MundoConquer_V2_Config_d4303bf2.zip
- SHA256 e6de8ce7d828c82fe73aeaaf372f17b674e4dfeeccbe67753529a041b6b497fe
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ConquerCipherHook.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
ConquerCipherHook.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
General
- Target MundoConquer_V2_Config_d4303bf2.zip
- Size 63KB
- Sample260730-g8wphasbnh
- SHA256 e6de8ce7d828c82fe73aeaaf372f17b674e4dfeeccbe67753529a041b6b497fe
- MD5 9700234d210fbfd2670c9993b8f25441
- SHA1 e9159aecbca02fe3d508005017ab3c7dde57c8fe
- SHA512 9031d2dad3521b7ee9802821dfcd642da4bc3a8021aa9c40a167b2b97fc9dcc3d70f84b135c8484de7d2fbb61a86f57279d18a1c08819616f8750010633bd3fa
- SSDEEP 1536:28Y7UNg28EsFgGapVqJmUPomVfz5eHvZqnFSQEHIR1Izi:2z7UNz8Esi9VqpPomVfzbIBHri
- TLSH T1455302AA8FF62957C126E0352D4A55CFD4A040C2CA7C4A1FD315CDA2976EE18CC3BB5D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/ConquerCipherHook.dll
File Explorer
-
MundoConquer_V2_Config_d4303bf2.zip.zip 63KB
-
CLHook.ini196B
-
ConquerCipherHook.dll.dll 133KB
-
LEEME.txt696B
-
LEEME_MundoConquer_V2.txt293B
-
config.json1KB
CLHook.ini
- SHA256 1cecb426990cdb94fc820ff7ab2020ee189d31a40e02b91070a53b27d6a8f05a
- MD5 468b89a587c694119336b6edb176236a
- SHA1 e66559cbd631973b632c4230aafb9f024fbfcb23
- SHA512 989f447eeacdc38c4615fbfb63c0bf4ec3f976a3defeb315b6803817aef2e9308b5ca45903883ea522d689f848e917c16e0af9a4ebbd90bf58b20b87d557ea0b
- TLSH T160D022AE200270842F0B0E6F2267A38B101823A6F0E4F178C20224327C9888A0F30CFE
- MD5 SHA1 SHA512 TLSH
ConquerCipherHook.dll
- IMPHASH c4302238b9082c66f8777ff77e1c21ab
- SHA256 bfb444c37dfd9e32d03e68ae9f3b8f941f75ad0c9698786315ca39148dbdecc9
- MD5 86a6ad0e61d933736384b497574643d3
- SHA1 aa6fec4b699a38c882fa6c60aec796977d480897
- SHA512 c43c62a70925fa09bb347adbe74fff307fb76792bb0b230d2e32c843a2172ff5e24143a72d79cae94cd8289a56e28990d17f31a6e3e7253e9d620c42f1b6995d
- SSDEEP 1536:WJQUU83HlXFwoBjwmrEBF6xm4+RtyzUTs42Ug/wD1cfRmh:WJuiZ9B0mABF6s4C86sBUg/wDyg
- TLSH T198D34A6CFE4314F2F22710F4088ED7BA413636068637AEB7EF4AD656BE72B51190521E
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
5040
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL
PDB paths
kernel32
CloseHandle
CreateSemaphoreW
DeleteCriticalSection
EnterCriticalSection
FlushInstructionCache
FreeLibrary
GetCurrentProcess
GetCurrentThreadId
GetLastError
GetModuleFileNameA
GetModuleHandleA
GetModuleHandleW
GetProcAddress
GetTempPathA
InitializeCriticalSection
IsDBCSLeadByteEx
LeaveCriticalSection
LoadLibraryA
MultiByteToWideChar
ReleaseSemaphore
SetLastError
Sleep
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
VirtualAlloc
VirtualProtect
VirtualQuery
WaitForSingleObject
WideCharToMultiByte
msvcrt
__mb_cur_max
_amsg_exit
_errno
_initterm
_iob
_lock
_unlock
abort
atoi
calloc
fclose
fopen
fputc
fputs
free
fwrite
localeconv
malloc
memcmp
memcpy
realloc
setlocale
strchr
strcmp
strerror
strlen
strncat
strncmp
strncpy
strrchr
vfprintf
wcslen
_write
user32
MessageBoxA
_Unwind_Backtrace
_Unwind_DeleteException
_Unwind_FindEnclosingFunction
_Unwind_Find_FDE
_Unwind_ForcedUnwind
_Unwind_GetCFA
_Unwind_GetDataRelBase
_Unwind_GetGR
