Release (1).rar
- SHA256 256c193278c79b8e7a63d2cbafc3c5b6f563e81c4d289875279e2bdc471a6ebd
Behavioral task
behavioral1
Sample
Release (1).rar
Resource
win10v2004-20260513-en
windows10-2004-x64
15 signatures
150 seconds
Behavioral task
behavioral2
Sample
Release (1).rar
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral3
Sample
driver.sys
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral4
Sample
map.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral5
Sample
map.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral6
Sample
selium.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral7
Sample
selium.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
7 signatures
150 seconds
General
- Target Release (1).rar
- Size 6.1MB
- Sample260728-azelasvdjb
- SHA256 256c193278c79b8e7a63d2cbafc3c5b6f563e81c4d289875279e2bdc471a6ebd
- MD5 5a495f84658d90da1c7c6f1ab92d0474
- SHA1 69aefec41e2794189db6fb6bf24a3033e0f03969
- SHA512 7b56dee53dd82b9ab4bad4b3ec57017ac8e16151551f543d1eeae595d2781fae0eef4f4fe944590c6961a45e8dcbb8828d2240c36d47ef9acd39fc30bd7db102
- SSDEEP 196608:zNW/a9bB6jViqABOqXJ8Azcf5fxfGYfHmIRNN/c:MS9d6Xq5EfxeYfHmIR7c
- TLSH T17D56332277C19E6DD29606BE06CC789FD0BFD86825EACCDA3F158B3B60D918594F81C4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
-
resource yara_rule static1/unpack001/selium.exe themida - Unsigned PE 3 IoCs
Checks for missing Authenticode signature.
resource unpack001/driver.sys unpack001/map.exe unpack001/selium.exe
File Explorer
-
Release (1).rar.rar 6.1MB
-
DRIVER LOAD INSTRUCTIONS.txt258B
-
driver.sys.sys 8KB
-
map.exe.exe 138KB
-
selium.exe.exe 6.1MB
DRIVER LOAD INSTRUCTIONS.txt
- SHA256 339ca1f1b56244f4e565a7adc92f8619469237d85b9535ddf696348104e7ad3e
- MD5 1dc051e55190c0efd7d517ebfa235280
- SHA1 0e65365f3d03aa188d0639d63b849868de8f837d
- SHA512 d65d39c0ad9290f267dd705ee26b9bc83db12a1f23bf85584f95561a04017afd7f4b2db240a931b8ef86a9ea280769de964338dc5ba16f1fdc76729a6caa0732
- TLSH T18DD02B4BA0C76C50C2509225A51C848078EB300C6E1A1609FC318406AB64F9E20BBE9F
- MD5 SHA1 SHA512 TLSH
driver.sys
- IMPHASH 082941a820bbe0f9deef2f93958bb110
- SHA256 fd4a1eb46a25b5e687957300aab62074cf36a7905bbbd0cb0809c150d5f5facc
- MD5 64459649af479f7d4ab915e8d2dc177d
- SHA1 e723c78eff93834f8ec6ea3fefaa4996d3b7fe72
- SHA512 c0d076a765399394c7a9e2e3c1ec9a161469ad8942688d68ca1802f81b3ffe5040c7f78f9581ce620cbd24460acdb6dce67872f3ec3c18542aaf3ddb85d7bb83
- SSDEEP 96:UU8fjUHmSWDb22zvqLcSHWj7nVQOJT0VzvDBhhJ:tWP22zvqYYcTVQ7zbzh
- TLSH T19102C8B061179DC4E25DE17ECA9746A9B6B5F01003924FEF8965CA6E1F12FC12C3BA80
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
4096
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\vkojiii\Desktop\vkojii driver src\build\driver\driver.pdb
ntoskrnl.exe
RtlInitUnicodeString
DbgPrintEx
ExAllocatePool
ExFreePoolWithTag
MmUnmapIoSpace
MmMapIoSpaceEx
IofCompleteRequest
IoCreateDevice
IoCreateSymbolicLink
IoDeleteDevice
IoDeleteSymbolicLink
ObfDereferenceObject
MmCopyMemory
KeStackAttachProcess
KeUnstackDetachProcess
PsLookupProcessByProcessId
IoCreateDriver
PsGetProcessSectionBaseAddress
ZwQuerySystemInformation
Name
.text
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
128B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
512B
Virtual Size
168B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
INIT
Size
1024B
Virtual Size
632B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
36B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, productName=Unmarked objects (old),
count=3, id=257, version=35215,
count=24, id=1, productName=Unmarked objects,
count=6, id=259, version=35215,
count=5, id=260, version=35215,
count=1, id=261, version=36248,
count=1, id=258, version=36248,
map.exe
- IMPHASH 976611f0da1b678bc00c773b400704ae
- SHA256 57832f7a25c5cd0dfca09c54d0019e4f19a0d27a949a92dc68baf35b72be8211
- MD5 365fc713b2097470bd269602b5d54eb2
- SHA1 4e237fb146ed252246ad81231294f877edbc35c7
- SHA512 5033693df40f39a568967b26977603c353d59e538d43da430838875d5955181cc5533a3ae8de4aaf23b8841046e72f970f539879f44c17a633b72df08ead29d3
- SSDEEP 3072:ejVYisyVqzOSDMbfVP+qmJTQSaMm5/6Ygnzg+zOG:ebsyVqzOswfUWlBgns+q
- TLSH T112D35B2BE659207ED2A6D9BDCA524912FBB27C850751B7CF136049B60F627D06F3E302
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
66140
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\quent\Documents\Digital\kdmapper-master (1)\kdmapper-master\x64\Release\DigiMapper.pdb
kernel32
GetModuleHandleA
DeleteFileW
CloseHandle
GetProcAddress
GetCurrentProcessId
MoveFileW
FlushFileBuffers
FindFirstFileW
VirtualProtect
FindNextFileW
GetCurrentProcess
FindClose
GetCurrentThreadId
Sleep
Process32NextW
Process32FirstW
GetWindowsDirectoryW
SetProcessWorkingSetSize
SetUnhandledExceptionFilter
GetTempPathW
FormatMessageA
GetLocaleInfoEx
CreateFileW
SetFilePointer
SetFileTime
VirtualAlloc
DeviceIoControl
WriteFile
VirtualFree
CreateToolhelp32Snapshot
GetFileSizeEx
GetFileAttributesExW
