4bc48a91f193bbe9a9f7b76cd4ecaea949408e16a76c1e711ca7bd10a3cea6cc
- SHA256 4bc48a91f193bbe9a9f7b76cd4ecaea949408e16a76c1e711ca7bd10a3cea6cc
Behavioral task
behavioral1
Sample
SysAccessPasswordRec_v6.0/Setup.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
SysAccessPasswordRec_v6.0/Setup.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
Behavioral task
behavioral3
Sample
SysAccessPasswordRec_v6.0/fix/x64/Startup.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral4
Sample
SysAccessPasswordRec_v6.0/fix/x64/Startup.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral5
Sample
SysAccessPasswordRec_v6.0/fix/x86/Startup.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral6
Sample
SysAccessPasswordRec_v6.0/fix/x86/Startup.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
General
- Target 4bc48a91f193bbe9a9f7b76cd4ecaea949408e16a76c1e711ca7bd10a3cea6cc
- Size 2.9MB
- Sample260730-ky91xsysht
- SHA256 4bc48a91f193bbe9a9f7b76cd4ecaea949408e16a76c1e711ca7bd10a3cea6cc
- MD5 2ee516c359fbf055d91110be12f9b595
- SHA1 1710472e7abf2785ad3018c6eefc03d05dc38ed2
- SHA512 c1be2ead246df249e745661f38d28f07c65d8dfa4c0affd4ee1b7d8afb0a01393a0497540ecdccaef7ebb571d22cefe0131df602e13bb2fb68f3cb61502e9883
- SSDEEP 49152:qIKo/3+1lLaKOkmR5D7NtBuSGa5kPOGsvpvJb1ptFKpJLmEIp:qIKiO1vURZdSmGsBvNrqy
- TLSH T1F1E533FE90A1171EE48393363933B94F029A7F2205D7680E49FF6E6DBDAB1D08426571
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Insecure Codesign Algorithm 1 IoCs
File was codesigned using an insecure algorithm.
resource unpack001/SysAccessPasswordRec_v6.0/Setup.exe - Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/SysAccessPasswordRec_v6.0/fix/x64/Startup.exe unpack001/SysAccessPasswordRec_v6.0/fix/x86/Startup.exe - Inno Setup is an open-source installation builder for Windows applications. 1 IoCs
Inno Setup installer
resource yara_rule static1/unpack001/SysAccessPasswordRec_v6.0/Setup.exe innosetup
File Explorer
-
4bc48a91f193bbe9a9f7b76cd4ecaea949408e16a76c1e711ca7bd10a3cea6cc.zip 2.9MB
-
SysAccessPasswordRec_v6.0/Setup.exe.exe 2.6MB
-
SysAccessPasswordRec_v6.0/fix/x64/Startup.exe.exe 420KB
-
SysAccessPasswordRec_v6.0/fix/x86/Startup.exe.exe 345KB
-
软件说明.txt126B
SysAccessPasswordRec_v6.0/Setup.exe
- SHA256 6d2e64912a11de3eb18d0ed4ce8ee9445c45a285fa359773fe64340c3280edb5
- MD5 cbaaaa7929a25ae942fd125ddc31b7f7
- SHA1 d5a1d4c6a35af649d17bf81ded1f33e5f01bd44f
- SHA512 f99103575ff1c54d9494a1aba1b36c56004f5ee0f10af51dcc10fdebf7c5013224e4c53504dfee1203312c6cae8b64b4998c252c6b21b9e8d407deeddacadf50
- SSDEEP 49152:3azN3u7fLS+4k0T5rbJH1u6Aa5kzIGsJFLJp1TbFKt/xm629:KJe7neTNrScGsnL1Ri8
- TLSH T108C533AA94D1053EE4A35B322D33B54B07777F111CB2680EA5EE5D5DAFB72C0C81A3A1
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Insecure Codesign Algorithm
File was codesigned using an insecure algorithm.
-
Inno Setup is an open-source installation builder for Windows applications.
