BOOT_CAPTURE2[.]rar

General

Target
BOOT_CAPTURE2.rar
Size 223KB
Sample260928-nhh42stthy
SHA256 57e4fd73a0b90ee461e2c1414a01a9e8a99001c3d84724292467f845058fbbc3
MD5 8935b681bae255182fd7cafe102803ce
SHA1 7a0eb6e24c3e7a5fa34290e23f7edae382f2782e
SHA512 87e74821a7891a2b0ccc340278d1fc90c0a520a3beb1fb9e1ec109d15b873738da127d1f9c37fb55aeee15d1a71af45d27044f1afe52151a58808a51ec3b8443
SSDEEP 6144:k7acQzpnlY0ogUsOQ0LJ9PHMieDhffjE6qsiyMkqEixbagSThDAPU:k7RQzVCuUs50LJRHMRpw6qs1g2hF
TLSH
T1AB24230F2D81464ED7B0759AD68A7B366E5C5A1F39D5CA789C77623FCC0C1AB00A9C8C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Booter2.exe
unpack001/systemsp.dll

File Explorer

BOOT_CAPTURE2.rar

.zip 223KB
Booter2.exe

.exe 6KB
systemsp.dll

.dll 562KB

BOOT_CAPTURE2.rar

SHA256 57e4fd73a0b90ee461e2c1414a01a9e8a99001c3d84724292467f845058fbbc3
MD5 8935b681bae255182fd7cafe102803ce
SHA1 7a0eb6e24c3e7a5fa34290e23f7edae382f2782e
SHA512 87e74821a7891a2b0ccc340278d1fc90c0a520a3beb1fb9e1ec109d15b873738da127d1f9c37fb55aeee15d1a71af45d27044f1afe52151a58808a51ec3b8443
SSDEEP 6144:k7acQzpnlY0ogUsOQ0LJ9PHMieDhffjE6qsiyMkqEixbagSThDAPU:k7RQzVCuUs50LJRHMRpw6qs1g2hF
TLSH
T1AB24230F2D81464ED7B0759AD68A7B366E5C5A1F39D5CA789C77623FCC0C1AB00A9C8C
MD5 SHA1 SHA512 SSDEEP TLSH

Booter2.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 7c6f0fecfb234a6265af59988b491aa09c9b5c7852d382173bc8d6f8eec3ab79
MD5 7f8264e71b5fc34aa3a096f2a7c6c4bb
SHA1 cd85f6ea310ce11b94abc37ba6ab15851a6ea275
SHA512 4587ef022e3193a80f4ba7ec78a3701a82b3d651019920ce1d15177de0112de01da69c4cbd0497038463dd9a33b1dcf0d6a1a76c54c320567eea2ae167303cc6
SSDEEP 96:aQt1GFOL4r/eRGmNvaQt0/2So4mRVziZbO/1ISYRUtxPUOzNt:aOkrL8a20pO6uV
TLSH
T1B2D1D9107BF44536D0AE8B7818B283205376BA19C937CBAF6CC4506D7D323908D53B72
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

11902

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

systemsp.dll

SHA256 20ac827192e3cb26ab3d77f545c0ee2c528a3aa981666a387a895c2025c17eb1
MD5 407c88b9f3346fbaeb3bc91aa8f961c6
SHA1 4e0dbb51d0c29692baee29e3ba089e4a69ecab67
SHA512 b3289b2c6769137320803be4d2fc23dd8813bbf705efdfa4025f4eba0ada845aa7e17a2382aadf79b98ba68161b0438a9243fa4600996abee3fbfdcf9cdad141
SSDEEP 6144:sd5oW/ATGcuC5c3+hJ580Rp2yASweJ0n2myOo+raBTaN2fAZShLL05Vk+C+eIECb:szol2yU2mno+DVk+CmhV3TfKMjj
TLSH
T1BFC4832C37F5DAA8E05BC93D9169725441FA41E58F07F2161CC0F9D76A2EA8CCFB8648
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

%!f(<nil>)

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

BOOT_CAPTURE2.rar

Booter2.exe

mscoree

dotnet

systemsp.dll

generic

Sharing

General

Malware Config

Signatures

File Explorer

BOOT_CAPTURE2.rar

Booter2.exe

mscoree

dotnet

systemsp.dll

generic