UniversalTriggerTool v4[.]0[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
UniversalTriggerTool v4.0.zip
Size 36.7MB
Sample260815-xa2qvssblc
SHA256 1e5d675e3ced0b31d01b3604473a4f244e47418a28ff3c983db6725165ed8bb5
MD5 346832249fea03921b6192c7c025c1aa
SHA1 21b31fe3525191307ed416990fcb0bccc14d6c00
SHA512 0a7d0f3a6ba50faea155a66e2f135e11dd42d7309fa64e57eb23b943c45d51329be206d833016ab2df36a8d8635146510701cc03b61ad164259683ee8a699073
SSDEEP 786432:qynXKhgHVCrhs/IpKxezwei4TQyL6pbQ5cdTCxqie7qfNVwE2fPPbKw7y:qOX51Crh3pLUejbGc5kCxwmDwvPPW
TLSH
T1C3873359808CA2F0B52BDB0C54047C1822C0FB6FE9157E68B658DB533F4BB9369AC776
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned MSI 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/UniversalTrigger.msi

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
unpack002/leechcore.dll
unpack002/vmm.dll

File Explorer

UniversalTriggerTool v4.0.zip

.zip 36.7MB
LICENSE

1KB
UniversalTrigger.msi

.msi 36.0MB
tests/basic.cpp

12KB
tests/demo.cpp

3KB
tests/example.cpp

705B
tests/main.cpp

54B
x64/Debug/dll.extract.7z

.7z 835KB
leechcore.dll

.dll 134KB
vmm.dll

.dll 2.1MB

UniversalTriggerTool v4.0.zip

SHA256 1e5d675e3ced0b31d01b3604473a4f244e47418a28ff3c983db6725165ed8bb5
MD5 346832249fea03921b6192c7c025c1aa
SHA1 21b31fe3525191307ed416990fcb0bccc14d6c00
SHA512 0a7d0f3a6ba50faea155a66e2f135e11dd42d7309fa64e57eb23b943c45d51329be206d833016ab2df36a8d8635146510701cc03b61ad164259683ee8a699073
SSDEEP 786432:qynXKhgHVCrhs/IpKxezwei4TQyL6pbQ5cdTCxqie7qfNVwE2fPPbKw7y:qOX51Crh3pLUejbGc5kCxwmDwvPPW
TLSH
T1C3873359808CA2F0B52BDB0C54047C1822C0FB6FE9157E68B658DB533F4BB9369AC776
MD5 SHA1 SHA512 SSDEEP TLSH

leechcore.dll

IMPHASH 99736fc0d6568ec45bbf18eaaa70a2e7
SHA256 e57b294e68b71f399b4f9cc06dc7299dea5050c8b9dd2c356dda4d0888a91935
MD5 8c5317185149b9723aa03d5f478045e9
SHA1 ee93c9fde72e2dbdb27da6ad7df3be27a6c2f3eb
SHA512 1dc0aeab09db04a6f76df92f63265f8aab52e6cd80da7c76573be4f9d7539e8e5f28d587f5008336eacdfa837431d6a352b940be6ef466a14fce5872135c0f53
SSDEEP 1536:5zv4dHmnTVXnNju9Nfxe2SBFIeWqQh5Wq/qsqZn/UnYPUznwgIPs:dv1NS9Vxe7PbWlluZn/EYPUznwgI0
TLSH
T137D33A4BB79520FAC8268179DA17961BFB73B41813105BEF06708A762F536E1BE3E311
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

100760

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\Github\production\LeechCore\files\lib\leechcore.pdb

credui

CredUIPromptForWindowsCredentialsW CredUnPackAuthenticationBufferW

rpcrt4

NdrClientCall3 RpcBindingSetAuthInfoExA RpcBindingFree RpcStringFreeA RpcBindingSetAuthInfoExW RpcStringBindingComposeA RpcBindingFromStringBindingA

secur32

LsaDeregisterLogonProcess LsaLookupAuthenticationPackage LsaConnectUntrusted

setupapi

SetupDiDestroyDeviceInfoList SetupDiEnumDeviceInterfaces SetupDiGetClassDevsW SetupDiGetDeviceInterfaceDetailW

winusb

WinUsb_WritePipe WinUsb_Free WinUsb_SetPipePolicy WinUsb_ReadPipe WinUsb_Initialize

ws2_32

setsockopt WSAGetLastError htons recvfrom connect socket send inet_addr WSAStartup closesocket ioctlsocket

