servercloner[.]exe

General

Target
servercloner.exe
Size 12.6MB
Sample261102-thzdxsdv6m
SHA256 071360bd5d51cf3d77681e8493d7a0f9b2dc077d65fe717bd691fb7e336f1d1a
MD5 76ac657913ed5f7f69a53ccc394758d2
SHA1 4aca37412395ca3d5f70649cc4fd8cbb37b5d83f
SHA512 a376101e5ee23987608b2244214edb5b3bc529e4f1e6b835738b35f86314b4657e2eea5a2e68ea1777c408cdce95404ab494be44ebab6a502086fea579418b3c
SSDEEP 196608:Cf8EZomIeTo8r35zKuSbH4VeqDdPkZhiLFf1KmUC3ZcnKvZddzrZtLapYKnPoT:KRo6DbpeQdCMhZGnKvFzrfIQ
TLSH
T1B7D633A629C3A4BEFB4F80386991635F662630334BA5576B43C05355CF27FC88FAD612
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
servercloner.exe

File Explorer

servercloner.exe

.exe 12.6MB

servercloner.exe

IMPHASH 8e3dad4d4ea6736338bcc4aca7b446c9
SHA256 071360bd5d51cf3d77681e8493d7a0f9b2dc077d65fe717bd691fb7e336f1d1a
MD5 76ac657913ed5f7f69a53ccc394758d2
SHA1 4aca37412395ca3d5f70649cc4fd8cbb37b5d83f
SHA512 a376101e5ee23987608b2244214edb5b3bc529e4f1e6b835738b35f86314b4657e2eea5a2e68ea1777c408cdce95404ab494be44ebab6a502086fea579418b3c
SSDEEP 196608:Cf8EZomIeTo8r35zKuSbH4VeqDdPkZhiLFf1KmUC3ZcnKvZddzrZtLapYKnPoT:KRo6DbpeQdCMhZGnKvFzrfIQ
TLSH
T1B7D633A629C3A4BEFB4F80386991635F662630334BA5576B43C05355CF27FC88FAD612
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

51340

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

shell32

SHFileOperationW SHGetFolderPathW CommandLineToArgvW

kernel32

SetLastError WriteConsoleW HeapReAlloc CreateDirectoryW SizeofResource SetConsoleCtrlHandler GetCommandLineW GetStdHandle WriteFile TerminateProcess GetModuleFileNameW SetEnvironmentVariableW GetTempPathW FindResourceA WaitForSingleObject CreateFileW GetFileAttributesW Sleep GetLastError LockResource CloseHandle LoadResource GetProcAddress GetCurrentProcessId CreateProcessW WideCharToMultiByte GetSystemTimeAsFileTime FormatMessageA GetExitCodeProcess RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentThreadId InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW HeapSize RtlUnwindEx EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW EncodePointer RaiseException RtlPcToFileHeader ExitProcess GetModuleHandleExW GetCommandLineA HeapAlloc MultiByteToWideChar HeapFree FlsAlloc FlsGetValue FlsSetValue FlsFree CompareStringW LCMapStringW GetFileType FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetStringTypeW GetProcessHeap FlushFileBuffers GetConsoleOutputCP GetConsoleMode GetFileSizeEx SetFilePointerEx

Sharing