146e96c025ce89318a3a6eebec06f8dd1cb00baec8777cb7b756d0ab96f82fb4[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
146e96c025ce89318a3a6eebec06f8dd1cb00baec8777cb7b756d0ab96f82fb4.zip
Size 12.3MB
Sample260626-kjddeahy91
SHA256 99f584d8614223f2807bc0e0ed4573f63cc80a0043cfc603c7781e0ee51cff16
MD5 b33d7ee4ff91a71e67935eedd476f35b
SHA1 ed634d12cf01a8f772ebc9da9f9220874426b5ab
SHA512 c539d4d00e93ac6b6fc44a9346b685b1bd379e37c8fc60246ad7ec50d82fb5b235a10c740568cd00f84c3f95bbbbc5e3cf619fd524287766d1e937b3efc3de3d
SSDEEP 196608:b3tWtuNDEl2hNXGkSszY1oiTG7hpkoqtQwZh8nTe1Ms20hOn3+vdx/OljrDTv1jL:bdWtQBSZ1e9eoZwZ8Te20hetjL
TLSH
T102D633B02514EFDD88E8F58094FCD2AC0BA35A6C581C61E27546D4FFB98C1AA473B17B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Detect suspicious telegram bot 1 IoCs

Detect suspicious telegram bot.

resource	yara_rule
static1/unpack001/146e96c025ce89318a3a6eebec06f8dd1cb00baec8777cb7b756d0ab96f82fb4	suspicious_telegram_bot

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/146e96c025ce89318a3a6eebec06f8dd1cb00baec8777cb7b756d0ab96f82fb4

File Explorer

146e96c025ce89318a3a6eebec06f8dd1cb00baec8777cb7b756d0ab96f82fb4.zip

.zip 12.3MB
146e96c025ce89318a3a6eebec06f8dd1cb00baec8777cb7b756d0ab96f82fb4

.dll 29.8MB

146e96c025ce89318a3a6eebec06f8dd1cb00baec8777cb7b756d0ab96f82fb4.zip

SHA256 99f584d8614223f2807bc0e0ed4573f63cc80a0043cfc603c7781e0ee51cff16
MD5 b33d7ee4ff91a71e67935eedd476f35b
SHA1 ed634d12cf01a8f772ebc9da9f9220874426b5ab
SHA512 c539d4d00e93ac6b6fc44a9346b685b1bd379e37c8fc60246ad7ec50d82fb5b235a10c740568cd00f84c3f95bbbbc5e3cf619fd524287766d1e937b3efc3de3d
SSDEEP 196608:b3tWtuNDEl2hNXGkSszY1oiTG7hpkoqtQwZh8nTe1Ms20hOn3+vdx/OljrDTv1jL:bdWtQBSZ1e9eoZwZ8Te20hetjL
TLSH
T102D633B02514EFDD88E8F58094FCD2AC0BA35A6C581C61E27546D4FFB98C1AA473B17B
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

146e96c025ce89318a3a6eebec06f8dd1cb00baec8777cb7b756d0ab96f82fb4

IMPHASH 478d1241a0bc7167be71872c34817f57
SHA256 146e96c025ce89318a3a6eebec06f8dd1cb00baec8777cb7b756d0ab96f82fb4
MD5 39632ee59ada35b079e80cfa176893e6
SHA1 2d5a0770566cae0579e63b500fd7c54f1e8b6931
SHA512 9f856fbbfc4c61402d00b6034fb2c7df0311453580ea9b9bca72503114957d55e3636b5863929025fb00398656a2bd73683bcd69ae8162a2fb0cf3ddb46ae3d5
SSDEEP 393216:adxUcLNT678pIbDlz00yWCsP6g0TJyzpkGzIDpdqzok6gVyN3TqtLZo0rdcRYMdt:aoI+OAJPsv
TLSH
T139677C42F75291A8C02AE574826B6E32F6717C8D873267EB1BD44A313E61BD05B3B7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Detect suspicious telegram bot

Detect suspicious telegram bot.
Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

