c2looper | wtsapi32[.]dll

General

Target
wtsapi32.dll
Size 235KB
Sample261026-ht8aesdx9m
SHA256 f96ff2f3abbff7f382ace509b90e54853b4b61c402ecde27d82f1c17b414867b
MD5 640879cfd692da0d6b36cb85f2190171
SHA1 e13573768143f2d14066da93250b90ebdb34d9ca
SHA512 2bb0bc8209f89782a034f4aeb68a5b34712db16a89e105c2986175c85c2756f627cddb15f368b4f4b921a1ec458fedffd773467198c63610ec9cb581fa423495
SSDEEP 6144:k9IuxplW4f7mQUgG0GaFjA1VJ6vqX6Is:k9IClW4ScdGzVJ6vgrs
TLSH
T1B7346C06F2A658B9F85BC07DC6538676A7B67C444731EAFF07A406356F2B7C06A38B10
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor trojan loader c2looper

Malware Config

Extracted

Family

c2looper

Attributes

github_token
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
host
api.github.com
owner
adioziaete
repo
memio

Signatures

Family: C2Looper
C2Looper is a Windows backdoor written in Rust.
backdoor trojan loader c2looper

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
wtsapi32.dll

File Explorer

wtsapi32.dll

.dll 235KB

wtsapi32.dll

IMPHASH 63184acd304ea176ff7d0fb5b58dab56
SHA256 f96ff2f3abbff7f382ace509b90e54853b4b61c402ecde27d82f1c17b414867b
MD5 640879cfd692da0d6b36cb85f2190171
SHA1 e13573768143f2d14066da93250b90ebdb34d9ca
SHA512 2bb0bc8209f89782a034f4aeb68a5b34712db16a89e105c2986175c85c2756f627cddb15f368b4f4b921a1ec458fedffd773467198c63610ec9cb581fa423495
SSDEEP 6144:k9IuxplW4f7mQUgG0GaFjA1VJ6vqX6Is:k9IClW4ScdGzVJ6vgrs
TLSH
T1B7346C06F2A658B9F85BC07DC6538676A7B67C444731EAFF07A406356F2B7C06A38B10
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

96996

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

wtsapi32.pdb

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WakeByAddressAll WaitOnAddress

kernel32

LoadLibraryW GetProcessHeap HeapFree GetProcAddress HeapReAlloc GetModuleHandleW CreatePipe SetHandleInformation CreateProcessW WaitForSingleObject GetCurrentThreadId GetLastError SetLastError GetEnvironmentVariableW GetCurrentDirectoryW RtlCaptureContext GetCurrentProcess RtlLookupFunctionEntry WaitForSingleObjectEx LoadLibraryA lstrlenW GetCurrentProcessId CreateMutexA CloseHandle ReleaseMutex RtlVirtualUnwind WideCharToMultiByte GetStdHandle GetConsoleMode GetConsoleOutputCP CreateFileW MultiByteToWideChar WriteConsoleW HeapAlloc QueryPerformanceCounter GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent RtlUnwindEx InterlockedFlushSList EncodePointer RaiseException EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW RtlPcToFileHeader ExitProcess TerminateProcess GetModuleHandleExW GetModuleFileNameW FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeCriticalSectionEx VirtualProtect LCMapStringW GetFileType GetStringTypeW HeapSize SetStdHandle FlushFileBuffers WriteFile SetFilePointerEx

ntdll

NtWriteFile RtlNtStatusToDosError

Name

.text

Size

160KB

Virtual Size

159KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

61KB

Virtual Size

61KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Extracted

Signatures

File Explorer

wtsapi32.dll

api-ms-win-core-synch-l1-2-0

kernel32

ntdll

generic