potass[.]zip | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
potass.zip
Size 11.2MB
Sample261001-wdw44stdqg
SHA256 d8a1b88b0767cea7716140ab0557f08a71d747b9955b71890b04aafdbfd42125
MD5 1a0686ecc034f48ec1d658d150f9fbc4
SHA1 166c6981faada0eaca51786931af67c9fa1a0f5a
SHA512 4443d557a3fa2433a444c6eb3b7c8f9af6e0e2c916ad7bfdfe524c6c1ee9064a63c9d13ef380af5790ca7f16bafe765702ae4c0a338f3a548ab037da97e9bf22
SSDEEP 196608:nGbZ1k7x2ezvI/rV2f+ug0+raKW9uOe68Y/X/wIOtPtDdjj6D0FBQjsYS6vO8YtH:GjwE/rqGraKW9uOe684pOZtPasYS6vd0
TLSH
T13EC633713FC59C1EFA48AD752B9A39A6E0C0CC08CA94F591987D5DE30B315F20B16BA6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/potass/Potassium.tunnel.exe

File Explorer

potass.zip

.zip 11.2MB
potass/Potassium.tunnel.exe

.exe 25.4MB
potass/README.txt

359B

potass.zip

SHA256 d8a1b88b0767cea7716140ab0557f08a71d747b9955b71890b04aafdbfd42125
MD5 1a0686ecc034f48ec1d658d150f9fbc4
SHA1 166c6981faada0eaca51786931af67c9fa1a0f5a
SHA512 4443d557a3fa2433a444c6eb3b7c8f9af6e0e2c916ad7bfdfe524c6c1ee9064a63c9d13ef380af5790ca7f16bafe765702ae4c0a338f3a548ab037da97e9bf22
SSDEEP 196608:nGbZ1k7x2ezvI/rV2f+ug0+raKW9uOe68Y/X/wIOtPtDdjj6D0FBQjsYS6vO8YtH:GjwE/rqGraKW9uOe684pOZtPasYS6vd0
TLSH
T13EC633713FC59C1EFA48AD752B9A39A6E0C0CC08CA94F591987D5DE30B315F20B16BA6
MD5 SHA1 SHA512 SSDEEP TLSH

potass/Potassium.tunnel.exe

IMPHASH ffd8d690d3a0715a9c460075f2435006
SHA256 8b0eb53ca98457dec118b0c9b0946eec96dd19dc6796d7bfb2774b0f4cb2097e
MD5 50d645cf733d1d85c2499673f855bdeb
SHA1 90bc2f85fe9cefd14ecbbfab3115bd93b78745af
SHA512 d7cad9049692533866352fe2a691e685d066a80aac94d12b6171839f6346e655e8e6f0671ac0b3c9a9959511ed60321cc09ae4f499fd23e54c424844e1183c33
SSDEEP 196608:JsqJtqlfcOnRXcd4pEBkvLSQxR5m0KJNTTH1/+30vVUkYHLHjL5HD:OlfznSd4pESvLSI9KfTXfYLHjNj
TLSH
T10B473A257B5A996CD05BC474838B4A729A7130CB0B35B9FF449492782F7EAF42F38358
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

15056528

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Potassium.pdb

bcryptprimitives

ProcessPrng

advapi32

RegCloseKey RegGetValueW RegQueryValueExW RegOpenKeyExW EventSetInformation EventRegister EventWriteTransfer EventUnregister SystemFunction036

ntdll

RtlGetVersion NtCreateNamedPipeFile NtWriteFile RtlNtStatusToDosError NtOpenFile NtDeviceIoControlFile NtCancelIoFileEx NtCreateFile NtReadFile

kernel32

LoadLibraryExA FormatMessageW LoadLibraryW HeapAlloc lstrlenW SetNamedPipeHandleState GetFullPathNameW CreateFileW GetCurrentThreadStackLimits FormatMessageA LoadLibraryA GetModuleFileNameA FreeLibrary VirtualProtect OpenMutexW CreateMutexW SetInformationJobObject CreateJobObjectW SetHandleInformation GetFileAttributesW OutputDebugStringA OutputDebugStringW GetModuleFileNameW GetProcessHeap ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW GetSystemTimeAsFileTime GetOverlappedResult PostQueuedCompletionStatus ReadFile WriteFile CancelIoEx CreateIoCompletionPort GetQueuedCompletionStatusEx LCIDToLocaleName GetUserDefaultUILanguage RtlPcToFileHeader GetFileInformationByHandle GetConsoleMode RaiseException FlsAlloc FlsGetValue FlsSetValue FlsFree EncodePointer HeapFree GetCurrentThreadId RtlUnwind GetProcessTimes TerminateProcess QueryPerformanceCounter QueryPerformanceFrequency RtlVirtualUnwind GetEnvironmentVariableW HeapReAlloc LoadLibraryExW WideCharToMultiByte WaitForSingleObjectEx GetCurrentProcessId CreateMutexA ReleaseMutex SetFilePointerEx SetFileInformationByHandle SetFileTime DuplicateHandle Process32NextW WaitForSingleObject AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread SetLastError GetCurrentDirectoryW GetEnvironmentStringsW GetCommandLineW Process32FirstW CreateToolhelp32Snapshot QueryFullProcessImageNameW OpenProcess CopyFileExW MoveFileExW CreateDirectoryW GetFinalPathNameByHandleW DeviceIoControl GetFileInformationByHandleEx AssignProcessToJobObject SwitchToThread CreateEventW DeleteFileW FindFirstFileExW FindClose SetEnvironmentVariableW InitializeSListHead GetTempPathW ExitProcess SetUnhandledExceptionFilter CancelIo RtlUnwindEx GetModuleHandleW MultiByteToWideChar WriteConsoleW GetStdHandle GetConsoleOutputCP CreateWaitableTimerExW SetWaitableTimer CreateThread WaitForMultipleObjects ReadFileEx SleepEx FreeEnvironmentStringsW CompareStringOrdinal GetSystemDirectoryW GetWindowsDirectoryW CreateProcessW WriteFileEx GetSystemTimePreciseAsFileTime GetSystemInfo GetExitCodeProcess RtlCaptureContext RtlLookupFunctionEntry FindNextFileW GetModuleHandleA Sleep GetProcAddress GetLastError CloseHandle InitializeCriticalSectionEx GetCurrentProcess SetFileCompletionNotificationModes DeleteCriticalSection

user32

RedrawWindow RegisterClassExW CreateWindowExW GetCursorPos ClientToScreen GetClientRect GetWindowLongW ScreenToClient MonitorFromWindow AdjustWindowRect GetMessageA DestroyWindow MonitorFromRect DrawTextW GetWindowDC OffsetRect GetMenuBarInfo DestroyMenu DrawIconEx CheckMenuItem GetMenuItemInfoW RemoveMenu CreatePopupMenu CreateMenu SetMenu SendMessageW SetMenuItemInfoW AppendMenuW InsertMenuW TrackPopupMenu DefWindowProcW CreateAcceleratorTableW DestroyAcceleratorTable VkKeyScanW CreateIcon GetAsyncKeyState GetKeyboardState MapVirtualKeyExW GetKeyboardLayout ToUnicodeEx GetKeyState GetRawInputData SetWindowTextW GetWindowTextW GetWindowTextLengthW SendInput SetForegroundWindow LoadImageW GetMonitorInfoW IsWindowVisible EnumDisplayMonitors MonitorFromPoint DestroyIcon GetMenu SystemParametersInfoA SetPropW SetWindowLongW EnableMenuItem GetSystemMenu ClipCursor GetClipCursor ShowCursor PostThreadMessageW RegisterRawInputDevices ReleaseCapture SetCapture MsgWaitForMultipleObjectsEx PostMessageW PeekMessageW RegisterWindowMessageA SetParent MapWindowPoints GetWindow SetFocus ShowWindow ReleaseDC IsProcessDPIAware GetDC EnableWindow IsWindowEnabled DispatchMessageW GetWindowRect SetWindowLongPtrW GetParent FindWindowExW SetWindowRgn GetSystemMetrics GetMessageW IsIconic EnumChildWindows GetWindowLongPtrW DispatchMessageA PostQuitMessage TranslateAcceleratorW TranslateMessage GetForegroundWindow SetWindowPos DrawMenuBar RegisterTouchWindow IsWindow AdjustWindowRectEx FlashWindowEx GetActiveWindow UpdateWindow InvalidateRect SetCursorPos SetWindowDisplayAffinity LoadCursorW InvalidateRgn GetWindowPlacement SetWindowPlacement ChangeDisplaySettingsExW GetUpdateRect MapVirtualKeyW ValidateRect SetCursor CloseTouchInputHandle GetTouchInputInfo TrackMouseEvent SystemParametersInfoW FillRect

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

comctl32

TaskDialogIndirect SetWindowSubclass DefSubclassProc RemoveWindowSubclass

ole32

CoCreateInstance RegisterDragDrop CoInitialize CoTaskMemFree CoUninitialize OleInitialize CoTaskMemAlloc CoInitializeEx CoCreateFreeThreadedMarshaler RevokeDragDrop

gdi32

SetBkMode CreateSolidBrush SetTextColor CombineRgn CreateDIBSection CreateRectRgn DeleteObject DeleteDC CreateCompatibleDC SelectObject BitBlt GetDeviceCaps

dwmapi

DwmSetWindowAttribute DwmEnableBlurBehindWindow DwmGetWindowAttribute

shlwapi

SHCreateMemStream

shell32

SHAppBarMessage ShellExecuteW DragFinish ILCreateFromPathW DragQueryFileW ILFree SHGetKnownFolderPath ShellExecuteExW SHOpenFolderAndSelectItems

oleaut32

GetErrorInfo SysFreeString SetErrorInfo SysStringLen

ws2_32

closesocket getsockname getsockopt getpeername accept recv WSASend send setsockopt ioctlsocket WSAIoctl WSASocketW bind listen shutdown freeaddrinfo WSAGetLastError getaddrinfo WSACleanup connect WSAStartup

bcrypt

BCryptGenRandom

api-ms-win-crt-math-l1-1-0

atan asin acos cos cosh exp fmod pow atan2 modf ldexp tan ceil roundf sqrtf _dsign sqrt log log2 round floor trunc log10 floorf ceilf _dclass sin frexp tanh sinh __setusermatherr

api-ms-win-crt-string-l1-1-0

isupper _wcsicmp wcslen wcscmp strspn strncmp islower isdigit strcpy_s tolower iscntrl strcmp strpbrk strcoll strncpy strncat strcspn isalpha toupper isxdigit isgraph isspace isprint strlen isalnum ispunct

api-ms-win-crt-heap-l1-1-0

_callnewh free malloc _set_new_mode calloc realloc _aligned_malloc _aligned_free

api-ms-win-crt-stdio-l1-1-0

fputs __p__commode fflush fgets fseek ftell _set_fmode __stdio_common_vfscanf tmpfile setvbuf fwrite tmpnam _popen clearerr __stdio_common_vfprintf ungetc getc freopen fread __stdio_common_vsprintf_s fopen ferror feof fclose __acrt_iob_func __stdio_common_vsprintf _pclose

api-ms-win-crt-runtime-l1-1-0

system _errno _wassert _seh_filter_exe _set_app_type _invoke_watson _configure_narrow_argv _initialize_narrow_environment _get_initial_narrow_environment _initterm abort terminate _crt_atexit _register_onexit_function _initialize_onexit_table _initterm_e exit strerror _exit _register_thread_local_exe_atexit_callback _c_exit _cexit __p___argv __p___argc

api-ms-win-crt-locale-l1-1-0

setlocale localeconv _configthreadlocale

api-ms-win-crt-convert-l1-1-0

_ultow_s atoi strtoll strtoull _wtoi strtod wcstol strtoul

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-time-l1-1-0

strftime _mktime64 _localtime64 _gmtime64 _time64 clock _difftime64 _localtime64_s _gmtime64_s

api-ms-win-crt-filesystem-l1-1-0

remove rename

api-ms-win-crt-utility-l1-1-0

rand srand

msvcp140

_Mtx_lock _Mtx_unlock ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z ?_Throw_Cpp_error@std@@YAXH@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?_Xlength_error@std@@YAXPEBD@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?_Xbad_function_call@std@@YAXXZ ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?__ExceptionPtrCreate@@YAXPEAX@Z ?uncaught_exception@std@@YA_NXZ ?__ExceptionPtrDestroy@@YAXPEAX@Z _Query_perf_frequency _Query_perf_counter ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?_Xout_of_range@std@@YAXPEBD@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?__ExceptionPtrRethrow@@YAXPEBX@Z ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?__ExceptionPtrCopy@@YAXPEAXPEBX@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?__ExceptionPtrToBool@@YA_NPEBX@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z