syte[.]xyz[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
syte.xyz.exe
Size 2.0MB
Sample260705-e64afshv8s
SHA256 a69a3f0c1b904e1d44a13d36a03fbd4ff7e0f2022349ddf6816ec26be9667810
MD5 bc25eb422e8808b1aacbda8996749720
SHA1 d4ca9c5d424a87d404223b0180cdd14391ca490e
SHA512 0ead1d5454ec74538f663c825333b964c2802df5153388d0fd479d7bad29a4200aac2c54d31f662b8f0a40f832c2c7b3829bf54b21157d87d54cd587510236ac
SSDEEP 49152:n0z1pdBbdqEMmTr34B/YTlWveBwUOpao5JnmbpSN:SbBUfiroBGlyPnmu
TLSH
T161A57D47F2A340E8C13BD1348653E776FA3078164524AE6F7ADCCB741F72E604A6AB64
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
syte.xyz.exe

File Explorer

syte.xyz.exe

.exe 2.0MB

syte.xyz.exe

IMPHASH 2ace672174b54f635ed3f878137a5371
SHA256 a69a3f0c1b904e1d44a13d36a03fbd4ff7e0f2022349ddf6816ec26be9667810
MD5 bc25eb422e8808b1aacbda8996749720
SHA1 d4ca9c5d424a87d404223b0180cdd14391ca490e
SHA512 0ead1d5454ec74538f663c825333b964c2802df5153388d0fd479d7bad29a4200aac2c54d31f662b8f0a40f832c2c7b3829bf54b21157d87d54cd587510236ac
SSDEEP 49152:n0z1pdBbdqEMmTr34B/YTlWveBwUOpao5JnmbpSN:SbBUfiroBGlyPnmu
TLSH
T161A57D47F2A340E8C13BD1348653E776FA3078164524AE6F7ADCCB741F72E604A6AB64
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5216

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

advapi32

ConvertStringSecurityDescriptorToSecurityDescriptorA RegCloseKey RegOpenKeyExW RegQueryValueExW

d3d11

D3D11CreateDevice D3D11CreateDeviceAndSwapChain

d3dcompiler_47

D3DCompile

dwmapi

DwmEnableBlurBehindWindow DwmGetColorizationColor DwmIsCompositionEnabled

gdi32

CreateRectRgn DeleteObject GetDeviceCaps

kernel32

AllocConsole CheckRemoteDebuggerPresent CloseHandle ConnectNamedPipe CreateEventA CreateFileA CreateNamedPipeA CreateProcessA CreateSemaphoreA CreateToolhelp32Snapshot DeleteCriticalSection DeleteFileA DisconnectNamedPipe DuplicateHandle EnterCriticalSection FindResourceA FormatMessageA FreeLibrary GetCPInfo GetConsoleWindow GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetExitCodeProcess GetLastError GetLocaleInfoA GetModuleHandleA GetModuleHandleW GetNamedPipeClientProcessId GetOverlappedResult GetProcAddress GetProcessAffinityMask GetStartupInfoA GetSystemTimeAsFileTime GetTempPathA GetThreadContext GetThreadPriority GetTickCount GlobalAlloc GlobalFree GlobalLock GlobalUnlock InitializeCriticalSection IsDBCSLeadByte IsDebuggerPresent IsProcessorFeaturePresent LeaveCriticalSection LoadLibraryA LoadLibraryW LoadResource LocalFree LockResource Module32FirstW Module32NextW MultiByteToWideChar OpenProcess OpenThread OutputDebugStringA PeekNamedPipe Process32FirstW Process32NextW QueryFullProcessImageNameA QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReadFile ReleaseSemaphore ResetEvent ResumeThread RtlCaptureContext RtlLookupFunctionEntry RtlUnwindEx RtlVirtualUnwind SearchPathA SetConsoleTitleA SetEvent SetLastError SetProcessAffinityMask SetThreadContext SetThreadPriority SetUnhandledExceptionFilter SizeofResource Sleep SuspendThread TerminateProcess Thread32First Thread32Next TlsAlloc TlsGetValue TlsSetValue TryEnterCriticalSection VerSetConditionMask VirtualProtect VirtualQuery WaitForMultipleObjects WaitForSingleObject WideCharToMultiByte WriteFile

msvcrt

_XcptFilter ___lc_codepage_func ___mb_cur_max_func __getmainargs __initenv __iob_func __set_app_type __setusermatherr _acmdln _amsg_exit _assert _beginthreadex _cexit _commode _endthreadex _errno _exit _fileno _fmode _initterm _lock _read _setjmp _setmode _strdup _strdup _stricmp _strnicmp _strtoi64 _strtoui64 _unlock _vscprintf _vsnprintf _wcsicmp _wfopen _write abort atexit atof calloc exit fclose fflush fprintf fputc fputs fread free freopen_s fseek ftell fwrite getc getenv isdigit isspace iswctype isxdigit ldexp localeconv longjmp malloc memchr memcmp memcpy memmove memset qsort realloc setlocale setvbuf strchr strcmp strcoll strerror strftime strlen strncmp strncpy strrchr strtol strtoul strxfrm tolower towupper towlower ungetc vfprintf wcscoll wcsftime wcslen wcsxfrm

shell32

ShellExecuteW

user32

ClientToScreen CloseClipboard CreateWindowExA DefWindowProcA DefWindowProcW DispatchMessageA EmptyClipboard GetAsyncKeyState GetCapture GetClientRect GetClipboardData GetCursorPos GetDC GetForegroundWindow GetKeyState GetKeyboardLayout GetMessageExtraInfo IsWindowUnicode LoadCursorA MessageBoxA MonitorFromWindow OpenClipboard PeekMessageA RegisterClassExA ReleaseCapture ReleaseDC ScreenToClient SetCapture SetClipboardData SetCursor SetCursorPos SetProcessDPIAware SetWindowLongPtrA ShowWindow TrackMouseEvent TranslateMessage UpdateWindow

winhttp

WinHttpCloseHandle WinHttpConnect WinHttpOpen WinHttpOpenRequest WinHttpQueryHeaders WinHttpReadData WinHttpReceiveResponse WinHttpSendRequest WinHttpSetTimeouts

winmm

PlaySoundA

openvr_api

VR_GetGenericInterface VR_GetInitToken VR_InitInternal2 VR_IsInterfaceVersionValid VR_ShutdownInternal

Name

.text

Size

1.3MB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

23KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

186KB

Virtual Size

186KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

41KB

Virtual Size

41KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

52KB

Virtual Size

51KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

10KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

32B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

410KB

Virtual Size

409KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

syte.xyz.exe

advapi32

d3d11

d3dcompiler_47

dwmapi

gdi32

kernel32

msvcrt

shell32

user32

winhttp

winmm

openvr_api

generic