mbupload-6aelcr8x.bin.zip
- SHA256 d5c4c4ecab03603e1c511fa956b39fa070b8d793aeda7028b6aaa5c120add4ad
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Application.cmd
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
Application.cmd
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral3
Sample
loader.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
loader.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral5
Sample
lua51.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
lua51.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral7
Sample
sdx.js
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral8
Sample
sdx.js
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
General
- Target mbupload-6aelcr8x.bin.zip
- Size 451KB
- Sample261021-rdl7padt41
- SHA256 d5c4c4ecab03603e1c511fa956b39fa070b8d793aeda7028b6aaa5c120add4ad
- MD5 86379e190e9f28ce867f501e8a6ac9f2
- SHA1 374e4eecc0aa1a098d67b573dd497ad56b724b28
- SHA512 f66ea09f5ce4e60c1aec1da02a7f4c2bda647efe99c7fa679be2da22f0e8e0125d4323e23d7f44ff0c2ed4a2cbd21780cebf0666ba580036fc185a74d18c76f0
- SSDEEP 12288:/zYfcEaN9B/Jm0LU0gM7aQEYyvZJHJmW3:8fclN9BhmSHe5vZJHgW3
- TLSH T166A4232CADE106503D67BF403D8D5F024A34A05BB6F9EAA6251F3F888CEFC6C156964D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/loader.exe unpack001/lua51.dll
File Explorer
-
mbupload-6aelcr8x.bin.zip.zip 451KB
-
Application.cmd24B
-
loader.exe.exe 31KB
-
lua51.dll.dll 587KB
-
sdx.o.js 293KB
Application.cmd
- SHA256 305729e83fa3aaf806c72e3b656a7114748a1a75d7e391fb9529eb824c1923fb
- MD5 f45aee771c5a0f9976d9fa2ee54d53d4
- SHA1 ce10a7578124a414ed2adb1d606449b6f703aea7
- SHA512 6b2a07dc33c4ee728af7ddfebaa0b8265aa9dc375d7f4ef8cc876eda2d5a4a84eb5e12c7ae708fbc0ddee59bc5ca655df2b80d59ed09451c6c902365e72ed67c
- MD5 SHA1 SHA512
loader.exe
- IMPHASH 5bbfcbabfc013bccac23927b24324ffd
- SHA256 7ad4b911d05a12f91ab27ba3baa351a56653ca099dda7ad87ee2b94f8cd018c9
- MD5 c2a7f19ba96dc460d591d37d664fe6aa
- SHA1 2e930eb7072ac6f8906c5df11e041d88aaea1fcd
- SHA512 baf23c903b68e13786657cf1bcfc6db55493988eac28edc3caaee1011f65ff04eebef9e204853a3abf07d4a36ad7ef5bb8a3683863fac600b49590d7376624ad
- SSDEEP 384:ib7da2Z2gMMu7VGueXHa2RIC23208fKUS5CWhYJ8L:Wa2JLuZ/eXaIO3r8iuWhYyL
- TLSH T138E2C62DB68258DEC591D27CA0D60731F079BD56172766BE1308F23A7E21AA1CB3F427
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
5184
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
kernel32
DeleteCriticalSection
EnterCriticalSection
GetCurrentProcess
GetFileInformationByHandleEx
GetFileType
GetLastError
GetModuleHandleA
GetProcAddress
InitializeCriticalSection
IsProcessorFeaturePresent
LeaveCriticalSection
LoadLibraryW
SetUnhandledExceptionFilter
Sleep
TerminateProcess
TlsGetValue
VirtualProtect
VirtualQuery
msvcrt
__C_specific_handler
__getmainargs
__initenv
__iob_func
__set_app_type
__setusermatherr
_amsg_exit
_cexit
_commode
_fileno
_fmode
_get_osfhandle
_initterm
_isatty
_write
atexit
abort
calloc
exit
fflush
fgets
fprintf
fputc
fputs
free
fwrite
getenv
isxdigit