_Unwind_GetIP
_Unwind_GetIPInfo
_Unwind_GetLanguageSpecificData
_Unwind_GetRegionStart
_Unwind_GetTextRelBase
_Unwind_RaiseException
_Unwind_Resume
_Unwind_Resume_or_Rethrow
_Unwind_SetGR
_Unwind_SetIP
_Z12CreateHook32PvS_P9HOOK_STUB
_Z12DeleteHook32PvS_
_Z12csv3_connectjP11sockaddr_ini@12
_Z13GetDestAddr32mm
_Z17StdCallToThisCallPv
_Z19AddrFromJumpTable32Pv
_Z19IsKnownHookHeader32Pvi
_Z21CreateHook32JumpTablePvS_P9HOOK_STUB
_Z21DeleteHook32JumpTablePvS_
_Z9ShellexecP6HWND__PcS1_S1_S1_i@24
_Z9csv3_initP11HINSTANCE__
_ZN28ConquerCipherHookBufferUtils6buffer10read_int32EPhi
_ZN28ConquerCipherHookBufferUtils6buffer10read_int64EPhi
_ZN28ConquerCipherHookBufferUtils6buffer10read_uint8EPhi
_ZN28ConquerCipherHookBufferUtils6buffer10write_charEPhPcii
_ZN28ConquerCipherHookBufferUtils6buffer11read_uint16EPhi
_ZN28ConquerCipherHookBufferUtils6buffer11write_int32EPhii
_ZN28ConquerCipherHookBufferUtils6buffer11write_int64EPhxi
_ZN28ConquerCipherHookBufferUtils6buffer11write_uint8EPhhi
_ZN28ConquerCipherHookBufferUtils6buffer12write_uint16EPhti
_ZN28ConquerCipherHookBufferUtils6buffer7encryptEPci
__deregister_frame
__deregister_frame_info
__deregister_frame_info_bases
__frame_state_for
__register_frame
__register_frame_info
__register_frame_info_bases
__register_frame_info_table
__register_frame_info_table_bases
__register_frame_table
connect_stub
credentials_stub
msgaccount_stub
shellexec_stub
szPassword
Name
.text
Size
92KB
Virtual Size
91KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
184B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
13KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
/4
Size
13KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.edata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.CRT
Size
512B
Virtual Size
44B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
8B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
LEEME.txt
- SHA256 59bc47c439b95fee9dd6444fe97902a903b382963fcdb900ba5d2ee0a54de335
- MD5 97a4a624c1e87d46f09f715e8f68908f
- SHA1 e1cecf4d3561cb057c0482f3258923b061b2cde7
- SHA512 4b391768fd4c9742291e18db25137af53ac548b7a5cca22391f73621882105974edd61599eacbb1f3f5a9051db5f06d85a000e9682d1ed763708f46c696060d6
- TLSH T1BD019C64E59E1FF05927C348D06B8851F46B9256300F87911A7043ACF5CBC3983D9E4B
- MD5 SHA1 SHA512 TLSH
LEEME_MundoConquer_V2.txt
- SHA256 de9e8164da2cbd8752874a2399977dbbf427a021f04456a2d89a6d7ec2c8589c
- MD5 cb1262fc7a7bb6247f67f2ff9ca35b21
- SHA1 3485165bf82a4b7d7de90d2e623845479e2d97cc
- SHA512 c76e6162bc344d7fb6b8cffda9c75311b0c03d7bf01ca8732681054867586e712ac4bc4abf4ff4088cf3f41d92cebe049ba25107a8ebdce391e2f80b7f77c9f4
- TLSH T1E2E07D42F55E222010B9498E64B6D241F0731D22748A4147464841EDE7C2C1C8D12C56
- MD5 SHA1 SHA512 TLSH
config.json
- SHA256 70efc3e79c23d178c04b56f60125281fa20607644915dcece41f34f5773c49fb
- MD5 474c2c3ee25d6d27cf5be23ec978b5a4
- SHA1 fbd9a1ce2070943d5cec1cb8bce150b0aa31d714
- SHA512 8f4ae4e1a336f3ab3fbb9ca8fc8fa71cf9d31c8791484ae608cac43a7a6af89471fd0791ac1465cba0991c87f7a3e5e3b54a8635e2eb42d7979c5ccc7f0a2019
- TLSH T12321C520D9590CB213681A785869424266A405F799483E3DBB0C460FAFCE97D33F5BEE
- MD5 SHA1 SHA512 TLSH