𝕭ella 汰_loader[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
𝕭ella 汰_loader.exe
Size 915KB
Sample260809-p2schafj7z
SHA256 688aa4b277f8fb8e30764c9ea0791f3522f929b897f3e5234b47fddc33a39f85
MD5 bf806e53bd53f71c5efe49420293776b
SHA1 4907c6bf3465dfd286593e418385982f8fdff700
SHA512 fb836e26200038194cf6d6a758d5031acfb14982dcafcb72a37eb1e896eb26eae8894b038688497708d5a4687b42da8c09e5b1f657610745dd86159b54b4318e
SSDEEP 12288:Lecicflv0EKadUcCbfFB1Y5fWIdyw+G1bNcdhg19Oa6m2cuA:LeTcflv3dUcCbfFU51hcdhg19OaC
TLSH
T1E9152A1BE6B345E8C52FD07887539772AE70B86A01247D2E1EA8D7325F21E509F6F720
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
𝕭ella 汰_loader.exe

File Explorer

𝕭ella 汰_loader.exe

.exe 915KB

𝕭ella 汰_loader.exe

IMPHASH f4c3e6059fd3a231eeb6dca6398e94c5
SHA256 688aa4b277f8fb8e30764c9ea0791f3522f929b897f3e5234b47fddc33a39f85
MD5 bf806e53bd53f71c5efe49420293776b
SHA1 4907c6bf3465dfd286593e418385982f8fdff700
SHA512 fb836e26200038194cf6d6a758d5031acfb14982dcafcb72a37eb1e896eb26eae8894b038688497708d5a4687b42da8c09e5b1f657610745dd86159b54b4318e
SSDEEP 12288:Lecicflv0EKadUcCbfFB1Y5fWIdyw+G1bNcdhg19Oa6m2cuA:LeTcflv3dUcCbfFU51hcdhg19OaC
TLSH
T1E9152A1BE6B345E8C52FD07887539772AE70B86A01247D2E1EA8D7325F21E509F6F720
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5328

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

kernel32

CloseHandle CreateSemaphoreW DeleteCriticalSection EnterCriticalSection FormatMessageA GetConsoleWindow GetCurrentThreadId GetLastError GetModuleHandleA GetModuleHandleW GetProcAddress GetStartupInfoA GetStdHandle GetSystemTimeAsFileTime GetTimeZoneInformation InitializeCriticalSection IsDBCSLeadByteEx LeaveCriticalSection LoadLibraryW LocalFree MultiByteToWideChar RaiseException ReleaseSemaphore RtlCaptureContext RtlLookupFunctionEntry RtlUnwindEx RtlVirtualUnwind SetConsoleCtrlHandler SetConsoleCursorPosition SetConsoleScreenBufferSize SetConsoleTitleA SetConsoleWindowInfo SetLastError SetUnhandledExceptionFilter Sleep TlsAlloc TlsFree TlsGetValue TlsSetValue VirtualProtect VirtualQuery WaitForSingleObject WideCharToMultiByte

msvcrt

__C_specific_handler ___lc_codepage_func ___mb_cur_max_func __getmainargs __initenv __iob_func __set_app_type __setusermatherr _acmdln _amsg_exit _cexit _commode _errno _filelengthi64 _fileno _fmode _fstat64 _initterm _lseeki64 _onexit _wfopen abort calloc exit fclose fflush fgetpos fopen fprintf fputc fputs fread free fsetpos fwrite getc getwc iswctype localeconv malloc memchr memcmp memcpy memmove memset putc putwc realloc setlocale setvbuf signal strcmp strcoll strerror strftime strlen strncmp strxfrm system towlower towupper ungetc ungetwc vfprintf wcscoll wcsftime wcslen wcsxfrm _write _read _fileno _fdopen _close

user32

GetSystemMetrics GetWindowLongA GetWindowRect SetWindowLongA SetWindowPos ShowWindow

winhttp

WinHttpCloseHandle WinHttpConnect WinHttpOpen WinHttpOpenRequest WinHttpReceiveResponse WinHttpSendRequest WinHttpSetOption WinHttpWebSocketClose WinHttpWebSocketCompleteUpgrade WinHttpWebSocketReceive WinHttpWebSocketSend

Name

.text

Size

719KB

Virtual Size

718KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

12KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

67KB

Virtual Size

66KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

43KB

Virtual Size

43KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

60KB

Virtual Size

60KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

96B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

𝕭ella 汰_loader.exe

kernel32

msvcrt

user32

winhttp

generic