vexor-updater[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
vexor-updater.exe
Size 2.4MB
Sample260712-glvtpae16y
SHA256 902584a04274d0cfbb766ace6f0b52d90d4b43bd0c6bda89ca5a6547662f02b2
MD5 468d4be3b71eea444c233ea682ea2f29
SHA1 21559b0d04719811d35d2482c0b455b8540e581e
SHA512 5422b79836480232ce96f2be8022e5149e1bf1382c7c86ab26812953de41f821753f042606443348a1d7ef6ce4fd8257c0ff9b6d1ecff5b1018791ede7e2d168
SSDEEP 49152:HoaFRu674+P2Jn2fpJ+79akz2UsnE73nowWx2mk9GDBWASp:nDJU9Tsnzc14Dm
TLSH
T1F7C5CF4552A916ECC176E178D706A617FA3A34840B309AFB1BE14A162F63BF3577F320
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
vexor-updater.exe

File Explorer

vexor-updater.exe

.exe 2.4MB

vexor-updater.exe

IMPHASH c858de1c52870f326958ecff2d32dfef
SHA256 902584a04274d0cfbb766ace6f0b52d90d4b43bd0c6bda89ca5a6547662f02b2
MD5 468d4be3b71eea444c233ea682ea2f29
SHA1 21559b0d04719811d35d2482c0b455b8540e581e
SHA512 5422b79836480232ce96f2be8022e5149e1bf1382c7c86ab26812953de41f821753f042606443348a1d7ef6ce4fd8257c0ff9b6d1ecff5b1018791ede7e2d168
SSDEEP 49152:HoaFRu674+P2Jn2fpJ+79akz2UsnE73nowWx2mk9GDBWASp:nDJU9Tsnzc14Dm
TLSH
T1F7C5CF4552A916ECC176E178D706A617FA3A34840B309AFB1BE14A162F63BF3577F320
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Password

ChangeSoon.999

Minor OS version

Major OS version

Entry point

1185860

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\vexx\Documents\Sources\Secureloader\Genesis\x64\Release\bypass.pdb

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_47

D3DCompile

wininet

InternetOpenUrlA InternetOpenA InternetReadFile InternetCloseHandle

kernel32

LoadResource WriteFile GetTempPathW CreateFileW GetCurrentThreadId GetTickCount64 GetLastError DeleteFileW CloseHandle GetCurrentProcessId CreateProcessW FlushFileBuffers CreateDirectoryW ReadFile GetVolumeInformationW Sleep GetComputerNameW HeapFree HeapAlloc GetProcessHeap GetEnvironmentVariableW GetFileAttributesW MoveFileExW GetFileSizeEx LocalFree SetLastError GetTempPathA OutputDebugStringA FindResourceA CreateToolhelp32Snapshot Process32NextW GetCurrentThread Process32FirstW K32GetModuleBaseNameA GetThreadContext K32EnumProcessModules IsDebuggerPresent CheckRemoteDebuggerPresent CreateFileA MapViewOfFile UnmapViewOfFile CreateFileMappingA GetTickCount RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter IsProcessorFeaturePresent GetStartupInfoW GetSystemTimeAsFileTime InitializeSListHead InitOnceComplete InitOnceBeginInitialize LockResource SizeofResource GetModuleFileNameA SetUnhandledExceptionFilter TerminateProcess GlobalUnlock WideCharToMultiByte GlobalLock GlobalFree GlobalAlloc QueryPerformanceCounter FreeLibrary GetProcAddress QueryPerformanceFrequency LoadLibraryA MultiByteToWideChar GetLocaleInfoA SleepConditionVariableSRW GetModuleHandleW WakeAllConditionVariable AcquireSRWLockExclusive ReleaseSRWLockExclusive GetCurrentProcess

user32

SetCursorPos IsWindowVisible EnumWindows GetWindowTextW DefWindowProcW DispatchMessageA GetWindowRect DestroyWindow MessageBoxW SetWindowRgn CreateWindowExW GetSystemMetrics UnregisterClassW RegisterClassExW ShowWindow MoveWindow TranslateMessage LoadIconA PeekMessageA PostQuitMessage UpdateWindow OpenClipboard CloseClipboard EmptyClipboard GetClipboardData SetClipboardData GetKeyState SetCursor GetMessageExtraInfo LoadCursorA ScreenToClient ReleaseCapture IsWindowUnicode GetClientRect SetCapture GetForegroundWindow GetKeyboardLayout TrackMouseEvent ClientToScreen GetCapture GetCursorPos

gdi32

CreateRoundRectRgn

advapi32

CryptDestroyHash CryptGenRandom CredWriteW CredReadW CredFree CredDeleteW CryptReleaseContext RegCloseKey CryptAcquireContextW RegQueryValueExW CryptGetHashParam RegOpenKeyExW CryptCreateHash CryptHashData