18948948

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

sas

SendSAS

newdev

UpdateDriverForPlugAndPlayDevicesW

wtsapi32

WTSFreeMemory WTSEnumerateSessionsA WTSQuerySessionInformationW

oleaut32

GetErrorInfo SetErrorInfo SysFreeString SysStringLen

kernel32

ResumeThread GetExitCodeProcess CreateSemaphoreA CreateThread FreeLibrary QueryFullProcessImageNameW LocalAlloc CreateFileMappingW OpenProcess GetCurrentProcessId MapViewOfFile DuplicateHandle UnmapViewOfFile GetCurrentProcess LocalFree VirtualProtect FlushFileBuffers SetLastError ReleaseSemaphore GetCurrentDirectoryW Sleep FlsGetValue SleepConditionVariableSRW FindClose FindFirstFileW FindNextFileW GetFileAttributesW GetFileSize GetFileTime ReadFile SetFilePointer ResetEvent ReleaseMutex CreateMutexA GlobalAlloc GlobalSize GlobalUnlock GlobalLock GlobalFree FlsAlloc VirtualQueryEx FlsSetValue FlsFree IsProcessorFeaturePresent ExitThread QueueUserAPC FindFirstFileExW GetCommandLineA GetProcessId CreateFileW VirtualAllocEx CreateEventA GetNamedPipeClientProcessId OpenFileMappingW VirtualQuery ExpandEnvironmentStringsW InitializeProcThreadAttributeList UpdateProcThreadAttribute DeleteProcThreadAttributeList HeapSize GetStartupInfoW CreateProcessW SetEndOfFile EncodePointer WriteFile TerminateProcess GetFileType SetEvent GetNamedPipeInfo CreatePipe SetThreadPriority WaitForMultipleObjectsEx WaitForSingleObjectEx CreateSemaphoreW WakeConditionVariable InitializeConditionVariable InitOnceBeginInitialize GetLastError GetCurrentThreadId CloseHandle WaitForSingleObject Process32NextW Process32FirstW CreateToolhelp32Snapshot InitOnceComplete WakeAllConditionVariable GetCurrentThread GetProcAddress LoadLibraryExA CreateNamedPipeW TryAcquireSRWLockExclusive ReleaseSRWLockShared AcquireSRWLockShared ReleaseSRWLockExclusive AcquireSRWLockExclusive HeapFree HeapAlloc GetProcessHeap GetTimeZoneInformationForYear CreateEventW ConnectNamedPipe FormatMessageW GetFileSizeEx GetOverlappedResult DeviceIoControl GetUserPreferredUILanguages InitializeSListHead SetUnhandledExceptionFilter GetStringTypeW DecodePointer LCMapStringEx GetCPInfo InterlockedFlushSList RtlPcToFileHeader RaiseException RtlUnwindEx RtlUnwind FreeLibraryAndExitThread IsDebuggerPresent UnhandledExceptionFilter LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW OutputDebugStringW GetConsoleOutputCP IsValidCodePage GetACP GetOEMCP SetStdHandle GetSystemInfo GetTempPathW GetSystemTimeAsFileTime ReadConsoleW WriteConsoleW GetWindowsDirectoryW GetSystemDirectoryW WaitForMultipleObjects ReadFileEx GetFullPathNameW ExitProcess CancelIo CopyFileExW GetFinalPathNameByHandleW RemoveDirectoryW MoveFileExW DeleteFileW CreateDirectoryW GetFileInformationByHandle HeapReAlloc SleepEx WriteFileEx GetStdHandle SetFilePointerEx GetCommandLineW SetEnvironmentVariableW GetEnvironmentVariableW GetEnvironmentStringsW SetWaitableTimer CreateWaitableTimerExW SwitchToThread SetThreadStackGuarantee CompareStringOrdinal FreeEnvironmentStringsW CancelIoEx SetFileCompletionNotificationModes GetQueuedCompletionStatusEx CreateIoCompletionPort PostQueuedCompletionStatus InitializeCriticalSection SetHandleInformation SetThreadErrorMode GetProcessIoCounters GetSystemTimes GetLogicalProcessorInformationEx GetProcessTimes K32GetPerformanceInfo GlobalMemoryStatusEx GetTickCount64 SetConsoleMode GetFileInformationByHandleEx GetConsoleMode GetComputerNameExW SetFileTime GetLogicalDrives RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext WideCharToMultiByte GetLogicalProcessorInformation TryEnterCriticalSection SleepConditionVariableCS LeaveCriticalSection EnterCriticalSection DeleteCriticalSection InitializeCriticalSectionEx SetErrorMode QueryPerformanceCounter QueryPerformanceFrequency GetModuleFileNameW GetModuleHandleExW ReadProcessMemory MultiByteToWideChar GetModuleHandleExA SetThreadExecutionState LoadLibraryW ProcessIdToSessionId LoadLibraryExW SetDllDirectoryW GetNativeSystemInfo LoadLibraryA GetModuleHandleW WTSGetActiveConsoleSessionId WriteProcessMemory GetModuleHandleA SetConsoleCtrlHandler VerSetConditionMask FormatMessageA VerifyVersionInfoW lstrlenW lstrcmpiW

