aperetif | 7ae31d6b2a42edbf32c51baf191db870b45707755e8feefa053371747355b7ac

General

Target
7ae31d6b2a42edbf32c51baf191db870b45707755e8feefa053371747355b7ac
Size 207KB
Sample260615-vmh36sdt4s
SHA256 7ae31d6b2a42edbf32c51baf191db870b45707755e8feefa053371747355b7ac
MD5 5cbbb406f476ea6f3c4ecb0d4bde7325
SHA1 a19d46251636fb46a013c7b52361b7340126ab27
SHA512 f5f5a947ef1e6218d7a7911259b07d2eca68385f465b37e63641949bd67739428a0cdda2e7e6eb119ab511b504b6cb987aad7d2d1ea4a938549a70ccfc672fd9
SSDEEP 6144:SLSSQsSy3Mqx5TOnjslHKrmZNAOKdpm+:S+fRy3MqPOGNcS+
TLSH
T1FA248D1174D2C973D572143109F8EBB55A3EB9210F709AEBA7D41B7E8F302C19A31A6B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

apt winter_vivern trojan aperetif

Malware Config

Signatures

Family: APERETIF
APERETIF is a lightweight espionage trojan used by the Winter Vivern APT.
trojan aperetif

Detects APERETIF 1 IoCs

apt winter_vivern

resource	yara_rule
sample	family_aperetif

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
7ae31d6b2a42edbf32c51baf191db870b45707755e8feefa053371747355b7ac

File Explorer

7ae31d6b2a42edbf32c51baf191db870b45707755e8feefa053371747355b7ac

.exe 207KB

7ae31d6b2a42edbf32c51baf191db870b45707755e8feefa053371747355b7ac

IMPHASH 062ab92b7531e75c19535d647666e06c
SHA256 7ae31d6b2a42edbf32c51baf191db870b45707755e8feefa053371747355b7ac
MD5 5cbbb406f476ea6f3c4ecb0d4bde7325
SHA1 a19d46251636fb46a013c7b52361b7340126ab27
SHA512 f5f5a947ef1e6218d7a7911259b07d2eca68385f465b37e63641949bd67739428a0cdda2e7e6eb119ab511b504b6cb987aad7d2d1ea4a938549a70ccfc672fd9
SSDEEP 6144:SLSSQsSy3Mqx5TOnjslHKrmZNAOKdpm+:S+fRy3MqPOGNcS+
TLSH
T1FA248D1174D2C973D572143109F8EBB55A3EB9210F709AEBA7D41B7E8F302C19A31A6B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Detects APERETIF

apt winter_vivern
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

28909

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Users\user_1\source\repos\Aperitivchick 2\Release\SystemProtector.pdb

kernel32

Sleep CreateFileW WideCharToMultiByte EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer MultiByteToWideChar LCMapStringEx GetStringTypeW GetCPInfo UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW RtlUnwind RaiseException GetLastError SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW GetStdHandle WriteFile GetModuleFileNameW ExitProcess GetModuleHandleExW GetCommandLineA GetCommandLineW HeapAlloc HeapFree GetFileType CloseHandle WaitForSingleObject GetExitCodeProcess CreateProcessW GetFileAttributesExW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW FlushFileBuffers GetConsoleOutputCP GetConsoleMode ReadFile GetFileSizeEx SetFilePointerEx ReadConsoleW HeapReAlloc FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetProcessHeap HeapSize WriteConsoleW

Resubmissions

Sharing