24082026_0046_20082026_svvhost[.]exe[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
24082026_0046_20082026_svvhost.exe.zip
Size 237KB
Sample260824-a4pbasbr5t
SHA256 bc239d4e92484786626958db0a4944c8ecd17f0aaccfd3724d5060940febffbb
MD5 94c342bfcd4ec309e6570d4b6bc48eef
SHA1 07f2ce519aca501d9ed848ee6f57e8e81ddea0cc
SHA512 4758d38a493ab61211442ad171a85c4a72e5cef8a6ecc6fd17ee531b3924412879d71e454c8726edffd852f64fe3b71fae5de6b0f964137dc1fe0fda78a1ad0f
SSDEEP 6144:MA7iBZ97s2DRlwL2otIKnh4JUtc2lhoMV9bVpQaJLjGyArd:hi621lwLFIbUitMVRVtLjGbp
TLSH
T1F0342288D71C4F0689C38BA2CCCBB156D23341AA56EFEF16E7EB24E55419A7400F93A5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 3 IoCs

Checks for missing Authenticode signature.

resource
unpack001/HVNC64.dll
unpack001/ReflectiveHVNC64.dll
unpack001/svvhost.exe

File Explorer

24082026_0046_20082026_svvhost.exe.zip

.zip 237KB
HVNC64.dll

.dll 157KB
ReflectiveHVNC64.dll

.dll 160KB
svvhost.exe

.exe 158KB

24082026_0046_20082026_svvhost.exe.zip

SHA256 bc239d4e92484786626958db0a4944c8ecd17f0aaccfd3724d5060940febffbb
MD5 94c342bfcd4ec309e6570d4b6bc48eef
SHA1 07f2ce519aca501d9ed848ee6f57e8e81ddea0cc
SHA512 4758d38a493ab61211442ad171a85c4a72e5cef8a6ecc6fd17ee531b3924412879d71e454c8726edffd852f64fe3b71fae5de6b0f964137dc1fe0fda78a1ad0f
SSDEEP 6144:MA7iBZ97s2DRlwL2otIKnh4JUtc2lhoMV9bVpQaJLjGyArd:hi621lwLFIbUitMVRVtLjGbp
TLSH
T1F0342288D71C4F0689C38BA2CCCBB156D23341AA56EFEF16E7EB24E55419A7400F93A5
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

HVNC64.dll

IMPHASH 714627db03650ab1afc83cd06cac881a
SHA256 c1634bbe012d27a8a8d6815f750b41c36c5249b79953d5fec6f36e21de1381e4
MD5 9fcfd046f62d40f4a95dff00bea95931
SHA1 b83d8fbb979bdbfa0b88dfa25be770f4d28ad40a
SHA512 03d3a3282de4ee3a672eafca7adefe20e5792fb44199f1077e294d7adad13ed95ad79812a4ee3bb956082005a4e3e990491ed761fdb74d298b0e3bd5c31bd545
SSDEEP 3072:J9DZz8QkzTloiFx63VUfWUp8G7x8oPGXf3mJ3odLwZD+p1:J918dTllxIUfWYx8ouXfmCENC
TLSH
T1FBF32907B65450AAE537C035CE979632E7B2384427201AEF6168EB752F337D2BB7A344
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

34688

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

ole32

OleInitialize

kernel32

GetModuleHandleW CopyFileW lstrcpyW GetTempFileNameW CreateFileMappingW MapViewOfFile GetTickCount GlobalUnlock AssignProcessToJobObject CreateJobObjectW ResumeThread lstrcpyA GetCurrentProcessId CreateProcessA TerminateJobObject lstrcmpiW GetCurrentProcess TerminateProcess lstrcmpA SetFileAttributesW ExitProcess ExpandEnvironmentStringsW CreateDirectoryW SetEnvironmentVariableW GetModuleFileNameW ExitThread GetFileSize FindNextFileW FindClose TerminateThread GetWindowsDirectoryW lstrcmpW MoveFileW GetVersionExW WaitForMultipleObjects FreeLibrary LoadLibraryExW lstrcpynA LocalReAlloc EnterCriticalSection LeaveCriticalSection InitializeCriticalSection DeleteCriticalSection K32GetModuleFileNameExW GetEnvironmentVariableA OpenProcess CreateToolhelp32Snapshot CreateEventW Process32NextW SetEvent Process32FirstW ResetEvent SetEnvironmentVariableA OpenFileMappingA GetEnvironmentVariableW GetCurrentThreadId ProcessIdToSessionId GetTickCount64 WTSGetActiveConsoleSessionId MoveFileExW LocalFree GlobalLock GetProcAddress CreateThread CloseHandle DeleteFileW GlobalAlloc lstrcatW LoadLibraryA FlushViewOfFile GetLastError FormatMessageW Sleep GetModuleHandleA lstrcatA UnmapViewOfFile GetFileAttributesW CreateFileW LocalAlloc WaitForSingleObject lstrlenA GetTempPathW VirtualAlloc lstrcpynW WriteFile lstrlenW CreateProcessW VirtualFree ReadFile FindFirstFileW

