909fa22e60749bb1fab1fcd1c54b098ec1b354ab1e9a1d7870f61ed2f0f5bc13

Sharing

Copy URL Twitter E-mail

General

Target
909fa22e60749bb1fab1fcd1c54b098ec1b354ab1e9a1d7870f61ed2f0f5bc13
Size 11.9MB
Sample260802-m6tp1syscz
SHA256 909fa22e60749bb1fab1fcd1c54b098ec1b354ab1e9a1d7870f61ed2f0f5bc13
MD5 8102c49f167f4ab17c4523e64af373f8
SHA1 e5d4a31a4f2dcd1c4a41cb4e836bd8932dc826ad
SHA512 ab5e967ed8756e9d00a05d8a05db86a147422da6221153a3bcb978339dedb4d53647b64fad2893fe5e824ae531c65d736ff09e6db7c892dce0ca23c6967eda2b
SSDEEP 196608:aG5QyS7S+UoXrVg0Yke5QyS7S+UoXrVgxR3Fszuhnv9FC3YaaRykLOy0:HA++hrVg0YkeA++hrVgxwzybCIaqyO4
TLSH
T1DCC623127783C0B6E4D662B046651B396AB98B204FE4C9D3EFE8CD653C321F2577624E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
909fa22e60749bb1fab1fcd1c54b098ec1b354ab1e9a1d7870f61ed2f0f5bc13

File Explorer

909fa22e60749bb1fab1fcd1c54b098ec1b354ab1e9a1d7870f61ed2f0f5bc13

.exe 11.9MB

909fa22e60749bb1fab1fcd1c54b098ec1b354ab1e9a1d7870f61ed2f0f5bc13

IMPHASH 118c73183d26bf3734667a01632a14a9
SHA256 909fa22e60749bb1fab1fcd1c54b098ec1b354ab1e9a1d7870f61ed2f0f5bc13
MD5 8102c49f167f4ab17c4523e64af373f8
SHA1 e5d4a31a4f2dcd1c4a41cb4e836bd8932dc826ad
SHA512 ab5e967ed8756e9d00a05d8a05db86a147422da6221153a3bcb978339dedb4d53647b64fad2893fe5e824ae531c65d736ff09e6db7c892dce0ca23c6967eda2b
SSDEEP 196608:aG5QyS7S+UoXrVg0Yke5QyS7S+UoXrVgxR3Fszuhnv9FC3YaaRykLOy0:HA++hrVg0YkeA++hrVgxwzybCIaqyO4
TLSH
T1DCC623127783C0B6E4D662B046651B396AB98B204FE4C9D3EFE8CD653C321F2577624E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

b7:a5:29:45:4a:97:65:33:bf:28:e8:4f:5c:70:fd:78:b1:37:94:a8:54:0e:99:10:50:1e:fb:06:77:61:df:4b

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=KP MOBILE,O=KP MOBILE,ST=Gyeonggi-do,C=KR

Chains

Jul 31, 2026

CN=KP MOBILE,O=KP MOBILE,ST=Gyeonggi-do,C=KR

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

CN=KP MOBILE,O=KP MOBILE,ST=Gyeonggi-do,C=KR

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

CN=KP MOBILE,O=KP MOBILE,ST=Gyeonggi-do,C=KR

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Serial Number

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=KP MOBILE,O=KP MOBILE,ST=Gyeonggi-do,C=KR

