Aetheria[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Aetheria.exe
Size 1.7MB
Sample260529-x4dwwsds91
SHA256 a01bf04ffcb45f1634d8d7c4dd9872b714667132509243e624df235bbcd203ac
MD5 f7e6f425910d0ac1bc2a2210975a591c
SHA1 18648190d92be262d4feccaf15a454c9e94686bf
SHA512 ffb5c09e4a2a283c95a627b7ab131884702ed7a04da6d7be0dcd13e01384bd900b9457e465e548cb3cc58cffed4134b29dd8950624865f1c20cf6fd617a401db
SSDEEP 49152:QCNXJ6r76maVX2xvHAm893vNTR3vsy+sRPrtnvCv:QCSsw893vNTR3vsy+sF
TLSH
T1CF859E1AA2B400FCD0B7D178C657961BEB71744D03309AEB27E049A52F63BE1677EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Aetheria.exe

File Explorer

Aetheria.exe

.exe 1.7MB

Aetheria.exe

IMPHASH 9bd690bceac9372817b868ca4005d095
SHA256 a01bf04ffcb45f1634d8d7c4dd9872b714667132509243e624df235bbcd203ac
MD5 f7e6f425910d0ac1bc2a2210975a591c
SHA1 18648190d92be262d4feccaf15a454c9e94686bf
SHA512 ffb5c09e4a2a283c95a627b7ab131884702ed7a04da6d7be0dcd13e01384bd900b9457e465e548cb3cc58cffed4134b29dd8950624865f1c20cf6fd617a401db
SSDEEP 49152:QCNXJ6r76maVX2xvHAm893vNTR3vsy+sRPrtnvCv:QCSsw893vNTR3vsy+sF
TLSH
T1CF859E1AA2B400FCD0B7D178C657961BEB71744D03309AEB27E049A52F63BE1677EB12
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1418684

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\exter\Downloads\Aetheria v16\x64\Release\Aetheria.pdb

kernel32

GetFileInformationByHandleEx AreFileApisANSI CreateFile2 SetFileInformationByHandle GetFileAttributesExW FindNextFileW FindFirstFileExW FindFirstFileW FindClose CreateDirectoryW GetCurrentDirectoryW GetLocaleInfoEx SleepConditionVariableSRW WakeAllConditionVariable SetUnhandledExceptionFilter WideCharToMultiByte GlobalLock FormatMessageA GetFileSizeEx VerifyVersionInfoW WaitForMultipleObjects PeekNamedPipe ReadFile GetFileType GetStdHandle GetEnvironmentVariableA WaitForSingleObjectEx MoveFileExW GetSystemInfo SleepEx LoadLibraryW LocalFree LeaveCriticalSection InitializeCriticalSection AcquireSRWLockExclusive ReleaseSRWLockExclusive FormatMessageW SetLastError SetDllDirectoryW QueryFullProcessImageNameW SetDefaultDllDirectories AddDllDirectory GetModuleHandleW GetModuleFileNameW GetModuleFileNameA UnmapViewOfFile MapViewOfFile CreateFileMappingW VirtualProtect GetSystemDirectoryW GetTickCount64 GetCurrentThreadId CreateThread GetCurrentProcessId GetCurrentProcess DeleteCriticalSection InitializeCriticalSectionEx GetProcessHeap HeapSize HeapFree HeapReAlloc HeapAlloc HeapDestroy AddVectoredExceptionHandler GetLastError GetFileAttributesA CreateFileW GetSystemTimeAsFileTime SetThreadPriority GlobalFree InitializeSListHead IsDebuggerPresent OutputDebugStringW GlobalUnlock GetLocaleInfoA LoadLibraryA QueryPerformanceFrequency GetProcAddress GlobalAlloc MultiByteToWideChar CloseHandle Process32Next CreateToolhelp32Snapshot OpenProcess Module32First GetProcessId Module32Next Process32First GetComputerNameA GetTickCount GetPrivateProfileStringA GetPrivateProfileIntA GetConsoleWindow WritePrivateProfileStringA GetCurrentThread Sleep GetModuleHandleA VerSetConditionMask FreeLibrary EnterCriticalSection QueryPerformanceCounter

user32

FindWindowA SetCursorPos UpdateWindow PeekMessageA PostQuitMessage GetCursorPos SendInput SetProcessDPIAware SetCursor IsWindowUnicode GetKeyState GetMessageExtraInfo LoadCursorA GetDC TranslateMessage SetLayeredWindowAttributes GetForegroundWindow MapVirtualKeyA SetWindowDisplayAffinity GetWindowLongA GetWindowTextA SetWindowLongA MessageBoxA GetAsyncKeyState GetKeyNameTextA ShowWindow RegisterClassExW UnregisterClassW GetSystemMetrics ScreenToClient CreateWindowExW DestroyWindow DispatchMessageA MonitorFromPoint DefWindowProcW IsWindow GetWindowRect GetCapture SetClipboardData GetClipboardData EmptyClipboard CloseClipboard OpenClipboard ClientToScreen TrackMouseEvent GetKeyboardLayout SetCapture ReleaseCapture ReleaseDC GetClientRect

gdi32

GetDeviceCaps

advapi32

GetUserNameA CopySid ConvertSidToStringSidA CryptAcquireContextW CryptReleaseContext CryptGetHashParam CryptCreateHash CryptHashData CryptDestroyHash SystemFunction036 CryptDestroyKey CryptImportKey CryptEncrypt RegDeleteKeyA RegCreateKeyExA IsValidSid InitializeAcl GetTokenInformation GetLengthSid AddAccessAllowedAce OpenProcessToken SetSecurityInfo

