24ea2a5e84f6da537a831b83630e34540e1b5806a1ac72aa8027fc6543317c28

Sharing

Copy URL Twitter E-mail

General

Target
24ea2a5e84f6da537a831b83630e34540e1b5806a1ac72aa8027fc6543317c28
Size 9.2MB
Sample260814-kr93cazsct
SHA256 24ea2a5e84f6da537a831b83630e34540e1b5806a1ac72aa8027fc6543317c28
MD5 ce3f7e4235c89e9cb09fbd74f44575b9
SHA1 6bcefbafdc4346c943546400f8b0df62b787f4ad
SHA512 3524014feee5d9e1ae3bc2967fb8b47cc5b93da97585f36b4cbf86199f9ab0e45e8299bf41171ff10646be1be36181c686b313763937859735dc95f3e63902d8
SSDEEP 98304:+xS5jvqgAwz5cu0fwmfRBwW7UwBpwLBDSAnMd//9YWFn+P:W2z5cRwmfRBwUOLFn43OW1
TLSH
T1FCA65B03F69580E8C0ADC5B8872BA637EB76FC890524B29B5BE44F212F66F505F1C359
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
24ea2a5e84f6da537a831b83630e34540e1b5806a1ac72aa8027fc6543317c28

File Explorer

24ea2a5e84f6da537a831b83630e34540e1b5806a1ac72aa8027fc6543317c28

.exe 9.2MB

24ea2a5e84f6da537a831b83630e34540e1b5806a1ac72aa8027fc6543317c28

IMPHASH c7ed81876c9d12e4d4be2bd1e67e331a
SHA256 24ea2a5e84f6da537a831b83630e34540e1b5806a1ac72aa8027fc6543317c28
MD5 ce3f7e4235c89e9cb09fbd74f44575b9
SHA1 6bcefbafdc4346c943546400f8b0df62b787f4ad
SHA512 3524014feee5d9e1ae3bc2967fb8b47cc5b93da97585f36b4cbf86199f9ab0e45e8299bf41171ff10646be1be36181c686b313763937859735dc95f3e63902d8
SSDEEP 98304:+xS5jvqgAwz5cu0fwmfRBwW7UwBpwLBDSAnMd//9YWFn+P:W2z5cRwmfRBwUOLFn43OW1
TLSH
T1FCA65B03F69580E8C0ADC5B8872BA637EB76FC890524B29B5BE44F212F66F505F1C359
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

6927164

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

tor_client.pdb

kernel32

ReadProcessMemory GetProcessTimes GetCurrentThreadId DeleteCriticalSection UnhandledExceptionFilter GetProcessIoCounters GetProcAddress LoadLibraryExA GetSystemTimes K32GetPerformanceInfo TryEnterCriticalSection LeaveCriticalSection CreateFileW LockFileEx GetFileInformationByHandle EnterCriticalSection FindClose GlobalMemoryStatusEx InitializeCriticalSection RaiseException FreeConsole lstrlenW SetHandleInformation OutputDebugStringA GetSystemTimePreciseAsFileTime ExitProcess CreateThread FormatMessageW DeviceIoControl GetFullPathNameW UnlockFileEx SetFilePointer SetEndOfFile CreateMutexW QueryPerformanceFrequency ReleaseMutex CreateMutexA GetQueuedCompletionStatusEx GetCurrentProcessId GetCurrentProcess CreateIoCompletionPort SetFileCompletionNotificationModes RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext QueryPerformanceCounter ReadDirectoryChangesW CancelIo GetModuleHandleA HeapValidate Sleep ReleaseSemaphore HeapSize OutputDebugStringW FlushViewOfFile HeapCompact HeapDestroy GetSystemTimeAsFileTime GetSystemTime FormatMessageA GetTickCount HeapCreate VirtualQueryEx FreeLibrary VirtualProtect GetModuleHandleW WaitForSingleObjectEx SetUnhandledExceptionFilter UnmapViewOfFile GetStdHandle GetConsoleMode GetConsoleOutputCP CreateFileMappingW MultiByteToWideChar WriteConsoleW LoadLibraryA WideCharToMultiByte GetModuleFileNameW GetFileInformationByHandleEx CreateEventW SetFileInformationByHandle GetFinalPathNameByHandleW SetFilePointerEx FindNextFileW CreateDirectoryW FindFirstFileExW SetLastError GetTickCount64 HeapReAlloc GetCurrentThread PostQueuedCompletionStatus SetThreadStackGuarantee DuplicateHandle MapViewOfFile AddVectoredExceptionHandler MoveFileExW DeleteFileW SetFileTime GetDiskFreeSpaceW WriteFile ReadFile AreFileApisANSI FlushFileBuffers GetFileSize UnlockFile LoadLibraryW DeleteFileA CreateFileA GetFileAttributesExW GetFileAttributesA GetDiskFreeSpaceA GetTempPathA GetFileAttributesW GetTempPathW GetFullPathNameA LockFile LocalFree TerminateProcess OpenProcess IsProcessorFeaturePresent SystemTimeToFileTime SetEnvironmentVariableW GetCurrentDirectoryW GetEnvironmentVariableW InitializeSListHead GetSystemInfo SwitchToThread CreateSemaphoreW GetLastError WaitForSingleObject LocalAlloc IsDebuggerPresent HeapAlloc HeapFree GetProcessHeap CloseHandle

