rustdesk-host=remote[.]mtc-server[.]de,key=gVUI62sIIEXmAkHhtBRYK8wumXkFQjxaLcL51uwqPnQ=[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
rustdesk-host=remote.mtc-server.de,key=gVUI62sIIEXmAkHhtBRYK8wumXkFQjxaLcL51uwqPnQ=.exe
Size 19.8MB
Sample260422-pp7awsfs2p
SHA256 23b661d7bc171cd500d5096456905283ffe06479582b62d3bd5066633935d43e
MD5 7caa1ef1cdeabb6c7487d66bd172fcf8
SHA1 a95d7098080fc3994ab434c2a5c4ec8f85817b11
SHA512 d4d13f539ce2e6177be3c06bab29fb69964424176a5f7573f27bfcdf87fe73b9b522182460331523f1421c0490e4c95b3a864eb9152df8bca7957916b85c5ae1
SSDEEP 393216:Mdvr3DHhPWjmUASYlYLGE3+6Pdj/uVDVU3LLHf36WAaS:SzTHhOjCl3b6F85UbL/36WAz
TLSH
T171273314F2844E3BD167C6708A824976A13A30E51723EDFF61E446A43F69FD0573AFA8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Insecure Codesign Algorithm 1 IoCs

File was codesigned using an insecure algorithm.

resource
rustdesk-host=remote.mtc-server.de,key=gVUI62sIIEXmAkHhtBRYK8wumXkFQjxaLcL51uwqPnQ=.exe

File Explorer

rustdesk-host=remote.mtc-server.de,key=gVUI62sIIEXmAkHhtBRYK8wumXkFQjxaLcL51uwqPnQ=.exe

.exe 19.8MB

rustdesk-host=remote.mtc-server.de,key=gVUI62sIIEXmAkHhtBRYK8wumXkFQjxaLcL51uwqPnQ=.exe

IMPHASH 9c1be6cd5754e7fe65d0f8406f76a365
SHA256 23b661d7bc171cd500d5096456905283ffe06479582b62d3bd5066633935d43e
MD5 7caa1ef1cdeabb6c7487d66bd172fcf8
SHA1 a95d7098080fc3994ab434c2a5c4ec8f85817b11
SHA512 d4d13f539ce2e6177be3c06bab29fb69964424176a5f7573f27bfcdf87fe73b9b522182460331523f1421c0490e4c95b3a864eb9152df8bca7957916b85c5ae1
SSDEEP 393216:Mdvr3DHhPWjmUASYlYLGE3+6Pdj/uVDVU3LLHf36WAaS:SzTHhOjCl3b6F85UbL/36WAz
TLSH
T171273314F2844E3BD167C6708A824976A13A30E51723EDFF61E446A43F69FD0573AFA8
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Insecure Codesign Algorithm

File was codesigned using an insecure algorithm.

Digest

d3:02:fc:67:34:42:b5:4a:47:74:27:d0:16:c0:35:e6:0b:c2:da:56

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=Zhou Huabing,O=Zhou Huabing,ST=Central Singapore,C=SG

Chains

Oct 13, 2023

CN=Zhou Huabing,O=Zhou Huabing,ST=Central Singapore,C=SG

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Serial Number

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 25, 2021 - Dec 31, 2028

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Serial Number

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=Zhou Huabing,O=Zhou Huabing,ST=Central Singapore,C=SG

Serial Number

af:d3:31:21:0e:f4:60:b7:18:3e:a2:a9:c5:78:18:cc

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 18, 2022 - Nov 18, 2023

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jul 14, 2023 - Oct 13, 2034

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

273904

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

SystemFunction036

kernel32

HeapFree GetProcessHeap HeapAlloc CloseHandle HeapReAlloc GetCommandLineW lstrlenW AcquireSRWLockExclusive ReleaseSRWLockExclusive GetFileInformationByHandleEx GetLastError WaitForMultipleObjects GetOverlappedResult GetCurrentProcess DuplicateHandle SwitchToThread SetFileInformationByHandle WaitForSingleObject GetExitCodeProcess CopyFileExW CompareStringOrdinal AddVectoredExceptionHandler SetThreadStackGuarantee AcquireSRWLockShared ReleaseSRWLockShared GetModuleHandleA GetProcAddress GetCurrentThread TryAcquireSRWLockExclusive GetStdHandle GetConsoleMode MultiByteToWideChar WriteConsoleW SetLastError WaitForSingleObjectEx LoadLibraryA GetCurrentProcessId CreateMutexA ReleaseMutex GetEnvironmentVariableW RtlLookupFunctionEntry GetModuleHandleW FormatMessageW GetModuleFileNameW CreateFileW GetFileInformationByHandle GetFullPathNameW CreateDirectoryW FindFirstFileW FindClose GetEnvironmentStringsW FreeEnvironmentStringsW GetSystemDirectoryW GetWindowsDirectoryW CreateProcessW GetFileAttributesW CreateNamedPipeW CreateThread ReadFileEx SleepEx WriteFileEx CreateEventW CancelIo ReadFile GetCurrentDirectoryW RtlCaptureContext SetFilePointerEx GetConsoleOutputCP FlushFileBuffers HeapSize LCMapStringW CompareStringW QueryPerformanceCounter GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent RtlUnwindEx EncodePointer RaiseException EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW RtlPcToFileHeader WriteFile ExitProcess TerminateProcess GetModuleHandleExW GetCommandLineA FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo WideCharToMultiByte SetEnvironmentVariableW SetStdHandle GetFileType GetStringTypeW FlsAlloc FlsGetValue FlsSetValue FlsFree

shell32

SHGetKnownFolderPath

ole32

CoTaskMemFree

ntdll

NtWriteFile NtReadFile NtCreateFile RtlNtStatusToDosError

bcrypt

BCryptGenRandom

Name

.text

Size

326KB

Virtual Size

326KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

19.5MB

Virtual Size

19.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

12KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

252B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

rustdesk-host=remote.mtc-server.de,key=gVUI62sIIEXmAkHhtBRYK8wumXkFQjxaLcL51uwqPnQ=.exe

advapi32

kernel32

shell32

ole32

ntdll

bcrypt

generic