BstkDeltaRooter[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
BstkDeltaRooter.exe
Size 9.1MB
Sample260730-wjbqcsxtb1
SHA256 4521484cae70e971be04305141581cf316170cae4308518e3c27a38d187259b2
MD5 242ddc93d295129fb2b042ea6091ee05
SHA1 4c756e2848dd4370f4e0a18b447703087633aea3
SHA512 add5a44c909591a1bee299828c1e53a7c6dff5f790ec42e76902540d8fcdcdc679f42c66f3514ee1f749815966299e92ce6316074396d79861700dd11d662166
SSDEEP 98304:GHb63iSEgdEpRVd5wndjNOb0lyaps36czQQdGg+VTPUzDmg0uAhyi5orTLNdR8i2:GHxQAd5LgNmL8TsqYFTXR
TLSH
T191A6AF07FAE208B9C865CD34C65E9227E63478855312A5FF6BC85B503F9BB90AF2D710
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
BstkDeltaRooter.exe

File Explorer

BstkDeltaRooter.exe

.exe 9.1MB

BstkDeltaRooter.exe

IMPHASH 88b6862033e74797fc495f1c80047a9e
SHA256 4521484cae70e971be04305141581cf316170cae4308518e3c27a38d187259b2
MD5 242ddc93d295129fb2b042ea6091ee05
SHA1 4c756e2848dd4370f4e0a18b447703087633aea3
SHA512 add5a44c909591a1bee299828c1e53a7c6dff5f790ec42e76902540d8fcdcdc679f42c66f3514ee1f749815966299e92ce6316074396d79861700dd11d662166
SSDEEP 98304:GHb63iSEgdEpRVd5wndjNOb0lyaps36czQQdGg+VTPUzDmg0uAhyi5orTLNdR8i2:GHxQAd5LgNmL8TsqYFTXR
TLSH
T191A6AF07FAE208B9C865CD34C65E9227E63478855312A5FF6BC85B503F9BB90AF2D710
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

695228

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3d11

D3D11CreateDeviceAndSwapChain

advapi32

RegQueryValueExA OpenProcessToken DuplicateTokenEx CreateProcessWithTokenW RegOpenKeyExA RegCloseKey

shell32

Shell_NotifyIconA ShellExecuteW ShellExecuteA

dwmapi

DwmSetWindowAttribute DwmExtendFrameIntoClientArea

ole32

CoCreateInstance CoUninitialize CoInitializeEx

msvcp140

?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z ?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@V?$fpos@U_Mbstatet@@@2@@Z ?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z ?_Incref@facet@locale@std@@UEAAXXZ ?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Id_cnt@id@locale@std@@0HA ?id@?$ctype@D@std@@2V0locale@2@A ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?id@?$collate@D@std@@2V0locale@2@A ?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?_Gndec@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?_Gnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD0@Z ?_Xlength_error@std@@YAXPEBD@Z ??0_Lockit@std@@QEAA@H@Z ??1_Lockit@std@@QEAA@XZ ?_Xbad_alloc@std@@YAXXZ ?_Xout_of_range@std@@YAXPEBD@Z ?uncaught_exception@std@@YA_NXZ _Thrd_detach _Mtx_lock _Mtx_unlock _Cnd_do_broadcast_at_thread_exit ?_Throw_Cpp_error@std@@YAXH@Z ?_Syserror_map@std@@YAPEBDH@Z ?_Winerror_map@std@@YAHH@Z _Strcoll _Strxfrm ??0_Locinfo@std@@QEAA@PEBD@Z ??1_Locinfo@std@@QEAA@XZ ?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ ?c_str@?$_Yarn@D@std@@QEBAPEBDXZ ??0facet@locale@std@@IEAA@_K@Z ??1facet@locale@std@@MEAA@XZ ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ?tolower@?$ctype@D@std@@QEBADD@Z ?tolower@?$ctype@D@std@@QEBAPEBDPEADPEBD@Z ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ??Bios_base@std@@QEBA_NXZ ??7ios_base@std@@QEBA_NXZ ?good@ios_base@std@@QEBA_NXZ ?flags@ios_base@std@@QEBAHXZ ?width@ios_base@std@@QEBA_JXZ ?width@ios_base@std@@QEAA_J_J@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADXZ ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ ?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?_Pnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z

