Bootstapsrer[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
Bootstapsrer.exe
Size 1024KB
Sample260908-t9qwvseq91
SHA256 732416c64e26d9547615835d81dce1b617c8b7f8b7ce04c7931c1b2c96d19085
MD5 697277a9582579cb2184475c82064e55
SHA1 4ae9ed058b6d109b17ea9e308fdb759fc4b04191
SHA512 ac433044718021929fdbc7cbab72c314ac36e04dbd9ce81de17aacc2c2a679597ebd642430a3f9be171e0b638058bed5ffcd17975b42517ced88c0068b6979e9
SSDEEP 3072:P9wwLK4XWVLlekstK6xpyQ1+yiS8iSSCAdLb3vV/AQo31ylQiGGNHe9JXzrsxvCv:lwEO8NxD5mgLGGwJDQVbwqmGE
TLSH
T113258E15F6A918F9E937817CCD424902EA727C164761EADF03A04AA72F277E09E3F711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Bootstapsrer.exe

File Explorer

Bootstapsrer.exe

.exe 1024KB

Bootstapsrer.exe

IMPHASH 2fb7473982051d3615c38155fe72e9a1
SHA256 732416c64e26d9547615835d81dce1b617c8b7f8b7ce04c7931c1b2c96d19085
MD5 697277a9582579cb2184475c82064e55
SHA1 4ae9ed058b6d109b17ea9e308fdb759fc4b04191
SHA512 ac433044718021929fdbc7cbab72c314ac36e04dbd9ce81de17aacc2c2a679597ebd642430a3f9be171e0b638058bed5ffcd17975b42517ced88c0068b6979e9
SSDEEP 3072:P9wwLK4XWVLlekstK6xpyQ1+yiS8iSSCAdLb3vV/AQo31ylQiGGNHe9JXzrsxvCv:lwEO8NxD5mgLGGwJDQVbwqmGE
TLSH
T113258E15F6A918F9E937817CCD424902EA727C164761EADF03A04AA72F277E09E3F711
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

60960

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\Administrator\source\repos\kapsolit\x64\Release\kapsolit.pdb

kernel32

CreateToolhelp32Snapshot MultiByteToWideChar Sleep GetTempPathA GetTimeZoneInformation GetTickCount64 Process32NextW Process32FirstW WaitForSingleObject SetFileAttributesA GlobalMemoryStatusEx WideCharToMultiByte CreateProcessA CreateDirectoryA GetTickCount WriteConsoleW CreateFileW GetEnvironmentVariableA GetSystemDefaultUILanguage CloseHandle GetModuleFileNameA HeapSize GetConsoleMode GetConsoleOutputCP FlushFileBuffers GetCurrentThreadId GetLastError WaitForSingleObjectEx GetExitCodeThread EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable QueryPerformanceCounter GetStringTypeW GetCPInfo SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead RtlLookupFunctionEntry RtlUnwindEx RtlPcToFileHeader RaiseException SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree GetCurrentProcess ExitProcess TerminateProcess FreeLibrary GetModuleHandleExW GetProcAddress CreateThread ExitThread FreeLibraryAndExitThread IsProcessorFeaturePresent GetModuleFileNameW GetStdHandle WriteFile HeapAlloc RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter HeapFree VirtualProtect LoadLibraryExW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileType IsValidCodePage GetACP GetOEMCP HeapReAlloc SetFilePointerEx FindClose FindFirstFileExW FindNextFileW GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW GetProcessHeap SetStdHandle

user32

GetCursorPos

advapi32

FreeSid CheckTokenMembership AllocateAndInitializeSid

shell32

ShellExecuteExA ShellExecuteA

urlmon

URLDownloadToFileW

Name

.text

Size

183KB

Virtual Size

182KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

80KB

Virtual Size

79KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

10KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

688B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

Bootstapsrer.exe

kernel32

user32

advapi32

shell32

urlmon

generic