Left Behind-v2[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
Left Behind-v2.exe
Size 5.0MB
Sample260817-vc3d3avdnc
SHA256 4187ae4fcee4f03025939cb6aa9ebc6bb18a4cfc76aa5ac74937b91df8930af2
MD5 9aa0ee9ea0d6e6460a4ccf05e022a228
SHA1 db5a3815f180ee95eb59e866400a1082a2485a2b
SHA512 22048217e9b36c2138162b294f34bf274b599f54857fbe9e2abb509c8d8930d6a26e91e289f6394a2a0b291819e85cb68d475b916be0307b9fa71f7ec9add07d
SSDEEP 49152:Tpz0PdyGpaCTaL0nhYAjKxA15Ib2WU1HOpNadAhWwluUBdYpTMqTPGQVjeJc:Tl0PTHq04xI5kXWwlusdATM4GQVj1
TLSH
T1A4366B80B953C172D5822471E16AE6FB26A46F64CF1486D7BBE43F3C7A764C009B3876
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Left Behind-v2.exe

File Explorer

Left Behind-v2.exe

.exe 5.0MB

Left Behind-v2.exe

IMPHASH 14c0911e8ee70f8d13b0abd09d53379c
SHA256 4187ae4fcee4f03025939cb6aa9ebc6bb18a4cfc76aa5ac74937b91df8930af2
MD5 9aa0ee9ea0d6e6460a4ccf05e022a228
SHA1 db5a3815f180ee95eb59e866400a1082a2485a2b
SHA512 22048217e9b36c2138162b294f34bf274b599f54857fbe9e2abb509c8d8930d6a26e91e289f6394a2a0b291819e85cb68d475b916be0307b9fa71f7ec9add07d
SSDEEP 49152:Tpz0PdyGpaCTaL0nhYAjKxA15Ib2WU1HOpNadAhWwluUBdYpTMqTPGQVjeJc:Tl0PTHq04xI5kXWwlusdATM4GQVj1
TLSH
T1A4366B80B953C172D5822471E16AE6FB26A46F64CF1486D7BBE43F3C7A764C009B3876
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2963752

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

c:\hudson\ZeusBase\ZeusGreen\GameMaker\Runner\VC_Runner\Win32\Release-Zeus\Runner.pdb

wininet

InternetReadFile InternetWriteFile HttpOpenRequestA InternetCloseHandle InternetCrackUrlA HttpEndRequestW HttpQueryInfoA InternetConnectA InternetOpenA InternetCanonicalizeUrlA HttpSendRequestA InternetGetConnectedState

d3d11

D3D11CreateDevice

dbghelp

MiniDumpWriteDump SymFromAddr SymInitialize

winmm

mciSendStringA mciGetErrorStringA joyGetPos timeGetDevCaps timeBeginPeriod timeEndPeriod joyGetPosEx

ws2_32

gethostname WSACleanup setsockopt sendto send recvfrom recv listen inet_ntoa inet_addr getsockopt ioctlsocket connect closesocket bind accept getpeername select __WSAFDIsSet ntohs ntohl htons htonl WSAStartup WSAGetLastError WSAAddressToStringA getaddrinfo freeaddrinfo socket

gdiplus

GdiplusStartup GdiplusShutdown

comctl32

InitCommonControlsEx

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

rpcrt4

UuidCreate UuidToStringW

dxgi

CreateDXGIFactory1

mf

MFCreateSampleGrabberSinkActivate MFCreateAudioRendererActivate MFCreateMediaSession MFCreateTopology MFCreateTopologyNode MFGetService