comctl32

RemoveWindowSubclass DefSubclassProc SetWindowSubclass

shell32

ShellExecuteA DragFinish DragQueryFileW Shell_NotifyIconGetRect SHAddToRecentDocs Shell_NotifyIconW SHGetKnownFolderPath CommandLineToArgvW SHAppBarMessage ShellExecuteExW ShellExecuteW

advapi32

CreateProcessAsUserW DuplicateTokenEx AdjustTokenPrivileges SetSecurityDescriptorDacl ImpersonateLoggedOnUser InitializeSecurityDescriptor CreateWellKnownSid ConvertStringSecurityDescriptorToSecurityDescriptorW CreateProcessWithLogonW FreeSid CreateProcessWithTokenW EqualSid SetNamedSecurityInfoW OpenProcessToken ConvertSidToStringSidW RevertToSelf ImpersonateAnonymousToken AllocateAndInitializeSid DuplicateToken GetLengthSid GetNamedSecurityInfoW ConvertStringSidToSidW GetTokenInformation LogonUserW IsWellKnownSid LookupAccountSidW SetEntriesInAclW LookupPrivilegeValueW RegOpenKeyExW RegSetValueExW StartServiceCtrlDispatcherW RegDeleteValueW RegDeleteTreeW RegisterServiceCtrlHandlerExW CloseServiceHandle OpenSCManagerW OpenServiceW QueryServiceStatusEx RegCloseKey RegDeleteKeyW RegEnumKeyExW RegEnumValueW SetServiceStatus GetUserNameW SystemFunction036 IsValidSid CopySid RegQueryValueExW

