FoxstrotClient[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
FoxstrotClient.exe
Size 542KB
Sample260913-all38acd77
SHA256 6493b2121dbf8ad0e7b736ea49b5ec01c15a51d688beb988d5ad02bc4c6f0ab3
MD5 64d7f522608c5ffe2b2f76214ab53b38
SHA1 083c43acd6aea80872282d8e3780bcaadbad6b80
SHA512 450b300bd5d0e69322b78e519d576a27b44f570314d45f0e811fdc59bee5da900d73f332f6ab185df712ac4d8efc53752f63a87510ada0b1ad9c8b3069a98fcb
SSDEEP 12288:i9AnaMNti7/dVz6yVFAJLI5PMjlb6AblbOmb4KQPAb7bkypP/Z5VZutLbnbzbbbm:71ef/u
TLSH
T11CC4E8059A950E4DE1B2537448B2D63052327F856A21DAAB47F4FD4FFE33A847C32B92
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
FoxstrotClient.exe

File Explorer

FoxstrotClient.exe

.exe 542KB

FoxstrotClient.exe

IMPHASH 1c8ae11145fa8256c58df4cbe5d353ca
SHA256 6493b2121dbf8ad0e7b736ea49b5ec01c15a51d688beb988d5ad02bc4c6f0ab3
MD5 64d7f522608c5ffe2b2f76214ab53b38
SHA1 083c43acd6aea80872282d8e3780bcaadbad6b80
SHA512 450b300bd5d0e69322b78e519d576a27b44f570314d45f0e811fdc59bee5da900d73f332f6ab185df712ac4d8efc53752f63a87510ada0b1ad9c8b3069a98fcb
SSDEEP 12288:i9AnaMNti7/dVz6yVFAJLI5PMjlb6AblbOmb4KQPAb7bkypP/Z5VZutLbnbzbbbm:71ef/u
TLSH
T11CC4E8059A950E4DE1B2537448B2D63052327F856A21DAAB47F4FD4FFE33A847C32B92
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

135316

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\Admin\Pictures\MegaSelfCode1.21.4\x64\Release\FoxstrotClient.pdb

kernel32

ReleaseMutex OpenProcess MultiByteToWideChar FormatMessageW GetLastError OutputDebugStringW WaitForSingleObjectEx OpenSemaphoreW CloseHandle HeapAlloc GetProcAddress CreateMutexExW GetCurrentProcessId GetProcessHeap GlobalMemoryStatusEx CreateProcessW GetModuleHandleW WideCharToMultiByte DebugBreak IsDebuggerPresent GetExitCodeProcess GetFileAttributesW OutputDebugStringA GetModuleFileNameW GetCurrentThreadId LoadLibraryW FreeLibrary GetEnvironmentVariableW FormatMessageA InitializeSListHead GetSystemTimeAsFileTime QueryPerformanceCounter GetStartupInfoW SetUnhandledExceptionFilter WakeAllConditionVariable Sleep SleepConditionVariableSRW AcquireSRWLockExclusive ReleaseSRWLockExclusive GetFileInformationByHandleEx CreateFileW WaitForSingleObject TerminateProcess GetModuleHandleExW ReleaseSemaphore GetStdHandle SetLastError HeapFree CreateSemaphoreExW LoadLibraryExW GetModuleFileNameA AreFileApisANSI GetLocaleInfoEx CreateDirectoryW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW SetFileInformationByHandle CreateFile2 LocalFree

user32

RegisterClassExW ShowWindow GetSystemMetrics DefWindowProcW DispatchMessageW SetLayeredWindowAttributes ScreenToClient CreateWindowExW SetWindowPos TranslateMessage LoadCursorW GetClientRect DestroyWindow PostMessageW GetMessageW ReleaseCapture GetWindowRect PostQuitMessage SendMessageW

advapi32

RegGetValueW EventUnregister EventWriteTransfer EventSetInformation EventRegister RegCloseKey RegCreateKeyExW RegSetValueExW RegOpenKeyExW RegQueryValueExW

ole32

CoTaskMemFree

msvcp140

_Thrd_detach ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ _Cnd_do_broadcast_at_thread_exit ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAA@XZ ?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z ??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IEAA@XZ ?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z ?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z ??0?$basic_iostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ?imbue@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAA?AVlocale@2@AEBV32@@Z ??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ ?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JXZ ?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAGXZ ?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEA_W_J@Z ?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEB_W_J@Z ?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAPEAV12@PEA_W_J@Z ?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAXAEBVlocale@2@@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@N@Z ??1?$basic_iostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ?good@ios_base@std@@QEBA_NXZ ??7ios_base@std@@QEBA_NXZ ??Bios_base@std@@QEBA_NXZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ?_Syserror_map@std@@YAPEBDH@Z ?setprecision@std@@YA?AU?$_Smanip@_J@1@_J@Z ?_Xlength_error@std@@YAXPEBD@Z ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Winerror_map@std@@YAHH@Z ?_Xout_of_range@std@@YAXPEBD@Z ?_Id_cnt@id@locale@std@@0HA ?_Xinvalid_argument@std@@YAXPEBD@Z ?_Xbad_alloc@std@@YAXXZ ?classic@locale@std@@SAAEBV12@XZ ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?uncaught_exceptions@std@@YAHXZ ?_Throw_Cpp_error@std@@YAXH@Z ??0_Lockit@std@@QEAA@H@Z ??1_Lockit@std@@QEAA@XZ _Query_perf_frequency _Query_perf_counter ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z

wininet

InternetReadFile InternetCloseHandle InternetOpenW HttpQueryInfoW InternetOpenUrlW

dwmapi

DwmSetWindowAttribute

bcrypt

BCryptDestroyKey BCryptDecrypt BCryptCloseAlgorithmProvider BCryptEncrypt BCryptGenerateSymmetricKey BCryptSetProperty BCryptOpenAlgorithmProvider

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__C_specific_handler __std_exception_copy __current_exception_context __current_exception _CxxThrowException memmove memcmp memcpy memset __std_exception_destroy wcsrchr __std_terminate _purecall

api-ms-win-crt-stdio-l1-1-0

fputc _set_fmode fflush fclose fgetc fwrite __stdio_common_vswprintf fgetpos setvbuf ungetc _get_stream_buffer_pointers __p__commode fsetpos fread _fseeki64

api-ms-win-crt-heap-l1-1-0

malloc _set_new_mode _callnewh free

api-ms-win-crt-string-l1-1-0

strlen wcslen _wcsicmp towupper wcscmp towlower

api-ms-win-crt-convert-l1-1-0

_wtoi strtol _ultow_s wcstol

api-ms-win-crt-runtime-l1-1-0

_get_wide_winmain_command_line _initterm _initterm_e _exit _crt_atexit _initialize_wide_environment _register_thread_local_exe_atexit_callback _configure_wide_argv _register_onexit_function _errno _set_app_type _initialize_onexit_table _seh_filter_exe _c_exit terminate _invalid_parameter_noinfo _beginthreadex abort _cexit exit

api-ms-win-crt-filesystem-l1-1-0

_lock_file _unlock_file

api-ms-win-crt-locale-l1-1-0

_configthreadlocale ___lc_codepage_func

api-ms-win-crt-math-l1-1-0

__setusermatherr