8872fb1ebfc410679e4dd29acb5ce61b6889a834166d92186c87b1331078dfea
- SHA256 8872fb1ebfc410679e4dd29acb5ce61b6889a834166d92186c87b1331078dfea
Behavioral task
behavioral1
Sample
HOT WHEELS UNLEASHED v1.0 Plus 10 Trainer.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
HOT WHEELS UNLEASHED v1.0 Plus 10 Trainer.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral3
Sample
Ƿվ__ҳ.url
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
Ƿվ__ҳ.url
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral5
Sample
ذ.url
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
ذ.url
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
General
- Target 8872fb1ebfc410679e4dd29acb5ce61b6889a834166d92186c87b1331078dfea
- Size 762KB
- Sample261030-d3grlsat5k
- SHA256 8872fb1ebfc410679e4dd29acb5ce61b6889a834166d92186c87b1331078dfea
- MD5 64f995f69ffa89eda20464c2261ff797
- SHA1 16c90b24c0cb4b07696f6b51185518fff3079ead
- SHA512 fa53c41d92e8401021430df99ba74214ba06812fb501e5c7c448c5cf4ba51afa611bb744eb56a023dd088dc5f71149f8eebba63f9b0d72cff6208132f4aa5276
- SSDEEP 12288:/QOZcgPDBaSE73W35SZi5EBqr6At8ng+I2z4N1hapXT6WX88Ikvoc6WQ:IOZHP9oTWp5EBe6At882U0j62FBvoHl
- TLSH T1C2F423F0B9D4D8CED153FA4EB126D595B6034B22738A687B9370B0B58D252CFAE40397
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- r77 rootkit payload 1 IoCs
Detects the payload of the r77 rootkit.
resource yara_rule static1/unpack001/HOT WHEELS UNLEASHED v1.0 Plus 10 Trainer.exe r77_payload - Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/HOT WHEELS UNLEASHED v1.0 Plus 10 Trainer.exe
File Explorer
-
8872fb1ebfc410679e4dd29acb5ce61b6889a834166d92186c87b1331078dfea.zip 762KB
-
HOT WHEELS UNLEASHED v1.0 Plus 10 Trainer.exe.exe 1.2MB
-
װʹ˵.txt1KB
-
Ƿվ__ҳ.url48B
-
ذ.url57B
HOT WHEELS UNLEASHED v1.0 Plus 10 Trainer.exe
- IMPHASH 02abf7189f5ed7c76c0812186bb0e6f0
- SHA256 115124b9aa3a6dda14a267f6babf37a736daff1eada3038cb7cd75a1f5222b41
- MD5 a879af8c3da13ac1783d456ef7705195
- SHA1 93140a742608d19980988292fe4ab03d86400ef1
- SHA512 4ccc5eb0627acb390807ff8bcb71a4385a6a9b86e68132c3e47cf65d9b3f6527d68e1a8e2253751af74b708988be7c3aa5517d5921a27900940e61129a092f54
- SSDEEP 24576:wtmDYBZN+Ik/KMjhM08guNOjURbDS5nsFbJ7:wtmkBZNjkymxONOjUSIV7
- TLSH T1F845BE5663A504F9E467D13CCA538906E7B278160B31D7DF13A4876A3F237E19E3AB20
- MD5 SHA1 SHA512 SSDEEP TLSH
-
r77 rootkit payload
Detects the payload of the r77 rootkit.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
167832
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
kernel32
GetCurrentProcessId
LoadLibraryW
GetProcAddress
WaitNamedPipeW
GetLastError
CreateFileW
ReadFile
WriteFile
GetModuleHandleA
LoadLibraryA
GetPrivateProfileStringW
WritePrivateProfileStringW
GetModuleHandleW
FindResourceW
LoadResource
SizeofResource
LockResource
Sleep
GetModuleFileNameW
LoadLibraryExW
FreeLibrary
MultiByteToWideChar
GetCurrentProcess
IsWow64Process
SetLastError
ResumeThread
WaitForSingleObject
LocalFree
GetTempPathW
CreateDirectoryW
WriteConsoleW
HeapSize
MapViewOfFile
CreateFileMappingW
UnmapViewOfFile
GetFileAttributesW
CloseHandle
GetProcessHeap
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
GetTimeZoneInformation
HeapReAlloc
SetStdHandle
GetFullPathNameW
GetCurrentDirectoryW
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
WideCharToMultiByte
GetStringTypeW
WaitForSingleObjectEx
