SacramentoZum[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
SacramentoZum.exe
Size 2.1MB
Sample260804-w48wlaxdpc
SHA256 4b788dc59db568205a6180f30bae301d6107896ee3e80c1edca4017c9bee5bed
MD5 25d4dc16ff90dad6221c7846336f357f
SHA1 03e70215222767e6fde4a379b7979d31bf5f12ef
SHA512 a8f2312b5bad3e09dd913bc0197c49f26c62e31b9464ded2b440b92746f567fd737424f2da6997b9284abc0b3cd48f658f85d575b42adbeb700c2f4acc60f00b
SSDEEP 49152:2FgFI1VciQbuls6SVZO4/AYMqvainRcchDuBSwujCxW3QsZ6BveK:AZVM03SVZSYMqvaiRcchDsSbjWW3nZCe
TLSH
T15BA52362A3D50576D8FAAB3C86B642AB17317E6D567C5D8B13C4C81E1F33A918A3034F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
SacramentoZum.exe

File Explorer

SacramentoZum.exe

.exe 2.1MB

SacramentoZum.exe

IMPHASH 013c74198fc6e42dcf33737d6c40c012
SHA256 4b788dc59db568205a6180f30bae301d6107896ee3e80c1edca4017c9bee5bed
MD5 25d4dc16ff90dad6221c7846336f357f
SHA1 03e70215222767e6fde4a379b7979d31bf5f12ef
SHA512 a8f2312b5bad3e09dd913bc0197c49f26c62e31b9464ded2b440b92746f567fd737424f2da6997b9284abc0b3cd48f658f85d575b42adbeb700c2f4acc60f00b
SSDEEP 49152:2FgFI1VciQbuls6SVZO4/AYMqvainRcchDuBSwujCxW3QsZ6BveK:AZVM03SVZSYMqvaiRcchDsSbjWW3nZCe
TLSH
T15BA52362A3D50576D8FAAB3C86B642AB17317E6D567C5D8B13C4C81E1F33A918A3034F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

32960

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

wextract.pdb

advapi32

OpenProcessToken GetTokenInformation RegSetValueExA EqualSid RegQueryValueExA LookupPrivilegeValueA RegCreateKeyExA RegOpenKeyExA RegQueryInfoKeyA RegDeleteValueA AllocateAndInitializeSid FreeSid AdjustTokenPrivileges RegCloseKey

kernel32

GetPrivateProfileIntA GetFileAttributesA IsDBCSLeadByte GetSystemDirectoryA GlobalUnlock GetShortPathNameA CreateDirectoryA FindFirstFileA GetLastError GetProcAddress RemoveDirectoryA SetFileAttributesA GlobalFree FindClose GetPrivateProfileStringA LoadLibraryA LocalAlloc WritePrivateProfileStringA GetModuleFileNameA FindNextFileA CompareStringA _lopen CloseHandle LocalFree DeleteFileA ExitProcess DosDateTimeToFileTime CreateFileA FindResourceA SetFilePointer GlobalAlloc ExpandEnvironmentStringsA WaitForSingleObject SetEvent GetModuleHandleW FormatMessageA SetFileTime WriteFile GetDriveTypeA GetVolumeInformationA TerminateThread SizeofResource CreateEventA GetExitCodeProcess CreateProcessA ReadFile SetCurrentDirectoryA _llseek ResetEvent LockResource GetSystemInfo LoadLibraryExA CreateMutexA GetCurrentDirectoryA GetVersionExA GetVersion GetTempPathA CreateThread LocalFileTimeToFileTime Sleep FreeResource GetWindowsDirectoryA lstrcmpA _lclose GlobalLock GetCurrentProcess LoadResource FreeLibrary GetStartupInfoW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess OutputDebugStringA QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime GetTickCount EnumResourceLanguagesA MulDiv GetDiskFreeSpaceA GetTempFileNameA

gdi32

GetDeviceCaps

user32

SetForegroundWindow MsgWaitForMultipleObjects SendDlgItemMessageA GetWindowLongPtrA GetWindowRect GetDC MessageBoxA PeekMessageA ReleaseDC GetDlgItem SetWindowPos ShowWindow SetWindowLongPtrA DispatchMessageA SetWindowTextA EnableWindow CallWindowProcA DialogBoxIndirectParamA GetDlgItemTextA LoadStringA MessageBeep CharUpperA CharNextA ExitWindowsEx CharPrevA EndDialog GetDesktopWindow SetDlgItemTextA SendMessageA GetSystemMetrics

msvcrt

?terminate@@YAXXZ _fmode _acmdln __C_specific_handler _initterm __setusermatherr _ismbblead _cexit memset memcpy _exit exit __set_app_type __getmainargs _amsg_exit _XcptFilter _errno _vsnprintf _commode

comctl32

ord17

cabinet

ord22 ord23 ord21 ord20

version

GetFileVersionInfoA GetFileVersionInfoSizeA VerQueryValueA