raid0[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
raid0.exe
Size 1.8MB
Sample260730-mefdbawbjf
SHA256 92681b9d6cac16f9b4eab1b63e63d1b08e2f77629a794502073bbe0199ee7010
MD5 360d35c227d6c4680daee8a7a0f05fed
SHA1 b3e82d28412e944ff20c8486ab5c337a4fe0c9df
SHA512 54c7dd30bc829c351cbedfe335f69a81c477c10a1be35f513ba29c73b107313935df355e50fac46e092e14ad41f720ec9fdc53dcae492be3af5d84a864a92223
SSDEEP 24576:ntZqKQNrqTeF8wSnJvTz+1xiPpOpsTFpcUOcqqYXX24N1cokF38qVDkzvIkk9iAC:nTqHGqGiCVx5kzvpXAM5rwavobbAt
TLSH
T18F9519B061D540C1F0C3F2BC293AF98AA563789225F5B3F66ED1CE0D5F6A07809EB651
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
raid0.exe

File Explorer

raid0.exe

.exe 1.8MB

raid0.exe

IMPHASH 10a688e4813c5a5193d77f5859f89ec7
SHA256 92681b9d6cac16f9b4eab1b63e63d1b08e2f77629a794502073bbe0199ee7010
MD5 360d35c227d6c4680daee8a7a0f05fed
SHA1 b3e82d28412e944ff20c8486ab5c337a4fe0c9df
SHA512 54c7dd30bc829c351cbedfe335f69a81c477c10a1be35f513ba29c73b107313935df355e50fac46e092e14ad41f720ec9fdc53dcae492be3af5d84a864a92223
SSDEEP 24576:ntZqKQNrqTeF8wSnJvTz+1xiPpOpsTFpcUOcqqYXX24N1cokF38qVDkzvIkk9iAC:nTqHGqGiCVx5kzvpXAM5rwavobbAt
TLSH
T18F9519B061D540C1F0C3F2BC293AF98AA563789225F5B3F66ED1CE0D5F6A07809EB651
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1483904

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\hiatu\Documents\vilspy+\repo\vilspy-monorepo\client\x64\Release\client_example.pdb

ws2_32

setsockopt getnameinfo ioctlsocket freeaddrinfo WSAPoll getsockopt recv connect ntohs socket send getsockname getpeername WSAStartup getaddrinfo inet_pton WSASocketW shutdown closesocket WSACleanup WSAGetLastError

crypt32

CertEnumCertificatesInStore CertOpenSystemStoreW CertFreeCertificateContext CertCloseStore

kernel32

GetOEMCP GetACP IsValidCodePage HeapReAlloc ReadFile SetFilePointerEx GetFileSizeEx GetConsoleMode GetEnvironmentStringsW FreeEnvironmentStringsW ReadConsoleW SetEnvironmentVariableW Sleep GetProcessHeap GetCurrentProcess VirtualAlloc GetProcessId GetVolumeInformationA WaitForSingleObject GetModuleHandleA OpenProcess CreateToolhelp32Snapshot MultiByteToWideChar Process32NextW GetCurrentThread LoadLibraryA Process32FirstW CloseHandle Module32FirstW GetThreadContext GetProcAddress WideCharToMultiByte Module32NextW GetConsoleOutputCP SetStdHandle CreateFileW HeapSize WriteConsoleW SetEndOfFile VirtualProtect FlushFileBuffers GetFileType EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW LoadLibraryExW HeapAlloc CreateProcessW GetExitCodeProcess UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlCaptureContext HeapFree GetCommandLineW GetCommandLineA WriteFile GetStdHandle GetModuleFileNameW TerminateProcess ExitProcess IsProcessorFeaturePresent GetModuleHandleExW FreeLibraryAndExitThread FreeLibrary ExitThread CreateThread FlsFree FlsSetValue FlsGetValue FlsAlloc SetLastError RtlUnwindEx RtlLookupFunctionEntry RaiseException RtlPcToFileHeader InitializeSListHead GetSystemTimeAsFileTime GetCurrentProcessId GetStartupInfoW SetUnhandledExceptionFilter GetStringTypeW FormatMessageA LocalFree GetLocaleInfoEx FindClose FindFirstFileExW FindNextFileW GetFileAttributesExW RtlUnwind SetFileInformationByHandle CreateFile2 AreFileApisANSI GetLastError GetModuleHandleW GetFileInformationByHandleEx QueryPerformanceCounter QueryPerformanceFrequency GetSystemTimePreciseAsFileTime ReleaseSRWLockExclusive AcquireSRWLockExclusive GetCurrentThreadId SleepConditionVariableSRW InitOnceComplete InitOnceBeginInitialize EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx WakeAllConditionVariable CompareStringEx GetCPInfo

advapi32

CryptGenRandom CryptCreateHash CryptHashData CryptDestroyHash CryptGetHashParam CryptReleaseContext CryptAcquireContextW

libcrypto-3-x64

EVP_DigestFinal_ex X509_get_ext_d2i ASN1_STRING_length X509_free X509_STORE_up_ref BIO_ctrl X509_STORE_free X509_NAME_get_text_by_NID EVP_MD_CTX_new d2i_X509 ERR_get_error X509_STORE_add_cert OPENSSL_sk_num X509_get_subject_name EVP_md5 EVP_sha256 EVP_DigestUpdate GENERAL_NAMES_free EVP_MD_CTX_free EVP_DigestInit_ex OPENSSL_sk_value ASN1_STRING_get0_data EVP_sha512 BIO_new_socket

libssl-3-x64

SSL_peek SSL_connect SSL_free SSL_CTX_get_cert_store SSL_CTX_set_default_verify_paths SSL_new SSL_CTX_free SSL_CTX_ctrl SSL_CTX_set_cert_store SSL_CTX_use_certificate_file SSL_CTX_use_PrivateKey_file SSL_CTX_new SSL_write SSL_get_verify_result TLS_client_method SSL_CTX_set_default_passwd_cb_userdata SSL_ctrl SSL_set_bio SSL_pending SSL_read SSL_set_verify SSL_CTX_load_verify_locations SSL_get1_peer_certificate SSL_shutdown SSL_get_error

Name

.text

Size

1.6MB

Virtual Size

1.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

151KB

Virtual Size

150KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

34KB

Virtual Size

41KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

25KB

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

raid0.exe

ws2_32

crypt32

kernel32

advapi32

libcrypto-3-x64

libssl-3-x64

generic