kernel32

IsDebuggerPresent InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess GetModuleFileNameA AcquireSRWLockShared ReleaseSRWLockShared AcquireSRWLockExclusive ReleaseSRWLockExclusive InitializeSRWLock QueryPerformanceCounter ResetEvent TryEnterCriticalSection EnterCriticalSection LeaveCriticalSection InitializeCriticalSection LocalAlloc LocalFree DeleteCriticalSection Sleep LoadLibraryA CloseHandle CreateThread SwitchToThread GetProcAddress FreeLibrary GetTickCount64 ReadFile DeviceIoControl GetLastError CreateFileA SetFilePointerEx VirtualFree VirtualAlloc CreateFileW VerSetConditionMask VerifyVersionInfoW WriteProcessMemory GetCurrentProcess K32GetModuleFileNameExW OpenProcess K32EnumProcesses ReadProcessMemory K32GetMappedFileNameW VirtualQueryEx WaitForMultipleObjects WaitForSingleObject CreateEventW SetEvent QueryPerformanceFrequency IsProcessorFeaturePresent

advapi32

StartServiceA ControlService DeleteService OpenSCManagerA OpenSCManagerW CloseServiceHandle CreateServiceA RegQueryValueExA RegOpenKeyA RegCloseKey OpenProcessToken AdjustTokenPrivileges LookupPrivilegeValueW OpenServiceA

ole32

CoTaskMemFree

vcruntime140

memset memcpy __C_specific_handler strstr __std_type_info_destroy_list memcmp wcsstr

api-ms-win-crt-stdio-l1-1-0

fread fopen_s fwrite __stdio_common_vsnwprintf_s _fseeki64 __stdio_common_vswprintf_s __stdio_common_vfprintf fclose __acrt_iob_func getchar __stdio_common_vsnprintf_s __stdio_common_vsprintf _ftelli64

api-ms-win-crt-string-l1-1-0

strncat_s strtok_s wcsncpy_s strcpy_s wcsncat_s _strnicmp _wcsicmp strncpy_s wcscpy_s strcat_s strcmp _stricmp

api-ms-win-crt-convert-l1-1-0

atoi _itoa_s strtoull

api-ms-win-crt-utility-l1-1-0

rand srand

api-ms-win-crt-runtime-l1-1-0

_initialize_onexit_table _initialize_narrow_environment _configure_narrow_argv _execute_onexit_table _initterm _cexit _initterm_e _seh_filter_dll

vmm.dll

IMPHASH 73241de18567ee6c92e259fda99b70e9
SHA256 1202ddfa9c5be85b286d7d6bb23fe3db65ba00a62c871856ec62b14e2a57225b
MD5 2c62bdd54d95976cfa90d4f7103baba0
SHA1 49b2ec9fa96f196fb2745a10e7fb30b23843782e
SHA512 cf8a1e6aa6979585def02d47a61d676856b9d67e36f35b832b66120c8ee0b63003fc20ea3e23b4d0c44d1aadf03b147f60c1831a5849cc5c3830bc3c7479033f
SSDEEP 49152:UKosX0aq4YmMeJ9TODjQQUxt82WsW8QPeujwTMUiR5rgz:hXI4Yb89TOQ1xR9nQW6U9
TLSH
T120A56D47B7A800BDC46BC179C91A5F07E6B1740523249ADF76ACCAA52F13FE2127E319
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1713212

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

E:\Desktop\MemProcFS-master\files\lib\vmm.pdb

leechcore

LcRead LcCreateEx LcClose LcSetOption LcReadScatter LcAllocScatter1 LcWriteScatter LcGetOption LcCommand LcAllocScatter2 LcMemFree

bcrypt

BCryptCreateHash BCryptHashData BCryptGetProperty BCryptCloseAlgorithmProvider BCryptFinishHash BCryptOpenAlgorithmProvider BCryptDestroyHash

