6c0dd4b41af06c01f45933091c91023accb2d2d889e66f948a8f0ef99b963fc0

Sharing

Copy URL Twitter E-mail

General

Target
6c0dd4b41af06c01f45933091c91023accb2d2d889e66f948a8f0ef99b963fc0
Size 5.2MB
Sample260720-mtp63afs7n
SHA256 6c0dd4b41af06c01f45933091c91023accb2d2d889e66f948a8f0ef99b963fc0
MD5 d81e8f99b70ee85c005693b478fd7bdb
SHA1 c891396a9daa178f3e26cd0278f32114958a26f5
SHA512 628005515c78d6fa16293fa8b185d5683d356ef88f8a143450a54f406af48c73c07ac7aeadadac998eab9f1ea727e562f1ce9a101709558c0f0cd6dc270ae09e
SSDEEP 98304:XmE4o0FIFfjXF3cXAERE8EEEiEEE6EEEYEEE/EEEvEEEsr4jXF3cXAERE8EEEiEd:LjXF3cXAERE8EEEiEEE6EEEYEEE/EEEK
TLSH
T16646DD91B2101355E2FF50B56C931CEADF0026A517B913C68FC8A77A2F83E9B867E507
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6c0dd4b41af06c01f45933091c91023accb2d2d889e66f948a8f0ef99b963fc0

File Explorer

6c0dd4b41af06c01f45933091c91023accb2d2d889e66f948a8f0ef99b963fc0

.exe 5.2MB

6c0dd4b41af06c01f45933091c91023accb2d2d889e66f948a8f0ef99b963fc0

IMPHASH 6541d04c6a3ddec29a09c18577e30715
SHA256 6c0dd4b41af06c01f45933091c91023accb2d2d889e66f948a8f0ef99b963fc0
MD5 d81e8f99b70ee85c005693b478fd7bdb
SHA1 c891396a9daa178f3e26cd0278f32114958a26f5
SHA512 628005515c78d6fa16293fa8b185d5683d356ef88f8a143450a54f406af48c73c07ac7aeadadac998eab9f1ea727e562f1ce9a101709558c0f0cd6dc270ae09e
SSDEEP 98304:XmE4o0FIFfjXF3cXAERE8EEEiEEE6EEEYEEE/EEEvEEEsr4jXF3cXAERE8EEEiEd:LjXF3cXAERE8EEEiEEE6EEEYEEE/EEEK
TLSH
T16646DD91B2101355E2FF50B56C931CEADF0026A517B913C68FC8A77A2F83E9B867E507
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

101236

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\vmagent_new\bin\joblist\862127\out\Release\360Thrust64.pdb

kernel32

DeleteCriticalSection FlushInstructionCache FindResourceExW EnterCriticalSection LeaveCriticalSection GetModuleHandleW GetModuleFileNameW lstrlenW InitializeCriticalSection FreeLibrary LoadLibraryExW lstrcmpiW LocalFree LocalAlloc GetConsoleOutputCP WriteConsoleA SetStdHandle LCMapStringW LCMapStringA GetStringTypeW GetStringTypeA IsValidLocale EnumSystemLocalesA GetUserDefaultLCID GetTimeFormatA GetDateFormatA GetCurrentThreadId GetConsoleCP SetFilePointer WideCharToMultiByte GetLocaleInfoA GetLocaleInfoW InitializeCriticalSectionAndSpinCount LoadLibraryA SetConsoleCtrlHandler IsValidCodePage GetOEMCP GetACP lstrlenA MultiByteToWideChar SetLastError CreateThread RaiseException CreatePipe GetStartupInfoW WaitForSingleObject RemoveDirectoryW DeleteFileW GetWindowsDirectoryW GetVersionExW FindFirstFileW GetFileAttributesW FindNextFileW FindClose GetSystemDirectoryA DeleteFileA FindResourceW GetLastError LoadResource LockResource SizeofResource CloseHandle SetFileAttributesW SetEnvironmentVariableA CompareStringW GetCPInfo CompareStringA FlushFileBuffers CreateFileA GetTimeZoneInformation FatalAppExitA GetSystemTimeAsFileTime GetCurrentProcessId GetTickCount QueryPerformanceCounter GetStartupInfoA GetFileType SetHandleCount GetCommandLineW WriteFile GetModuleHandleA GetProcAddress GetCurrentProcess GetSystemDirectoryW CreateProcessW CreateFileW GetFileSize ReadFile GetConsoleMode InterlockedPushEntrySList HeapFree HeapAlloc GetProcessHeap VirtualFree VirtualAlloc InterlockedPopEntrySList HeapDestroy HeapReAlloc HeapSize TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext RtlUnwindEx RtlPcToFileHeader EncodePointer DecodePointer TlsAlloc FlsGetValue FlsSetValue FlsFree GetCurrentThread FlsAlloc Sleep ExitProcess GetStdHandle GetModuleFileNameA HeapSetInformation HeapCreate FreeEnvironmentStringsW GetEnvironmentStringsW WriteConsoleW

user32

CharNextW SetWindowLongPtrW GetWindow GetWindowRect GetWindowLongW MonitorFromWindow UnregisterClassA GetClientRect MapWindowPoints SetWindowPos GetDlgItem GetParent SetDlgItemTextW SendDlgItemMessageW DestroyWindow SendMessageW EndDialog DialogBoxParamW wsprintfW GetSystemMetrics LoadImageW DefWindowProcW GetActiveWindow GetMonitorInfoW

advapi32

GetUserNameW RegEnumKeyExW RegOpenKeyExW RegDeleteKeyW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken RegOpenKeyW RegQueryValueExW RegEnumKeyW GetNamedSecurityInfoW BuildExplicitAccessWithNameW SetEntriesInAclW SetNamedSecurityInfoW GetExplicitEntriesFromAclW DeleteAce LookupAccountNameW LookupAccountSidW RegCreateKeyExW RegCreateKeyW RegSetValueExW RegDeleteValueW RegQueryInfoKeyW RegCloseKey

ole32

CoTaskMemRealloc CoTaskMemAlloc CoTaskMemFree CoInitialize CoUninitialize CoCreateInstance

oleaut32

SysFreeString VarUI4FromStr

shlwapi

PathAppendW PathFileExistsW PathRemoveFileSpecW StrStrIW StrCmpIW

comctl32

InitCommonControlsEx

crypt32

CertEnumCertificatesInStore CertCloseStore CertDeleteCertificateFromStore CertCompareCertificate CertDuplicateCertificateContext CertOpenStore CertGetNameStringW

Sharing

General

Malware Config

Signatures

File Explorer

6c0dd4b41af06c01f45933091c91023accb2d2d889e66f948a8f0ef99b963fc0

kernel32

user32

advapi32

ole32

oleaut32

shlwapi

comctl32

crypt32

generic