oleaut32

SysFreeString SysAllocString

virtdisk

OpenVirtualDisk AttachVirtualDisk GetVirtualDiskPhysicalPath DetachVirtualDisk

user32

EnumDisplayMonitors GetMonitorInfoA MonitorFromWindow LoadCursorA SetWindowLongW SetWindowLongA GetWindowLongW WindowFromPoint ClientToScreen GetCursorPos SetCursor SetCursorPos AdjustWindowRectEx GetPropA SetPropA ReleaseDC GetDC SetForegroundWindow GetForegroundWindow IsWindowUnicode ReleaseCapture SetCapture GetCapture GetKeyState SetFocus BringWindowToTop IsIconic SetWindowPos SetLayeredWindowAttributes IsChild GetMessageExtraInfo TrackMouseEvent GetKeyboardLayout EmptyClipboard GetClipboardData SetClipboardData CloseClipboard OpenClipboard GetShellWindow PostMessageA MonitorFromPoint LoadIconA ScreenToClient GetClientRect UpdateWindow ShowWindow DestroyWindow CreateWindowExW RegisterClassExW UnregisterClassW PostQuitMessage DefWindowProcW SetProcessDPIAware PeekMessageA TranslateMessage SetWindowLongPtrA DispatchMessageA

kernel32

RtlCaptureContext RtlLookupFunctionEntry InitializeSListHead GetSystemTimeAsFileTime TerminateProcess GetCurrentThreadId GetCurrentProcessId SleepConditionVariableSRW WakeAllConditionVariable AcquireSRWLockExclusive ReleaseSRWLockExclusive GetFileInformationByHandleEx CopyFileW GetModuleHandleW AreFileApisANSI SetFileInformationByHandle GetFileInformationByHandle GetFileAttributesExW FindNextFileW FindFirstFileExW FindFirstFileW FindClose GetLocaleInfoEx FormatMessageA LocalFree IsDBCSLeadByte GetLocaleInfoA LoadLibraryA GetProcAddress FreeLibrary QueryPerformanceFrequency QueryPerformanceCounter VerSetConditionMask WideCharToMultiByte GlobalFree GlobalLock GlobalUnlock GlobalAlloc OutputDebugStringA DeviceIoControl WriteFile SetFilePointerEx SetFilePointer ReadFile GetFileSizeEx FlushFileBuffers CreateFileW CreateFileA Process32Next Process32First CreateToolhelp32Snapshot MultiByteToWideChar OpenProcess CreateProcessA IsDebuggerPresent GetLastError CloseHandle GetTempPathA FindResourceA SizeofResource LockResource LoadResource GetModuleHandleA Sleep UnhandledExceptionFilter RtlVirtualUnwind SetUnhandledExceptionFilter IsProcessorFeaturePresent GetCurrentProcess

imm32

ImmSetCandidateWindow ImmSetCompositionWindow ImmGetContext ImmReleaseContext

gdi32

GetDeviceCaps

d3dcompiler_47

D3DCompile

vcruntime140

_CxxThrowException __current_exception_context __current_exception __C_specific_handler memcmp memchr strchr __std_terminate memset memmove memcpy __std_exception_destroy __std_exception_copy

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-runtime-l1-1-0

_exit _seh_filter_exe _set_app_type _configure_narrow_argv __p___argc _initialize_narrow_environment _get_initial_narrow_environment _invoke_watson _crt_atexit _initterm _register_onexit_function _initialize_onexit_table terminate _initterm_e _register_thread_local_exe_atexit_callback _beginthreadex _c_exit abort _cexit __p___argv exit

api-ms-win-crt-string-l1-1-0

strcmp _stricmp strncpy wcslen tolower strcpy strcpy_s strncmp strlen

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsscanf __acrt_iob_func fopen __p__commode __stdio_common_vsprintf setvbuf fwrite __stdio_common_vfprintf _fseeki64 fsetpos fputc fgetpos fflush _set_fmode _get_stream_buffer_pointers fgetc fclose feof ferror ungetc ftell fseek fread _wfopen

api-ms-win-crt-heap-l1-1-0

_callnewh realloc malloc free _set_new_mode calloc

api-ms-win-crt-math-l1-1-0

sinf cosf fmodf sqrtf acosf __setusermatherr ldexp pow ceilf

api-ms-win-crt-convert-l1-1-0

strtol

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-filesystem-l1-1-0

_unlock_file _lock_file

api-ms-win-crt-time-l1-1-0

_time64 _ctime64_s

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func _configthreadlocale