detect-mc[.]7z | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
detect-mc.7z
Size 10.1MB
Sample260508-scrapady9k
SHA256 964cf5d66a109caeaddf8ee5c10e50a65358c14ea1dee5237a614c7e1c9ef9f8
MD5 4e18dd5fcf59fda623fbd3c7ee36e3d6
SHA1 0ea87ba59ecb47875519a39989c0604f0c86838b
SHA512 62ca228614bed748435c31da07cc53e7aa35445e543c33a78f4890a1ae4fb36e203eb3944416d8c85d9b894118b2a90531fb76be2cc71d11312b2d92422e0127
SSDEEP 196608:M/GdFta9XIeCt0aYhhQVf41UJKc3Mpo/zDfTbo2spP1QGeK2:M+dFOXIeCtCSVf58piTs2Ou9f
TLSH
T1AAB6337BAFBF95435B005A918F516BCD0A0475565EA26CFE713BABCA2B8110C2F701EC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Embeds OpenSSL 1 IoCs

Embeds OpenSSL, may be used to circumvent TLS interception.

resource	yara_rule
static1/unpack001/detect-mc.exe	embeds_openssl

File Explorer

detect-mc.7z

.7z 10.1MB
detect-mc.exe

.exe 26.7MB

detect-mc.7z

SHA256 964cf5d66a109caeaddf8ee5c10e50a65358c14ea1dee5237a614c7e1c9ef9f8
MD5 4e18dd5fcf59fda623fbd3c7ee36e3d6
SHA1 0ea87ba59ecb47875519a39989c0604f0c86838b
SHA512 62ca228614bed748435c31da07cc53e7aa35445e543c33a78f4890a1ae4fb36e203eb3944416d8c85d9b894118b2a90531fb76be2cc71d11312b2d92422e0127
SSDEEP 196608:M/GdFta9XIeCt0aYhhQVf41UJKc3Mpo/zDfTbo2spP1QGeK2:M+dFOXIeCtCSVf58piTs2Ou9f
TLSH
T1AAB6337BAFBF95435B005A918F516BCD0A0475565EA26CFE713BABCA2B8110C2F701EC
MD5 SHA1 SHA512 SSDEEP TLSH

detect-mc.exe

IMPHASH b698ae14b3577023ddf9b0dcbc10ea1e
SHA256 d8ba1e22a4119676dd6ef90427cccb19d77e4635111f2dadcc11692c328c17b9
MD5 f54182dae7abf7078255ffe0dc54a157
SHA1 9914e9b01fadaa7b4909e53ec5f716001443f4dc
SHA512 178cca2df071f91e1000808bceca72bb5d3a9974e91c165807ccf74699e2b9c5fe66957328a1d0674e97a18ff178066dde529b8df22ff0ee455ecb7902a26ac3
SSDEEP 786432:t1FcHTZXLKPodn0LLk0nzc3L6FEPq8cIYWQ4hanI:tMBLKWVh
TLSH
T19E572B766100C0BDCE495074C691CE2FB86C68A96AF14F83C4A537FA3ADDD746EABC41
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Embeds OpenSSL

Embeds OpenSSL, may be used to circumvent TLS interception.

Digest

1d:02:96:3d:97:ea:fc:91:e1:cb:c0:e4:e4:c4:6c:b3:d0:e5:15:e3:55:23:ed:6f:2d:bf:10:72:77:5c:65:43

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=detect,O=detect,L=Taunton,C=GB

Chains

Apr 30, 2026

CN=detect,O=detect,L=Taunton,C=GB

CN=SSL.com Code Signing Intermediate CA RSA R1,O=SSL Corp,L=Houston,ST=Texas,C=US

CN=SSL.com Root Certification Authority RSA,O=SSL Corporation,L=Houston,ST=Texas,C=US

Subject

CN=SSL.com Root Certification Authority RSA,O=SSL Corporation,L=Houston,ST=Texas,C=US

Serial Number

7b:2c:9b:d3:16:80:32:99

Issuer

CN=SSL.com Root Certification Authority RSA,O=SSL Corporation,L=Houston,ST=Texas,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Feb 12, 2016 - Feb 12, 2041

Subject

CN=detect,O=detect,L=Taunton,C=GB

Serial Number

75:7c:65:a5:eb:7a:79:35:42:d0:0e:a6:34:6d:97:4f

Issuer

CN=SSL.com Code Signing Intermediate CA RSA R1,O=SSL Corp,L=Houston,ST=Texas,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Sep 30, 2025 - Sep 30, 2026

Subject

CN=SSL.com Code Signing Intermediate CA RSA R1,O=SSL Corp,L=Houston,ST=Texas,C=US

Serial Number

64:33:51:d3:c7:38:9f:08

Issuer

CN=SSL.com Root Certification Authority RSA,O=SSL Corporation,L=Houston,ST=Texas,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jun 24, 2016 - Jun 24, 2031

Subject

CN=SSL.com Timestamping Unit 2025 E1,O=SSL Corp,L=Houston,ST=Texas,C=US

Serial Number

1f:6b:16:62:d2:2e:1b:6c:5d:f1:c0:c1:a0:60:0e:38

Issuer

CN=SSL.com Timestamping Issuing RSA CA R1,O=SSL Corp,L=Houston,ST=Texas,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Feb 18, 2025 - Nov 12, 2034

Subject

CN=SSL.com Timestamping Issuing RSA CA R1,O=SSL Corp,L=Houston,ST=Texas,C=US

Serial Number

6d:52:18:70:87:e8:23:4d:85:60:00:d0:80:8f:93:56

Issuer

CN=SSL.com Root Certification Authority RSA,O=SSL Corporation,L=Houston,ST=Texas,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Nov 13, 2019 - Nov 12, 2034

Minor OS version

Major OS version

Entry point

27732416

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

RegQueryValueExW RegOpenKeyExW RegQueryInfoKeyW RegCloseKey CryptReleaseContext CryptGetHashParam CryptDestroyHash CryptHashData CryptCreateHash RegEnumKeyExW CryptAcquireContextW RegEnumValueW OpenServiceA QueryServiceStatusEx OpenProcessToken OpenSCManagerA LookupPrivilegeValueA CloseServiceHandle AdjustTokenPrivileges RegOpenKeyExA RegQueryValueExA LookupPrivilegeValueW CryptAcquireContextA GetUserNameA CryptDestroyKey CryptSetHashParam CryptGetProvParam CryptGetUserKey OpenServiceW OpenSCManagerW OpenEventLogW ReadEventLogW StartServiceW RegLoadKeyA RegUnLoadKeyA RegEnumKeyExA RegEnumValueA GetTokenInformation GetUserNameW CryptExportKey CryptDecrypt CryptSignHashW CryptEnumProvidersW ConvertSidToStringSidW CryptEncrypt CryptGenRandom DeregisterEventSource RegisterEventSourceW ReportEventW CryptImportKey

crypt32

CertGetCertificateContextProperty CertFindCertificateInStore CertFreeCertificateContext CertNameToStrA CertGetNameStringA CertOpenStore CertCloseStore CertEnumCertificatesInStore CertDuplicateCertificateContext PFXImportCertStore CryptDecodeObjectEx CertAddCertificateContextToStore CertFindExtension CryptQueryObject CertCreateCertificateChainEngine CertFreeCertificateChainEngine CertGetCertificateChain CertFreeCertificateChain CryptStringToBinaryA CertOpenSystemStoreW

ws2_32

WSAResetEvent WSAEventSelect socket setsockopt listen WSAEnumNetworkEvents WSACreateEvent sendto connect closesocket bind accept WSAWaitForMultipleEvents WSAIoctl WSASetLastError htons recvfrom send recv getnameinfo shutdown freeaddrinfo getaddrinfo WSAGetLastError WSACleanup WSAStartup ntohs getsockopt getsockname ioctlsocket gethostname getpeername __WSAFDIsSet select htonl WSACloseEvent