shell32

ShellExecuteW SHGetFolderPathW ShellExecuteA

ole32

CoCreateInstance

dwmapi

DwmExtendFrameIntoClientArea

msvcp140

_Thrd_detach _Query_perf_counter _Cnd_do_broadcast_at_thread_exit _Mtx_lock ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ?_Throw_Cpp_error@std@@YAXH@Z _Strxfrm ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z ?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z ?id@?$ctype@D@std@@2V0locale@2@A ?id@?$collate@D@std@@2V0locale@2@A _Strcoll ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?tolower@?$ctype@D@std@@QEBAPEBDPEADPEBD@Z ?tolower@?$ctype@D@std@@QEBADD@Z ??1facet@locale@std@@MEAA@XZ ??0facet@locale@std@@IEAA@_K@Z ?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ ?_Incref@facet@locale@std@@UEAAXXZ ?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ ??1_Locinfo@std@@QEAA@XZ ??0_Locinfo@std@@QEAA@PEBD@Z _Thrd_id _Thrd_join _Query_perf_frequency ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?_Xbad_function_call@std@@YAXXZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ?good@ios_base@std@@QEBA_NXZ _Mtx_unlock ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ?_Xbad_alloc@std@@YAXXZ ?_Xlength_error@std@@YAXPEBD@Z ?_Xout_of_range@std@@YAXPEBD@Z ?_Random_device@std@@YAIXZ ?__ExceptionPtrCreate@@YAXPEAX@Z ?__ExceptionPtrCopy@@YAXPEAXPEBX@Z ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?uncaught_exceptions@std@@YAHXZ ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Id_cnt@id@locale@std@@0HA ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?__ExceptionPtrToBool@@YA_NPEBX@Z ?__ExceptionPtrDestroy@@YAXPEAX@Z ?__ExceptionPtrCurrentException@@YAXPEAX@Z ?__ExceptionPtrRethrow@@YAXPEBX@Z ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z

imm32

ImmSetCompositionWindow ImmReleaseContext ImmGetContext ImmSetCandidateWindow

winhttp

WinHttpAddRequestHeaders WinHttpQueryHeaders WinHttpReadData WinHttpReceiveResponse WinHttpSetOption WinHttpCloseHandle WinHttpSendRequest WinHttpQueryDataAvailable WinHttpOpen WinHttpOpenRequest WinHttpConnect

bcrypt

BCryptGetProperty BCryptGenerateSymmetricKey BCryptSetProperty BCryptDecrypt BCryptDestroyKey BCryptCreateHash BCryptHashData BCryptDestroyHash BCryptCloseAlgorithmProvider BCryptFinishHash BCryptOpenAlgorithmProvider

rpcrt4

RpcStringFreeA UuidToStringA UuidCreate

crypt32

CryptProtectData CryptStringToBinaryA CryptUnprotectData

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__std_exception_destroy __std_exception_copy strstr strchr __current_exception_context __current_exception strrchr longjmp memchr memcpy wcsstr __intrinsic_setjmp _CxxThrowException memmove memset __std_terminate __C_specific_handler memcmp

api-ms-win-crt-stdio-l1-1-0

fwrite fread __stdio_common_vsscanf __p__commode __stdio_common_vfprintf fseek fclose fflush fputc __acrt_iob_func __stdio_common_vswprintf_s ftell _get_stream_buffer_pointers _fseeki64 __stdio_common_vsprintf fsetpos ungetc fgetc setvbuf _set_fmode fgetpos __stdio_common_vsprintf_s _wfopen

api-ms-win-crt-heap-l1-1-0

realloc free _set_new_mode malloc _callnewh

api-ms-win-crt-runtime-l1-1-0

_Exit _c_exit _exit _initterm _get_narrow_winmain_command_line _set_app_type _seh_filter_exe exit _cexit _crt_atexit _beginthreadex terminate _invoke_watson set_terminate _register_onexit_function _initialize_onexit_table abort _initterm_e _initialize_narrow_environment _configure_narrow_argv _register_thread_local_exe_atexit_callback

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-string-l1-1-0

towlower strcmp strncpy strncpy_s strcpy_s wcscpy_s isxdigit tolower strncmp isdigit

api-ms-win-crt-convert-l1-1-0

strtol strtoull atoi

api-ms-win-crt-filesystem-l1-1-0

_unlock_file _lock_file

api-ms-win-crt-time-l1-1-0

_time64 _localtime64_s

api-ms-win-crt-math-l1-1-0

powf fmodf cosf ceilf sinf acosf sqrtf __setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale