PlagueRust[.]rar | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
PlagueRust.rar
Size 282KB
Sample260930-yk2dhszsh1
SHA256 8cbc7aa7a8b94fb7a2093ce145999eccaaf4d4a30443fd23df0c7e8b8568bb0b
MD5 386f30a12b22bb2db47b719f00d64ac1
SHA1 6bfbc8a04c74991b9a26468af7e9a7e5bd143cd8
SHA512 1d879c29969a1aa0b5afd2f75ab13c012528ebe90907a23273ef5a4a1cd8e1f5c03d7d5cc22d2e47e2a92360e4bcefcf371192ef9ed9e3fea76f107efd93aba1
SSDEEP 6144:drBeo44S3QvBJU5k93sUjp+nbn+F7Qfou2aXnvht4XOJ:d1VK3YBJUEsUj4bn+Fo12+hqXw
TLSH
T136542372D23C1370D6EC6099066845912ABAF9026E59FBCB5D90C4BD9ED36203FF7B21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/PlagueRust.exe

File Explorer

PlagueRust.rar

.rar 282KB
PlagueRust.exe

.exe 744KB

PlagueRust.rar

SHA256 8cbc7aa7a8b94fb7a2093ce145999eccaaf4d4a30443fd23df0c7e8b8568bb0b
MD5 386f30a12b22bb2db47b719f00d64ac1
SHA1 6bfbc8a04c74991b9a26468af7e9a7e5bd143cd8
SHA512 1d879c29969a1aa0b5afd2f75ab13c012528ebe90907a23273ef5a4a1cd8e1f5c03d7d5cc22d2e47e2a92360e4bcefcf371192ef9ed9e3fea76f107efd93aba1
SSDEEP 6144:drBeo44S3QvBJU5k93sUjp+nbn+F7Qfou2aXnvht4XOJ:d1VK3YBJUEsUj4bn+Fo12+hqXw
TLSH
T136542372D23C1370D6EC6099066845912ABAF9026E59FBCB5D90C4BD9ED36203FF7B21
MD5 SHA1 SHA512 SSDEEP TLSH

PlagueRust.exe

IMPHASH 574a10d134706e142574c8b5add1f0e4
SHA256 888a1bff4bdf1cf0b23fc9079715141621f5d7e775d32445f40f290af7350752
MD5 9dc80234ff53a9a60a198993cd90c599
SHA1 23ea6097583d794ae93620ff103e1af62706d5ef
SHA512 1b0ca87e1e46173714311fbdc4dd3011b920858feeb3f4d73feea20ab0fdb9b93801be0a8cbdafe5c306c2566c84bddfbc1492bf74a6c5951967195cbf539bc2
SSDEEP 12288:T3MXQ/zRrKhLUyTcMgEXJ1wo6FQI6EgtQo8UWYgeWYg955/155/WeNBnDhN3PpoY:YXQ/zRrKy9MRZ1X6FQI6ptQo8NNBnDhl
TLSH
T104F49D5AAAF501E9D07AE034DA969307FBB57C400B218AC733D46A5C2FF35E45EBA311
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

557408

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

G:\PlagueRust.pdb

winmm

PlaySoundA

d3d11

D3D11CreateDeviceAndSwapChain

kernel32

GetLastError CloseHandle SetConsoleTextAttribute SetConsoleTitleA GetStdHandle CreateThread GetConsoleWindow SleepEx AllocConsole SetConsoleTitleW Beep GetPrivateProfileStringA GetConsoleScreenBufferInfo GlobalFree AcquireSRWLockExclusive GetCurrentProcess SleepConditionVariableSRW GetCurrentThreadId WakeAllConditionVariable InitializeSListHead SetUnhandledExceptionFilter GetModuleHandleW GetCurrentProcessId GetSystemTimeAsFileTime GlobalAlloc GetModuleHandleA Sleep QueryPerformanceCounter QueryPerformanceFrequency GlobalUnlock GlobalLock ReleaseSRWLockExclusive