Serial Number

60:14:b5:6e:4f:ff:35:dc:4c:94:84:52:b7:7c:9a:a9

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 25, 2021 - Oct 25, 2022

Subject

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Serial Number

33:00:00:00:44:b7:3f:fc:ef:5a:cf:a2:7a:00:00:00:00:00:44

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 22, 2015 - Jul 22, 2025

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Serial Number

02:7c:39:01:0c:a7:5a:c3:3a:b5:ee:0d:54:0e:f9:e5

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Jan 18, 2038

Minor OS version

Major OS version

Entry point

839893

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GlobalLock GlobalAlloc SuspendThread ReleaseMutex CreateMutexA GetCurrentProcess TerminateThread SetFileTime LocalFileTimeToFileTime GetLocalTime SystemTimeToFileTime UnmapViewOfFile GetFileSize SetFilePointer SetStdHandle GlobalUnlock IsBadCodePtr IsBadReadPtr CompareStringW CompareStringA SetUnhandledExceptionFilter GetStringTypeW GetStringTypeA IsBadWritePtr VirtualAlloc LCMapStringW LCMapStringA SetEnvironmentVariableA VirtualFree HeapCreate HeapDestroy GetEnvironmentVariableA GetFileType GetStdHandle SetHandleCount GetEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsW FreeEnvironmentStringsA UnhandledExceptionFilter GetACP HeapSize TerminateProcess RaiseException GetSystemTime GetTimeZoneInformation RtlUnwind GetStartupInfoA GetOEMCP GetCPInfo GetProcessVersion SetErrorMode GlobalFlags GetCurrentThread GetFileTime TlsGetValue LocalReAlloc TlsSetValue TlsFree GlobalHandle TlsAlloc LocalAlloc FileTimeToLocalFileTime FileTimeToSystemTime CreateSemaphoreA ResumeThread ReleaseSemaphore EnterCriticalSection LeaveCriticalSection GetProfileStringA WriteFile WaitForMultipleObjects CreateFileA SetEvent FindResourceA LoadResource LockResource ReadFile GetModuleFileNameA WideCharToMultiByte MultiByteToWideChar GetCurrentThreadId ExitProcess GlobalSize GlobalFree DeleteCriticalSection InitializeCriticalSection lstrcatA lstrlenA WinExec lstrcpyA FindNextFileA GlobalReAlloc HeapFree HeapReAlloc GetProcessHeap HeapAlloc GetFullPathNameA FreeLibrary LoadLibraryA GetLastError GetVersionExA WritePrivateProfileStringA CreateThread CreateEventA Sleep lstrcmpA GetVersion GlobalGetAtomNameA GlobalAddAtomA GlobalFindAtomA GlobalDeleteAtom lstrcmpiA SetEndOfFile UnlockFile LockFile FlushFileBuffers DuplicateHandle lstrcpynA SetLastError LocalFree InterlockedDecrement InterlockedIncrement FindFirstFileA FindClose GetFileAttributesA DeleteFileA CreateDirectoryA GetCurrentDirectoryA SetCurrentDirectoryA GetVolumeInformationA GetModuleHandleA GetProcAddress CloseHandle MulDiv GetCommandLineA GetTickCount WaitForSingleObject

user32

wsprintfA CloseClipboard GetClipboardData OpenClipboard SetClipboardData EmptyClipboard GetSystemMetrics GetCursorPos MessageBoxA SetWindowPos SendMessageA DestroyCursor SetParent IsWindow PostMessageA GetTopWindow GetParent GetFocus GetClientRect InvalidateRect ValidateRect UpdateWindow EqualRect GetWindowRect SetForegroundWindow DestroyMenu IsChild ReleaseDC IsRectEmpty FillRect GetDC SetCursor LoadCursorA SetCursorPos SetActiveWindow GetForegroundWindow GetDesktopWindow LoadIconA TranslateMessage DrawFrameControl DrawEdge DrawFocusRect WindowFromPoint GetMessageA DispatchMessageA SetRectEmpty RegisterClipboardFormatA CreateIconFromResourceEx CreateIconFromResource DrawIconEx CreatePopupMenu AppendMenuA ModifyMenuA CreateMenu CreateAcceleratorTableA GetDlgCtrlID GetSubMenu EnableMenuItem ClientToScreen EnumDisplaySettingsA LoadImageA SystemParametersInfoA ShowWindow IsWindowEnabled TranslateAcceleratorA GetKeyState CopyAcceleratorTableA PostQuitMessage IsZoomed GetClassInfoA DefWindowProcA GetMenu SetMenu PeekMessageA IsIconic SetFocus GetActiveWindow GetWindow DestroyAcceleratorTable SetWindowRgn GetMessagePos ScreenToClient ChildWindowFromPointEx CopyRect LoadBitmapA WinHelpA KillTimer SetTimer ReleaseCapture GetCapture SetCapture GetScrollRange SetScrollRange SetScrollPos GetWindowTextA GetWindowTextLengthA CharUpperA GetWindowDC BeginPaint EndPaint TabbedTextOutA DrawTextA GrayStringA GetDlgItem DestroyWindow CreateDialogIndirectParamA EndDialog GetNextDlgTabItem GetWindowPlacement RegisterWindowMessageA GetLastActivePopup GetMessageTime RemovePropA CallWindowProcA GetPropA UnhookWindowsHookEx SetPropA GetClassLongA CallNextHookEx SetWindowsHookExA CreateWindowExA GetMenuItemID GetMenuItemCount RegisterClassA GetScrollPos AdjustWindowRectEx MapWindowPoints SendDlgItemMessageA ScrollWindowEx IsDialogMessageA SetWindowTextA MoveWindow CheckMenuItem SetMenuItemBitmaps GetMenuState GetMenuCheckMarkDimensions GetClassNameA LoadStringA GetSysColorBrush SetRect InflateRect IntersectRect DestroyIcon PtInRect OffsetRect IsWindowVisible EnableWindow RedrawWindow GetWindowLongA SetWindowLongA GetSysColor UnregisterClassA