userenv

GetUserProfileDirectoryW CreateEnvironmentBlock DestroyEnvironmentBlock

user32

IsProcessDPIAware CheckMenuItem EnableMenuItem SetMenuItemInfoW AppendMenuW RemoveClipboardFormatListener ExitWindowsEx DrawIconEx EnumDisplaySettingsW SetForegroundWindow ShowWindow FindWindowW IsClipboardFormatAvailable InsertMenuW ReleaseDC EmptyClipboard GetIconInfo ClipCursor SetCursorPos OpenClipboard CreateWindowExA RegisterClassExA CreatePopupMenu CreateMenu DestroyMenu DrawTextW VkKeyScanExW DestroyAcceleratorTable FillRect GetWindowDC OffsetRect MapWindowPoints GetMenuBarInfo ShowCursor GetMenu SetMenu DrawMenuBar RemoveMenu GetMenuItemInfoW TrackPopupMenu SetTimer KillTimer SetWindowLongPtrW GetWindowLongPtrW ChangeWindowMessageFilterEx RegisterClassW GetClipCursor SetWindowLongW GetWindowPlacement GetSystemMenu LoadCursorA SetWindowPlacement ChangeDisplaySettingsExW AttachThreadInput CreateIcon DestroyIcon RegisterWindowMessageA SetWindowDisplayAffinity GetClipboardFormatNameA GetUpdateRect CountClipboardFormats ToUnicodeEx MessageBoxW MapVirtualKeyW GetMonitorInfoW SetCursor MapVirtualKeyExW GetKeyboardState GetRawInputData SystemParametersInfoW ReleaseCapture SetCapture MsgWaitForMultipleObjectsEx SetPropW AllowSetForegroundWindow AdjustWindowRectEx RegisterClipboardFormatW wsprintfW LoadCursorW GetWindowRect SetWindowPos MonitorFromWindow RegisterClipboardFormatA GetSystemMetrics CloseTouchInputHandle GetTouchInputInfo DestroyWindow TrackMouseEvent MonitorFromRect ClientToScreen GetWindowLongW ScreenToClient GetAsyncKeyState DefWindowProcW PostThreadMessageW PeekMessageW SendMessageW GetClipboardData ValidateRect GetClientRect RedrawWindow DispatchMessageW GetMessageW GetWindowThreadProcessId GetForegroundWindow UnhookWindowsHookEx DispatchMessageA TranslateMessage GetMessageA SetWindowsHookExA DefWindowProcA AddClipboardFormatListener PostMessageW GetCursorPos GetCursorInfo LockWorkStation SetClipboardData ChangeClipboardChain SetClipboardViewer SendMessageA RegisterRawInputDevices RegisterClassExW SendInput PostQuitMessage GetClipboardOwner GetUserObjectInformationA GetThreadDesktop CloseDesktop SetThreadDesktop OpenInputDesktop GetDoubleClickTime GetKeyboardLayout CreateWindowExW SystemParametersInfoA GetActiveWindow CloseClipboard EnumDisplaySettingsExW InvalidateRgn EnumDisplayDevicesW GetMonitorInfoA PostMessageA FindWindowExA CreateAcceleratorTableW IsWindowVisible EnumDisplayMonitors GetKeyState CallNextHookEx PostThreadMessageA IsWindow BlockInput RegisterTouchWindow GetDC

ole32

CoTaskMemAlloc CoTaskMemFree RevokeDragDrop CoUninitialize CoInitializeEx CoCreateInstance OleGetClipboard OleIsCurrentClipboard ReleaseStgMedium PropVariantClear OleUninitialize OleInitialize RegisterDragDrop OleSetClipboard

secur32

DeleteSecurityContext FreeCredentialsHandle AcquireCredentialsHandleA ApplyControlToken QueryContextAttributesW DecryptMessage InitializeSecurityContextW FreeContextBuffer AcceptSecurityContext EncryptMessage

ws2_32

accept connect listen getsockname bind send recv WSAGetLastError getsockopt WSAStartup ioctlsocket getpeername shutdown recvfrom sendto setsockopt WSAIoctl WSASend closesocket socket WSACleanup freeaddrinfo getaddrinfo WSASocketW

gdi32

GetObjectA GetBitmapBits DeleteObject SelectObject DeleteDC CreateDCW SetTextColor CreateDIBitmap SetBkMode CreateSolidBrush CreateRectRgn CreateDIBSection GetDeviceCaps CreateCompatibleBitmap GetDIBits CreateCompatibleDC BitBlt

crypt32

CertEnumCertificatesInStore CertDuplicateCertificateChain CertFreeCertificateChain CertDuplicateCertificateContext CertFreeCertificateContext CertGetCertificateChain CertVerifyTimeValidity CertGetEnhancedKeyUsage CertDuplicateStore CertCloseStore CertOpenStore CertVerifyCertificateChainPolicy CertAddCertificateContextToStore

winspool.drv

EnumPrintersW GetDefaultPrinterW EnumPrinterDriversW DeletePrinterDriverExW DeletePrinterDriverPackageW EnumPortsW OpenPrinterW XcvDataW ClosePrinter SetPrinterW DeletePrinter UploadPrinterDriverPackageW InstallPrinterDriverFromPackageW AddPrinterW

setupapi

SetupDiGetDeviceInfoListDetailW SetupDiGetDeviceRegistryPropertyW SetupDiGetClassDevsExW SetupDiCallClassInstaller SetupDiSetDeviceRegistryPropertyW SetupDiSetClassInstallParamsW SetupDiCreateDeviceInfoW SetupDiGetClassDevsW SetupDiGetDeviceInstallParamsW SetupDiEnumDeviceInterfaces SetupDiCreateDeviceInfoList SetupDiGetINFClassW SetupDiDestroyDeviceInfoList SetupDiGetDeviceInterfaceDetailW SetupDiEnumDeviceInfo