malloc
memcpy
putc
setvbuf
signal
strchr
strlen
strncmp
strstr
vfprintf
wcsncmp
lua51
luaJIT_version_2_1_1774896198
luaL_callmeta
luaL_loadbuffer
luaL_loadfile
luaL_newstate
luaL_openlibs
luaL_traceback
luaL_where
lua_call
lua_close
lua_concat
lua_cpcall
lua_createtable
lua_error
lua_gc
lua_getfield
lua_gettable
lua_gettop
lua_insert
lua_isstring
lua_objlen
lua_pcall
lua_pushboolean
lua_pushcclosure
lua_pushfstring
lua_pushlstring
lua_pushnil
lua_pushstring
lua_pushvalue
lua_rawgeti
lua_rawseti
lua_remove
lua_setfield
lua_sethook
lua_settop
lua_toboolean
lua_tolstring
lua_type
Name
.text
Size
13KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
224B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.pdata
Size
1024B
Virtual Size
816B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.xdata
Size
1024B
Virtual Size
652B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.tls
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
124B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
lua51.dll
- IMPHASH c408ea58a5c6242773f6d306db52755d
- SHA256 04d3c82782927330d56827ff551697666dbab4b3abf5b86bde492efdd142bc58
- MD5 82e81158366a953c33d0720dfe34b95b
- SHA1 4b5eee1d2ba5bf3ca0389c0415626634c640a4bd
- SHA512 3c9f7360bafc48d573d24fe1612e23a97fe08944c9ad5f5d46818d5e74365d00d7e5aeee63391d4c0de7390b5fecaa695b698fd62ccc741dec181f0d24ee82af
- SSDEEP 12288:Psx+0xTI82jcKvyp9jvgEXXBKHKLx2h601BqStQIF3yB:OrmyXMKF2hXBtQIF3yB
- TLSH T173D4160BA6B362BCC267C134879B8BB1B931BC5402346DBF55A0E7311E71E91179FA39
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4592
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL
PDB paths
kernel32
CreateThread
DeleteCriticalSection
EnterCriticalSection
FormatMessageA
FreeLibrary
GetCPInfo
GetCurrentProcess
GetLastError
GetModuleFileNameA
GetModuleHandleA
GetModuleHandleExA
GetProcAddress
GetTempPathA
InitializeCriticalSection
IsProcessorFeaturePresent
LeaveCriticalSection
LoadLibraryExA
LoadLibraryW
MultiByteToWideChar
RaiseException
RtlCaptureContext
RtlLookupFunctionEntry
RtlRestoreContext
RtlUnwindEx
RtlVirtualUnwind
SetLastError
Sleep
TerminateProcess
TlsGetValue
VirtualAlloc
VirtualFree
VirtualProtect
VirtualQuery
WaitForSingleObject
msvcrt
__DestructExceptionObject
___lc_codepage_func
___mb_cur_max_func
__iob_func
__setusermatherr
_amsg_exit
_close
_errno
_fdopen
_filelengthi64
_fileno
_fmode
_gmtime64
_initterm
_localtime64
_lock
_mktime64
_open
_pclose
_popen
_strtoi64
_strtoui64
_time64
_strdup
_unlock
_write
abort
acos
asin
atan
calloc
clearerr
clock
cosh
difftime
exit
fclose
feof
ferror
fflush
fgetpos
fgets
fopen
fprintf
fputc
fputs
free
fread
fsetpos
fwrite
getc
getenv
isdigit
isspace
isxdigit
localeconv
log10
malloc
memchr
memcmp
memcpy
memmove
memset
putchar
realloc
remove
rename
setlocale
setvbuf
sinh
strchr
strcmp
strcpy
strerror
strftime
strlen
strncmp
strncpy
strrchr
strstr
strtol
strtoul
system
tan
tanh
tmpnam
tolower
ungetc
vfprintf
luaJIT_profile_dumpstack
luaJIT_profile_start
luaJIT_profile_stop
luaJIT_setmode
luaJIT_version_2_1_1774896198
luaL_addlstring
luaL_addstring
luaL_addvalue
luaL_argerror
luaL_buffinit
luaL_callmeta
luaL_checkany
luaL_checkinteger
luaL_checklstring
luaL_checknumber
luaL_checkoption
luaL_checkstack
luaL_checktype
luaL_checkudata
luaL_error
luaL_execresult
luaL_fileresult
luaL_findtable
luaL_getmetafield
luaL_gsub
luaL_loadbuffer
luaL_loadbufferx
luaL_loadfile
luaL_loadfilex
luaL_loadstring
luaL_newmetatable
luaL_newstate
luaL_openlib
luaL_openlibs
luaL_optinteger
luaL_optlstring
luaL_optnumber
luaL_prepbuffer
luaL_pushmodule
luaL_pushresult
luaL_ref
luaL_register
luaL_setfuncs
luaL_setmetatable
luaL_testudata
luaL_traceback
luaL_typerror
luaL_unref
luaL_where
lua_atpanic
lua_call
lua_checkstack
lua_close
lua_concat
lua_copy
lua_cpcall
lua_createtable
lua_dump
lua_equal
lua_error
lua_gc
lua_getallocf
lua_getfenv
lua_getfield
lua_gethook
lua_gethookcount
lua_gethookmask
lua_getinfo
lua_getlocal
lua_getmetatable
lua_getstack
lua_gettable
lua_gettop
lua_getupvalue
lua_insert
lua_iscfunction
lua_isnumber
lua_isstring
lua_isuserdata
lua_isyieldable
lua_lessthan
lua_load
lua_loadx
lua_newstate
lua_newthread
lua_newuserdata
lua_next
lua_objlen
lua_pcall
lua_pushboolean
lua_pushcclosure
lua_pushfstring
lua_pushinteger
lua_pushlightuserdata
lua_pushlstring
lua_pushnil
lua_pushnumber
lua_pushstring
lua_pushthread
lua_pushvalue
lua_pushvfstring
lua_rawequal
lua_rawget
lua_rawgeti
lua_rawset
lua_rawseti
lua_remove
lua_replace
lua_resume
lua_setallocf
lua_setfenv
lua_setfield
lua_sethook
lua_setlocal
lua_setmetatable
lua_settable
lua_settop
lua_setupvalue
lua_status
lua_toboolean
lua_tocfunction
lua_tointeger
lua_tointegerx
lua_tolstring
lua_tonumber
lua_tonumberx
lua_topointer
lua_tothread
lua_touserdata
lua_type
lua_typename
lua_upvalueid
lua_upvaluejoin
lua_version
lua_xmove
lua_yield
luaopen_base
luaopen_bit
luaopen_debug
luaopen_ffi
luaopen_io
luaopen_jit
luaopen_math
luaopen_os
luaopen_package
luaopen_string
luaopen_string_buffer
luaopen_table
Name
.text
Size
496KB
Virtual Size
496KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
800B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
42KB
Virtual Size
41KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.pdata
Size
16KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.xdata
Size
15KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.edata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.tls
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
sdx.o
- SHA256 4c1ec56cc133765e635378a240e1a407d86898b325c05370634c6501938fecea
- MD5 e2ff43c4d1dd476401313f92012e83c6
- SHA1 214b3d3c56b8434ac6579840a4327f1d4d22571d
- SHA512 820df12653fc80393278b4d1a5041eac288d8552523a8c7c2d23b1df3c6b7b63040258662d0877003640b87a30a9219bd7144a988d8b54a8231e05c5139e279c
- SSDEEP 3072:ZKJ2q9pI/ySnGerWJzzousbmV6iHyQ8tPBIFPG4ayoBjw2rj45unPxvaSlFh8s7a:s/kgJzhvNJKBie4aHVj45uVLqU9Y
- TLSH T1EB54F8D0218810E5EAEB859DDC6A8EA761B724F18B07168BCF1CF4B837542E1DECDC56
- MD5 SHA1 SHA512 SSDEEP TLSH