shell32

ShellExecuteA ShellExecuteW

msvcp140

?_Pnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_J@Z ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Xbad_function_call@std@@YAXXZ ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ?id@?$ctype@D@std@@2V0locale@2@A ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z ?put@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QEBA?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AEAVios_base@2@DPEBUtm@@PEBD3@Z ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ?_Gnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ ?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?_Gndec@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ??7ios_base@std@@QEBA_NXZ ??Bios_base@std@@QEBA_NXZ ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?always_noconv@codecvt_base@std@@QEBA_NXZ _Thrd_join _Thrd_id ?good@ios_base@std@@QEBA_NXZ ?width@ios_base@std@@QEBA_JXZ ?width@ios_base@std@@QEAA_J_J@Z ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z ?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?_Getcat@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ _Mtx_unlock _Xtime_get_ticks _Thrd_detach _Query_perf_counter _Cnd_do_broadcast_at_thread_exit _Mtx_lock ?_Syserror_map@std@@YAPEBDH@Z ?_Xlength_error@std@@YAXPEBD@Z ?_Random_device@std@@YAIXZ ?_Winerror_map@std@@YAHH@Z ?_Xout_of_range@std@@YAXPEBD@Z ?_Id_cnt@id@locale@std@@0HA ?_Xinvalid_argument@std@@YAXPEBD@Z ?_Xbad_alloc@std@@YAXXZ ?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?uncaught_exceptions@std@@YAHXZ ?id@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@2V0locale@2@A ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?_Throw_Cpp_error@std@@YAXH@Z ??0_Lockit@std@@QEAA@H@Z ??1_Lockit@std@@QEAA@XZ _Query_perf_frequency ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ

d3d11

D3D11CreateDeviceAndSwapChain

dwmapi

DwmSetWindowAttribute DwmExtendFrameIntoClientArea

imm32

ImmGetContext ImmReleaseContext ImmSetCandidateWindow ImmSetCompositionWindow

d3dcompiler_47

D3DCompile

crypt32

CertOpenStore CertCloseStore CertFreeCertificateChain CertGetCertificateChain CertFreeCertificateChainEngine CertCreateCertificateChainEngine CryptQueryObject CertGetNameStringW CertFindExtension CertAddCertificateContextToStore CryptDecodeObjectEx PFXImportCertStore CryptStringToBinaryW CertFreeCertificateContext CertFindCertificateInStore CertEnumCertificatesInStore

ws2_32

gethostname ioctlsocket sendto recvfrom listen htonl accept select ntohl __WSAFDIsSet WSAIoctl socket setsockopt recv htons getsockname getpeername connect bind WSACleanup WSAStartup WSASetLastError ntohs WSAGetLastError closesocket WSAWaitForMultipleEvents WSAResetEvent WSAEventSelect WSAEnumNetworkEvents WSACreateEvent WSACloseEvent send getsockopt inet_ntop inet_pton freeaddrinfo getaddrinfo

shlwapi

PathFindFileNameW

psapi

GetModuleInformation

wintrust

WinVerifyTrust

dnsapi

DnsQuery_A DnsFree

userenv

UnloadUserProfile

bcrypt

BCryptGenRandom

vcruntime140_1

__CxxFrameHandler4

vcruntime140

wcschr memchr __std_exception_destroy __std_exception_copy __std_terminate strstr strchr memcmp __current_exception_context __current_exception __C_specific_handler strrchr memset memcpy memmove _CxxThrowException

api-ms-win-crt-runtime-l1-1-0

_configure_narrow_argv _initialize_narrow_environment _invoke_watson _initialize_onexit_table _register_onexit_function _crt_atexit _errno _cexit _seh_filter_exe terminate system _set_app_type _get_initial_narrow_environment _resetstkoflw _initterm _invalid_parameter_noinfo abort _initterm_e _exit __sys_nerr __sys_errlist _register_thread_local_exe_atexit_callback exit __p___argc __p___argv _c_exit _beginthreadex

api-ms-win-crt-heap-l1-1-0

calloc realloc _set_new_mode malloc free _callnewh

api-ms-win-crt-convert-l1-1-0

strtoul wcstombs strtof atof atoi strtod strtol strtoll strtoull

api-ms-win-crt-time-l1-1-0

_localtime64 _time64 strftime _gmtime64 _localtime64_s

api-ms-win-crt-string-l1-1-0

_stricmp _strdup wcsncpy towlower isxdigit strcpy_s isspace strpbrk wcsncmp tolower strspn wcspbrk strcmp strlen strncmp strcspn _wcsdup wcslen strncpy

api-ms-win-crt-utility-l1-1-0

rand qsort

api-ms-win-crt-stdio-l1-1-0

_set_fmode ungetc setvbuf _close _popen ftell _fseeki64 fsetpos fputc fgets fgetpos fgetc _get_stream_buffer_pointers fputs _fileno __p__commode feof _wopen __stdio_common_vsprintf _lseeki64 _read _write __stdio_common_vsscanf fread _wfopen fwrite __stdio_common_vsprintf_s __stdio_common_vfprintf fseek fclose fflush __acrt_iob_func _pclose

api-ms-win-crt-math-l1-1-0

_dclass sqrtf _fdclass round acosf _fdopen _dsign __setusermatherr ceilf cosf floorf fmodf log logf pow powf roundf atan2f sinf

api-ms-win-crt-environment-l1-1-0

getenv _dupenv_s

api-ms-win-crt-filesystem-l1-1-0

_unlock_file _lock_file _wstat64 _fstat64 _unlink

api-ms-win-crt-locale-l1-1-0

_configthreadlocale localeconv ___lc_codepage_func