AreFileApisANSI
GetLastError
GetModuleHandleW
GetFileInformationByHandleEx
WideCharToMultiByte
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WakeAllConditionVariable
SleepConditionVariableSRW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
LocalFree
user32
GetWindowThreadProcessId
GetShellWindow
advapi32
RegCloseKey
RegDeleteTreeW
RegSetValueExW
RegOpenKeyExW
RegCreateKeyW
RegDeleteValueW
RegOpenKeyW
RegSetKeyValueW
msvcp140
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z
??7ios_base@std@@QEBA_NXZ
?always_noconv@codecvt_base@std@@QEBA_NXZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Id_cnt@id@locale@std@@0HA
?_Xlength_error@std@@YAXPEBD@Z
?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?_Xbad_alloc@std@@YAXXZ
?_Winerror_map@std@@YAHH@Z
?_Syserror_map@std@@YAPEBDH@Z
?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAHXZ
?uncaught_exception@std@@YA_NXZ
?wcout@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
??0_Lockit@std@@QEAA@H@Z
??1_Lockit@std@@QEAA@XZ
?good@ios_base@std@@QEBA_NXZ
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ
?put@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@_W@Z
?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z
?widen@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBA_WD@Z
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ
ntdll
NtLoadDriver
NtUnloadDriver
NtQuerySystemInformation
RtlAdjustPrivilege
RtlInitUnicodeString
vcruntime140_1
__CxxFrameHandler4
vcruntime140
memset
memcpy
memcmp
__current_exception
__C_specific_handler
__std_terminate
__std_exception_copy
__std_exception_destroy
_CxxThrowException
__current_exception_context
wcsstr
memmove
api-ms-win-crt-utility-l1-1-0
rand
srand
api-ms-win-crt-runtime-l1-1-0
_c_exit
_register_thread_local_exe_atexit_callback
__p___argc
_initterm
terminate
_crt_atexit
_register_onexit_function
_get_initial_wide_environment
_cexit
_exit
_seh_filter_exe
exit
__p___wargv
_initialize_wide_environment
_configure_wide_argv
_invoke_watson
abort
_initterm_e
_set_app_type
_initialize_onexit_table
api-ms-win-crt-filesystem-l1-1-0
_wremove
_lock_file
_unlock_file
api-ms-win-crt-string-l1-1-0
_stricmp
_wcsicmp
wcscpy_s
wcscat_s
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-heap-l1-1-0
malloc
_callnewh
free
_set_new_mode
api-ms-win-crt-stdio-l1-1-0
fsetpos
ungetc
setvbuf
fgetpos
fwrite
_get_stream_buffer_pointers
_set_fmode
fgetc
fclose
fflush
fputc
__p__commode
_fseeki64
fread
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
___lc_codepage_func
api-ms-win-crt-math-l1-1-0
__setusermatherr
Name
.text
Size
65KB
Virtual Size
65KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
66KB
Virtual Size
65KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
488B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
268B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=18, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=4, id=259, version=35207,
count=10, id=260, version=35207,
count=35, id=261, version=35207,
count=6, id=257, version=35207,
count=9, id=257, version=33145,
count=229, id=1, productName=Unmarked objects,
count=7, id=265, version=35222,
count=1, id=255, version=35222,
count=1, id=258, version=35222,
selium.exe
- SHA256 e338e0d5e88f2f5850b0711b05e57bc0e938cde580124befd284dba2ae6b5b9a
- MD5 d0c4105dc8df7c8c13a4929bcc7a7476
- SHA1 d86e646a472abf023781811133b2fcfb75a6a4e3
- SHA512 3217bc8c5e1cc63855166f055790e1bbcb589769a9bb4527c1866267965def115d70e7dc8e86ab567ea96b61e32c61ba05813a48a77c79fbfbafe3716a661deb
- SSDEEP 196608:N9EbDJT7PcAogku8nymbhqD14n6GJx+qx7:XeToAog+9ID2nJx+qx7
- TLSH T17D56337F1501997DE831BC753948D966A4138D0EEEFF3825AABC1E12193F11E6638CA3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
9523288
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
Name
Size
329KB
Virtual Size
656KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
Size
2.1MB
Virtual Size
2.1MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
Size
443KB
Virtual Size
609KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
Size
16KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
Size
363B
Virtual Size
696B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
Size
952B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.imports
Size
2KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.themida
Size
Virtual Size
5.7MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.boot
Size
3.2MB
Virtual Size
3.2MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
16B
Virtual Size
4KB
Characteristics
IMAGE_SCN_MEM_READ
generic
count=20, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=4, id=259, version=35721,
count=10, id=260, version=35721,
count=36, id=261, version=35721,
count=6, id=257, version=35721,
count=381, id=1, productName=Unmarked objects,
count=21, id=257, version=33145,
count=10, id=265, version=36252,
count=1, id=255, version=36252,
count=1, id=258, version=36252,