dwmapi

DwmEnableBlurBehindWindow

cfgmgr32

CM_Get_DevNode_Status

iphlpapi

GetAdaptersAddresses GetBestInterface SendARP

ntdll

RtlGetVersion NtCancelIoFileEx NtWriteFile NtReadFile NtQuerySystemInformation NtQueryInformationProcess RtlGetNtVersionNumbers NtCreateFile NtDeviceIoControlFile RtlNtStatusToDosError

powrprof

CallNtPowerInformation

d3d11

D3D11CreateDevice

dxgi

CreateDXGIFactory1

pdh

PdhAddEnglishCounterW PdhOpenQueryA PdhCollectQueryDataEx PdhGetFormattedCounterValue PdhRemoveCounter PdhCloseQuery PdhCollectQueryData PdhAddEnglishCounterA

psapi

GetProcessMemoryInfo GetModuleFileNameExW

bcrypt

BCryptGenRandom

drop_dart_object free_WireSyncReturn free_c_args free_zero_copy_buffer_f32 free_zero_copy_buffer_f64 free_zero_copy_buffer_i16 free_zero_copy_buffer_i32 free_zero_copy_buffer_i64 free_zero_copy_buffer_i8 free_zero_copy_buffer_u16 free_zero_copy_buffer_u32 free_zero_copy_buffer_u64 free_zero_copy_buffer_u8 get_dart_object get_rustdesk_app_name init_frb_dart_api_dl new_StringList_0 new_dart_opaque new_int_32_list_0 new_uint_8_list_0 privacy_mode_hook_keyboard privacy_mode_hook_mouse rustdesk_core_main_args session_get_rgba store_dart_post_cobject wire_cm_can_elevate wire_cm_check_click_time wire_cm_check_clients_length wire_cm_close_connection wire_cm_close_voice_call wire_cm_elevate_portable wire_cm_get_click_time wire_cm_get_clients_length wire_cm_get_clients_state wire_cm_get_config wire_cm_handle_incoming_voice_call wire_cm_init wire_cm_login_res wire_cm_remove_disconnected_connection wire_cm_send_chat wire_cm_switch_back wire_cm_switch_permission wire_get_double_click_time wire_get_local_flutter_option wire_get_local_kb_layout_type wire_get_next_texture_key wire_get_voice_call_input_device wire_host_stop_system_key_propagate wire_install_install_me wire_install_install_options wire_install_install_path wire_install_run_without_install wire_install_show_run_without_install wire_is_custom_client wire_is_disable_ab wire_is_disable_account wire_is_disable_group_panel wire_is_disable_installation wire_is_disable_settings wire_is_incoming_only wire_is_outgoing_only wire_is_preset_password wire_is_preset_password_mobile_only wire_is_selinux_enforcing wire_is_support_multi_ui_session wire_main_account_auth wire_main_account_auth_cancel wire_main_account_auth_result wire_main_audio_support_loopback wire_main_change_id wire_main_change_language wire_main_change_theme wire_main_check_connect_status wire_main_check_hwcodec wire_main_check_mouse_time wire_main_check_super_user_permission wire_main_clear_ab wire_main_clear_group wire_main_clear_trusted_devices wire_main_clip_cursor wire_main_create_shortcut wire_main_current_is_wayland wire_main_default_privacy_mode_impl wire_main_deploy_device wire_main_device_id wire_main_device_name wire_main_discover wire_main_forget_password wire_main_generate2fa wire_main_get_api_server wire_main_get_app_name wire_main_get_app_name_sync wire_main_get_async_status wire_main_get_build_date wire_main_get_buildin_option wire_main_get_common wire_main_get_common_sync wire_main_get_connect_status wire_main_get_data_dir_ios wire_main_get_displays wire_main_get_env wire_main_get_error wire_main_get_fav wire_main_get_fingerprint wire_main_get_hard_option wire_main_get_home_dir wire_main_get_http_status wire_main_get_input_source wire_main_get_lan_peers wire_main_get_langs wire_main_get_last_remote_id wire_main_get_license wire_main_get_local_option wire_main_get_login_device_info wire_main_get_main_display wire_main_get_mouse_time wire_main_get_my_id wire_main_get_new_stored_peers wire_main_get_new_version wire_main_get_option wire_main_get_option_sync wire_main_get_options wire_main_get_options_sync wire_main_get_peer_flutter_option_sync