advapi32

RegCreateKeyExW RegQueryValueExW GetTokenInformation RegCloseKey RegOpenKeyExW RegSetValueExW SystemFunction036 OpenProcessToken IsValidSid GetLengthSid CopySid

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WaitOnAddress WakeByAddressAll

pdh

PdhCloseQuery PdhOpenQueryA PdhRemoveCounter PdhCollectQueryData PdhGetFormattedCounterValue PdhAddEnglishCounterW

shell32

SHGetKnownFolderPath CommandLineToArgvW

ntdll

NtQueryInformationProcess NtWriteFile NtCancelIoFileEx RtlNtStatusToDosError NtDeviceIoControlFile NtQuerySystemInformation NtCreateFile RtlGetVersion NtReadFile

psapi

GetModuleFileNameExW GetProcessMemoryInfo

powrprof

CallNtPowerInformation

oleaut32

GetErrorInfo SysStringLen SysFreeString

ole32

CoTaskMemFree

bcryptprimitives

ProcessPrng

crypt32

CertDuplicateCertificateChain CertFreeCertificateChain CertOpenStore CertDuplicateCertificateContext CertFreeCertificateContext CertDuplicateStore CertGetCertificateChain CertCloseStore CertVerifyCertificateChainPolicy CertEnumCertificatesInStore CertAddCertificateContextToStore

ws2_32

getsockname listen bind accept getpeername ioctlsocket socket connect getsockopt WSASocketW setsockopt getaddrinfo freeaddrinfo WSAIoctl WSAStartup WSACleanup recv send closesocket WSASend shutdown WSAGetLastError

bcrypt

BCryptGenRandom

secur32

FreeContextBuffer DecryptMessage EncryptMessage FreeCredentialsHandle AcquireCredentialsHandleA AcceptSecurityContext ApplyControlToken QueryContextAttributesW InitializeSecurityContextW DeleteSecurityContext

vcruntime140

__current_exception_context memmove memcpy memcmp memset __CxxFrameHandler3 __current_exception __C_specific_handler strrchr memchr strchr

api-ms-win-crt-math-l1-1-0

_dclass __setusermatherr log2 fabs exp fmax trunc log pow roundf ceil

api-ms-win-crt-string-l1-1-0

wcslen strcmp strspn strncmp strcspn strlen

api-ms-win-crt-heap-l1-1-0

free _set_new_mode realloc _msize malloc

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-time-l1-1-0

_localtime64_s

api-ms-win-crt-runtime-l1-1-0

__p___argc __p___argv _cexit _c_exit _register_thread_local_exe_atexit_callback _exit exit _initterm_e _initterm _get_initial_narrow_environment _initialize_narrow_environment _configure_narrow_argv _set_app_type _initialize_onexit_table _register_onexit_function _seh_filter_exe _crt_atexit terminate _beginthreadex _endthreadex

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sharing

General

Malware Config

Signatures

File Explorer

24ea2a5e84f6da537a831b83630e34540e1b5806a1ac72aa8027fc6543317c28

kernel32

advapi32

api-ms-win-core-synch-l1-2-0

pdh

shell32

ntdll

psapi

powrprof

oleaut32

ole32

bcryptprimitives

crypt32

ws2_32

bcrypt

secur32

vcruntime140

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic