vexor-updater[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
vexor-updater.exe
Size 3.0MB
Sample261009-tx63bahs6p
SHA256 8178bf87091e32bbce49bdb73c49dd87fd9faf7cee9ee78c23efcf2c919724f3
MD5 6c37bee4f46d3a8c40b4ee66664abdde
SHA1 e434b8a39894d97adca5f2e318c02433e53599c6
SHA512 b2aaa8bbed01cd1fe789082f1ffb0a633c79a026ad7658e9a71c9a776592ad4a5e5de46c15e385be2b5f0eeb0ad3828bd093f9401be5184c437bf5e7794b4a8b
SSDEEP 49152:1LiScUkNMeAuSBriDtn8C2FPoWPaD2Q6I3jWASp:1e4BR+AgDo
TLSH
T117E5CF03B3A3C5A9C1175539C715EB2BA72278010322CBDFA7842E95EE435E46FBB794
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
vexor-updater.exe

File Explorer

vexor-updater.exe

.exe 3.0MB

vexor-updater.exe

IMPHASH 1d86bd3d2b096833b3e3f4706882b453
SHA256 8178bf87091e32bbce49bdb73c49dd87fd9faf7cee9ee78c23efcf2c919724f3
MD5 6c37bee4f46d3a8c40b4ee66664abdde
SHA1 e434b8a39894d97adca5f2e318c02433e53599c6
SHA512 b2aaa8bbed01cd1fe789082f1ffb0a633c79a026ad7658e9a71c9a776592ad4a5e5de46c15e385be2b5f0eeb0ad3828bd093f9401be5184c437bf5e7794b4a8b
SSDEEP 49152:1LiScUkNMeAuSBriDtn8C2FPoWPaD2Q6I3jWASp:1e4BR+AgDo
TLSH
T117E5CF03B3A3C5A9C1175539C715EB2BA72278010322CBDFA7842E95EE435E46FBB794
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

868192

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_47

D3DCompile

d3dx11_43

D3DX11CreateShaderResourceViewFromMemory

dwmapi

DwmExtendFrameIntoClientArea

winhttp

WinHttpSendRequest WinHttpQueryHeaders WinHttpConnect WinHttpQueryDataAvailable WinHttpCloseHandle WinHttpSetOption WinHttpOpenRequest WinHttpReadData WinHttpReceiveResponse WinHttpAddRequestHeaders WinHttpOpen

shell32

ShellExecuteA SHGetFolderPathW

ole32

CoUninitialize CoInitializeEx CoCreateInstance

kernel32

GetLocaleInfoA MultiByteToWideChar LoadLibraryA QueryPerformanceFrequency GetProcAddress FreeLibrary QueryPerformanceCounter GlobalAlloc GlobalFree GlobalLock WideCharToMultiByte GlobalUnlock SizeofResource GetCommandLineW GetEnvironmentVariableW Sleep LockResource LoadResource FindResourceW GetModuleHandleW CreateDirectoryW ReadFile GetVolumeInformationW WriteFile GetTempPathW CreateFileW GetLastError CloseHandle LoadLibraryW GetComputerNameW HeapFree HeapAlloc GetProcessHeap GetFileAttributesW DeleteFileW MoveFileExW GetFileSizeEx LocalFree FindFirstFileW SetHandleInformation FindNextFileW GetStdHandle OutputDebugStringA TerminateProcess GetModuleFileNameW SetEnvironmentVariableW CreatePipe PeekNamedPipe FindClose WaitForSingleObject OpenProcess CreateToolhelp32Snapshot Process32NextW Process32FirstW GetStartupInfoW CreateProcessW QueryFullProcessImageNameW GetFileType GetTickCount GetExitCodeProcess SetLastError GetCurrentProcess GetCurrentThread K32GetModuleBaseNameA GetThreadContext K32EnumProcessModules IsDebuggerPresent CheckRemoteDebuggerPresent CreateFileA MapViewOfFile UnmapViewOfFile CreateFileMappingA InitOnceComplete GetTickCount64 UnhandledExceptionFilter SetUnhandledExceptionFilter FlushFileBuffers InitOnceBeginInitialize ReleaseSRWLockExclusive AcquireSRWLockExclusive InitializeSListHead GetSystemTimeAsFileTime SleepConditionVariableSRW GetCurrentThreadId WakeAllConditionVariable RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsProcessorFeaturePresent GetCurrentProcessId

user32

EnumWindows DefWindowProcW DestroyWindow CreateWindowExW GetSystemMetrics UnregisterClassW RegisterClassExW ShowWindow DispatchMessageW PeekMessageW SetLayeredWindowAttributes TranslateMessage PostQuitMessage UpdateWindow OpenClipboard CloseClipboard EmptyClipboard GetClipboardData SetClipboardData GetKeyState GetWindowLongW IsWindowVisible ScreenToClient GetCapture ClientToScreen TrackMouseEvent GetKeyboardLayout GetForegroundWindow LoadCursorW SetCapture SetCursor GetClientRect IsWindowUnicode ReleaseCapture SetCursorPos GetCursorPos GetWindowTextW SendMessageW MessageBoxA CharLowerBuffA MoveWindow IsWindow GetWindowThreadProcessId GetMessageExtraInfo GetWindowRect

advapi32

CryptAcquireContextW CredWriteW CryptReleaseContext RegQueryValueExW CredReadW CredFree CredDeleteW RegCloseKey RegOpenKeyExW CryptGenRandom CryptCreateHash CryptGetHashParam CryptDestroyHash CryptHashData

msvcp140

?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Id_cnt@id@locale@std@@0HA ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ??0_Lockit@std@@QEAA@H@Z ??1_Lockit@std@@QEAA@XZ _Query_perf_frequency ?_Xout_of_range@std@@YAXPEBD@Z ?_Xbad_alloc@std@@YAXXZ _Mtx_unlock _Thrd_detach _Cnd_do_broadcast_at_thread_exit _Mtx_lock ?_Throw_Cpp_error@std@@YAXH@Z ?good@ios_base@std@@QEBA_NXZ ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ _Query_perf_counter ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?always_noconv@codecvt_base@std@@QEBA_NXZ _Thrd_id _Thrd_join ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?uncaught_exceptions@std@@YAHXZ ?_Xlength_error@std@@YAXPEBD@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ

imm32

ImmSetCompositionWindow ImmReleaseContext ImmGetContext ImmSetCandidateWindow

dnsapi

DnsFree DnsQuery_W

bcrypt

BCryptGetProperty BCryptCreateHash BCryptHashData BCryptDestroyHash BCryptCloseAlgorithmProvider BCryptFinishHash BCryptOpenAlgorithmProvider

rpcrt4

UuidCreate RpcStringFreeA UuidToStringA

crypt32

CryptProtectData CryptUnprotectData

vcruntime140_1

__CxxFrameHandler4

vcruntime140

_CxxThrowException __intrinsic_setjmp __C_specific_handler __current_exception_context __current_exception memcmp memchr memset memmove __std_terminate memcpy longjmp strrchr wcsstr __std_exception_destroy __std_exception_copy strstr

api-ms-win-crt-runtime-l1-1-0

_invoke_watson _exit exit _initterm_e _initterm abort terminate _get_narrow_winmain_command_line _set_app_type _beginthreadex _seh_filter_exe _cexit _crt_atexit _register_onexit_function _c_exit _initialize_onexit_table _initialize_narrow_environment _configure_narrow_argv _register_thread_local_exe_atexit_callback

api-ms-win-crt-string-l1-1-0

strncmp strcmp strncpy strncpy_s wcscpy_s _stricmp _strnicmp isxdigit towlower isdigit tolower

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsprintf __stdio_common_vsscanf __stdio_common_vfprintf fseek fclose fflush _get_stream_buffer_pointers _fseeki64 __acrt_iob_func fsetpos ungetc setvbuf _wfopen fgetpos fputc ftell fgetc __stdio_common_vsprintf_s _set_fmode __stdio_common_vswprintf_s fread fwrite __p__commode

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-heap-l1-1-0

malloc free _set_new_mode _callnewh

api-ms-win-crt-convert-l1-1-0

strtol strtoull

api-ms-win-crt-filesystem-l1-1-0

_unlock_file _lock_file

api-ms-win-crt-time-l1-1-0

_time64 _localtime64_s

api-ms-win-crt-math-l1-1-0

sinf fmodf cosf ceilf __setusermatherr powf acosf sqrtf

api-ms-win-crt-locale-l1-1-0

_configthreadlocale