user32

SendMessageTimeoutA SendMessageTimeoutW GetWindowRect PostMessageW CloseWindow GetKeyboardLayoutList GetParent GetProcessWindowStation GetDesktopWindow GetUserObjectInformationW EnumDisplaySettingsA GetMonitorInfoA GetThreadDesktop EnumDisplayMonitors MonitorFromWindow ToAscii ReleaseDC SetForegroundWindow PtInRect OpenDesktopW MenuItemFromPoint HiliteMenuItem ActivateKeyboardLayout PrintWindow BringWindowToTop GetTopWindow CreateDesktopW SetWindowLongA VkKeyScanExA GetKeyboardState GetMenuItemCount SetActiveWindow SetWindowPos GetDC GetMenu GetWindow ScreenToClient WindowFromPoint GetWindowPlacement CloseDesktop GetKeyboardLayout MoveWindow SetFocus LoadKeyboardLayoutA SystemParametersInfoA IsWindowVisible SetThreadDesktop GetWindowLongA GetWindowTextW OemToCharA GetClassNameW GetDlgItem SetWinEventHook CharLowerA UnhookWinEvent SetWindowTextW IsWindow GetWindowThreadProcessId FindWindowExW PostMessageA FindWindowW EnumDesktopWindows OpenClipboard wvsprintfW CloseClipboard EmptyClipboard GetClipboardData SetClipboardData IsClipboardFormatAvailable

gdi32

BitBlt Rectangle CreateCompatibleDC DeleteObject CreateSolidBrush CreatePen CreateCompatibleBitmap GetDIBits SelectObject

advapi32

RegCloseKey GetSidSubAuthorityCount GetSidSubAuthority OpenProcessToken RegOpenKeyExA RegQueryValueExA GetTokenInformation

shell32

SHEvaluateSystemCommandTemplate SHFileOperationW ShellExecuteW SHGetFolderPathW

ReflectiveHVNC64.dll

IMPHASH 893117acd2900217e1ea9ec8648addbc
SHA256 6162dd763b88e4ca3325960d7870f3eea68cefcc0ccbb97a02f32d00f34c399c
MD5 c3d10b68ee4cc6b0279110ac18704eb0
SHA1 b3e00fe25298bc64aeea0bfbfcaaf4bd613675a0
SHA512 bea9b23b6d372c34659e3af72bc040715d864a635e480bb7020b6dcacb2c0b508b47699068ecf7303ad3a8e6b5e88a8d9a706f959b60228e9e90695b6fe4c07f
SSDEEP 3072:K9MZ6wv6Mb9i4y3EHLe+WGhk+AvZ8Z8mXspkORTm:K93whI/se+PEZ8ZheTm
TLSH
T109F32907B65451AAE533C034CA979633F7B3384823201ADF6164EA752F237E2BB7A355
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

56992

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

ole32

OleInitialize

kernel32

GetModuleHandleW CopyFileW lstrcpyW GetTempFileNameW CreateFileMappingW MapViewOfFile GetTickCount GlobalUnlock AssignProcessToJobObject CreateJobObjectW ResumeThread lstrcpyA GetCurrentProcessId CreateProcessA TerminateJobObject lstrcmpiW GetCurrentProcess TerminateProcess lstrcmpA SetFileAttributesW ExitProcess ExpandEnvironmentStringsW CreateDirectoryW SetEnvironmentVariableW ExitThread FindFirstFileW GetFileSize FindClose TerminateThread GetWindowsDirectoryW lstrcmpW MoveFileW GetVersionExW WaitForMultipleObjects FreeLibrary LoadLibraryExW lstrcpynA LocalReAlloc EnterCriticalSection LeaveCriticalSection InitializeCriticalSection DeleteCriticalSection GetModuleFileNameW K32GetModuleFileNameExW GetEnvironmentVariableA OpenProcess CreateToolhelp32Snapshot CreateEventW Process32NextW SetEvent Process32FirstW ResetEvent SetEnvironmentVariableA OpenFileMappingA GetEnvironmentVariableW GetCurrentThreadId ProcessIdToSessionId GetTickCount64 WTSGetActiveConsoleSessionId MoveFileExW LocalFree GlobalLock GetProcAddress CreateThread CloseHandle DeleteFileW GlobalAlloc lstrcatW LoadLibraryA FlushViewOfFile GetLastError FormatMessageW Sleep GetModuleHandleA lstrcatA UnmapViewOfFile GetFileAttributesW CreateFileW LocalAlloc WaitForSingleObject lstrlenA GetTempPathW VirtualAlloc lstrcpynW WriteFile lstrlenW CreateProcessW VirtualFree ReadFile FindNextFileW

