false_realitier[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
false_realitier.zip
Size 29.8MB
Sample261030-p2fcyact5t
SHA256 d186f78b7ecc5f245e9d5c880b4f3b67dbeff878858afe6e655542a7ca088936
MD5 cb4b164d60a71272b6e4adb9aa58cdd8
SHA1 f2a5a6a52a237dc551126af6c6c2411ae2882b82
SHA512 6ee4888f1d0156014ae2a4620dd9991fe310b5089c454f42f6f311a7382473fd552332f1b873287835be2b27f60b3ef05c89dbe5e596ddcff1787c25859e87ca
SSDEEP 786432:CnjJ0/nA9//++BdzoE+uJ3cAyNJ1a3eh81x6TuHweT+CORaTjIHe:c0un++BhOAyNf4e2jaVeduyI+
TLSH
T1AB673364CAED989EC44E423872D0CD4F3AE696851C07428B984BC64265D339B6EFCDF7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
unpack001/false_realitier/FalseRealitiers.console.exe
unpack001/false_realitier/FalseRealitiers.exe

File Explorer

false_realitier.zip

.zip 29.8MB
false_realitier/FalseRealitiers.console.exe

.exe 181KB
false_realitier/FalseRealitiers.exe

.exe 80.2MB
false_realitier/FalseRealitiers.pck

2.5MB

false_realitier.zip

SHA256 d186f78b7ecc5f245e9d5c880b4f3b67dbeff878858afe6e655542a7ca088936
MD5 cb4b164d60a71272b6e4adb9aa58cdd8
SHA1 f2a5a6a52a237dc551126af6c6c2411ae2882b82
SHA512 6ee4888f1d0156014ae2a4620dd9991fe310b5089c454f42f6f311a7382473fd552332f1b873287835be2b27f60b3ef05c89dbe5e596ddcff1787c25859e87ca
SSDEEP 786432:CnjJ0/nA9//++BdzoE+uJ3cAyNJ1a3eh81x6TuHweT+CORaTjIHe:c0un++BhOAyNf4e2jaVeduyI+
TLSH
T1AB673364CAED989EC44E423872D0CD4F3AE696851C07428B984BC64265D339B6EFCDF7
MD5 SHA1 SHA512 SSDEEP TLSH

false_realitier/FalseRealitiers.console.exe

IMPHASH d63eba35c76e43d011d758384b562b42
SHA256 5b30574f2012c511b1004d84bbb43d5c85eed44510282a056bda6527a676211f
MD5 e14aed7156ab1bc0e1dedcbfa923c99f
SHA1 162994e09ceb0eeb938096273c9e04ddc3480b9e
SHA512 7783fec5aa922424938e211f858a90b812c46177f16fd67fe21c54763fe09cae274caf4a0ee7a8dd773b2d196a12cdec74e208a5b23b9105f654c3caca4d8295
SSDEEP 3072:l8eFktmxhoK2+ncWqfjWWBilo91Sf3+obKHP:1ktmxaWqL7i691SPjKv
TLSH
T1430418383F5FF764E4928630C8AA83A473607F05E42257EA6257B626CAF3550C57933E
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5104

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

Name

.text

Size

28KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

192B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

1024B

Virtual Size

1024B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

96B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

138KB

Virtual Size

138KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

140B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

false_realitier/FalseRealitiers.exe

IMPHASH 7130bb3d3a9e9b23251a543e00e3dd09
SHA256 3704990acd39d295419cf23d64f69be55628022a3a1e442065ffd05594a1e358
MD5 d6fd0dd2714b7e5aede307e42ba6d517
SHA1 d4e7f860e23256abd8ccb0edcacc2b2e8a8b6151
SHA512 563bc637c862daa47c28db0139618e18945fcc2b31cf7abf0cf99dfc927e1c0398cc56f1f6abaed816c800b5de62544a6ced24a2a92548f1eaada0ea3a9b8edf
SSDEEP 393216:MDp20u8/lYxIlcPL5fvxbAYam32RtR3BtchhuUJ4TjPNJ8oCnfxWpdqUuKVU8o+:MFJYOlE5f+vtlBtch28o8kzN
TLSH
T101082A03F3A360DDD46BF1349E3BA677B631B84911342E2B56929B302F61E209779F58
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5072

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

advapi32

AdjustTokenPrivileges GetCurrentHwProfileA GetSidSubAuthority GetSidSubAuthorityCount GetTokenInformation LookupPrivilegeValueW OpenProcessToken RegCloseKey RegEnumKeyExW RegEnumValueW RegGetValueW RegOpenKeyExW RegOpenKeyW RegQueryInfoKeyW RegQueryValueExW RegSetValueExW

avrt

AvSetMmThreadCharacteristicsW AvSetMmThreadPriority

bcrypt

BCryptGenRandom

crypt32

CertCloseStore CertEnumCertificatesInStore CertGetCertificateContextProperty CertOpenSystemStoreA CryptBinaryToStringA

dbghelp

ImageDirectoryEntryToData ImageDirectoryEntryToDataEx ImageRvaToVa

dinput8

DirectInput8Create

dwmapi

DwmEnableBlurBehindWindow DwmGetWindowAttribute DwmIsCompositionEnabled DwmSetWindowAttribute

dwrite

DWriteCreateFactory

dxgi

CreateDXGIFactory1

gdi32

BitBlt ChoosePixelFormat CreateBitmap CreateCompatibleBitmap CreateCompatibleDC CreateDIBSection CreatePen CreatePolygonRgn CreateRectRgn CreateSolidBrush DeleteDC DeleteObject GetDIBits GetDeviceCaps GetPixel GetStockObject GetTextExtentPoint32W Rectangle SelectObject SetDIBitsToDevice SetPixelFormat SwapBuffers

imm32

ImmAssociateContext ImmGetCompositionStringW ImmGetContext ImmReleaseContext ImmSetCandidateWindow ImmSetCompositionWindow

iphlpapi

GetAdaptersAddresses GetBestInterfaceEx

kernel32

AcquireSRWLockExclusive AcquireSRWLockShared AddVectoredExceptionHandler AttachConsole CloseHandle CompareFileTime CompareStringOrdinal ConnectNamedPipe CreateDirectoryW CreateEventA CreateFileMappingA CreateFileMappingW CreateFileW CreateMutexA CreateNamedPipeW CreatePipe CreateProcessW CreateSemaphoreA CreateSymbolicLinkW CreateThread DeleteCriticalSection DeleteFileW DuplicateHandle EnterCriticalSection FindClose FindFirstFileExW FindFirstFileW FindNextFileW FlushFileBuffers FormatMessageA FormatMessageW FreeLibrary GetACP GetCommandLineW GetConsoleScreenBufferInfo GetConsoleWindow GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetDiskFreeSpaceExA GetDynamicTimeZoneInformation GetEnvironmentVariableW GetExitCodeProcess GetExitCodeThread GetFileAttributesExW GetFileAttributesW GetFileSize GetFinalPathNameByHandleW GetFullPathNameW GetGeoInfoW GetHandleInformation GetLargePageMinimum GetLastError GetLocalTime GetLocaleInfoEx GetLocaleInfoW GetLogicalDrives GetModuleFileNameA GetModuleFileNameW GetModuleHandleA GetModuleHandleExA GetModuleHandleExW GetModuleHandleW GetNativeSystemInfo GetProcAddress GetProcessAffinityMask GetProcessHeap GetProcessTimes GetStdHandle GetSystemInfo GetSystemTime GetSystemTimeAsFileTime GetTempFileNameA GetTempFileNameW GetTempPathA GetThreadContext GetThreadId GetThreadPriority GetTickCount64 GetTimeZoneInformation GetUserDefaultUILanguage GetUserGeoID GetVolumeInformationW GlobalAlloc GlobalLock GlobalMemoryStatusEx GlobalSize GlobalUnlock HeapAlloc HeapFree InitOnceExecuteOnce InitializeConditionVariable InitializeCriticalSection InitializeSRWLock IsDBCSLeadByteEx IsDebuggerPresent K32GetModuleInformation K32GetPerformanceInfo K32GetProcessMemoryInfo LCIDToLocaleName LeaveCriticalSection LoadLibraryA LoadLibraryExW LoadLibraryW LocalFree LocaleNameToLCID MapViewOfFile MultiByteToWideChar OpenProcess OutputDebugStringA OutputDebugStringW PowerClearRequest PowerCreateRequest PowerSetRequest QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReadFile ReleaseMutex ReleaseSRWLockExclusive ReleaseSRWLockShared ReleaseSemaphore RemoveVectoredExceptionHandler ReplaceFileW ResetEvent ResumeThread RtlCaptureContext RtlLookupFunctionEntry RtlUnwindEx RtlVirtualUnwind SearchPathW SetConsoleCP SetConsoleCtrlHandler SetConsoleMode SetConsoleOutputCP SetConsoleTextAttribute SetCurrentDirectoryW SetEnvironmentVariableW SetErrorMode SetEvent SetFileAttributesW SetHandleInformation SetLastError SetPriorityClass SetProcessAffinityMask SetStdHandle SetThreadAffinityMask SetThreadContext SetThreadIdealProcessor SetThreadPriority SetUnhandledExceptionFilter Sleep SleepConditionVariableCS SleepConditionVariableSRW SuspendThread SwitchToThread SystemTimeToFileTime TerminateProcess TerminateThread TlsAlloc TlsFree TlsGetValue TlsSetValue TryAcquireSRWLockExclusive TryEnterCriticalSection UnmapViewOfFile VerSetConditionMask VerifyVersionInfoW VirtualAlloc VirtualFree VirtualProtect VirtualQuery WaitForMultipleObjects WaitForSingleObject WaitForSingleObjectEx WakeAllConditionVariable WakeConditionVariable WideCharToMultiByte WriteFile __C_specific_handler lstrlenW

msvcrt

___lc_codepage_func ___mb_cur_max_func __getmainargs __initenv __iob_func __set_app_type __setusermatherr _aligned_free _aligned_malloc _amsg_exit _assert _beginthreadex _cexit _chsize _commode _endthreadex _errno _filelengthi64 _fileno fwprintf _fmode _fstat64 _get_osfhandle _getpid _gmtime64 _hypot _initterm _itoa_s _lock _lseeki64 _onexit _scprintf _set_error_mode _setjmp _snprintf _strdup _stricmp _time64 _timezone _tzname _tzset _ultoa _unlock _vscprintf _vsnprintf _vsnprintf_s _wchdir _wfopen _wfopen_s _wfsopen _wgetcwd _wgetenv _wrename _wrmdir _wstat64 _wunlink abort acos asin atan atof atoi bsearch calloc cosh exit fclose feof ferror fflush fgetpos fgets fopen fprintf fputc fputs fputwc fread free freopen_s fseek fsetpos ftell fwrite getc getenv getwc isalnum isalpha isspace tanh iswctype isxdigit localeconv log10 longjmp malloc mbstowcs memchr memcmp memcpy memmove memset perror printf putc putwc qsort rand realloc remove rewind setbuf setlocale setvbuf signal sinh srand strcat strcat_s strchr strcmp strcoll strcpy strcpy_s strcspn strerror strftime strlen strncat strncmp strncpy strpbrk strrchr strstr strtol strtoul strxfrm tan tolower toupper towlower towupper ungetc ungetwc vfprintf wcscmp wcscoll wcscpy wcscpy_s wcsftime wcslen wcstol wcstombs wcsxfrm _strtoui64 _strtoi64 _vsnprintf_s _nextafter _write _stricmp _strdup _read _open _memicmp _getpid _fileno _fdopen _close

ntdll

NtQueryInformationFile

ole32

CoCreateInstance CoInitializeEx CoTaskMemFree CoUninitialize PropVariantClear

oleaut32

SysAllocString SysFreeString VariantInit

shell32

CommandLineToArgvW DragAcceptFiles DragQueryFileW SHCreateItemFromParsingName SHFileOperationW SHGetKnownFolderPath SHGetPropertyStoreForWindow SetCurrentProcessExplicitAppUserModelID ShellExecuteW Shell_NotifyIconGetRect Shell_NotifyIconW

