TeslaY Client Prime[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
TeslaY Client Prime.exe
Size 39.3MB
Sample260823-tebhpahn3s
SHA256 8a3f2d0a68d5b24f3dfc4a4aad6ee9908e2323301c045941eed142bea695df94
MD5 02b2b2fda92fc1f38a51dce607785fe0
SHA1 4fa40f1448184f92810907611e84c1d596efc4c4
SHA512 00a26d75fc77c8019aa5c6a82b6773a17d36cfc518e91086c2fc4537a6661be5cc2407168e4832ecf0f55047f1eaaa66363f6d3b2bda567df59f435458212911
SSDEEP 393216:xnjmGyQOi3fHVrpavCRgrnLjc5PsdN2mq:RDxpavCiPj6sdN2
TLSH
T11E974B11BB965DAED09AC070834A4672AA3134EB0B25BAEF44D553743F7EAF11F3C258
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
TeslaY Client Prime.exe

File Explorer

TeslaY Client Prime.exe

.exe 39.3MB

TeslaY Client Prime.exe

IMPHASH 809b56743b6041054c7905de04d88002
SHA256 8a3f2d0a68d5b24f3dfc4a4aad6ee9908e2323301c045941eed142bea695df94
MD5 02b2b2fda92fc1f38a51dce607785fe0
SHA1 4fa40f1448184f92810907611e84c1d596efc4c4
SHA512 00a26d75fc77c8019aa5c6a82b6773a17d36cfc518e91086c2fc4537a6661be5cc2407168e4832ecf0f55047f1eaaa66363f6d3b2bda567df59f435458212911
SSDEEP 393216:xnjmGyQOi3fHVrpavCRgrnLjc5PsdN2mq:RDxpavCiPj6sdN2
TLSH
T11E974B11BB965DAED09AC070834A4672AA3134EB0B25BAEF44D553743F7EAF11F3C258
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Password

12345

Minor OS version

Major OS version

Entry point

24818884

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

teslay_client_prime.pdb

kernel32

GetModuleHandleW CloseHandle LocalFree GetCurrentThreadId CreateMutexW GetLastError CreateEventW SetEvent ReleaseMutex GetCurrentProcess SetProcessWorkingSetSize GetUserDefaultUILanguage LCIDToLocaleName WaitForSingleObject ResetEvent SetEndOfFile HeapSize GetStringTypeW GetCPInfo GetOEMCP GetACP IsValidCodePage LCMapStringW CompareStringW FlsGetValue GetCommandLineA InitializeCriticalSectionAndSpinCount DeleteCriticalSection LeaveCriticalSection EnterCriticalSection EncodePointer RaiseException RtlPcToFileHeader RtlUnwindEx InitializeCriticalSectionEx GetStartupInfoW IsDebuggerPresent InitializeSListHead GetSystemTimeAsFileTime SleepConditionVariableSRW WakeAllConditionVariable IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter LoadLibraryExW VirtualAlloc GetProcessHeap VirtualQuery VirtualProtect VirtualFree HeapFree VirtualQueryEx GetFileSizeEx FindNextFileW SetStdHandle GetTempPathW GetFileType IsThreadAFiber SetConsoleCtrlHandler SetNamedPipeHandleState GetCurrentProcessorNumber TlsFree TlsSetValue TlsAlloc SwitchToThread GetProcessTimes AcquireSRWLockExclusive ReleaseSRWLockExclusive InitializeSRWLock WriteFile SetLastError ReleaseSRWLockShared AcquireSRWLockShared InitOnceExecuteOnce TlsGetValue WideCharToMultiByte GetConsoleMode ReadConsoleW FlsSetValue GetModuleHandleExW FlsAlloc FlsFree SetWaitableTimer CreateWaitableTimerExW GetConsoleOutputCP WriteConsoleW MultiByteToWideChar SetEnvironmentVariableW HeapAlloc GetFinalPathNameByHandleW SetHandleInformation WaitForSingleObjectEx FreeLibrary FindFirstFileExW GetCurrentDirectoryW GetCurrentThread OutputDebugStringW OutputDebugStringA PostQueuedCompletionStatus ReadFile GetOverlappedResult CreateIoCompletionPort CancelIoEx GetCurrentProcessId SetThreadStackGuarantee GetQueuedCompletionStatusEx GetStdHandle SetFileCompletionNotificationModes AddVectoredExceptionHandler DuplicateHandle OpenProcess CreateFileW SetFilePointerEx CreateDirectoryW ExitProcess CreateProcessA GetTimeZoneInformationForYear DeleteFileW GetModuleHandleA GetExitCodeProcess GetSystemTimes GetProcessIoCounters GetEnvironmentStringsW TerminateProcess GetModuleFileNameW GetCommandLineW GetEnvironmentVariableA QueryPerformanceCounter QueryPerformanceFrequency GetSystemInfo GetModuleHandleExA LoadLibraryA LoadLibraryW CreateProcessW GetWindowsDirectoryW GetSystemDirectoryW GetFileInformationByHandleEx GetFileInformationByHandle SetFileTime GetSystemTimePreciseAsFileTime WriteConsoleA FindClose GetConsoleScreenBufferInfo RtlLookupFunctionEntry RtlCaptureContext FlushFileBuffers GetProcAddress Sleep lstrlenW ReadProcessMemory CreateMutexA FormatMessageW WriteFileEx SleepEx ReadFileEx GetFileAttributesW CreateThread HeapReAlloc CopyFileExW SetFileInformationByHandle MoveFileExW GetFullPathNameW RtlVirtualUnwind FreeEnvironmentStringsW CompareStringOrdinal LoadLibraryExA GetEnvironmentVariableW

