776aac4718d53e0b67ea8218aaededefea9961e8c574c4bcfdbcec36eef487de
- SHA256 776aac4718d53e0b67ea8218aaededefea9961e8c574c4bcfdbcec36eef487de
Overview
overview
7Static
static
3Զ�...fi.bat
windows10-2004-x64
6Զ�...fi.bat
windows11-21h2-x64
6Զ�...fi.exe
windows10-2004-x64
7Զ�...fi.exe
windows11-21h2-x64
6Զ�...fi.ps1
windows10-2004-x64
3Զ�...fi.ps1
windows11-21h2-x64
3Զ�...��.cmd
windows10-2004-x64
7Զ�...��.cmd
windows11-21h2-x64
6Զ�...��.cmd
windows10-2004-x64
6Զ�...��.cmd
windows11-21h2-x64
6Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Զȵ/wifi.bat
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
Զȵ/wifi.bat
Resource
win11-20260513-en
windows11-21h2-x64
4 signatures
150 seconds
Behavioral task
behavioral3
Sample
Զȵ/wifi.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral4
Sample
Զȵ/wifi.exe
Resource
win11-20260513-en
windows11-21h2-x64
7 signatures
150 seconds
Behavioral task
behavioral5
Sample
Զȵ/wifi.ps1
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral6
Sample
Զȵ/wifi.ps1
Resource
win11-20260513-en
windows11-21h2-x64
3 signatures
150 seconds
Behavioral task
behavioral7
Sample
Զȵ/÷exeʧЧʱ.cmd
Resource
win10v2004-20260513-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral8
Sample
Զȵ/÷exeʧЧʱ.cmd
Resource
win11-20260513-en
windows11-21h2-x64
6 signatures
150 seconds
Behavioral task
behavioral9
Sample
Զȵ/ڿӻ.cmd
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral10
Sample
Զȵ/ڿӻ.cmd
Resource
win11-20260513-en
windows11-21h2-x64
5 signatures
150 seconds
General
- Target 776aac4718d53e0b67ea8218aaededefea9961e8c574c4bcfdbcec36eef487de
- Size 161KB
- Sample260601-phbkmsdv5l
- SHA256 776aac4718d53e0b67ea8218aaededefea9961e8c574c4bcfdbcec36eef487de
- MD5 cdba397ffb3fd924bb9d3a20beee8277
- SHA1 b982b4787731b0bfd4b1dccbb370a2d74f83b150
- SHA512 0c9ddd8999eb7f89b35a871b7e8bb072a921aedc9d7bfa7480eb8cca5f17230f7c8950d195aa13857f60e99af805f0f710c1cfac0356dd3c45e9f7edddff9f7f
- SSDEEP 3072:PdRjdJop6d7O7jBsO8M5l0tiDalZoSVMa18rS6tDStFfsT16Ze7:Pdnapfb8RhP8RDeq6O
- TLSH T118F3133BB440E054D3A7AB34E05A8F1C86FE3619500C6E799FA3ECF687A52362CD7805
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Զȵ/wifi.exe
File Explorer
-
776aac4718d53e0b67ea8218aaededefea9961e8c574c4bcfdbcec36eef487de.zip 161KB
-
Զȵ/wifi.bat140B
-
Զȵ/wifi.exe.exe 333KB
-
Զȵ/wifi.ps1.ps1 1KB
-
Զȵ/÷exeʧЧʱ.cmd.cmd .bat 335B
-
Զȵ/ڿӻ.cmd194B
Զȵ/wifi.bat
- SHA256 780f60956ba79b45538b44287d5ae5eb1486b9c95b0fc527f04d0e00248d9e63
- MD5 e818ff1953022ecea37132d6b7415674
- SHA1 00bc3e95d9ef649eb56028c90344222e51322237
- SHA512 ae4c21df6a4843c8247801f201ad02925e8a89cdd43e2fee1432a0b7ea49ea03dc66d40353f480313d20a453c70ab5905e22d91a4e734537cf02258195926a0d
- TLSH T142C02BA18E4DC09881EF951A0218C933BD83F017119C1562B59A08A42E14280D33D0C0
- MD5 SHA1 SHA512 TLSH
Զȵ/wifi.exe
- IMPHASH 47b0da2d13e0214f54c3bd05550e8319
- SHA256 2bc85e540a631cf84d9ca8265ffbd41512568315e45bd7d9faa54c38b6e8b82f
- MD5 6234394b13ef7ac8dbcc749f8c4286ae
- SHA1 54cb403245b11ac6cba7cbae2b27c2d73fa7977c
- SHA512 7a1d5087082740028d7d2f7f396bb6663d64a69b8bec88b96ad0d9c7ca5349800457db9d35a06c82cfb284af39dc99f5939a2c47c897e017721714e45f83bf0c
- SSDEEP 6144:AoTf1YKSP3zJI2c0ROBSs5X4/eGb7cHdS4nAXlgtDit:AoTfx+l1c0ROBSaX/VS
- TLSH T19D74E5C6F45042E2EC294A75D19A7CB00947BE3EDB6D8CCB32C8F69235A30E345B595B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4096
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
msvcrt
memset
strncmp
memmove
strncpy
strstr
_strnicmp
_stricmp
strlen
strcmp
memcpy
sprintf
fabs
ceil
malloc
floor
free
fclose
strcpy
tolower
kernel32
GetModuleHandleA
HeapCreate
HeapDestroy
ExitProcess
RemoveDirectoryA
GetExitCodeProcess
GetTempFileNameA
GetCommandLineA
GetNativeSystemInfo
FindResourceA
LoadResource
SizeofResource
GetShortPathNameA
GetWindowsDirectoryA
GetSystemDirectoryA
HeapAlloc
HeapFree
Sleep
LoadLibraryA
GetProcAddress
FreeLibrary
GetCurrentThreadId
GetCurrentProcessId
CloseHandle
InitializeCriticalSection
GetModuleFileNameA
GetEnvironmentVariableA
SetEnvironmentVariableA
CreateFileA
ReadFile
WriteFile
SetFilePointer
DeleteFileA
GetFileSize
HeapReAlloc
GetCurrentProcess
TerminateProcess
SetUnhandledExceptionFilter
EnterCriticalSection
LeaveCriticalSection
GetVersionExA
SetLastError
HeapSize
TlsAlloc
CreateDirectoryA
GetTempPathA
SetFileAttributesA
GetCurrentDirectoryA
SetCurrentDirectoryA
DeleteCriticalSection
MultiByteToWideChar
WideCharToMultiByte
user32
CharUpperA
CharLowerA
MessageBoxA
SendMessageA
PostMessageA
GetWindowThreadProcessId
IsWindowVisible
GetWindowLongA
GetForegroundWindow
IsWindowEnabled
EnableWindow
EnumWindows
SetWindowPos
DestroyWindow
GetDC
GetWindowTextLengthA
GetWindowTextA
SetRect
DrawTextA
GetSystemMetrics
ReleaseDC
GetSysColor
GetSysColorBrush
CreateWindowExA
CallWindowProcA
SetWindowLongA
SetFocus
RedrawWindow
RemovePropA
DefWindowProcA
SetPropA
GetParent
GetPropA
GetWindow
SetActiveWindow
UnregisterClassA
DestroyAcceleratorTable
LoadIconA
LoadCursorA
RegisterClassA
AdjustWindowRectEx
ShowWindow
CreateAcceleratorTableA
PeekMessageA
MsgWaitForMultipleObjects
GetMessageA
GetActiveWindow
TranslateAcceleratorA
TranslateMessage
DispatchMessageA
GetFocus
GetClientRect
FillRect
EnumChildWindows
DefFrameProcA
GetWindowRect
IsChild
GetClassNameA
GetKeyState
DestroyIcon
RegisterWindowMessageA
gdi32
GetStockObject
SelectObject
SetBkColor
SetTextColor
GetTextExtentPoint32A
CreateSolidBrush
DeleteObject
GetObjectA
CreateCompatibleDC
GetDIBits
DeleteDC
GetObjectType
CreateDIBSection
BitBlt
CreateBitmap
SetPixel
comctl32
InitCommonControlsEx
ole32
CoInitialize
CoTaskMemFree
RevokeDragDrop
shell32
ShellExecuteExA
winmm
timeBeginPeriod
shlwapi
PathQuoteSpacesA
PathAddBackslashA
PathRemoveArgsA
PathGetArgsA
PathRenameExtensionA
PathUnquoteSpacesA
Name
.code
Size
13KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.text
Size
45KB
Virtual Size
44KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
5KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
266KB
Virtual Size
265KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
Զȵ/wifi.ps1
- SHA256 7b5af2d5ca180084f19168480f8b1bb54f3502cd7f12ee2fade1d3a163c21153
- MD5 88f7c45016b2cf4f18a99de69c6958b8
- SHA1 dbca40a43df6a04885b4a654469f015b346f5b97
- SHA512 17fa78270fdee9be333434de7e3f238477869275bda4a8a56d3e3d1bafa47c8d2be0c9f0746054727553032721b0245682dbccfd9b0a0b83e5ea79bae7ce64f1
- TLSH T10321538A26C95424535B6B43F61777A807B40C8B150F14A444AC0ED6EE3FF871BBA9EB
- MD5 SHA1 SHA512 TLSH
Զȵ/÷exeʧЧʱ.cmd
- SHA256 5fc403ea3b11d9ead9c9c81c11cf3839a451c323a04604122ca2642965cc2f42
- MD5 24960b399754cb639540fb641f825a6c
- SHA1 65807fafd285325290abc93d68ed509d93ad3538
- SHA512 790b1edee8a1d765ce42607857b7f45c2d7a744dd75fcee4a73c6796c910283e72ccab12e6e7618121e8a8b16afa3b2328ab1bd40dd7a546356617be19828a2d
- TLSH T1A8E078409D35C5DD65B7541A36335555FE476143B00CD31231D05874375E7DACB2A0D6
- MD5 SHA1 SHA512 TLSH
Զȵ/ڿӻ.cmd
- SHA256 7f3e8d35304fd0a307ebfc0a08960b923ef208a8466b70ff817aa391703075ab
- MD5 1aff48127f730f5471c23349c8057653
- SHA1 893ebb037f47dbeb7863c2fd9e2313e2d5069819
- SHA512 c985d955501ad5d6bda90d1c62381a514d3af6155f80edf3f74b3ed17f34ab1c5edde46e0363e968a2a120ae72458f694f594a27f24b8cfacd1e601e0a531d62
- TLSH T13FC02290821A49ACA2BB246E1121851BAE476003B198931232C908AC2A2C381C33A0C8
- MD5 SHA1 SHA512 TLSH