wire_main_get_peer_option wire_main_get_peer_option_sync wire_main_get_peer_sync wire_main_get_printer_names wire_main_get_proxy_status wire_main_get_socks wire_main_get_software_update_url wire_main_get_sound_inputs wire_main_get_temporary_password wire_main_get_trusted_devices wire_main_get_unlock_pin wire_main_get_use_texture_render wire_main_get_user_default_option wire_main_get_uuid wire_main_get_version wire_main_goto_install wire_main_handle_relay_id wire_main_handle_wayland_screencast_restore_token wire_main_has_file_clipboard wire_main_has_gpu_texture_render wire_main_has_hwcodec wire_main_has_valid_2fa_sync wire_main_has_valid_bot_sync wire_main_has_vram wire_main_hide_dock wire_main_http_request wire_main_init wire_main_init_input_source wire_main_is_can_input_monitoring wire_main_is_can_screen_recording wire_main_is_installed wire_main_is_installed_daemon wire_main_is_installed_lower_version wire_main_is_login_wayland wire_main_is_option_fixed wire_main_is_process_trusted wire_main_is_root wire_main_is_share_rdp wire_main_is_using_public_server wire_main_load_ab wire_main_load_fav_peers wire_main_load_group wire_main_load_lan_peers wire_main_load_recent_peers wire_main_load_recent_peers_for_ab wire_main_max_encrypt_len wire_main_on_main_window_close wire_main_peer_exists wire_main_peer_has_password wire_main_remove_discovered wire_main_remove_peer wire_main_remove_trusted_devices wire_main_resolve_avatar_url wire_main_save_ab wire_main_save_group wire_main_set_common wire_main_set_cursor_position wire_main_set_env wire_main_set_home_dir wire_main_set_input_source wire_main_set_local_option wire_main_set_option wire_main_set_options wire_main_set_peer_alias wire_main_set_peer_flutter_option_sync wire_main_set_peer_option wire_main_set_peer_option_sync wire_main_set_permanent_password_with_result wire_main_set_share_rdp wire_main_set_socks wire_main_set_unlock_pin wire_main_set_user_default_option wire_main_show_option wire_main_start_dbus_server wire_main_start_ipc_url_server wire_main_start_service wire_main_stop_service wire_main_store_fav wire_main_support_remove_wallpaper wire_main_supported_hwdecodings wire_main_supported_input_source wire_main_supported_privacy_mode_impls wire_main_test_if_valid_server wire_main_test_wallpaper wire_main_update_me wire_main_update_temporary_password wire_main_uri_prefix_sync wire_main_verify2fa wire_main_verify_bot wire_main_video_save_directory wire_main_wol wire_option_synced wire_peer_get_sessions_count wire_plugin_enable wire_plugin_event wire_plugin_feature_is_enabled wire_plugin_get_session_option wire_plugin_get_shared_option wire_plugin_install wire_plugin_is_enabled wire_plugin_list_reload wire_plugin_register_event_stream wire_plugin_reload wire_plugin_set_session_option wire_plugin_set_shared_option wire_plugin_sync_ui wire_query_onlines wire_send_url_scheme wire_session_add_existed_sync wire_session_add_job wire_session_add_port_forward wire_session_add_sync wire_session_alternative_codecs wire_session_cancel_job wire_session_change_prefer_codec wire_session_change_resolution wire_session_close wire_session_close_terminal wire_session_close_voice_call wire_session_create_dir wire_session_ctrl_alt_del wire_session_elevate_direct wire_session_elevate_with_logon wire_session_enter_or_leave wire_session_get_audit_guid wire_session_get_audit_server_sync wire_session_get_common wire_session_get_common_sync wire_session_get_conn_session_id wire_session_get_conn_token wire_session_get_custom_image_quality wire_session_get_displays_as_individual_windows wire_session_get_edge_scroll_edge_thickness wire_session_get_enable_trusted_devices wire_session_get_flutter_option wire_session_get_image_quality wire_session_get_is_recording