shlwapi

QISearch SHStrDupW

user32

ActivateKeyboardLayout AdjustWindowRectEx AllowSetForegroundWindow CallNextHookEx CallWindowProcW ClientToScreen ClipCursor CloseClipboard CloseTouchInputHandle CreateCaret CreateIconFromResource CreateIconIndirect CreatePopupMenu CreateWindowExW DefWindowProcW DestroyCaret DestroyIcon DestroyMenu DestroyWindow DialogBoxIndirectParamW DispatchMessageW DisplayConfigGetDeviceInfo DrawTextW EmptyClipboard EndDialog EnumDisplayMonitors EnumDisplaySettingsW FillRect FlashWindowEx GetAsyncKeyState GetClientRect GetClipboardData GetCursorPos GetDC GetDCEx GetDisplayConfigBufferSizes GetDlgItem GetDoubleClickTime GetForegroundWindow GetKeyState GetKeyboardLayout GetKeyboardLayoutList GetKeyboardState GetMenuItemCount GetMenuItemInfoW GetMenuItemRect GetMessageExtraInfo GetMessageTime GetMonitorInfoA GetMonitorInfoW GetRawInputData GetRawInputDeviceInfoA GetRawInputDeviceList GetSystemMetrics GetTouchInputInfo GetUpdateRect GetWindowDC GetWindowLongPtrA GetWindowLongPtrW GetWindowRect GetWindowTextLengthW GetWindowTextW GetWindowThreadProcessId InsertMenuItemW IsClipboardFormatAvailable IsIconic IsProcessDPIAware IsWindow IsWindowVisible IsZoomed KillTimer LoadCursorA LoadIconA MapVirtualKeyA MapVirtualKeyExA MessageBoxW MonitorFromWindow MoveWindow OffsetRect OpenClipboard PeekMessageW PostMessageA QueryDisplayConfig RegisterClassExW RegisterClassW RegisterClipboardFormatA RegisterRawInputDevices RegisterTouchWindow ReleaseCapture ReleaseDC RemoveMenu ScreenToClient SendMessageA SendMessageW SetCapture SetCaretPos SetClipboardData SetCursor SetCursorPos SetFocus SetForegroundWindow SetMenuInfo SetMenuItemInfoW SetTimer SetWindowLongPtrA SetWindowLongPtrW SetWindowPos SetWindowRgn SetWindowTextW SetWindowsHookExA ShowWindow SystemParametersInfoA ToUnicodeEx TrackMouseEvent TrackPopupMenuEx TranslateMessage UnhookWindowsHookEx UnregisterClassW WindowFromDC WindowFromPoint

winmm

midiInClose midiInGetDevCapsA midiInGetErrorTextA midiInGetNumDevs midiInOpen midiInStart midiInStop timeBeginPeriod timeEndPeriod

ws2_32

WSAConnect freeaddrinfo getaddrinfo getnameinfo inet_pton

wsock32

WSACleanup WSAGetLastError WSAStartup __WSAFDIsSet accept bind closesocket connect getsockname htonl htons inet_addr ioctlsocket listen ntohl ntohs recv recvfrom select send sendto setsockopt socket

Name

.text

Size

62.9MB

Virtual Size

62.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

297KB

Virtual Size

297KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

13.6MB

Virtual Size

13.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

pck

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

1.3MB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

1.6MB

Virtual Size

1.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

1.8MB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

512B

Virtual Size

157B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

22KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

112B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

141KB

Virtual Size

141KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

394KB

Virtual Size

393KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

false_realitier.zip

false_realitier/FalseRealitiers.console.exe

kernel32

msvcrt

shlwapi

version

generic

false_realitier/FalseRealitiers.exe

advapi32

avrt

bcrypt

crypt32

dbghelp

dinput8

dwmapi

dwrite

dxgi

gdi32

imm32

iphlpapi

kernel32

msvcrt

ntdll

ole32

oleaut32

shell32

shlwapi

user32

winmm

ws2_32

wsock32

generic

false_realitier/FalseRealitiers.pck