19e69e7f25b188a88ea6bbfa2f07dfddb46d68891ebfae688bbc1af3bfa9d03a

Sharing

Copy URL Twitter E-mail

General

Target
19e69e7f25b188a88ea6bbfa2f07dfddb46d68891ebfae688bbc1af3bfa9d03a
Size 5.1MB
Sample260814-krfthayglc
SHA256 19e69e7f25b188a88ea6bbfa2f07dfddb46d68891ebfae688bbc1af3bfa9d03a
MD5 e1e68c1d960383568c82512124721d0c
SHA1 0330a88502d0c6cb0d6a9b0509edba3381028483
SHA512 bedfe3abe028fd3a53bf8e3a0639256b2d8a47bd61a25b3a7a8ad1d5737237d8ce5c1abcd71c701c394824f513d8f7495e9d12bab6aa09df6fdacf860c2d1fa3
SSDEEP 49152:vLDR3VAys0gscdD7x7qqOL247WJqLT029LsC52QYv8vasYEQEeD8zqDzg3m8lczn:v3L9LgQv+8uv17gitPhKXCLZS64wZ
TLSH
T1CC465C03F69281EDC0AEC179875B9333FA32B8894534B65B5BD4CB222E15F60AF4D758
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
19e69e7f25b188a88ea6bbfa2f07dfddb46d68891ebfae688bbc1af3bfa9d03a

File Explorer

19e69e7f25b188a88ea6bbfa2f07dfddb46d68891ebfae688bbc1af3bfa9d03a

.exe 5.1MB

19e69e7f25b188a88ea6bbfa2f07dfddb46d68891ebfae688bbc1af3bfa9d03a

IMPHASH 6fb30a3f36cc47da33b89e63d1548d1e
SHA256 19e69e7f25b188a88ea6bbfa2f07dfddb46d68891ebfae688bbc1af3bfa9d03a
MD5 e1e68c1d960383568c82512124721d0c
SHA1 0330a88502d0c6cb0d6a9b0509edba3381028483
SHA512 bedfe3abe028fd3a53bf8e3a0639256b2d8a47bd61a25b3a7a8ad1d5737237d8ce5c1abcd71c701c394824f513d8f7495e9d12bab6aa09df6fdacf860c2d1fa3
SSDEEP 49152:vLDR3VAys0gscdD7x7qqOL247WJqLT029LsC52QYv8vasYEQEeD8zqDzg3m8lczn:v3L9LgQv+8uv17gitPhKXCLZS64wZ
TLSH
T1CC465C03F69281EDC0AEC179875B9333FA32B8894534B65B5BD4CB222E15F60AF4D758
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5088

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

advapi32

CopySid GetLengthSid GetTokenInformation IsValidSid LookupAccountSidW OpenProcessToken RegCloseKey RegCreateKeyExW RegDeleteTreeW RegEnumKeyExW RegEnumValueW RegOpenKeyExW RegQueryValueExW RegSetValueExW SystemFunction036

bcrypt

BCryptGenRandom

crypt32

CertAddCertificateContextToStore CertCloseStore CertDuplicateCertificateChain CertDuplicateCertificateContext CertDuplicateStore CertEnumCertificatesInStore CertFreeCertificateChain CertFreeCertificateContext CertGetCertificateChain CertOpenStore CertVerifyCertificateChainPolicy CryptUnprotectData

gdi32

BitBlt CreateCompatibleBitmap CreateCompatibleDC DeleteDC DeleteObject GetDIBits SelectObject

