TungTungClient[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
TungTungClient.exe
Size 6.9MB
Sample260922-slapasha72
SHA256 5109b574bb8464b71675c8e80d476cf0e6e398ac60b3d28f8e9a9a6bb5d172d8
MD5 6d0f293210d6f85c6a54240eed1daaa2
SHA1 62c3a28e3219d0f7d3e092a9b6c499ada568596f
SHA512 76a6adf63ae430c5e94fcbb463766a3711de765986e9cd3bcc09342bd1427f604810a86aed437cb746588c1ece2074e53f0370f6c97de919f02612b62a21114d
SSDEEP 98304:qdYPATG0ITECrGQ1krqxjNWJ1eGv48Oz8e4NwmEWvAYsdOvsAb2F9y1L:q3TG0crGQ1EEjNqvzpeVWI6
TLSH
T1D0766B2B36E5CAFEECE9457C44A3EF7174EFCC2AEE6795929141D86C32909D2083C581
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
TungTungClient.exe

File Explorer

TungTungClient.exe

.exe 6.9MB

TungTungClient.exe

IMPHASH 38ae933f037ac1b8fc19aa7d207daafa
SHA256 5109b574bb8464b71675c8e80d476cf0e6e398ac60b3d28f8e9a9a6bb5d172d8
MD5 6d0f293210d6f85c6a54240eed1daaa2
SHA1 62c3a28e3219d0f7d3e092a9b6c499ada568596f
SHA512 76a6adf63ae430c5e94fcbb463766a3711de765986e9cd3bcc09342bd1427f604810a86aed437cb746588c1ece2074e53f0370f6c97de919f02612b62a21114d
SSDEEP 98304:qdYPATG0ITECrGQ1krqxjNWJ1eGv48Oz8e4NwmEWvAYsdOvsAb2F9y1L:q3TG0crGQ1EEjNqvzpeVWI6
TLSH
T1D0766B2B36E5CAFEECE9457C44A3EF7174EFCC2AEE6795929141D86C32909D2083C581
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5152

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

gdi32

BitBlt CreateCompatibleBitmap CreateCompatibleDC DeleteDC DeleteObject GetDeviceCaps SelectObject

gdiplus

GdipAddPathArc GdipAlloc GdipCloneBrush GdipCloneImage GdipClosePathFigure GdipCreateFont GdipCreateFontFamilyFromName GdipCreateFromHDC GdipCreateLineBrushFromRectWithAngle GdipCreatePath GdipCreatePen1 GdipCreateSolidFill GdipCreateStringFormat GdipDeleteBrush GdipDeleteFont GdipDeleteFontFamily GdipDeleteGraphics GdipDeletePath GdipDeletePen GdipDeleteStringFormat GdipDisposeImage GdipDrawImageRect GdipDrawLine GdipDrawPath GdipDrawString GdipFillEllipse GdipFillPath GdipFillRectangle GdipFree GdipGetImageHeight GdipGetImageWidth GdipLoadImageFromStream GdipResetClip GdipSetClipRect GdipSetInterpolationMode GdipSetPixelOffsetMode GdipSetSmoothingMode GdipSetStringFormatAlign GdipSetStringFormatFlags GdipSetStringFormatLineAlign GdipSetStringFormatTrimming GdipSetTextRenderingHint GdiplusShutdown GdiplusStartup

kernel32

AttachConsole CloseHandle CreateDirectoryW CreateEventA CreateFileW CreateRemoteThread CreateSemaphoreA CreateThread CreateToolhelp32Snapshot DeleteCriticalSection DeleteFileW DuplicateHandle EnterCriticalSection FindResourceW FormatMessageA FormatMessageW GetCPInfo GetConsoleMode GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetEnvironmentVariableW GetExitCodeThread GetFileAttributesW GetFileSizeEx GetFullPathNameW GetLastError GetModuleFileNameW GetModuleHandleA GetModuleHandleW GetProcAddress GetProcessAffinityMask GetStdHandle GetSystemTimeAsFileTime GetTempPathW GetThreadContext GetThreadPriority GetTickCount GetTickCount64 GlobalAlloc GlobalFree GlobalLock GlobalUnlock InitializeCriticalSection IsWow64Process LeaveCriticalSection LoadLibraryW LoadResource LocalFree LockResource Module32FirstW Module32NextW MultiByteToWideChar OpenProcess OutputDebugStringA Process32FirstW Process32NextW QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReadFile ReleaseSemaphore ResetEvent ResumeThread RtlCaptureContext RtlLookupFunctionEntry RtlUnwindEx RtlVirtualUnwind SetConsoleMode SetConsoleOutputCP SetEvent SetLastError SetProcessAffinityMask SetThreadContext SetThreadPriority SetUnhandledExceptionFilter SizeofResource Sleep SuspendThread TlsAlloc TlsGetValue TlsSetValue TryEnterCriticalSection VirtualAllocEx VirtualFreeEx VirtualProtect VirtualQuery WaitForMultipleObjects WaitForSingleObject WideCharToMultiByte WriteFile WriteProcessMemory __C_specific_handler

msvcrt

fwprintf _assert ___lc_codepage_func ___mb_cur_max_func __iob_func __set_app_type __setusermatherr __wgetmainargs __winitenv _amsg_exit _beginthreadex _cexit _commode _endthreadex _errno _fmode _initterm _lock _setjmp _setmode _unlock _vscprintf _vsnprintf _wcsicmp abort atexit calloc exit fflush fprintf fputc fputwc free freopen getenv iswdigit localeconv longjmp malloc memchr memcmp memcpy memmove memset realloc setvbuf signal strchr strcmp strerror strlen strncmp strtoul towlower vfprintf wcslen wcsrchr wcstoul _strdup _read _fileno

ole32

CreateStreamOnHGlobal

user32

BeginPaint CreateWindowExW DefWindowProcW DispatchMessageW EndPaint EnumWindows GetDC GetMessageW GetWindowTextLengthW GetWindowTextW GetWindowThreadProcessId InvalidateRect IsWindowVisible KillTimer LoadCursorW MessageBoxW PostMessageW PostQuitMessage RegisterClassW ReleaseDC ScreenToClient SetCursor SetTimer ShowWindow SystemParametersInfoW TrackMouseEvent TranslateMessage UpdateWindow

Name

.text

Size

264KB

Virtual Size

263KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

1024B

Virtual Size

768B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

22KB

Virtual Size

21KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

14KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

13KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

9KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

32B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

6.2MB

Virtual Size

6.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1024B

Virtual Size

744B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/19

Size

12KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/31

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/45

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/57

Size

1024B

Virtual Size

744B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/70

Size

512B

Virtual Size

151B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/81

Size

512B

Virtual Size

468B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/97

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

TungTungClient.exe

gdi32

gdiplus

kernel32

msvcrt

ole32

user32

generic