Inno Setup installer
Digest
11:82:2b:72:2a:63:52:12:0d:dd:04:28:80:e6:df:28:79:94:21:e9
Digest Algorithm
sha1
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=9374267-0142,CN=SysTools Inc,O=SysTools Inc,L=Holladay,ST=Utah,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130455746168,1.3.6.1.4.1.311.60.2.1.3=#13025553
Chains
Dec 23, 2021
SERIALNUMBER=9374267-0142,CN=SysTools Inc,O=SysTools Inc,L=Holladay,ST=Utah,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130455746168,1.3.6.1.4.1.311.60.2.1.3=#13025553
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US
Serial Number
0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Issuer
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jan 1, 2021 - Jan 6, 2031
Subject
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jan 7, 2016 - Jan 7, 2031
Subject
SERIALNUMBER=9374267-0142,CN=SysTools Inc,O=SysTools Inc,L=Holladay,ST=Utah,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130455746168,1.3.6.1.4.1.311.60.2.1.3=#13025553
Serial Number
0f:2c:72:4d:bb:e7:1a:9a:01:26:28:64:2c:36:77:4e
Issuer
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Feb 21, 2019 - Apr 27, 2022
Subject
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Apr 18, 2012 - Apr 18, 2027
Minor OS version
0
Major OS version
1
Entry point
40000
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
PDB paths
Name
CODE
Size
37KB
Virtual Size
36KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
DATA
Size
1024B
Virtual Size
588B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
BSS
Size
Virtual Size
3KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
Virtual Size
8B
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
512B
Virtual Size
24B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
10KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
SysAccessPasswordRec_v6.0/fix/x64/Startup.exe
- SHA256 f96e6c84cb94ddc8ea80e7926c41ad4f521adb849283cf1b5ab9a1049d96f040
- MD5 3214d69002d8da3cf92a1ae83afd4cdb
- SHA1 31cda02145b01f22e825481a090292cfa6c0f68f
- SHA512 04a77c21e3e23057cc6a1ec70037df98d35e4ccd016ff5ebf61a8d73616d4247ca4d34bdc1db1fb49a81e98bbcd5fc9ececba66ec17e852201f739dccafdfc44
- SSDEEP 6144:73Y5jeQw8korwzy/ln6vGBaRcBdfFSmGQT10a:T4l6FqdfFSAT
- TLSH T1DA944A0037D95D02D5BEB6F155B8814043B3BE41A922C6AE7EBD309E17B2B83CE9165F
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
Name
.text
Size
413KB
Virtual Size
412KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
SysAccessPasswordRec_v6.0/fix/x86/Startup.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 f91c09bae54c488191091749c453fc1865e09aab223c8f3c42a4a7fd04642575
- MD5 36d9eb3d90e1293e760295b36eb10567
- SHA1 3061ce6f4395c3a27316600c98b236f09077a7d2
- SHA512 232f3412d871eba92c7b3b1e539054ece5644d30bdda6270cf536e5fdc73ce52f13b21daf578c596a1f8750c21419d5ea6ec7e6ffa19150a92904c39f3d154ec
- SSDEEP 3072:WLVbR4k2OpzCT7Sw6X56Xc6XVZ5ZKjZ5Zo/X6Xte3F6zQYJhh/2FfqMw5TzkLSph:WZukxzCJ/kjzy/JF6zFJv28VTgPa
- TLSH T1CA74171037D94E02D5BEB5F155B8854007B7BE816922C6DE7EBC309A17B2B83CE9066F
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
353902
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
338KB
Virtual Size
337KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
软件说明.txt
- SHA256 2702605da521a55864d85d160ff24af860207979b5e7c16f637032995a3e7c39
- MD5 21a052186ab8e2fc250b159aabba9b15
- SHA1 24814b48c689db24affcef0c7672904b2fe3f465
- SHA512 9d998b26155ea07e202c98ab4d608360859a4b29abd7a16e1441c40684accacd16f38c36287f3e3aebb52ef97acb8b5671c4fe5f3432d023de875e16c0454a24
- TLSH T19AB09BC11DD710554465120859429D9CD01D149658947BD55E47815FF96E254CA41B1E
- MD5 SHA1 SHA512 TLSH