crypt32

CertFreeCertificateContext CertCreateCertificateContext CertGetNameStringW

shlwapi

StrStrIA

ws2_32

inet_ntop

kernel32

RtlLookupFunctionEntry RtlCaptureContext RtlVirtualUnwind IsProcessorFeaturePresent SetUnhandledExceptionFilter GetCurrentProcess IsDebuggerPresent TerminateProcess UnhandledExceptionFilter LockResource ResetEvent LocalAlloc LocalFree AreFileApisANSI ReadFile TryEnterCriticalSection HeapCreate HeapFree EnterCriticalSection GetFullPathNameW WriteFile GetDiskFreeSpaceW OutputDebugStringA LockFile LeaveCriticalSection InitializeCriticalSection SetFilePointer GetFullPathNameA SetEndOfFile UnlockFileEx GetTempPathW CreateMutexW WaitForSingleObject CreateFileW GetFileAttributesW GetCurrentThreadId UnmapViewOfFile HeapValidate HeapSize MultiByteToWideChar Sleep GetTempPathA FormatMessageW GetDiskFreeSpaceA GetLastError GetFileAttributesA GetFileAttributesExW OutputDebugStringW FlushViewOfFile CreateFileA LoadLibraryA WaitForSingleObjectEx DeleteFileA DeleteFileW HeapReAlloc CloseHandle GetSystemInfo LoadLibraryW HeapAlloc HeapCompact HeapDestroy UnlockFile GetProcAddress LockFileEx GetFileSize DeleteCriticalSection GetCurrentProcessId GetProcessHeap SystemTimeToFileTime FreeLibrary WideCharToMultiByte GetSystemTimeAsFileTime GetSystemTime FormatMessageA CreateFileMappingW MapViewOfFile QueryPerformanceCounter GetTickCount FlushFileBuffers GetLongPathNameW WaitForMultipleObjects CreateEventW GetTickCount64 SetEvent GetLocalTime ReleaseSRWLockExclusive AcquireSRWLockExclusive ReleaseSRWLockShared AcquireSRWLockShared InitializeSRWLock VerSetConditionMask VerifyVersionInfoW QueryPerformanceFrequency GetModuleFileNameA SizeofResource GetModuleFileNameW FileTimeToSystemTime FindClose LoadResource FindResourceW InitializeCriticalSectionAndSpinCount GetModuleHandleA InterlockedPushEntrySList InitializeSListHead InterlockedPopEntrySList QueryDepthSList GetStdHandle ReadConsoleA SwitchToThread CreateThread FindFirstFileA LoadLibraryExA FindNextFileA

advapi32

LookupAccountSidA RegDeleteValueA IsValidSid ConvertStringSidToSidA RegCreateKeyA RegCloseKey RegOpenKeyExA RegSetValueExA RegGetValueA ConvertSidToStringSidA

vcruntime140

strstr __std_type_info_destroy_list __C_specific_handler strrchr memcmp memcpy memmove memset

api-ms-win-crt-string-l1-1-0

_wcsnicmp _strnicmp strcmp strtok_s strcat_s strncmp strcpy_s _stricmp strncpy_s strncat_s strspn strnlen strcspn toupper

api-ms-win-crt-heap-l1-1-0

free malloc _msize realloc

api-ms-win-crt-runtime-l1-1-0

_beginthreadex _cexit _execute_onexit_table _initialize_onexit_table _initialize_narrow_environment _configure_narrow_argv _seh_filter_dll _initterm_e _initterm _endthreadex

api-ms-win-crt-time-l1-1-0

_localtime64_s

api-ms-win-crt-stdio-l1-1-0

_fseeki64 fopen_s tmpnam_s __stdio_common_vsnprintf_s __stdio_common_vsprintf_s fwrite __stdio_common_vsprintf __acrt_iob_func __stdio_common_vfprintf __stdio_common_vsnwprintf_s fclose fread _fsopen fflush