iphlpapi

FreeMibTable GetAdaptersAddresses GetIfEntry2 GetIfTable2

kernel32

AddVectoredExceptionHandler AreFileApisANSI CancelIo CloseHandle CompareStringOrdinal CopyFileExW CreateDirectoryW CreateEventW CreateFileA CreateFileMappingA CreateFileMappingW CreateFileW CreateIoCompletionPort CreateMutexA CreateMutexW CreateNamedPipeW CreateProcessW CreateThread CreateToolhelp32Snapshot CreateWaitableTimerExW DeleteCriticalSection DeleteFileA DeleteFileW DeleteProcThreadAttributeList DeviceIoControl DuplicateHandle EnterCriticalSection ExitProcess FindClose FindFirstFileExW FindNextFileW FlushFileBuffers FlushViewOfFile FormatMessageA FormatMessageW FreeEnvironmentStringsW FreeLibrary GetConsoleMode GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetDiskFreeSpaceA GetDiskFreeSpaceExW GetDiskFreeSpaceW GetDriveTypeW GetEnvironmentStringsW GetEnvironmentVariableW GetExitCodeProcess GetFileAttributesA GetFileAttributesExW GetFileAttributesW GetFileInformationByHandle GetFileInformationByHandleEx GetFileSize GetFinalPathNameByHandleW GetFullPathNameA GetFullPathNameW GetLastError GetLogicalDrives GetModuleFileNameW GetModuleHandleA GetModuleHandleW GetOverlappedResult GetProcAddress GetProcessHeap GetProcessIoCounters GetProcessTimes GetQueuedCompletionStatusEx GetStdHandle GetSystemDirectoryW GetSystemInfo GetSystemTime GetSystemTimeAsFileTime GetSystemTimePreciseAsFileTime GetSystemTimes GetTempPathA GetTempPathW GetTickCount GetTickCount64 GetTimeZoneInformationForYear GetVolumeInformationW GetWindowsDirectoryW GlobalLock GlobalMemoryStatusEx GlobalUnlock HeapAlloc HeapCompact HeapCreate HeapDestroy HeapFree HeapReAlloc HeapSize HeapValidate InitOnceBeginInitialize InitOnceComplete InitializeCriticalSection InitializeProcThreadAttributeList LeaveCriticalSection LoadLibraryA LoadLibraryExW LoadLibraryW LocalFree LockFile LockFileEx MapViewOfFile Module32FirstW Module32NextW MultiByteToWideChar OpenProcess OutputDebugStringA OutputDebugStringW PostQueuedCompletionStatus QueryPerformanceCounter QueryPerformanceFrequency ReadFile ReadFileEx ReadProcessMemory RemoveDirectoryW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind SetEndOfFile SetFileCompletionNotificationModes SetFileInformationByHandle SetFilePointer SetFilePointerEx SetHandleInformation SetLastError SetPriorityClass SetThreadErrorMode SetThreadStackGuarantee SetUnhandledExceptionFilter SetWaitableTimer Sleep SleepEx SwitchToThread SystemTimeToFileTime TlsAlloc TlsFree TlsGetValue TlsSetValue TryEnterCriticalSection UnlockFile UnlockFileEx UnmapViewOfFile UpdateProcThreadAttribute VirtualQueryEx WaitForMultipleObjects WaitForSingleObject WaitForSingleObjectEx WideCharToMultiByte WriteConsoleW WriteFile WriteFileEx lstrlenW RaiseException RtlUnwindEx VirtualProtect VirtualQuery __C_specific_handler

netapi32

NetApiBufferFree NetUserEnum NetUserGetInfo NetUserGetLocalGroups

ntdll

NtCancelIoFileEx NtCreateFile NtDeviceIoControlFile NtOpenFile NtQueryInformationProcess NtQuerySystemInformation NtReadFile NtWriteFile RtlGetVersion RtlNtStatusToDosError

ole32

CoCreateInstance CoInitializeEx CoInitializeSecurity CoSetProxyBlanket CoTaskMemFree CoUninitialize

oleaut32

SysAllocString SysFreeString VariantClear

pdh

PdhAddEnglishCounterW PdhCloseQuery PdhCollectQueryData PdhGetFormattedCounterValue PdhOpenQueryA PdhRemoveCounter

powrprof

CallNtPowerInformation

psapi

GetModuleFileNameExW GetPerformanceInfo

secur32

AcceptSecurityContext AcquireCredentialsHandleA ApplyControlToken DecryptMessage DeleteSecurityContext EncryptMessage FreeContextBuffer FreeCredentialsHandle InitializeSecurityContextW LsaEnumerateLogonSessions LsaFreeReturnBuffer LsaGetLogonSessionData QueryContextAttributesW

shell32

CommandLineToArgvW SHGetKnownFolderPath

user32

CloseClipboard GetClipboardData GetDC GetSystemMetrics IsClipboardFormatAvailable OpenClipboard ReleaseDC

ws2_32

WSACleanup WSAGetLastError WSAIoctl WSASend WSASocketW WSAStartup bind closesocket connect freeaddrinfo getaddrinfo getpeername getsockname getsockopt ioctlsocket recv send setsockopt shutdown socket

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

bcryptprimitives

ProcessPrng

msvcrt

__getmainargs __initenv __iob_func __set_app_type __setusermatherr _amsg_exit _beginthreadex _cexit _commode _endthreadex _errno _fmode _fpreset _initterm _localtime64 _onexit abort calloc exit fprintf free fwrite log malloc memcmp memcpy memmove memset pow qsort realloc signal strcmp strcspn strlen strncmp strrchr vfprintf wcslen

Name

.text

Size

3.5MB

Virtual Size

3.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

20KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

1.2MB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

101KB

Virtual Size

100KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

270KB

Virtual Size

269KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

864B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

13KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

104B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

34KB

Virtual Size

33KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

19e69e7f25b188a88ea6bbfa2f07dfddb46d68891ebfae688bbc1af3bfa9d03a

advapi32

bcrypt

crypt32

gdi32

iphlpapi

kernel32

netapi32

ntdll

ole32

oleaut32

pdh

powrprof

psapi

secur32

shell32

user32

ws2_32

api-ms-win-core-synch-l1-2-0

bcryptprimitives

msvcrt

generic