psapi

EmptyWorkingSet GetModuleFileNameExW

user32

MonitorFromWindow GetMonitorInfoW EnumChildWindows RegisterClassExW GetCursorPos DispatchMessageA MessageBoxW MonitorFromRect CloseTouchInputHandle GetTouchInputInfo SetCursor GetMessageA ValidateRect AdjustWindowRectEx CreateWindowExW DispatchMessageW DestroyWindow IsWindow InvalidateRgn MapVirtualKeyW PostThreadMessageW TrackMouseEvent GetUpdateRect LoadCursorW SetWindowPos GetSystemMetrics GetWindowPlacement SetWindowPlacement PeekMessageW ChangeDisplaySettingsExW DefWindowProcW RedrawWindow RegisterTouchWindow PostMessageW GetMessageW TranslateMessage GetClientRect GetWindowRect IsIconic GetForegroundWindow ScreenToClient GetWindowLongW ClientToScreen FillRect GetActiveWindow OffsetRect GetWindowDC SendInput RegisterRawInputDevices DrawIconEx SetCapture DrawTextW ReleaseCapture ReleaseDC MapWindowPoints GetDC SetMenuItemInfoW ShowWindow SendMessageW RegisterClassW RegisterWindowMessageA MonitorFromPoint IsProcessDPIAware DestroyIcon ChangeWindowMessageFilterEx GetRawInputData GetWindowLongPtrW SetWindowLongPtrW KillTimer IsWindowVisible SetPropW SetForegroundWindow ClipCursor GetClipCursor TrackPopupMenu ShowCursor SetWindowLongW GetSystemMenu GetMenuItemInfoW GetKeyboardState GetAsyncKeyState SetWindowDisplayAffinity ToUnicodeEx GetKeyboardLayout MapVirtualKeyExW SystemParametersInfoW SetTimer MsgWaitForMultipleObjectsEx GetKeyState GetMenuBarInfo DestroyMenu SystemParametersInfoA PostQuitMessage GetMenu SetMenu RemoveMenu AppendMenuW InsertMenuW CheckMenuItem CreateAcceleratorTableW DestroyAcceleratorTable DrawMenuBar EnableMenuItem CreatePopupMenu CreateMenu CreateIcon

ntdll

NtWriteFile NtQueryInformationProcess NtQuerySystemInformation NtDeviceIoControlFile RtlNtStatusToDosError NtCancelIoFileEx NtOpenFile NtCreateFile NtCreateNamedPipeFile RtlGetVersion NtReadFile

advapi32

RegGetValueW SystemFunction036 GetTokenInformation EventRegister EventSetInformation OpenProcessToken EventWriteTransfer RegDeleteValueW EventUnregister AdjustTokenPrivileges LookupPrivilegeValueA RegCloseKey RegSetValueExW RegQueryValueExW RegCreateKeyExW RegOpenKeyExW IsValidSid GetLengthSid CopySid

oleaut32

GetErrorInfo SysStringLen SetErrorInfo SysFreeString

bcryptprimitives

ProcessPrng

ws2_32

getpeername getsockname recvfrom getsockopt accept WSASend ioctlsocket connect recv send WSAStartup bind listen shutdown setsockopt WSAIoctl freeaddrinfo WSASocketW closesocket WSAGetLastError getaddrinfo sendto

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WaitOnAddress WakeByAddressAll

crypt32

CryptProtectData CryptUnprotectData CertFreeCertificateChainEngine CertGetCertificateChain CertCreateCertificateChainEngine CertOpenStore CertAddEncodedCertificateToStore CertSetCertificateContextProperty CertCloseStore CertFreeCertificateContext CertFreeCertificateChain CertVerifyCertificateChainPolicy

comctl32

SetWindowSubclass DefSubclassProc RemoveWindowSubclass

shell32

CommandLineToArgvW SHAppBarMessage DragQueryFileW Shell_NotifyIconGetRect DragFinish Shell_NotifyIconW

shlwapi

SHCreateMemStream

ole32

CoUninitialize CoCreateInstance CoInitializeEx RevokeDragDrop RegisterDragDrop OleInitialize

combase

CoTaskMemFree CoTaskMemAlloc

bcrypt

BCryptGenRandom

gdi32

SetBkMode DeleteDC SelectObject CreateDIBSection CreateCompatibleDC SetTextColor DeleteObject CreateSolidBrush CreateRectRgn GetDeviceCaps

dwmapi

DwmEnableBlurBehindWindow DwmSetWindowAttribute

pdh

PdhRemoveCounter PdhCloseQuery

powrprof

CallNtPowerInformation

iphlpapi

FreeMibTable GetIfTable2 GetAdaptersAddresses

Name

.text

Size

24.2MB

Virtual Size

24.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

13.4MB

Virtual Size

13.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

200KB

Virtual Size

254KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

1.1MB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

20KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

425KB

Virtual Size

425KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

TeslaY Client Prime.exe

kernel32

psapi

user32

ntdll

advapi32

oleaut32

bcryptprimitives

ws2_32

api-ms-win-core-synch-l1-2-0

crypt32

comctl32

shell32

shlwapi

ole32

combase

bcrypt

gdi32

dwmapi

pdh

powrprof

iphlpapi

generic