16705e219a85a541c730476f57cbe37907df8a5dc27b01e40a4adbb086e9e677

Sharing

Copy URL Twitter E-mail

General

Target
16705e219a85a541c730476f57cbe37907df8a5dc27b01e40a4adbb086e9e677
Size 50KB
Sample260818-fffl5sek8x
SHA256 16705e219a85a541c730476f57cbe37907df8a5dc27b01e40a4adbb086e9e677
MD5 93800dd35431708d2be652157998cd1c
SHA1 2c059ef0355b1a5feb3c4164258a5433e41b9bbd
SHA512 56ae8a2d49235f8466b1ea0c9f79a465617eda07ad70f86e61b3473f8aa87f52b7402d64f58981eb1f0be1bd2631b1d61e6a2ebc3d36decc9a392da5db8a433b
SSDEEP 1536:ga7ihwN8exaIPxxtruk5UScZhZEEi+cHJf:gamyN91XXEiRp
TLSH
T139337D96F29410F8E87BD27CC9A3925BE2B27450973187DF077086291F637E1A276F02
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
16705e219a85a541c730476f57cbe37907df8a5dc27b01e40a4adbb086e9e677

File Explorer

16705e219a85a541c730476f57cbe37907df8a5dc27b01e40a4adbb086e9e677

.exe .ps1 50KB

16705e219a85a541c730476f57cbe37907df8a5dc27b01e40a4adbb086e9e677

IMPHASH 1f887e8be5295713905d5a95aa5b4cec
SHA256 16705e219a85a541c730476f57cbe37907df8a5dc27b01e40a4adbb086e9e677
MD5 93800dd35431708d2be652157998cd1c
SHA1 2c059ef0355b1a5feb3c4164258a5433e41b9bbd
SHA512 56ae8a2d49235f8466b1ea0c9f79a465617eda07ad70f86e61b3473f8aa87f52b7402d64f58981eb1f0be1bd2631b1d61e6a2ebc3d36decc9a392da5db8a433b
SSDEEP 1536:ga7ihwN8exaIPxxtruk5UScZhZEEi+cHJf:gamyN91XXEiRp
TLSH
T139337D96F29410F8E87BD27CC9A3925BE2B27450973187DF077086291F637E1A276F02
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

35536

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\progarm\VS\C2\debug\beacon\windows\build\Release\fygt.pdb

ws2_32

WSACleanup WSAGetLastError gethostname inet_ntop ioctlsocket htonl inet_addr inet_ntoa ntohl getnameinfo bind closesocket connect htons listen select send setsockopt socket getaddrinfo freeaddrinfo inet_pton accept recv WSAStartup

advapi32

CryptAcquireContextA GetTokenInformation LookupAccountSidA GetUserNameA CryptGenRandom OpenProcessToken

iphlpapi

IcmpCloseHandle IcmpSendEcho IcmpCreateFile

secur32

DecryptMessage EncryptMessage FreeContextBuffer QueryContextAttributesA DeleteSecurityContext InitializeSecurityContextA FreeCredentialsHandle AcquireCredentialsHandleA

kernel32

UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext FileTimeToSystemTime SystemTimeToTzSpecificLocalTime MoveFileExA MoveFileA SetUnhandledExceptionFilter SetFileAttributesA RemoveDirectoryA GetLogicalDrives GetFileSizeEx FindNextFileW FindFirstFileW GetModuleHandleW DeleteFileA CreateFileA GetCurrentProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW WriteFile FindClose Process32NextW Process32FirstW CreateToolhelp32Snapshot WideCharToMultiByte MultiByteToWideChar LoadLibraryA GetProcAddress GetModuleFileNameA IsWow64Process GetProcessHeap InitializeCriticalSection EnterCriticalSection LeaveCriticalSection DeleteCriticalSection Sleep CreateThread SetConsoleCP SetConsoleOutputCP GetStdHandle CreateDirectoryA GetFileAttributesA ReadFile CloseHandle SetHandleInformation CreatePipe HeapAlloc HeapReAlloc HeapFree WaitForSingleObject TerminateProcess CreateProcessA ProcessIdToSessionId OpenProcess GetNativeSystemInfo

user32

SetProcessDPIAware

vcruntime140

memset __current_exception_context strrchr strchr memmove strstr __C_specific_handler memcpy __current_exception

api-ms-win-crt-string-l1-1-0

strncmp wcslen strcmp wcscmp wcscpy strcpy_s strncpy_s strlen strcpy tolower

api-ms-win-crt-convert-l1-1-0

atoi

api-ms-win-crt-utility-l1-1-0

rand

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode __stdio_common_vsprintf

api-ms-win-crt-runtime-l1-1-0

exit _cexit _c_exit _register_thread_local_exe_atexit_callback _get_narrow_winmain_command_line _initialize_narrow_environment _exit _initialize_onexit_table _register_onexit_function _crt_atexit terminate _initterm_e _configure_narrow_argv _set_app_type _initterm _seh_filter_exe

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode

Name

.text

Size

33KB

Virtual Size

33KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

11KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

130KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fig

Size

512B

Virtual Size

123B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

64B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

16705e219a85a541c730476f57cbe37907df8a5dc27b01e40a4adbb086e9e677

ws2_32

advapi32

iphlpapi

secur32

kernel32

user32

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic