ter-windows-x64-latest[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
ter-windows-x64-latest.zip
Size 370KB
Sample260808-k8mclscf89
SHA256 5ee996b1cd9fd8eb2b4f3b1086ca8b2fbe9f6a9341d050ba4f8eeda935675aed
MD5 20ae41a98103d078125d0b888b642fa0
SHA1 36d54e87a6af734a0a0fc3cfe83d45b9a5c14993
SHA512 213b0ae4177503e8285da80649519ff96bac3c285d07aefa8adb3ac1cd36473d275f4b40dac7fa528ae75ea597b4f9f52ac18fca8e2921796bec5caa548e491d
SSDEEP 6144:MNihOgqnU4vg1SlUTD8yMieNz40lsq/X8Aigz9a8s5Em/YPck+oQ2ubTmQGnIjA:Mje38t40lsq/X8AigAXYPcFokTkYA
TLSH
T1DC8423696EBFA3F7777D12CE332962687F1F2AE360C29BE5A01850B7256534041A21C7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/ter.exe

File Explorer

ter-windows-x64-latest.zip

.zip 370KB
README.md

9KB
install.ps1

.ps1 1005B
ter.exe

.exe 770KB

ter-windows-x64-latest.zip

SHA256 5ee996b1cd9fd8eb2b4f3b1086ca8b2fbe9f6a9341d050ba4f8eeda935675aed
MD5 20ae41a98103d078125d0b888b642fa0
SHA1 36d54e87a6af734a0a0fc3cfe83d45b9a5c14993
SHA512 213b0ae4177503e8285da80649519ff96bac3c285d07aefa8adb3ac1cd36473d275f4b40dac7fa528ae75ea597b4f9f52ac18fca8e2921796bec5caa548e491d
SSDEEP 6144:MNihOgqnU4vg1SlUTD8yMieNz40lsq/X8Aigz9a8s5Em/YPck+oQ2ubTmQGnIjA:Mje38t40lsq/X8AigAXYPcFokTkYA
TLSH
T1DC8423696EBFA3F7777D12CE332962687F1F2AE360C29BE5A01850B7256534041A21C7
MD5 SHA1 SHA512 SSDEEP TLSH

ter.exe

IMPHASH 172fbe24d1e271dc36df845446ba1294
SHA256 1656bc679d7f617bb8ec482eff2ffea11eb3f7a5ec38c72c3ffb32e785af2f6f
MD5 b663b6eee658ff35b0ddb056312b5812
SHA1 3dea4f99b4820b40bb8394dd2ec869cdf3037462
SHA512 de52e2d98b218b7c6a8acc5e3e91315f710abc442064ee171d6f770a51db8990d052479588a16f53dd3519acd7d7d4c2d84c9dce9ad78ad2a49dcf5a31a31887
SSDEEP 6144:eWu6SURwVE/kYzWii8Aow9AwBmOK8Q0Y3JhFAzY/Of+ejmTqj9HSxjNVuhHvsPp8:v3NwpBm3Jkdj9jlC2hOoANmsJxYGbY
TLSH
T1DBF43B11BE5A49A5E099C8B4834B86639A3678CB0F3AB4FF00C551393F7DAB55F3D218
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

562192

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ter.pdb

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

bcryptprimitives

ProcessPrng

kernel32

GetSystemTimeAsFileTime GetTempPathW DeleteFileW QueryPerformanceCounter QueryPerformanceFrequency GetModuleFileNameW FormatMessageW GetModuleHandleW WriteFileEx SleepEx ReadFileEx GetEnvironmentVariableW HeapAlloc WriteConsoleW MultiByteToWideChar InitializeSListHead GetFileAttributesW CreateProcessW WaitForSingleObject SetUnhandledExceptionFilter GetConsoleOutputCP GetWindowsDirectoryW GetConsoleMode GetStdHandle RtlVirtualUnwind WideCharToMultiByte GetSystemDirectoryW ReleaseMutex CloseHandle FreeEnvironmentStringsW GetSystemTimePreciseAsFileTime GlobalAlloc GlobalLock GlobalUnlock GetCurrentProcessId lstrlenW GetProcAddress GlobalFree LoadLibraryA WaitForSingleObjectEx GlobalSize RtlLookupFunctionEntry GetCurrentProcess RtlCaptureContext GetEnvironmentStringsW CompareStringOrdinal GetCurrentDirectoryW CreateDirectoryW GetFileInformationByHandleEx SetLastError GetFileInformationByHandle SetFileInformationByHandle SetFileTime GetCurrentThreadId HeapReAlloc FindClose FindNextFileW GetLastError HeapFree GetProcessHeap FindFirstFileExW CreateFileW CreateWaitableTimerExW SetWaitableTimer Sleep GetFullPathNameW DuplicateHandle LoadLibraryExA TerminateProcess GetModuleHandleA SetThreadStackGuarantee GetCurrentThread ResizePseudoConsole WriteFile ReadFile MoveFileExW CreateMutexA CreateThread ClosePseudoConsole AddVectoredExceptionHandler CreatePipe CreatePseudoConsole InitializeProcThreadAttributeList DeleteProcThreadAttributeList UpdateProcThreadAttribute

ntdll

NtOpenFile NtReadFile NtWriteFile NtCreateNamedPipeFile RtlNtStatusToDosError

user32

LoadCursorW BeginPaint RegisterClassW ReleaseCapture SetProcessDpiAwarenessContext PostMessageW GetCursorPos DestroyMenu TrackPopupMenu ClientToScreen AppendMenuW CreatePopupMenu CallWindowProcW ReleaseDC GetDC FillRect DrawTextW GetClientRect InvalidateRect LoadIconW CloseClipboard SetClipboardData EmptyClipboard OpenClipboard GetFocus GetKeyState SetWindowTextW DefWindowProcW SetWindowLongPtrW GetWindowLongPtrW GetWindowTextW SendMessageW CreateWindowExW GetWindowRect AdjustWindowRectEx MessageBoxW SetForegroundWindow DestroyWindow PostQuitMessage DispatchMessageW TranslateMessage IsDialogMessageW GetAncestor GetMessageW EnableWindow ShowWindow SetFocus GetDpiForWindow FrameRect EndPaint GetClipboardData SetCapture

gdi32

CreateCompatibleDC GetTextMetricsW GetTextFaceW CreateCompatibleBitmap ExtTextOutW SetBkColor CreateSolidBrush SetTextColor BitBlt SetBkMode CreateFontW SelectObject DeleteObject DeleteDC

shell32

Shell_NotifyIconW

oleaut32

SysStringLen SysFreeString GetErrorInfo

vcruntime140

_CxxThrowException __current_exception __CxxFrameHandler3 __C_specific_handler memset memcpy memcmp memmove __current_exception_context

api-ms-win-crt-math-l1-1-0

roundf ceil __setusermatherr

api-ms-win-crt-runtime-l1-1-0

_initterm_e exit _exit __p___argc __p___argv _cexit _c_exit _seh_filter_exe _set_app_type _get_initial_narrow_environment _initialize_onexit_table _register_onexit_function _crt_atexit terminate _initialize_narrow_environment _configure_narrow_argv _register_thread_local_exe_atexit_callback _initterm

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode free