e4d1d38fa48e3486fc0964ee9101bfb1f032297db2078d01a891f2a2bab3943a
- SHA256 e4d1d38fa48e3486fc0964ee9101bfb1f032297db2078d01a891f2a2bab3943a
Overview
overview
8Static
static
5Snapshot/#...��.bat
windows10-2004-x64
8Snapshot/#...��.bat
windows11-ltsc_2024-x64
8Snapshot/3...��.cmd
windows10-2004-x64
3Snapshot/3...��.cmd
windows11-ltsc_2024-x64
3Snapshot/3...��.cmd
windows10-2004-x64
3Snapshot/3...��.cmd
windows11-ltsc_2024-x64
3Snapshot/S...64.exe
windows10-2004-x64
5Snapshot/S...64.exe
windows11-ltsc_2024-x64
5Snapshot/S...��.exe
windows10-2004-x64
6Snapshot/S...��.exe
windows11-ltsc_2024-x64
6Snapshot/SysVer.cmd
windows10-2004-x64
3Snapshot/SysVer.cmd
windows11-ltsc_2024-x64
3Behavioral task
behavioral1
Sample
Snapshot/#清理卸载.bat
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
Snapshot/#清理卸载.bat
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
Behavioral task
behavioral3
Sample
Snapshot/31_BCD引导编辑.cmd
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral4
Sample
Snapshot/31_BCD引导编辑.cmd
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral5
Sample
Snapshot/32_NT6+ 引导修复.cmd
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral6
Sample
Snapshot/32_NT6+ 引导修复.cmd
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral7
Sample
Snapshot/Snapshot64.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral8
Sample
Snapshot/Snapshot64.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral9
Sample
Snapshot/Snapshot备份还原.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral10
Sample
Snapshot/Snapshot备份还原.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral11
Sample
Snapshot/SysVer.cmd
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral12
Sample
Snapshot/SysVer.cmd
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
General
- Target e4d1d38fa48e3486fc0964ee9101bfb1f032297db2078d01a891f2a2bab3943a
- Size 2.0MB
- Sample260806-m9pkgazanf
- SHA256 e4d1d38fa48e3486fc0964ee9101bfb1f032297db2078d01a891f2a2bab3943a
- MD5 3360e70ec47c95331f72054161469063
- SHA1 2bd4d19a64904ccf2bde5e0708c855151f5f3a3b
- SHA512 ff4e4c92566711db3e1426e767f440c889d2a45864304f253da4171762df6310c3022963d6b0e4f6dda4faf46ae35d4c13425304a749d16c7d061f50deac09f2
- SSDEEP 49152:moloKisRGLXmpgunu4cdroegwKRpfUFvxDDrIhEazoNj:moloKtGLXAgEuNdroeirfOvxDfIqaUNj
- TLSH T181A533B336006D17ACB967369A4E8226B56B51EFC7DD35D90F8F28F881EC0112DBA074
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
-
resource yara_rule static1/unpack001/Snapshot/Snapshot64.exe upx - Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/Snapshot/Snapshot64.exe unpack001/Snapshot/Snapshot备份还原.exe
File Explorer
-
e4d1d38fa48e3486fc0964ee9101bfb1f032297db2078d01a891f2a2bab3943a.rar 2.0MB
-
Snapshot/#清理卸载.bat.bat 4KB
-
Snapshot/31_BCD引导编辑.cmd74B
-
Snapshot/32_NT6+ 引导修复.cmd76B
-
Snapshot/Snapshot64.exe.exe 1.5MB
-
Snapshot/Snapshot备份还原.exe.exe 530KB
-
Snapshot/SysVer.cmd.cmd .bat 4KB
Snapshot/#清理卸载.bat
- SHA256 ff958df6dc1058e27c4f410b8a3d5a1e07133dcdca18fb5cc7812eaa50bdc8a7
- MD5 60b672e2d929b40926650e6d9d8a3cdf
- SHA1 fa413ec3b1bb6e74dff40b8b70820c1f43bf8d88
- SHA512 d2f17e7edcca39a8843a2ebe74622d9ce8bd526c0b3c5692dcdd8082fa779fa2725bf024ea5d5c93c3d934dcdd255b1669b006cd5d328d66de30ccabcb0716de
- SSDEEP 96:GCQC8kLYBJYYY/mUYW9V9VJbNMROBrEc/QIMEX1qt4M4G5:3LVMBNCp7/Hr4YO
- TLSH T13EA143162B018A1249E50592DB9ECB5677E7DE0B78307AE923D274D6EE9F35803F02E1
- MD5 SHA1 SHA512 SSDEEP TLSH
Snapshot/31_BCD引导编辑.cmd
- SHA256 7e6ab2449af4b04e98fcfee0d54d5ac128ce940b1d268e06a3b8a1340a73f4f4
- MD5 c4202e69e3e324b3e3984235c3aa2f8f
- SHA1 19a3e816ef1c2abd983a658567b01ad9f0777209
