18b46e3cc797915adea96ea362982b100dc0bedbc094d806c07a9ff6af9f13fe
- SHA256 18b46e3cc797915adea96ea362982b100dc0bedbc094d806c07a9ff6af9f13fe
Behavioral task
behavioral1
Sample
KMS/HEU_KMS_Activator_v64.0.0.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
KMS/HEU_KMS_Activator_v64.0.0.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
Behavioral task
behavioral3
Sample
KMS/当前目录添加到WD白名单.cmd
Resource
win10v2004-20260911-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral4
Sample
KMS/当前目录添加到WD白名单.cmd
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
Behavioral task
behavioral5
Sample
KMS/当前目录移除WD白名单.cmd
Resource
win10v2004-20260911-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral6
Sample
KMS/当前目录移除WD白名单.cmd
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
General
- Target 18b46e3cc797915adea96ea362982b100dc0bedbc094d806c07a9ff6af9f13fe
- Size 4.8MB
- Sample261002-d4tgss1fkc
- SHA256 18b46e3cc797915adea96ea362982b100dc0bedbc094d806c07a9ff6af9f13fe
- MD5 740a8bd01368437b24187ffd8e9dfc74
- SHA1 08f0271e6db38fb89293c4116aba731a88a6a34d
- SHA512 159f03c37e9815edf057230e2391b4ee3b369aae24b7e4cf04fa056f4957f4897cfeb0e68fc94d850f0b7780ad010c3ab327d0ba623c8b8c1044862b13e63522
- SSDEEP 98304:2cY8VK69PsPEfnwZwB5CkzfGJHJ8WKYMWXV3iH7WK2t+8A6Gon1ZRf:BJJIEf085CkbG0WKYMWXPtk7on1ZR
- TLSH T12236332F670169C086096478B538FF4E6161C7C8724DBCE98CA4AA253EAD371463EDFD
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule static1/unpack002/out.upx autoit_exe -
resource yara_rule static1/unpack001/KMS/HEU_KMS_Activator_v64.0.0.exe upx - Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/KMS/HEU_KMS_Activator_v64.0.0.exe unpack002/out.upx
File Explorer
-
18b46e3cc797915adea96ea362982b100dc0bedbc094d806c07a9ff6af9f13fe.zip 4.8MB
-
KMS/HEU_KMS_Activator_v64.0.0.exe.exe 4.5MB
-
out.upx.exe 5.0MB
-
KMS/当前目录添加到WD白名单.cmd416B
-
KMS/当前目录移除WD白名单.cmd422B
-
KMS/更新地址：微信公众号.jpg.jpg 628KB
-
KMS/更新日志.txt41KB
KMS/HEU_KMS_Activator_v64.0.0.exe
- SHA256 6ad72af453a9c4db99a30317e97689e893a110681e84655392865c8a813e8a5c
- MD5 d02212c7fb76461347686d99cfbd25c6
- SHA1 912e34145e5822e6dbc98eac55b2a1b80f7ea305
- SHA512 5b65a3f929ef593bc957da360d8b9b15ee825bdb1b407e19a3980936ef460a2860e4afbadd10ba7870f2231cd0ec0bbfe95388416afa1ba50d4f3312ea764015
- SSDEEP 98304:G+S9bgH9IDIZzMxqJ5w2zbArLVuoeWgunT3IlhCA6l+keOq8:9Mcd8IRGi5w2nAQoeWgun7luP8
- TLSH T1692633D6B20FE90CC890E7B4611D9E4AD653FB89560F72AE7FA07A693D1434006CC9E7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
5262672
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
UPX0
Size
Virtual Size
4.7MB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
372KB
Virtual Size
372KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4.1MB
Virtual Size
4.1MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=35, id=241, version=40116,
count=157, id=243, version=40116,
count=35, id=242, version=40116,
count=1, id=199, version=41118,
count=45, id=261, version=26706,
count=18, id=260, version=26706,
count=21, id=259, version=26706,
count=9, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=37, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=553, id=1, productName=Unmarked objects,
count=80, id=270, version=27045,
count=1, id=259, version=27045,
count=1, id=255, version=27045,
count=1, id=151,
count=1, id=258, version=27045,
out.upx
- SHA256 2764bcf2ad0a82bd037dab34ae37b65f7eef52499abcb4a6be1707586da1a990
- MD5 3366908173f8239affc20a11e8cbd63a
- SHA1 024f17c4e4d7cd1b2d7d2e88359b4be936b8bd55
- SHA512 97458d9a9b3314086887bf375ccb76775a4d2309c2aaa7d480c182100186e682fea583cfcf1e03e85156df7434b51c5063444b027808f8149e615c413d0d4908
- SSDEEP 98304:GjTQYxsW5qIDIZzMxqJ5w2zbArLVuoeWgunT3IlhCA6l+keOq8:G3dxf08IRGi5w2nAQoeWgun7luP8
- TLSH T14B3623427342D02AFF97D3724B0AEE0697796B560117B62F27A81D39BE70370067D6A3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
AutoIT Executable
AutoIT scripts compiled to PE executables.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
132471
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
.text
Size
619KB
Virtual Size
618KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
191KB
Virtual Size
190KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
18KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4.1MB
Virtual Size
4.1MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
29KB
Virtual Size
29KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=35, id=241, version=40116,
count=157, id=243, version=40116,
count=35, id=242, version=40116,
count=1, id=199, version=41118,
count=45, id=261, version=26706,
count=18, id=260, version=26706,
count=21, id=259, version=26706,
count=9, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=37, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=553, id=1, productName=Unmarked objects,
count=80, id=270, version=27045,
count=1, id=259, version=27045,
count=1, id=255, version=27045,
count=1, id=151,
count=1, id=258, version=27045,
KMS/当前目录添加到WD白名单.cmd
- SHA256 f9e65a39bfcb45fa75a3fcce4c421a33ddd726dbf5a300ada0623f1ee3fcded2
- MD5 0c629d146aeff1670273d4ffa0c6b01b
- SHA1 45933d928fde7041f7dcdec38e7bb177ec9dc0ac
- SHA512 b3d77dc80f7861f19bae99cf0cff269e906d27302b7383705ff9ea89dc4faa65ab563500aa9b7e3849b37c627e07a9cf3855d235ce88fae300d41155f34a6f6a
- TLSH T116E0EC6240EA445F663673608E5D61553C1FD1BB0A599DC36630C4607904988F1EBE5B
- MD5 SHA1 SHA512 TLSH
KMS/当前目录移除WD白名单.cmd
- SHA256 608896bbc173dda3037eefca287ad6de2b032c14423b01d06135632c54037995
- MD5 550eb7300f60e7b2746c1c33aa2dc3a5
- SHA1 00f442cd25aae45a8d0097d983c7922fc5c5417e
- SHA512 927a36d33812d0100b4bed427f6899b41928e0e98acd19c3634db81df14469bd0056b7e18d2e42aa910aabca4111ac86bad60998bdb94909fe3978729e13f8b2
- TLSH T113E05C2200EA441E673632608E1E25552C0FC1BB4A5DADC32630C4607904988F1EBE1B
- MD5 SHA1 SHA512 TLSH
KMS/更新地址：微信公众号.jpg
- SHA256 36483cea085373955d9c504faf8d0a608a4109760a7bcc36fc38887c8c45ddec
- MD5 123a56f34eee911cf7947e67082643a5
- SHA1 29b31beb20aab73b4c77c34f0d50a939153b4843
- SHA512 588fd2251a9dd56195a7f8231b7cb270c3a11de2a8fe93f5ecd8ca80a8407a92420d9b08b30706354e90117dbed0a4cbbe197d239c7c8fee16e5a16d59243c41
- SSDEEP 12288:2PmmG7QG1DpDp8Ykz94nFxXB/mq6w0W1CCDIxQ:DXx+Yk4ki7BMxQ
- TLSH T137D4CAA68DB07F56BD561D1863A06FBA104D282F5BE9020CB85DCF8B7183DDA70DF846
- MD5 SHA1 SHA512 SSDEEP TLSH
Extracted URLs
-
qr http://weixin.qq.com/r/FBMFHavEvvbBre9_90YG
-
qr http://weixin.qq.com/r/XUx3b67EqPPXreoM9xlP
KMS/更新日志.txt
- SHA256 2ab146e4aedc502629b4c9cb0b47ab5d09310481001bd21f58213f9bd3d620cc
- MD5 de551fc6ce06d405be2e1bf9e80d25e8
- SHA1 7a3c1b029741dca01d6dac9c25c3f246ffda5ac0
- SHA512 5b7739934a59b27c7051d168c14bdd046cae9660bb5ee3d79523f27992a309d1d7cae295a6edb9f1b257512eae523c11ee582191bb7c117f88a7583250cb86fc
- SSDEEP 768:uWw5o5yGjfqNYpwBErFeotR2Ck5CTi3Sh:uWws5fuE+C5m3Sh
- TLSH T1EA13D627B52F0417F336627A83164582CA7580D1866BCEE2B06DB8F44FB324927EF95D
- MD5 SHA1 SHA512 SSDEEP TLSH