lotuslite | _8dd7d6472771db5b82cfc87adcb03b303fcd8f16462700ce6ff63f3d935348d9[.]dll

General

Target
_8dd7d6472771db5b82cfc87adcb03b303fcd8f16462700ce6ff63f3d935348d9.dll
Size 343KB
Sample260620-feaz9sev2s
SHA256 8dd7d6472771db5b82cfc87adcb03b303fcd8f16462700ce6ff63f3d935348d9
MD5 ef5b753e5a2118d18c5e809c3d159a35
SHA1 eb352c7f82a6987aaa5f3cad51e4c458970f5600
SHA512 134ed0f76add1307de424fce7c495db7e5747f7acd954cd5b42f9da5c99d91b03f4edcafff9561ebfa724aa40da41400a209ea3e77bf7080aa6c53346b2deed5
SSDEEP 6144:EqKC01Sme0uK1z/1JKapvOoUHMETZg4JdCm5yniN1kMcTeSauAOziU0PXhSM87S:EjwKLAaIoU1ZRh5yiN12rfYU8SM87
TLSH
T102748D11F881C872D17F02346828F79A25BDF9514BB8C5EF2BD80A6E6F311C1AA35767
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

mustang_panda backdoor lotuslite

Malware Config

Extracted

Family

lotuslite

C2

103.79.77.181

Signatures

Family: LotusLite
LotusLite is a backdoor written in C++.
backdoor lotuslite

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
_8dd7d6472771db5b82cfc87adcb03b303fcd8f16462700ce6ff63f3d935348d9.dll

File Explorer

_8dd7d6472771db5b82cfc87adcb03b303fcd8f16462700ce6ff63f3d935348d9.dll

.dll 343KB

_8dd7d6472771db5b82cfc87adcb03b303fcd8f16462700ce6ff63f3d935348d9.dll

IMPHASH a631b3d43aa4cf385846879c89c4e9e2
SHA256 8dd7d6472771db5b82cfc87adcb03b303fcd8f16462700ce6ff63f3d935348d9
MD5 ef5b753e5a2118d18c5e809c3d159a35
SHA1 eb352c7f82a6987aaa5f3cad51e4c458970f5600
SHA512 134ed0f76add1307de424fce7c495db7e5747f7acd954cd5b42f9da5c99d91b03f4edcafff9561ebfa724aa40da41400a209ea3e77bf7080aa6c53346b2deed5
SSDEEP 6144:EqKC01Sme0uK1z/1JKapvOoUHMETZg4JdCm5yniN1kMcTeSauAOziU0PXhSM87S:EjwKLAaIoU1ZRh5yiN12rfYU8SM87
TLSH
T102748D11F881C872D17F02346828F79A25BDF9514BB8C5EF2BD80A6E6F311C1AA35767
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

51198

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

ReadFile SetHandleInformation FindFirstFileA CreateEventExW GetCommandLineW FindNextFileA FindClose GetModuleHandleA Sleep GetLastError CloseHandle SetCurrentDirectoryW LocalFree ExitProcess CreateDirectoryA SetEndOfFile WideCharToMultiByte EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection DeleteCriticalSection GetCurrentThreadId DuplicateHandle WaitForSingleObjectEx GetCurrentProcess GetCurrentThread QueryPerformanceCounter SetLastError InitializeCriticalSectionAndSpinCount CreateEventW TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime GetTickCount GetModuleHandleW GetProcAddress EncodePointer DecodePointer MultiByteToWideChar LCMapStringW GetLocaleInfoW GetStringTypeW GetCPInfo SetEvent ResetEvent UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW GetCurrentProcessId InitializeSListHead CreateTimerQueue SignalObjectAndWait SwitchToThread CreateThread SetThreadPriority GetThreadPriority GetLogicalProcessorInformation CreateTimerQueueTimer ChangeTimerQueueTimer DeleteTimerQueueTimer GetNumaHighestNodeNumber GetProcessAffinityMask SetThreadAffinityMask RegisterWaitForSingleObject UnregisterWait GetThreadTimes FreeLibrary FreeLibraryAndExitThread GetModuleFileNameW LoadLibraryExW GetVersionExW VirtualAlloc VirtualFree VirtualProtect ReleaseSemaphore InterlockedPopEntrySList InterlockedPushEntrySList InterlockedFlushSList QueryDepthSList UnregisterWaitEx LoadLibraryW RtlUnwind RaiseException HeapAlloc HeapFree ExitThread GetModuleHandleExW HeapReAlloc GetModuleFileNameA GetACP WriteFile GetConsoleCP GetConsoleMode GetProcessHeap IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetStdHandle GetFileType FlushFileBuffers SetFilePointerEx FindFirstFileExA IsValidCodePage GetOEMCP GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW CreateFileW SetStdHandle WriteConsoleW ReadConsoleW HeapSize

user32

MessageBoxA

Name

.text

Size

236KB

Virtual Size

235KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

77KB

Virtual Size

77KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

8KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

9B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

1016B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

15KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Extracted

Signatures

File Explorer

_8dd7d6472771db5b82cfc87adcb03b303fcd8f16462700ce6ff63f3d935348d9.dll

kernel32

user32

generic