24122024.rar
- SHA256 b378d7f1fa1cffa05b55917225232224ff0b13a1d739feac017c7fe56f1b3adb
Password
sordum
Behavioral task
behavioral1
Sample
24122024/Defender_Settings.vbs
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
24122024/Defender_Settings.vbs
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
Behavioral task
behavioral3
Sample
24122024/dControl.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral4
Sample
24122024/dControl.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
30 signatures
150 seconds
General
- Target 24122024.rar
- Size 446KB
- Sample260805-m2vrhsab27
- SHA256 b378d7f1fa1cffa05b55917225232224ff0b13a1d739feac017c7fe56f1b3adb
- MD5 96b5933de9fc36d0385cdd41f2955fe0
- SHA1 c457e29bc8638c9e2e1e10203bc00f19da1a8ca6
- SHA512 76733c94d51b26f23b83b0d32e8ab68dd686777186ad5b21430e14f76950e30d2ccc6278bf9e424fb26d9db00e7ad892dce4dbc0b570638e046795312bf5ae78
- SSDEEP 12288:oxnSX+G1gpDHX46Sd5XkQTvHZ0/5EIq0yK36skx:MnSuugpDIkOHZW6Uy46rx
- TLSH T191A4231EFAC6DE14B0067C23EB61FD7554261F0F94892ADA96CF2CF23651D958C28E8C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule static1/unpack002/out.upx autoit_exe - Codesign digest Mismatch 1 IoCs
File was altered after it was signed.
resource unpack001/24122024/dControl.exe -
resource yara_rule static1/unpack001/24122024/dControl.exe upx - Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack002/out.upx
File Explorer
-
24122024.rar.rar 446KB
-
24122024/Defender_Settings.vbs.vbs 313B
-
24122024/ReadMe.txt2KB
-
24122024/dControl.exe.exe 447KB
-
out.upx.exe 653KB
-
24122024/dControl.ini85KB
24122024/Defender_Settings.vbs
- SHA256 af42a17d428c8e9d6f4a6d3393ec268f4d12bbfd01a897d87275482a45c847e9
- MD5 b0bf0a477bcca312021177572311e666
- SHA1 ea77332d7779938ae8e92ad35d6dea4f4be37a92
- SHA512 09366608f2670d2eb0e8ddcacd081a7b2d7b680c4cdd02494d08821dbdf17595b30e88f6ce0888591592e7caa422414a895846a268fd63e8243074972c9f52d8
- TLSH T17BE0720B25BCD2C3043322D0806D6047C1F28A202C68E0032AA1EDCEA870BB902EC2C7
- MD5 SHA1 SHA512 TLSH
24122024/ReadMe.txt
- SHA256 d3b0219253a58ccb394559751299bd16dba1120e02cb11571c3b6a085b1027f8
- MD5 8dbe87a9bf6342c4e2ea406fa86e76bb
- SHA1 35fe083b3f5793fe1b803d091262e4dee2cd0c4d
- SHA512 3fca076f1c6fe286bef4d211fad2643e2c2e426d75e665c1a1c8dd241689fbd3911544b90f65e0b2ab25ce0ff63fc5520684ff7c1c2fb71be9cda6359a8b1c8e
- TLSH T16351BA2526BB3A7D07735798654B6C13A71870D63FBB0CAB308D94F612C0918EB6F25D
- MD5 SHA1 SHA512 TLSH
24122024/dControl.exe
- SHA256 1ef6c1a4dfdc39b63bfe650ca81ab89510de6c0d3d7c608ac5be80033e559326
- MD5 58008524a6473bdf86c1040a9a9e39c3
- SHA1 cb704d2e8df80fd3500a5b817966dc262d80ddb8
- SHA512 8cf492584303523bf6cdfeb6b1b779ee44471c91e759ce32fd4849547b6245d4ed86af5b38d1c6979729a77f312ba91c48207a332ae1589a6e25de67ffb96c31
- SSDEEP 6144:Vzv+kSn74iCmfianQGDM3OXTWRDy9GYQDUmJFXIXHrsUBnBTF8JJCYrYNsQJzfgu:Vzcn7EanlQiWtYhmJFSwUBLcQZfgiD
- TLSH T1EBA42292D5045CD2D5174339DF7B7FF38EB6ADEE29180A8344B8387B3C3A9922158A53
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Codesign digest Mismatch
File was altered after it was signed.