GetCurrentThreadId
GetExitCodeThread
InitializeSRWLock
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
TryEnterCriticalSection
DeleteCriticalSection
EncodePointer
DecodePointer
LCMapStringEx
QueryPerformanceCounter
GetSystemTimeAsFileTime
CompareStringEx
GetCPInfo
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
InitializeSListHead
RtlUnwindEx
RtlPcToFileHeader
RaiseException
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetDriveTypeW
GetFileInformationByHandle
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
ExitProcess
GetModuleHandleExW
CreateThread
ExitThread
FreeLibraryAndExitThread
GetStdHandle
HeapFree
HeapAlloc
SetFilePointerEx
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
CompareStringW
LCMapStringW
GetLocaleInfoW
user32
MessageBoxA
MessageBoxW
advapi32
SetEntriesInAclW
ConvertStringSidToSidW
GetNamedSecurityInfoW
SetNamedSecurityInfoW
shell32
SHGetFolderPathW
oleaut32
SafeArrayCreate
SafeArrayAccessData
SafeArrayUnaccessData
SafeArrayCreateVector
SafeArrayDestroy
mscoree
CorBindToRuntime
CLRCreateInstance
wininet
InternetReadFile
InternetOpenUrlA
InternetOpenA
version
GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW
winmm
PlaySoundW
Name
.text
Size
313KB
Virtual Size
313KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
118KB
Virtual Size
118KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
6KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
15KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_RDATA
Size
512B
Virtual Size
252B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
741KB
Virtual Size
741KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=259, version=27412,
count=19, id=260, version=27412,
count=183, id=261, version=27412,
count=17, id=260, version=30034,
count=10, id=259, version=30034,
count=89, id=261, version=30034,
count=2, id=147, productName=VS2008 build 21022, version=21022,
count=17, id=257, version=27412,
count=191, id=1, productName=Unmarked objects,
count=17, id=265, version=30133,
count=1, id=255, productName=VS2019 v16.11.1 build 30133, version=30133,
count=1, id=151,
count=1, id=258, productName=VS2019 v16.11.1 build 30133, version=30133,
װʹ˵.txt
- SHA256 2cd7e332c19f16dbbb32cc6f7eceee2b60b75a3caafd04f299b77609ffe7e163
- MD5 415b2c858c51b236b29ebfe88321891d
- SHA1 96880fb66943c42458611a8e38bea7b9c35e5da0
- SHA512 7e99de5441909189c64523604d32a9d3d317155354d4f484ac1fcd88b8d77a36c2da113dce6d72f1feae20b405d949c5a571de600d2f301071a17e4da454bf68
- TLSH T11C21788C9FA78B5DC74DDD14C12118A4CA432BE2729C55561C511195FF1B4FEF14F64C
- MD5 SHA1 SHA512 TLSH
Ƿվ__ҳ.url
- SHA256 b227ced1365a3af0d13ba414813c41f844972b2629e5cef2d3041fe7a546cec9
- MD5 bdc6522ac9e56bf6fb89885a913ede8e
- SHA1 7dbc318215c8ceb26bc2e50aee08914b48109047
- SHA512 7ce6afb2405a476c1701778226da56efa0473682e0ecb721812f7444635c4e84c5e18f32a507f058da6b04e7d0ea2b2d5a228e850ae81f81128602e95753ed6f
- MD5 SHA1 SHA512
ذ.url
- SHA256 4615652904207d6692b4b708164bdc92c4ab4e62e984c325a78fd346c9b54298
- MD5 76e8d0d978aed1857724ab053c27c713
- SHA1 0da7578bc10626797c2bfb61730c0387dc1205fa
- SHA512 112c467fd5e9278fd332c3c915f3eca69dcf41c4c93433a581adc6dfee0e1537ea2976e18a1868cbc1f157e14a495ab59a549becddf516201f76b7ed03747ad3
- TLSH T1729002968109C4958706468C5472D554D81375E4D457C4E5D1949A04594A5A545C5608
- MD5 SHA1 SHA512 TLSH