cookieplus | 6f9b79c20330a7c8ade8285866e5602bb86b50a817205ee3c8a466101193386d

Target
6f9b79c20330a7c8ade8285866e5602bb86b50a817205ee3c8a466101193386d
Size 655KB
Sample260515-zz7phsbs2j
SHA256 6f9b79c20330a7c8ade8285866e5602bb86b50a817205ee3c8a466101193386d
MD5 4c4abe85a1c68ba8385d2cb928ac5646
SHA1 8edcd1d8d390d61587d334f4527e569a5bdf915c
SHA512 4e52ea548f7a2ab770dc39f7737c282ee7bef7a44ab961604e7e9ffd25c282bd50e711d8a3af38d64b6b12766e50264310ecc15bfeef24da6fecaf2099a693db
SSDEEP 12288:MDthpRVihEcZZa1ANKMrIU9+/EcgKhLNeV7oTAv9YOe:MZ2hEcZY1ANKIIUU5RAV7Bl
TLSH
T14EE4291562B4066CE0EA8978CE7B8E52D673BC45172096DF5290661A3F337F98A3F313
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

loader apt lazarus downloader backdoor cookieplus

Malware Config

Signatures

Family: CookiePlus
CookiePlus is a plugin-based loader,downloader,backdoor used by the Lazarus group against targets in the nuclear sector.
loader downloader backdoor cookieplus

Detects CookiePlus loader 1 IoCs

loader apt lazarus

resource	yara_rule
sample	family_cookieplus

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6f9b79c20330a7c8ade8285866e5602bb86b50a817205ee3c8a466101193386d

File Explorer

6f9b79c20330a7c8ade8285866e5602bb86b50a817205ee3c8a466101193386d

.dll 655KB

6f9b79c20330a7c8ade8285866e5602bb86b50a817205ee3c8a466101193386d

IMPHASH c2942567fb2d15268ea07360ae967ced
SHA256 6f9b79c20330a7c8ade8285866e5602bb86b50a817205ee3c8a466101193386d
MD5 4c4abe85a1c68ba8385d2cb928ac5646
SHA1 8edcd1d8d390d61587d334f4527e569a5bdf915c
SHA512 4e52ea548f7a2ab770dc39f7737c282ee7bef7a44ab961604e7e9ffd25c282bd50e711d8a3af38d64b6b12766e50264310ecc15bfeef24da6fecaf2099a693db
SSDEEP 12288:MDthpRVihEcZZa1ANKMrIU9+/EcgKhLNeV7oTAv9YOe:MZ2hEcZY1ANKIIUU5RAV7Bl
TLSH
T14EE4291562B4066CE0EA8978CE7B8E52D673BC45172096DF5290661A3F337F98A3F313
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects CookiePlus loader

loader apt lazarus
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

233876

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

comctl32

InitCommonControlsEx

comdlg32

ChooseColorW

shlwapi

PathCanonicalizeW PathIsDirectoryW PathRemoveFileSpecA PathCombineW PathRemoveFileSpecW PathFindExtensionW PathRemoveExtensionW PathIsRootW PathAppendW PathFindFileNameW PathFileExistsW

shell32

ShellExecuteW

gdi32

CreateCompatibleBitmap CreateCompatibleDC SetPixel StretchBlt DeleteDC Rectangle GetDeviceCaps SetBkMode LineTo CreatePen MoveToEx CreateFontIndirectW SetBkColor GetObjectW SetTextColor GetStockObject SelectObject CreateSolidBrush DeleteObject

msimg32

AlphaBlend

kernel32

SetFilePointerEx SetStdHandle FlushFileBuffers WriteFile GetConsoleCP GetConsoleMode HeapSize SetEndOfFile GetProcessHeap GetModuleHandleW LoadLibraryExA GetModuleHandleA OpenProcess GetProcAddress GetCurrentProcessId FreeLibrary CreateDirectoryW WritePrivateProfileStringW GetPrivateProfileIntW GetPrivateProfileStringW ReadFile GetTempPathW LocalAlloc CreateFileW SetFileAttributesW Sleep CreateFileA DeleteFileW CloseHandle CreateThread GlobalLock GetFileSize CopyFileW WideCharToMultiByte GetTickCount GlobalUnlock MulDiv MultiByteToWideChar GetModuleFileNameW GetFileAttributesW LoadLibraryW SizeofResource FormatMessageW ReadConsoleW GlobalAlloc GlobalFree LoadResource FindResourceW LocalFree GetModuleHandleExW WaitForSingleObject GetCurrentThreadId CreateEventW SetEvent ResetEvent FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose EnumSystemLocalesW GetUserDefaultLCID IsValidLocale HeapReAlloc GetFileType GetStdHandle HeapAlloc HeapFree ExitProcess LoadLibraryExW InterlockedFlushSList RaiseException RtlPcToFileHeader RtlUnwindEx TlsFree TlsSetValue TlsGetValue TlsAlloc SetLastError GetLocaleInfoW LCMapStringW CompareStringW GetCPInfo DecodePointer EncodePointer GetStringTypeW InitializeSListHead GetSystemTimeAsFileTime QueryPerformanceCounter GetStartupInfoW IsDebuggerPresent WaitForSingleObjectEx DeleteCriticalSection InitializeCriticalSectionAndSpinCount LeaveCriticalSection EnterCriticalSection IsProcessorFeaturePresent TerminateProcess GetCurrentProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext LockResource WriteConsoleW GetLastError

user32

SetWindowsHookExW LoadCursorW UnhookWindowsHookEx DispatchMessageW RegisterClassExW UnregisterClassW CallNextHookEx PostMessageW AdjustWindowRectEx DefWindowProcW GetMessageW GetSysColorBrush GetCapture SetCapture SetScrollPos ReleaseCapture CharLowerW IsCharAlphaNumericW GetMenuState GetDC GetSystemMetrics DestroyCursor OpenClipboard DestroyIcon CloseClipboard GetClipboardData DrawMenuBar FlashWindowEx EnableMenuItem LoadImageW SendInput MessageBoxW SetTimer SetWindowTextW MessageBoxA SetForegroundWindow GetDlgItemInt SetDlgItemInt EnableWindow CreateDialogParamW FrameRect SendDlgItemMessageW GetWindowRect GetFocus DestroyWindow InflateRect IsWindowVisible SetWindowPos FillRect SendMessageW ShowWindow RedrawWindow DrawFocusRect MoveWindow GetWindowDC ReleaseDC EndDialog SetDlgItemTextW GetDlgItem DialogBoxParamW CallWindowProcW SetWindowLongPtrW GetWindowLongPtrW CreateCursor GetSysColor SetCursor GetClientRect DrawTextW UpdateWindow InvalidateRect BeginPaint EndPaint GetWindowTextW ClientToScreen CreateDialogIndirectParamW PostQuitMessage GetParent EnumChildWindows GetClassNameW GetMenuItemInfoA SetScrollInfo ShowScrollBar CreateWindowExW SetFocus GetScrollPos KillTimer

advapi32

SetServiceStatus RegisterServiceCtrlHandlerW

Name

.text

Size

364KB

Virtual Size

363KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

130KB

Virtual Size

129KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

7KB

Virtual Size

23KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

17KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

148B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

130KB

Virtual Size

130KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

6f9b79c20330a7c8ade8285866e5602bb86b50a817205ee3c8a466101193386d

comctl32

comdlg32

shlwapi

shell32

gdi32

msimg32

kernel32

user32

advapi32

generic