Terenax Private Loader (1)[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
Terenax Private Loader (1).exe
Size 1.1MB
Sample260804-vcsjvsvgpc
SHA256 80aeec314070f1531bb5a568fd64f70bb36e3b22593bfe7e992f250f786002a5
MD5 9aa6a1cbb87dca4922fa90775d092036
SHA1 34ed10ffd13ef86bbd5e8f3690406349813d0f30
SHA512 443fbc431696cf4618ba58e218049d70afc60a223a82261410ed2c6394d9373f68c6f9821d42e4c0e6dd26e0752132ff9d8f4134598d5b5e5e1f6aa7ea86e911
SSDEEP 12288:7zmqwHC39mo9gkBoTLnmcBaEkEymPUrgpnsxBhYEQFViar3Z4eQ0P35qHjdf2MzJ:GqPtmLkBoTLDByEytc6BzKQ0xwzRW4
TLSH
T13B357C01BBB802A9E2FF9B39D8710506C776FC4A9725EBCF1A4845AD1D633909D31B63
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Terenax Private Loader (1).exe

File Explorer

Terenax Private Loader (1).exe

.exe 1.1MB

Terenax Private Loader (1).exe

IMPHASH ccb7d40f189c43b438866fa29ae8f50e
SHA256 80aeec314070f1531bb5a568fd64f70bb36e3b22593bfe7e992f250f786002a5
MD5 9aa6a1cbb87dca4922fa90775d092036
SHA1 34ed10ffd13ef86bbd5e8f3690406349813d0f30
SHA512 443fbc431696cf4618ba58e218049d70afc60a223a82261410ed2c6394d9373f68c6f9821d42e4c0e6dd26e0752132ff9d8f4134598d5b5e5e1f6aa7ea86e911
SSDEEP 12288:7zmqwHC39mo9gkBoTLnmcBaEkEymPUrgpnsxBhYEQFViar3Z4eQ0P35qHjdf2MzJ:GqPtmLkBoTLDByEytc6BzKQ0xwzRW4
TLSH
T13B357C01BBB802A9E2FF9B39D8710506C776FC4A9725EBCF1A4845AD1D633909D31B63
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

115008

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

VirtualProtect SetConsoleTextAttribute SetConsoleTitleA GetCurrentProcess GetStdHandle TerminateProcess GetModuleFileNameW GetFileAttributesW OpenProcess SetProcessMitigationPolicy CreateToolhelp32Snapshot Sleep GetTempPathA GetFileAttributesA Process32NextW GetCurrentThread DeleteFileA Process32First Process32FirstW CloseHandle CreateThread SetFileAttributesA AddVectoredExceptionHandler GetProcAddress ExitProcess GetModuleHandleW CreateProcessA SetConsoleOutputCP CreateDirectoryA GetComputerNameA SetEndOfFile WriteConsoleW HeapSize SetStdHandle Process32Next RemoveVectoredExceptionHandler GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose HeapReAlloc ReadFile EnumSystemLocalesW MultiByteToWideChar GetStringTypeW WideCharToMultiByte EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx GetCPInfo SetUnhandledExceptionFilter GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlLookupFunctionEntry RtlUnwindEx RtlPcToFileHeader RaiseException GetLastError SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree GetConsoleCP IsProcessorFeaturePresent FreeLibrary GetModuleHandleExW WriteFile GetCommandLineA GetCommandLineW RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter GetFileSizeEx SetFilePointerEx GetFileType HeapAlloc GetTimeZoneInformation FlushFileBuffers GetConsoleOutputCP GetConsoleMode HeapFree CreateFileW SetConsoleMode GetNumberOfConsoleInputEvents ReadConsoleInputW PeekConsoleInputA ReadConsoleW WaitForSingleObject GetExitCodeProcess CreateProcessW GetFileAttributesExW LoadLibraryExW GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID RtlUnwind

user32

FindWindowW

shell32

ShellExecuteW

advapi32

RegCloseKey

winhttp

WinHttpReadData WinHttpOpenRequest WinHttpOpen WinHttpReceiveResponse WinHttpSetTimeouts WinHttpConnect WinHttpCrackUrl WinHttpQueryDataAvailable WinHttpSendRequest WinHttpCloseHandle

ntdll

RtlAdjustPrivilege NtRaiseHardError

Name

.text

Size

275KB

Virtual Size

275KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

93KB

Virtual Size

92KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

719KB

Virtual Size

729KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

13KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

Terenax Private Loader (1).exe

kernel32

user32

shell32

advapi32

winhttp

ntdll

generic