wire_session_get_keyboard_mode wire_session_get_last_audit_note wire_session_get_option wire_session_get_peer_option wire_session_get_platform wire_session_get_remember wire_session_get_reverse_mouse_wheel_sync wire_session_get_rgba_size wire_session_get_scroll_style wire_session_get_toggle_option wire_session_get_toggle_option_sync wire_session_get_trackpad_speed wire_session_get_use_all_my_displays_for_the_remote_session wire_session_get_view_style wire_session_handle_flutter_key_event wire_session_handle_flutter_raw_key_event wire_session_handle_screenshot wire_session_input_key wire_session_input_os_password wire_session_input_string wire_session_is_keyboard_mode_supported wire_session_is_multi_ui_session wire_session_load_last_transfer_jobs wire_session_lock_screen wire_session_login wire_session_new_rdp wire_session_next_rgba wire_session_on_waiting_for_image_dialog_show wire_session_open_terminal wire_session_peer_option wire_session_printer_response wire_session_read_dir_to_remove_recursive wire_session_read_local_dir_sync wire_session_read_local_empty_dirs_recursive_sync wire_session_read_remote_dir wire_session_read_remote_empty_dirs_recursive_sync wire_session_reconnect wire_session_record_screen wire_session_refresh wire_session_register_gpu_texture wire_session_register_pixelbuffer_texture wire_session_remove_all_empty_dirs wire_session_remove_file wire_session_remove_port_forward wire_session_rename_file wire_session_request_new_display_init_msgs wire_session_request_voice_call wire_session_resize_terminal wire_session_restart_remote_device wire_session_resume_job wire_session_send2fa wire_session_send_chat wire_session_send_files wire_session_send_mouse wire_session_send_note wire_session_send_pointer wire_session_send_selected_session_id wire_session_send_terminal_input wire_session_set_audit_guid wire_session_set_confirm_override_file wire_session_set_custom_fps wire_session_set_custom_image_quality wire_session_set_displays_as_individual_windows wire_session_set_edge_scroll_edge_thickness wire_session_set_flutter_option wire_session_set_image_quality wire_session_set_keyboard_mode wire_session_set_reverse_mouse_wheel wire_session_set_scroll_style wire_session_set_size wire_session_set_trackpad_speed wire_session_set_use_all_my_displays_for_the_remote_session wire_session_set_view_style wire_session_start wire_session_start_with_displays wire_session_switch_display wire_session_switch_sides wire_session_take_screenshot wire_session_toggle_option wire_session_toggle_privacy_mode wire_session_toggle_virtual_display wire_set_cur_session_id wire_set_local_flutter_option wire_set_local_kb_layout_type wire_set_voice_call_input_device wire_start_global_event_stream wire_stop_global_event_stream wire_translate wire_version_to_number wire_will_session_close_close_session

Name

.text

Size

18.5MB

Virtual Size

18.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rodata

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

10.5MB

Virtual Size

10.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

49KB

Virtual Size

393KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

372KB

Virtual Size

371KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

48B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

260KB

Virtual Size

259KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

146e96c025ce89318a3a6eebec06f8dd1cb00baec8777cb7b756d0ab96f82fb4.zip

146e96c025ce89318a3a6eebec06f8dd1cb00baec8777cb7b756d0ab96f82fb4

sas

newdev

wtsapi32

oleaut32

kernel32

comctl32

shell32

advapi32

userenv

user32

ole32

secur32

ws2_32

gdi32

crypt32

winspool.drv

setupapi

dwmapi

cfgmgr32

iphlpapi

ntdll

powrprof

d3d11

dxgi

pdh

psapi

bcrypt

generic