api-ms-win-crt-heap-l1-1-0

free calloc realloc _msize malloc

api-ms-win-crt-time-l1-1-0

_Getdays _Getmonths _W_Getdays _W_Getmonths _Strftime _mkgmtime64 _time64 _Gettnames _gmtime64_s _mktime64 _localtime64_s strftime

api-ms-win-crt-stdio-l1-1-0

getc _read _isatty __stdio_common_vfprintf clearerr _sopen_s fseek __acrt_iob_func __stdio_common_vswprintf _filelength _close fgets _fileno fopen feof ferror _wfopen __stdio_common_vsprintf_s _setmode __stdio_common_vswprintf_s __stdio_common_vsscanf __stdio_common_vswscanf fflush fclose fputwc ungetwc fgetc fgetwc fwrite fgetpos fread setvbuf ungetc fsetpos fputc _fseeki64 _get_stream_buffer_pointers __stdio_common_vsprintf ftell fputs

api-ms-win-crt-runtime-l1-1-0

_errno terminate _invalid_parameter_noinfo_noreturn signal _set_invalid_parameter_handler _wassert strerror_s exit _beginthreadex raise _exit _endthreadex abort

api-ms-win-crt-string-l1-1-0

tolower isprint strncmp _wcsicmp isalpha isalnum _strnicmp strcmp _stricmp towupper isdigit iswalpha strnlen strspn strcspn _strdup iswdigit wcscat_s toupper iswprint isspace towlower strcpy_s strncpy _wcsnicmp isxdigit

api-ms-win-crt-filesystem-l1-1-0

_fstat64 _unlink _unlock_file _stat64i32 _lock_file

api-ms-win-crt-convert-l1-1-0

atof strtoull strtoll strtoul strtol wcstoul _strtoi64 atoi wcstombs_s wcstol strtod

api-ms-win-crt-locale-l1-1-0

localeconv

api-ms-win-crt-math-l1-1-0

_dclass pow frexp log2 _isnan _dsign acosf fmodf ldexp

api-ms-win-crt-environment-l1-1-0

_dupenv_s getenv

api-ms-win-crt-utility-l1-1-0

srand rand qsort

user32

GetCapture SetWindowLongA ClientToScreen IsChild TrackMouseEvent GetMonitorInfoA GetForegroundWindow DefWindowProcA CreateWindowExA SetLayeredWindowAttributes SetFocus BringWindowToTop SetCapture SetCursor SetWindowLongW GetClientRect SetProcessDPIAware RegisterClassExA DestroyWindow SetForegroundWindow IsIconic WindowFromPoint ReleaseDC GetCursorPos OpenClipboard CloseClipboard EmptyClipboard GetClipboardData SetClipboardData EnumWindows GetClassNameW GetWindowTextW EnumDisplayMonitors MessageBoxA CharUpperBuffW UnregisterClassA LoadCursorA GetKeyState AdjustWindowRectEx GetWindowLongW PostQuitMessage KillTimer LoadIconA SetWindowTextW ScreenToClient ShowWindow MonitorFromWindow SetWindowPos SetCursorPos RegisterClassA GetDC SetTimer UpdateWindow PeekMessageA TranslateMessage DispatchMessageA ReleaseCapture GetAsyncKeyState MessageBoxW GetUserObjectInformationW GetProcessWindowStation

wevtapi

EvtCreateRenderContext EvtClose EvtRender EvtNext EvtQuery EvtOpenChannelConfig EvtGetChannelConfigProperty EvtOpenLog

