Keyfilemaker-BTCR[.]rar

Sharing

Copy URL Twitter E-mail

General

Target
Keyfilemaker-BTCR.rar
Size 7.1MB
Sample260827-bckdpswwdx
SHA256 c9438d7cb1070da08cc5d8d953920b4c947990d28f0a5e4606602b3252e56c93
MD5 36568ccbd369e37fc10ce84e9e150051
SHA1 850d50b32a6ffab1445e205dbe934f8892999e65
SHA512 410f69a7a13d5004b25cbcc139339dc12a6b3eccdeb8b4f7165d6fa85e07eb17761b9b1679c2d88011ca20cbd389508ebae9e0404292971528ba721a198f2387
SSDEEP 98304:0MINW8p/f9rrJ6Ov+sRQwT1hdpljQS76nvy1lMf4UjO1nn7bL41:tIow/f9USFevy1lMGnXL41
TLSH
T1F5769E03F29181E9C06DC074835BA637FB32BC8D4525B2AB6BE44B622F66F506F5D718
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/BTCR/Keyfilemaker.exe

File Explorer

Keyfilemaker-BTCR.rar

.rar 7.1MB
BTCR/Keyfilemaker.exe

.exe 5.8MB
BTCR/btcr.1.png

.png 767KB
BTCR/btcr.2.png

.png 491KB
btcr.nfo

13KB
file_id.diz

715B

Keyfilemaker-BTCR.rar

SHA256 c9438d7cb1070da08cc5d8d953920b4c947990d28f0a5e4606602b3252e56c93
MD5 36568ccbd369e37fc10ce84e9e150051
SHA1 850d50b32a6ffab1445e205dbe934f8892999e65
SHA512 410f69a7a13d5004b25cbcc139339dc12a6b3eccdeb8b4f7165d6fa85e07eb17761b9b1679c2d88011ca20cbd389508ebae9e0404292971528ba721a198f2387
SSDEEP 98304:0MINW8p/f9rrJ6Ov+sRQwT1hdpljQS76nvy1lMf4UjO1nn7bL41:tIow/f9USFevy1lMGnXL41
TLSH
T1F5769E03F29181E9C06DC074835BA637FB32BC8D4525B2AB6BE44B622F66F506F5D718
MD5 SHA1 SHA512 SSDEEP TLSH

BTCR/Keyfilemaker.exe

IMPHASH 8e4fc4cf100010c5b073838f0fbeebd9
SHA256 5c3474c48610ff22457f1a73773e56a14846021ac4dd7f85cd8925ce658d28b6
MD5 47eb3c352626e7bcb22f7cc616375c53
SHA1 bdde6c23cb86e6d4391afd25a6b8b253d7a05194
SHA512 271f634acf5fed07c76d29f555503082aa6092d202220fd848fc1a8dd2863e8289887095cc5cceafccee013bb82a73391e56f622ed71116061413e7b58701ab5
SSDEEP 98304:iv+sRQwT1hdpljQS76nvy1lMf4UjO1nn7bL4:2Fevy1lMGnXL4
TLSH
T12D568D43F29181E8C0ADC0B4835AA637FB32BC8D4535B2AB5BE44B612F66F506F4D719
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4411648

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

keyfilemaker.pdb

bcryptprimitives

ProcessPrng

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WaitOnAddress WakeByAddressAll

kernel32

GetProcessHeap HeapFree HeapReAlloc FreeLibrary GlobalLock GlobalUnlock GetProcAddress LoadLibraryExW FormatMessageW WideCharToMultiByte CreateFileMappingW MapViewOfFile GetCurrentProcess DuplicateHandle VirtualProtect UnmapViewOfFile FindFirstFileExW FindNextFileW FindClose GetUserPreferredUILanguages SetFilePointerEx WaitForSingleObject SetThreadErrorMode Sleep GetModuleHandleA RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind SetLastError GetCurrentDirectoryW WaitForSingleObjectEx LoadLibraryA lstrlenW GetCurrentProcessId CreateMutexA ReleaseMutex GetStdHandle GetConsoleMode GetConsoleOutputCP MultiByteToWideChar WriteConsoleW GetEnvironmentVariableW QueryPerformanceFrequency GetModuleHandleW GetFileInformationByHandle GetFileInformationByHandleEx GetFullPathNameW CreateFileW SetFileInformationByHandle CreateThread QueryPerformanceCounter HeapAlloc CreateEventA RemoveVectoredExceptionHandler SetThreadStackGuarantee GlobalAlloc GlobalFree LoadLibraryExA TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount DeleteCriticalSection LeaveCriticalSection EnterCriticalSection RaiseException EncodePointer RtlUnwindEx IsProcessorFeaturePresent GetStartupInfoW SetUnhandledExceptionFilter UnhandledExceptionFilter IsDebuggerPresent InitializeSListHead GetSystemTimeAsFileTime TlsFree RtlPcToFileHeader WriteFile GetModuleFileNameW ExitProcess TerminateProcess GetModuleHandleExW GetCommandLineA GetCommandLineW IsValidCodePage GetACP GetOEMCP GetCPInfo GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetFileType GetStringTypeW TlsSetValue FlsAlloc FlsGetValue FlsSetValue FlsFree CompareStringW LCMapStringW AddVectoredExceptionHandler SetWaitableTimer CreateWaitableTimerExW GetCurrentThread GetSystemInfo SwitchToThread CloseHandle GetSystemTimePreciseAsFileTime GetLastError GetCurrentThreadId HeapSize FlushFileBuffers GlobalSize

user32

ChangeDisplaySettingsExW SetWindowPlacement GetRawInputData MapVirtualKeyW SetWindowDisplayAffinity IsIconic GetAsyncKeyState IsProcessDPIAware SendInput SetForegroundWindow ClipCursor DestroyIcon GetKeyState RegisterTouchWindow GetSystemMetrics GetClipCursor DestroyCursor SetWindowLongW SendMessageW ShowWindow SystemParametersInfoA GetWindowRect GetMonitorInfoW ReleaseCapture SetCapture MonitorFromWindow GetCursorPos SetCursor LoadCursorW DefWindowProcW MonitorFromRect GetWindowPlacement CloseTouchInputHandle GetTouchInputInfo ScreenToClient TrackMouseEvent RegisterWindowMessageA ToUnicodeEx AdjustWindowRectEx GetMenu GetWindowLongW GetKeyboardState MapVirtualKeyExW SetClipboardData EmptyClipboard OpenClipboard GetClipboardData DefWindowProcA RegisterClassExA CreateWindowExA ReleaseDC GetDC CreateIcon CloseClipboard TranslateMessage MsgWaitForMultipleObjectsEx DispatchMessageW PeekMessageW RegisterRawInputDevices SetWindowLongPtrW GetWindowLongPtrW RedrawWindow FlashWindowEx GetClientRect CreateWindowExW RegisterClassExW DestroyWindow MonitorFromPoint ValidateRect SetWindowTextW GetForegroundWindow GetActiveWindow InvalidateRgn SetWindowPos TrackPopupMenu SetMenuDefaultItem EnableMenuItem GetSystemMenu ClientToScreen IsWindowVisible PostMessageW ShowCursor GetKeyboardLayout

shell32

DragQueryFileW DragFinish

gdi32

CreateCompatibleDC DeleteObject SwapBuffers ChoosePixelFormat DeleteDC SetPixelFormat DescribePixelFormat CreateRectRgn GetDeviceCaps SelectObject GetPixelFormat BitBlt CreateDIBSection

advapi32

ImpersonateAnonymousToken RevertToSelf

ntdll

RtlNtStatusToDosError NtReadFile NtWriteFile

opengl32

wglGetCurrentContext wglGetProcAddress wglDeleteContext wglCreateContext wglMakeCurrent

d3dcompiler_47

D3DCompile

oleaut32

SysFreeString GetErrorInfo SysStringLen

ole32

CoInitializeEx CoCreateInstance OleInitialize RevokeDragDrop RegisterDragDrop CoUninitialize

imm32

ImmAssociateContextEx ImmReleaseContext ImmGetCompositionStringW ImmGetContext

uxtheme

SetWindowTheme

dwmapi

DwmEnableBlurBehindWindow DwmSetWindowAttribute