gdi32

SetROP2 SetBkColor CreateRectRgnIndirect SetStretchBltMode GetClipRgn CreatePolygonRgn SelectClipRgn DeleteObject CreateDIBitmap GetSystemPaletteEntries CreatePalette StretchBlt SelectPalette RealizePalette GetDIBits GetWindowExtEx GetViewportOrgEx GetWindowOrgEx BeginPath EndPath PathToRegion CreateEllipticRgn CreateRoundRectRgn GetTextColor GetBkMode GetBkColor GetROP2 GetStretchBltMode GetPolyFillMode CreateCompatibleBitmap CreateDCA CreateBitmap SelectObject CreatePen PatBlt CombineRgn CreateRectRgn FillRgn CreateSolidBrush CreateFontIndirectA GetStockObject GetObjectA EndPage EndDoc DeleteDC StartDocA StartPage BitBlt CreateCompatibleDC Ellipse Rectangle LPtoDP DPtoLP GetCurrentObject RoundRect GetTextExtentPoint32A GetDeviceCaps SaveDC RestoreDC SetBkMode SetPolyFillMode SetTextColor SetMapMode SetViewportOrgEx OffsetViewportOrgEx SetViewportExtEx ScaleViewportExtEx SetWindowOrgEx SetWindowExtEx ScaleWindowExtEx GetClipBox ExcludeClipRect MoveToEx LineTo GetTextMetricsA Escape ExtTextOutA TextOutA RectVisible PtVisible GetViewportExtEx ExtSelectClipRgn

winmm

midiStreamClose midiOutReset midiStreamStop midiStreamOut midiOutPrepareHeader midiStreamProperty midiStreamOpen midiOutUnprepareHeader waveOutOpen waveOutGetNumDevs waveOutClose waveOutReset waveOutPause waveOutWrite waveOutPrepareHeader waveOutUnprepareHeader waveOutRestart midiStreamRestart

winspool.drv

OpenPrinterA DocumentPropertiesA ClosePrinter

advapi32

RegQueryValueA RegSetValueExA RegOpenKeyExA RegCloseKey RegCreateKeyExA

shell32

Shell_NotifyIconA ShellExecuteA

ole32

OleInitialize OleUninitialize CLSIDFromString

oleaut32

RegisterTypeLi LoadTypeLi UnRegisterTypeLi SystemTimeToVariantTime

comctl32

ord17 ImageList_Destroy

ws2_32

WSAAsyncSelect closesocket recvfrom ioctlsocket recv WSACleanup getpeername accept ntohl inet_ntoa

comdlg32

ChooseColorA GetOpenFileNameA GetSaveFileNameA GetFileTitleA

Sharing

General

Malware Config

Signatures

File Explorer

909fa22e60749bb1fab1fcd1c54b098ec1b354ab1e9a1d7870f61ed2f0f5bc13

PE Signature issue

kernel32

user32

gdi32

winmm

winspool.drv

advapi32

shell32

ole32

oleaut32

comctl32

ws2_32

comdlg32

generic