- SHA512 261421bac7df7d0a714902af9a987dc948feb247731b43fdaf066f374dce30c9287f78c8c8ed7a80158993d060bc5444e6e7f831b5bd04bc3c19f18a8a05f632
- TLSH T10FA012A409208B26408C49514159E34224D62A4D00C154D008E54753002700150044C1
- MD5 SHA1 SHA512 TLSH
Snapshot/32_NT6+ 引导修复.cmd
- SHA256 a0ec330ad54f149da2438062ae9a3bc3310b9311c9a78a4bf4796995b02a1173
- MD5 0fb61a3fa0564a7f71d78f875e99afac
- SHA1 5b21355657c430001c360e3ecbb3bfc20deec60d
- SHA512 a75cc178c03e9647d64ae502c3ecd994c49f43ed1c959fd794c3efb4ed0851f324ed6e20effc0d4aafa88758a506f348b233040707e019bedc40819fe6dcb3ef
- TLSH T172A011B802380FA800882A22A0AAE28008AB2A8E00C028E000CA0F82023A08A02080C2
- MD5 SHA1 SHA512 TLSH
Snapshot/Snapshot64.exe
- SHA256 ef5bf3f8c8a2bc6f09e01b441bf3628a29525a0727343cad480b784fb594c124
- MD5 668812732ff8130f1b3c107cf39f6f02
- SHA1 969147f5c06c0a5ec8e2b7a24e393ae7d32e396f
- SHA512 9de6351f5dcf6c7c47b9031e36184932b75bfaf26f383a3676e7ad2e8ec8c6eec1f77f15b4b3f9a59b0039b8ec4facd31e88df9329b7d55d869db03f4ca73694
- SSDEEP 49152:PHpZa2F4xrxUi4yCBQOz5kadoUrvDnozVpXq9pB0oX:PHesY14yTOzqaKUrboz/y
- TLSH T1897533EBF620F8F7C484B9B56DCCD8A08815A576C917318B0050F75A6EBB9A16D4C2FC
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
5118016
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
Name
UPX0
Size
Virtual Size
3.4MB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
1.5MB
Virtual Size
1.5MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=2, id=253, version=34321,
count=10, id=259, version=34321,
count=19, id=260, version=34321,
count=61, id=261, version=34321,
count=218, id=261, version=33145,
count=13, id=259, version=33145,
count=16, id=260, version=33145,
count=433, id=1, productName=Unmarked objects,
count=23, id=257, version=33145,
count=22, id=260, version=35721,
count=269, id=261, version=35721,
count=106, id=265, version=34444,
count=1, id=260, version=34444,
count=1, id=255, version=34444,
count=1, id=151,
count=1, id=258, version=34444,
Snapshot/Snapshot备份还原.exe
- IMPHASH 234ecae781a7845c972346b1edefdddc
- SHA256 5ef67d9fa3d61e35f6ced2bf996ef8d3b65dc430cb5e4f3bb1f46f86a10b0ac9
- MD5 0ffaa2da44305680a8cd5b42fd78ac0f
- SHA1 ac69e1127838159c5dff47c0e0f302737f67b5f8
- SHA512 3b84e8006da6f4cdaf0462447b6196f0e81e12b88df909f0b6d062039447dc63256c1184dd95ebb3fa2296970fdf676d05ec0d5c82077b7f63cfd394688ba609
- SSDEEP 12288:O0JX4wTPNBGAf/z9qe7xV6PJMjwEFxi8TimPhToSkMfHk/:hvHznxMPJW3i8Z6MfHk/
- TLSH T140B4128653FB8D1BC4F8063832B69602EC399427D99057B0B5CE3C0DEF6EB109195E9E
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1512303
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
kernel32
GetModuleHandleA
GetProcAddress
shlwapi
StrStrA
user32
GetDC
gdi32
BitBlt
advapi32
FreeSid
shell32
SHChangeNotify
version
VerQueryValueW
setupapi
CM_Get_Parent
LoadEnvi
MemoryCompare
MemoryCopy
MemorySet
WndProc1
WndProc1_
WndProc2
WndProc2_
WndProc3
WndProc3_
_dllMain_Name@12
_mainB_@8
_mainW@16
_main_@4
main
main1
main5
mainB
Name
.MPRESS1
Size
393KB
Virtual Size
1.4MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.MPRESS2
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
132KB
Virtual Size
132KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
Snapshot/SysVer.cmd
- SHA256 1c9b1b914176ef36bcc84eb80cf260c0f2490e644ce081f2d5e4d134313eb28e
- MD5 83ce345b0208765d1c1e191dcd8df0f3
- SHA1 326f34e7ac1c943ba81b543eb88585a2773658a0
- SHA512 c1ddf4e4982a0b41fccbaacd334586f55996262245a10c26bc950ad43b153e6f00b3b365074d88f04644816de40ecf7c3b21bd586a0e884a4e7b8fc40c62c96d
- SSDEEP 96:Qe0pQCHkj4p7hbIyACMgymnoJ0Liahc5+xTmQm35KvVE:oLEI7hUyyzooCLiahc5+xTmQmp8G
- TLSH T184A141E30082482145F853E785E18367B777D29B7430D0F8328CD165BFEA325A3A2AE7
- MD5 SHA1 SHA512 SSDEEP TLSH