mfplat

MFShutdown MFCreateSourceResolver MFCreateMediaType MFStartup

kernel32

SetCurrentDirectoryW HeapReAlloc GetTimeZoneInformation SetStdHandle ReadConsoleW SetFilePointerEx GetFileSizeEx GetConsoleMode GetConsoleOutputCP FlushFileBuffers EnumSystemLocalesW IsValidLocale LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW SetConsoleCtrlHandler DecodePointer WriteFile GetStdHandle PeekNamedPipe GetFileType GetFileInformationByHandle GetDriveTypeW FileTimeToSystemTime SystemTimeToTzSpecificLocalTime FindFirstFileExW ReadFile MoveFileExW SetFileAttributesW GetFileAttributesExW GetModuleHandleExW HeapWalk HeapValidate EncodePointer LoadLibraryExW InterlockedFlushSList InterlockedPushEntrySList RtlUnwind VirtualQuery GetProcessHeap HeapFree HeapAlloc InitializeSListHead RaiseException GetACP GetOEMCP GetStartupInfoW IsDebuggerPresent TerminateProcess UnhandledExceptionFilter FreeLibraryWhenCallbackReturns GetSystemTimeAsFileTime GetCurrentProcessorNumber IsProcessorFeaturePresent CreateSymbolicLinkW FlushProcessWriteBuffers CreateSemaphoreExW InitOnceExecuteOnce FlsFree FlsSetValue FlsGetValue FlsAlloc SetFileInformationByHandle FormatMessageA SleepConditionVariableSRW SleepConditionVariableCS WakeAllConditionVariable GetProcAddress LoadLibraryW WideCharToMultiByte GetLastError LoadLibraryA MultiByteToWideChar CloseHandle WaitForSingleObjectEx CreateEventExW OutputDebugStringA GetCPInfo GetCurrentDirectoryW DeleteFileW GetFullPathNameW SetLastError CreateThread GetExitCodeThread GetModuleHandleW LocalFree FormatMessageW SetCurrentDirectoryA GetCurrentDirectoryA FreeLibrary GetEnvironmentVariableW CreateDirectoryW FindClose FindFirstFileW FindNextFileW GetFileAttributesW RemoveDirectoryW Sleep GetExitCodeProcess CreateProcessW QueryPerformanceCounter QueryPerformanceFrequency WaitForSingleObject SetWaitableTimer CreateWaitableTimerW GetTickCount64 GetFileAttributesA GetCurrentProcess GetCurrentThread SetThreadPriority SetPriorityClass GlobalAlloc GlobalUnlock GlobalLock GlobalMemoryStatusEx GetSystemInfo GetVersionExW GetLocaleInfoW GetUserDefaultLCID VerSetConditionMask VerifyVersionInfoW ExitProcess lstrlenA GetCommandLineW ExpandEnvironmentStringsW CreateFileW GetFinalPathNameByHandleW SetUnhandledExceptionFilter SetErrorMode GetCurrentProcessId GetCurrentThreadId GetModuleFileNameW MoveFileA WakeConditionVariable InitializeConditionVariable TryEnterCriticalSection InitializeCriticalSectionEx AcquireSRWLockExclusive ReleaseSRWLockExclusive InitializeSRWLock TlsFree TlsSetValue TlsGetValue TlsAlloc DeleteCriticalSection InitializeCriticalSectionAndSpinCount LeaveCriticalSection EnterCriticalSection RtlCaptureStackBackTrace SubmitThreadpoolWork CloseThreadpoolWork CreateThreadpoolTimer SetThreadpoolTimer WaitForThreadpoolTimerCallbacks CloseThreadpoolTimer CreateThreadpoolWait SetThreadpoolWait CloseThreadpoolWait GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW OutputDebugStringW GetStringTypeW SetEndOfFile IsValidCodePage HeapSize GetConsoleWindow WriteConsoleW GetFileInformationByHandleEx CreateThreadpoolWork

user32

PeekMessageW IsDialogMessageW SetProcessDPIAware GetForegroundWindow UpdateWindow SetWindowLongW EnumDisplaySettingsW MonitorFromWindow GetMonitorInfoW ScreenToClient SetWindowTextW ReleaseDC GetDC DrawTextW GetDlgItemTextW SetDlgItemTextW GetDlgItem EndDialog DialogBoxParamW CreateDialogParamW LoadImageW TranslateMessage SetDlgItemTextA DispatchMessageW LoadCursorW CallNextHookEx SetCursor AdjustWindowRectEx GetWindowRect GetClientRect SetForegroundWindow GetSystemMetrics ReleaseCapture SetCapture GetKeyState SetFocus BringWindowToTop SetWindowPos ShowWindow DestroyWindow CreateWindowExW RegisterClassExW DefWindowProcW PostMessageW SendMessageW MessageBoxW GetRawInputDeviceList GetRawInputDeviceInfoA MessageBoxA GetFocus IsClipboardFormatAvailable EmptyClipboard GetClipboardData SetClipboardData CloseClipboard OpenClipboard keybd_event GetAsyncKeyState wsprintfW GetCursorPos GetActiveWindow MapWindowPoints ClientToScreen SetCursorPos MoveWindow

gdi32

SelectObject GetStockObject GetDeviceCaps

comdlg32

GetOpenFileNameW GetSaveFileNameW

advapi32

RegCloseKey RegQueryValueExW RegOpenKeyExW

shell32

SHGetFolderPathW ShellExecuteW

ole32

CoCreateInstance CoCreateFreeThreadedMarshaler CoTaskMemFree CoInitialize

dwmapi

DwmGetCompositionTimingInfo