kernel32

RtlUnwindEx InitializeSListHead GetStartupInfoW IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter LoadLibraryExW RtlCaptureContext CreateEventW ResetEvent IsDebuggerPresent GetCPInfo CompareStringEx LCMapStringEx FlsFree FlsSetValue FlsGetValue FlsAlloc EncodePointer RtlPcToFileHeader InitOnceBeginInitialize InitOnceComplete SleepConditionVariableSRW SleepConditionVariableCS WakeAllConditionVariable WakeConditionVariable InitializeConditionVariable GetNativeSystemInfo GetStringTypeW InitializeSRWLock GetLocaleInfoEx GetFileInformationByHandleEx CopyFileW SetFilePointerEx SetFileInformationByHandle GetFileInformationByHandle GetCurrentDirectoryW CreateSemaphoreA GetExitCodeThread ReleaseSemaphore VerifyVersionInfoW SleepEx WaitForMultipleObjects PeekNamedPipe MoveFileExA GetSystemDirectoryA CreateEventA SetEvent AcquireSRWLockExclusive ReleaseSRWLockExclusive ExitProcess GetModuleFileNameW GetConsoleOutputCP VirtualProtect GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW SetStdHandle IsValidCodePage GetACP GetOEMCP GetCommandLineA GetCommandLineW RtlUnwind GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW WriteConsoleW RtlLookupFunctionEntry ReadConsoleW ReadConsoleA SetConsoleMode GetConsoleMode ConvertFiberToThread SwitchToThread DeleteFiber GetModuleHandleExW RtlVirtualUnwind InitializeCriticalSectionAndSpinCount SetLastError GetFileType GetEnvironmentVariableW TlsFree TlsSetValue TlsGetValue TlsAlloc GetTimeZoneInformation VerSetConditionMask QueryPerformanceFrequency GlobalUnlock GlobalLock GlobalFree GlobalAlloc GetVolumeInformationW TzSpecificLocalTimeToSystemTime GetLogicalDriveStringsW QueryDosDeviceW OpenThread ResumeThread SuspendThread Thread32First Thread32Next K32EnumProcesses K32GetModuleFileNameExA K32GetProcessImageFileNameA GetLocalTime FlushFileBuffers GetTickCount QueryPerformanceCounter FormatMessageA GetModuleHandleW GetProcessHeap LockFileEx LocalFree UnlockFile HeapDestroy HeapCompact HeapAlloc LoadLibraryW GetSystemInfo HeapReAlloc DeleteFileA WaitForSingleObjectEx FlushViewOfFile OutputDebugStringW FormatMessageW GetTempPathA HeapSize HeapValidate GetCurrentThreadId CreateMutexW UnlockFileEx GetFullPathNameA InitializeCriticalSection LeaveCriticalSection LockFile OutputDebugStringA GetDiskFreeSpaceW GetFullPathNameW EnterCriticalSection HeapFree HeapCreate TryEnterCriticalSection AreFileApisANSI FreeLibrary GetCurrentProcessId LoadLibraryA GetStdHandle FindFirstFileW CopyFileA CompareFileTime CreateProcessA GetFileSize GetDiskFreeSpaceA SetEndOfFile SetFilePointer WriteFile MoveFileA GetExitCodeProcess Sleep CreatePipe SetHandleInformation TerminateProcess QueryDosDeviceA GetFileAttributesExA Process32Next Process32First GetProcessTimes CreateFileMappingA GetEnvironmentVariableA MultiByteToWideChar GetFileAttributesA MapViewOfFile CreateFileMappingW GetModuleFileNameA InitializeCriticalSectionEx GetLastError FileTimeToSystemTime RaiseException FileTimeToLocalFileTime DecodePointer DeleteCriticalSection ReadFile SearchPathW ExpandEnvironmentStringsW GetTempPathW WaitForSingleObject CreateFileW GetFileAttributesW GetFileAttributesExW DeleteFileW CloseHandle CreateProcessW WideCharToMultiByte OpenProcess CreateToolhelp32Snapshot Process32NextW K32GetModuleBaseNameW Process32FirstW K32GetModuleInformation ReadProcessMemory SystemTimeToFileTime K32EnumProcessModules GetSystemTime SystemTimeToTzSpecificLocalTime GetLogicalDrives FindFirstVolumeW DeviceIoControl GetVolumeNameForVolumeMountPointW FindVolumeClose GetVolumePathNamesForVolumeNameW FindNextVolumeW GetDriveTypeW GetTickCount64 GetSystemTimeAsFileTime SetConsoleOutputCP GetFinalPathNameByHandleW OpenFileById CreateFileA GetCurrentProcess VirtualQueryEx FindFirstFileA FindNextFileA FindClose GetModuleHandleA GetProcAddress GetFirmwareEnvironmentVariableW GetFileSizeEx FindFirstFileExW FindNextFileW UnmapViewOfFile