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-convert-l1-1-0

strtoull strtoul

api-ms-win-crt-filesystem-l1-1-0

remove _access_s

api-ms-win-crt-math-l1-1-0

floor log10

VMMDLL_Close VMMDLL_CloseAll VMMDLL_ConfigGet VMMDLL_ConfigSet VMMDLL_ForensicFileAppend VMMDLL_Initialize VMMDLL_InitializeEx VMMDLL_InitializePlugins VMMDLL_Log VMMDLL_LogEx VMMDLL_Map_GetEATU VMMDLL_Map_GetEATW VMMDLL_Map_GetHandleU VMMDLL_Map_GetHandleW VMMDLL_Map_GetHeap VMMDLL_Map_GetHeapAlloc VMMDLL_Map_GetIATU VMMDLL_Map_GetIATW VMMDLL_Map_GetModuleFromNameU VMMDLL_Map_GetModuleFromNameW VMMDLL_Map_GetModuleU VMMDLL_Map_GetModuleW VMMDLL_Map_GetNetU VMMDLL_Map_GetNetW VMMDLL_Map_GetPfn VMMDLL_Map_GetPfnEx VMMDLL_Map_GetPhysMem VMMDLL_Map_GetPool VMMDLL_Map_GetPteU VMMDLL_Map_GetPteW VMMDLL_Map_GetServicesU VMMDLL_Map_GetServicesW VMMDLL_Map_GetThread VMMDLL_Map_GetUnloadedModuleU VMMDLL_Map_GetUnloadedModuleW VMMDLL_Map_GetUsersU VMMDLL_Map_GetUsersW VMMDLL_Map_GetVMU VMMDLL_Map_GetVMW VMMDLL_Map_GetVadEx VMMDLL_Map_GetVadU VMMDLL_Map_GetVadW VMMDLL_MemFree VMMDLL_MemPrefetchPages VMMDLL_MemRead VMMDLL_MemReadEx VMMDLL_MemReadPage VMMDLL_MemReadScatter VMMDLL_MemSearch VMMDLL_MemSize VMMDLL_MemVirt2Phys VMMDLL_MemWrite VMMDLL_MemWriteScatter VMMDLL_PdbLoad VMMDLL_PdbSymbolAddress VMMDLL_PdbSymbolName VMMDLL_PdbTypeChildOffset VMMDLL_PdbTypeSize VMMDLL_PidGetFromName VMMDLL_PidList VMMDLL_ProcessGetDirectoriesU VMMDLL_ProcessGetDirectoriesW VMMDLL_ProcessGetInformation VMMDLL_ProcessGetInformationAll VMMDLL_ProcessGetInformationString VMMDLL_ProcessGetModuleBaseU VMMDLL_ProcessGetModuleBaseW VMMDLL_ProcessGetProcAddressU VMMDLL_ProcessGetProcAddressW VMMDLL_ProcessGetSectionsU VMMDLL_ProcessGetSectionsW VMMDLL_Scatter_Clear VMMDLL_Scatter_CloseHandle VMMDLL_Scatter_Execute VMMDLL_Scatter_ExecuteRead VMMDLL_Scatter_Initialize VMMDLL_Scatter_Prepare VMMDLL_Scatter_PrepareEx VMMDLL_Scatter_PrepareWrite VMMDLL_Scatter_PrepareWriteEx VMMDLL_Scatter_Read VMMDLL_UtilFillHexAscii VMMDLL_UtilVfsReadFile_FromBOOL VMMDLL_UtilVfsReadFile_FromDWORD VMMDLL_UtilVfsReadFile_FromPBYTE VMMDLL_UtilVfsReadFile_FromQWORD VMMDLL_UtilVfsWriteFile_BOOL VMMDLL_UtilVfsWriteFile_DWORD VMMDLL_VfsListBlobU VMMDLL_VfsListU VMMDLL_VfsListW VMMDLL_VfsList_AddDirectory VMMDLL_VfsList_AddDirectoryW VMMDLL_VfsList_AddFile VMMDLL_VfsList_AddFileW VMMDLL_VfsReadU VMMDLL_VfsReadW VMMDLL_VfsWriteU VMMDLL_VfsWriteW VMMDLL_VmGetVmmHandle VMMDLL_VmMemRead VMMDLL_VmMemReadScatter VMMDLL_VmMemTranslateGPA VMMDLL_VmMemWrite VMMDLL_VmMemWriteScatter VMMDLL_VmScatterInitialize VMMDLL_WinGetThunkInfoIATU VMMDLL_WinGetThunkInfoIATW VMMDLL_WinReg_EnumKeyExU VMMDLL_WinReg_EnumKeyExW VMMDLL_WinReg_EnumValueU VMMDLL_WinReg_EnumValueW VMMDLL_WinReg_HiveList VMMDLL_WinReg_HiveReadEx VMMDLL_WinReg_HiveWrite VMMDLL_WinReg_QueryValueExU VMMDLL_WinReg_QueryValueExW VMMDLL_YaraSearch

Sharing

General

Malware Config

Signatures

File Explorer

UniversalTriggerTool v4.0.zip

LICENSE

UniversalTrigger.msi

tests/basic.cpp

tests/demo.cpp

tests/example.cpp

tests/main.cpp

x64/Debug/dll.extract.7z

leechcore.dll

credui

rpcrt4

secur32

setupapi

winusb

ws2_32

kernel32

advapi32

ole32

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-runtime-l1-1-0

generic

vmm.dll

leechcore

bcrypt

crypt32

shlwapi

ws2_32

kernel32

advapi32

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-math-l1-1-0

generic