user32

gdi32

BitBlt Rectangle CreateCompatibleDC DeleteObject CreateSolidBrush CreatePen CreateCompatibleBitmap GetDIBits SelectObject

advapi32

RegCloseKey GetSidSubAuthorityCount GetSidSubAuthority OpenProcessToken RegOpenKeyExA RegQueryValueExA GetTokenInformation

shell32

SHEvaluateSystemCommandTemplate SHFileOperationW ShellExecuteW SHGetFolderPathW

svvhost.exe

IMPHASH 57f518ff8223b8b7cbb14a0e738c23d1
SHA256 559c37e58a67f08b55c3436e59f906246a1d2d467149a41bddc14818f61b573a
MD5 cda3fcd3db4b12ed675809e25a908520
SHA1 af923151854111c71b515cc156e585d6a3705821
SHA512 b42494687757bfd489d449e431b8fce3fa8e9b42d000dfaed0958efc5efe9d428989f92816599081e0819bd32f74788d42ec62533252d619f613b7b74fe15baf
SSDEEP 3072:OTjZXvqdwANWM5yykJNd4Jjn5k798+0EVGj0gH8iay:OTxvqSANWwkJNSp5098+0EwR
TLSH
T120F33A17725020E9E433C074CD969637F7B2386423201AEF6568EB752F226E2BF7A355
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

34816

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ole32

OleInitialize

kernel32

GetModuleHandleW CopyFileW lstrcpyW GetTempFileNameW CreateFileMappingW MapViewOfFile GetTickCount GlobalUnlock AssignProcessToJobObject CreateJobObjectW ResumeThread lstrcpyA GetCurrentProcessId CreateProcessA TerminateJobObject lstrcmpiW GetCommandLineW GetCurrentProcess TerminateProcess lstrcmpA SetFileAttributesW ExitProcess ExpandEnvironmentStringsW CreateDirectoryW SetEnvironmentVariableW ExitThread FindFirstFileW GetFileSize FindClose TerminateThread GetWindowsDirectoryW lstrcmpW MoveFileW GetVersionExW WaitForMultipleObjects FreeLibrary LoadLibraryExW lstrcpynA LocalReAlloc EnterCriticalSection LeaveCriticalSection InitializeCriticalSection DeleteCriticalSection GetModuleFileNameW K32GetModuleFileNameExW GetEnvironmentVariableA OpenProcess CreateToolhelp32Snapshot CreateEventW Process32NextW SetEvent Process32FirstW ResetEvent CreateFileMappingA SetEnvironmentVariableA OpenFileMappingA GetExitCodeProcess GetEnvironmentVariableW GetCurrentThreadId ProcessIdToSessionId GetTickCount64 WTSGetActiveConsoleSessionId MoveFileExW LocalFree GlobalLock GetProcAddress CreateThread CloseHandle DeleteFileW GlobalAlloc lstrcatW LoadLibraryA FlushViewOfFile GetLastError FormatMessageW Sleep GetModuleHandleA lstrcatA UnmapViewOfFile GetFileAttributesW CreateFileW LocalAlloc WaitForSingleObject lstrlenA GetTempPathW VirtualAlloc lstrcpynW WriteFile lstrlenW CreateProcessW VirtualFree ReadFile FindNextFileW

user32

gdi32

BitBlt Rectangle CreateCompatibleDC DeleteObject CreateSolidBrush CreatePen CreateCompatibleBitmap GetDIBits SelectObject

advapi32

RegCloseKey GetSidSubAuthorityCount GetSidSubAuthority OpenProcessToken RegOpenKeyExA RegQueryValueExA GetTokenInformation

shell32

SHEvaluateSystemCommandTemplate SHFileOperationW ShellExecuteW SHGetFolderPathW

24082026_0046_20082026_svvhost.exe.zip

HVNC64.dll

ole32

kernel32

user32

gdi32

advapi32

shell32

generic

ReflectiveHVNC64.dll

ole32

kernel32

user32

gdi32

advapi32

shell32

generic

svvhost.exe

ole32

kernel32

user32

gdi32

advapi32

shell32

generic