dbghelp

MiniDumpReadDumpStream

shell32

Shell_NotifyIconA SHGetPathFromIDListW SHGetKnownFolderPath SHGetNameFromIDList ord680 SHGetFolderPathA

ole32

CoTaskMemFree CoInitializeSecurity CoInitialize CoInitializeEx CoSetProxyBlanket CoUninitialize CoCreateInstance

secur32

LsaEnumerateLogonSessions LsaFreeReturnBuffer LsaGetLogonSessionData

shlwapi

PathFileExistsW

wintrust

CryptCATAdminReleaseContext CryptCATAdminAcquireContext CryptCATAdminEnumCatalogFromHash WinVerifyTrust CryptCATAdminReleaseCatalogContext WTHelperGetProvSignerFromChain CryptCATCatalogInfoFromContext CryptCATAdminCalcHashFromFileHandle WTHelperProvDataFromStateData WTHelperGetProvCertFromChain

setupapi

SetupDiGetClassDevsW SetupDiEnumDeviceInfo SetupDiGetDevicePropertyW SetupDiDestroyDeviceInfoList

winhttp

WinHttpQueryDataAvailable WinHttpConnect WinHttpSendRequest WinHttpCrackUrl WinHttpReceiveResponse WinHttpOpen WinHttpReadData WinHttpOpenRequest WinHttpCloseHandle

ntdll

RtlGetCompressionWorkSpaceSize RtlDecompressBufferEx

oleaut32

SysStringLen SysFreeString SysAllocString VariantTimeToSystemTime VariantInit VariantClear

version

GetFileVersionInfoSizeW VerQueryValueW GetFileVersionInfoW

d3d11

D3D11CreateDeviceAndSwapChain

dxgi

CreateDXGIFactory

imm32

ImmSetCandidateWindow ImmReleaseContext ImmGetContext ImmSetCompositionWindow ImmAssociateContextEx

d3dcompiler_47

D3DCompile

gdi32

GetDeviceCaps

bcrypt

BCryptGenRandom

normaliz

IdnToAscii IdnToUnicode

wldap32

ord211 ord50 ord60 ord45 ord32 ord33 ord35 ord79 ord30 ord200 ord217 ord301 ord143 ord26 ord41 ord46 ord22 ord27

Name

.text

Size

7.2MB

Virtual Size

7.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

1.5MB

Virtual Size

1.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

441KB

Virtual Size

441KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

243KB

Virtual Size

243KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

9KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

191KB

Virtual Size

191KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

54KB

Virtual Size

53KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.detect

Size

17.0MB

Virtual Size

17.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

generic

count=144, id=261, version=33145,

count=4, id=259, version=33145,

count=19, id=260, version=30034,

count=17, id=259, version=30034,

count=12, id=253, version=28518,

count=387, id=260, version=33130,

count=4, productName=Unmarked objects (old),

count=126, id=260, version=33812,

count=9, id=260, version=33145,

count=2, id=262, version=33145,

count=106, id=261, version=30034,

count=22, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=697, id=1, productName=Unmarked objects,

count=55, id=257, version=33145,

count=10, id=260, productName=VS2015 UPD3.1 build 24215, version=24215,

count=28, id=259, version=27035,

count=503, id=260, version=27035,

count=54, id=260, version=30159,

count=146, id=265, version=30159,

count=1, id=255, version=30159,

count=1, id=151,

count=1, id=258, version=30159,