user32

keybd_event mouse_event IsWindow FindWindowA GetWindowRect GetKeyState GetWindowLongA ScreenToClient GetCapture ClientToScreen GetForegroundWindow SetCapture SetCursor GetClientRect ReleaseCapture LoadCursorA MessageBoxA SetForegroundWindow UpdateWindow RegisterClassExA SetWindowLongPtrA PostQuitMessage UnregisterClassA GetWindowLongPtrA PeekMessageA TranslateMessage SetCursorPos GetCursorPos OpenClipboard CloseClipboard EmptyClipboard GetClipboardData SetClipboardData DispatchMessageA DestroyWindow SetWindowPos MonitorFromWindow SetLayeredWindowAttributes SetWindowLongA GetAsyncKeyState ShowWindow GetWindowPlacement GetSystemMetrics DefWindowProcA CreateWindowExA GetMonitorInfoA

advapi32

ConvertSidToStringSidA IsValidSid OpenProcessToken GetTokenInformation

shell32

ShellExecuteA

msvcp140

__crtLCMapStringA ?_Xinvalid_argument@std@@YAXPEBD@Z ??0_Locinfo@std@@QEAA@PEBD@Z ??1_Locinfo@std@@QEAA@XZ ?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ ?set_new_handler@std@@YAP6AXXZP6AXXZ@Z ?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ ??0facet@locale@std@@IEAA@_K@Z ??1facet@locale@std@@MEAA@XZ ?tolower@?$ctype@D@std@@QEBADD@Z ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Incref@facet@locale@std@@UEAAXXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?uncaught_exceptions@std@@YAHXZ ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Xbad_alloc@std@@YAXXZ ?_Id_cnt@id@locale@std@@0HA ?_Xout_of_range@std@@YAXPEBD@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?_Xlength_error@std@@YAXPEBD@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ?good@ios_base@std@@QEBA_NXZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ?_Random_device@std@@YAIXZ _Query_perf_frequency _Query_perf_counter _Strxfrm ?_Throw_Cpp_error@std@@YAXH@Z ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z ?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A ?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z ?id@?$ctype@D@std@@2V0locale@2@A ?id@?$collate@D@std@@2V0locale@2@A _Strcoll _Cnd_do_broadcast_at_thread_exit _Thrd_detach ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z

winhttp

WinHttpQueryDataAvailable WinHttpReceiveResponse WinHttpOpen WinHttpAddRequestHeaders WinHttpReadData WinHttpOpenRequest WinHttpCloseHandle WinHttpConnect WinHttpSendRequest

dwmapi

DwmExtendFrameIntoClientArea

imm32

ImmReleaseContext ImmSetCompositionWindow ImmGetContext

d3dcompiler_47

D3DCompile

xinput1_4

ord4 ord2

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memchr memcmp memcpy memmove memset _CxxThrowException __CxxFrameHandler3 __RTDynamicCast __C_specific_handler __RTtypeid __current_exception __current_exception_context strstr __std_type_info_name _purecall __std_type_info_compare __std_terminate __std_exception_copy __std_exception_destroy strchr

api-ms-win-crt-runtime-l1-1-0

_invalid_parameter_noinfo _invalid_parameter_noinfo_noreturn exit terminate _configure_narrow_argv _initialize_narrow_environment _errno _register_onexit_function _crt_atexit _cexit _seh_filter_exe _set_app_type _initialize_onexit_table _get_initial_narrow_environment _initterm _initterm_e _exit _beginthreadex __p___argc __p___argv _c_exit _register_thread_local_exe_atexit_callback system

api-ms-win-crt-stdio-l1-1-0

__p__commode fseek _set_fmode __acrt_iob_func __stdio_common_vfprintf _wfopen __stdio_common_vsprintf __stdio_common_vsscanf ftell __stdio_common_vsprintf_s fputc _get_stream_buffer_pointers _fseeki64 fread fsetpos ungetc setvbuf fgetpos fwrite fopen freopen __stdio_common_vsnprintf_s fgetc fflush fclose

api-ms-win-crt-heap-l1-1-0

malloc free _aligned_malloc _callnewh realloc _aligned_free _set_new_mode

api-ms-win-crt-utility-l1-1-0

rand qsort

api-ms-win-crt-filesystem-l1-1-0

_lock_file _unlock_file

api-ms-win-crt-convert-l1-1-0

strtod atof atoi

api-ms-win-crt-math-l1-1-0

sqrtf sinf cosf floorf fmodf ceilf __setusermatherr

api-ms-win-crt-string-l1-1-0

strcmp strcpy_s strncpy strlen wcslen

api-ms-win-crt-locale-l1-1-0

_configthreadlocale ___lc_collate_cp_func ___lc_locale_name_func