Password
sordum
PE Signature issue
Digest
13:f6:ef:3f:06:29:49:56:6c:21:59:e0:0c:ac:6f:83:24:95:fa:e4
Digest Algorithm
sha1
PE Digests Matches
Not matched
Trusted
Not trusted
Signing Certificate
CN=Sordum Software
Chains
Mar 1, 2022
CN=Sordum Software
Subject
CN=Sordum Software
Serial Number
69:98:6c:80:0a:7c:5b:8e:47:86:45:a0:3e:86:d5:40
Issuer
CN=Sordum Software
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Sep 11, 2021 - Jul 31, 2030
Subject
CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL
Serial Number
1b:b5:8f:25:2a:df:23:00:49:28:c9:ae:3d:7e:ed:27
Issuer
CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Timespan
May 31, 2021 - Sep 17, 2029
Subject
CN=Certum Timestamp 2021,O=Asseco Data Systems S.A.,C=PL
Serial Number
f1:64:25:8c:09:b6:e2:7b:e2:0e:32:60:8e:4b:f4:a8
Issuer
CN=Certum Timestamping 2021 CA,O=Asseco Data Systems S.A.,C=PL
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
May 19, 2021 - May 18, 2032
Subject
CN=Certum Timestamping 2021 CA,O=Asseco Data Systems S.A.,C=PL
Serial Number
e7:ff:69:c7:3b:35:ce:4b:91:26:d8:74:7c:68:a5:87
Issuer
CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
May 19, 2021 - May 18, 2036
Minor OS version
0
Major OS version
5
Entry point
775760
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
UPX0
Size
Virtual Size
492KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
262KB
Virtual Size
264KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
57KB
Virtual Size
60KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=2, id=152, version=20115,
count=175, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=53, id=171, productName=VS2010 SP1 build 40219, version=40219,
count=9, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=33, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=528, id=1, productName=Unmarked objects,
count=72, id=180, version=40219,
count=28, id=158, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=154, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=151,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
out.upx
- SHA256 481e03978ca339ce697252895efe89b09fefd3098ad247d24eeb6cca9969f553
- MD5 6970ea0b6597dcd5b4f5f19f28e958a8
- SHA1 a0130bb7ac03ec4799c90781ca93fd1392c6d54c
- SHA512 bc95cbe9a050e3d3b713745ef399bf2817d38f8e019f6edffdd2bf755badbde766e434e39a7f32356125bba0692b694c18da8dd0762aac0c9430d45acb215e01
- SSDEEP 12288:nkxDoouVA2nxKkhEvdRgQriDJOIlW+yBGQowlNCWS:RRmJkioQrilOIc+yMx
- TLSH T1E9E4AF21F5C69076C2A322B19F7EF76ADA3D693A0327D1D727D83C315EA04416A29733
- MD5 SHA1 SHA512 SSDEEP TLSH
-
AutoIT Executable
AutoIT scripts compiled to PE executables.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
91585
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
.text
Size
514KB
Virtual Size
513KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
56KB
Virtual Size
55KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
26KB
Virtual Size
105KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
56KB
Virtual Size
56KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=152, version=20115,
count=175, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=53, id=171, productName=VS2010 SP1 build 40219, version=40219,
count=9, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=33, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=528, id=1, productName=Unmarked objects,
count=72, id=180, version=40219,
count=28, id=158, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=154, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=151,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
24122024/dControl.ini
- SHA256 8e9a84da243905685ca77b6ef71841e610b88b7963d4de59f6dcbdd1621ecacd
- MD5 05450ff06366ae22654b63a6e27d1624
- SHA1 11453c370f41287fb6339e509bb9d3c91842b379
- SHA512 ee0a9605b566aa89c8c9b260e1d9c15aecbd6cddc2df47fe24ef2cafbe8923b3e025bd5cd3d34499292589a3c094dd796ab4560c8099bad2051a54928c37b4b2
- SSDEEP 768:i/G+NmPfjsxaxdk2akexodULxEQq1wIgC+AEbSr6:1+NyjsxkKdkJdULgbWSO
- TLSH T15B83021A92FA6219F2F39B10E6F41F720B36BD95693CD04C0ED55D8C19E0E609522BFB
- MD5 SHA1 SHA512 SSDEEP TLSH