcHx2wgDAEls/4VA8lmh1PwVwJVTV85YXzwiZk1+1YeEYg:czUhn55wghW/oktwWJdV8KXMMg
TLSH
T14A248C217680C57BD4620AB115E8D6F64239BD354B2419CB73C83F7AAE748D2473AE3B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Detects CastleLoader payload

tag_150
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

98654

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\Projects\General\Sparja\output\bin\Win32\client.pdb

kernel32

InitializeCriticalSectionEx GetLastError DecodePointer DeleteCriticalSection WriteFile CreateDirectoryW ReadFile SetFileTime SetFilePointer CreateFileW GetFileAttributesW MultiByteToWideChar LocalFileTimeToFileTime CloseHandle GetCurrentDirectoryW SystemTimeToFileTime WideCharToMultiByte WriteConsoleW GetConsoleMode GetConsoleOutputCP FlushFileBuffers SetFilePointerEx GetStringTypeW SetStdHandle GetProcessHeap IsDebuggerPresent OutputDebugStringW RaiseException EnterCriticalSection LeaveCriticalSection ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent GetStartupInfoW GetModuleHandleW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead LocalFree RtlUnwind SetLastError EncodePointer InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW ExitProcess GetModuleHandleExW GetModuleFileNameW GetStdHandle HeapFree HeapAlloc GetFileType HeapSize HeapReAlloc FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW LCMapStringW

user32

GetSystemMetrics MessageBoxW wsprintfW

ole32

CoCreateInstance

oleaut32

VariantInit SysFreeString SysAllocString VariantClear

Sharing