ttsrs-windows-latest-x64[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
ttsrs-windows-latest-x64.zip
Size 5.3MB
Sample261102-wfwalaby6s
SHA256 47101f473332b2bb14632851aa0670acf3d6409232c4990e86ba07072c0b2783
MD5 173c8267b3e467078b04033f6a5aaa91
SHA1 031e96582c0d5f5e1805e9e087d55282f86e9cfa
SHA512 fbdebc033ba39b355eb5b4235e03032ee6b9a96a5165b735eedc872475d4a1ee14925ff9d9e9a740a1d3304dd31dc1b317f232e4fa54211201c07bea11a91c84
SSDEEP 98304:ejy+A6D1ZZX26Jug0vHPqNjv9k6+eL9fycJtUdloQzdnEX1vm7TRiOnbxmwLvBys:y7HDDZX2NvHuNZyTeuaXFeTRbBJyNq
TLSH
T1FD46330322706D79A134F46CF3D54BE372906EBE35A1AA212C7770F97C692F25A9C1C9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/ttsrs.exe

File Explorer

ttsrs-windows-latest-x64.zip

.zip 5.3MB
ttsrs.exe

.exe 11.9MB

ttsrs-windows-latest-x64.zip

SHA256 47101f473332b2bb14632851aa0670acf3d6409232c4990e86ba07072c0b2783
MD5 173c8267b3e467078b04033f6a5aaa91
SHA1 031e96582c0d5f5e1805e9e087d55282f86e9cfa
SHA512 fbdebc033ba39b355eb5b4235e03032ee6b9a96a5165b735eedc872475d4a1ee14925ff9d9e9a740a1d3304dd31dc1b317f232e4fa54211201c07bea11a91c84
SSDEEP 98304:ejy+A6D1ZZX26Jug0vHPqNjv9k6+eL9fycJtUdloQzdnEX1vm7TRiOnbxmwLvBys:y7HDDZX2NvHuNZyTeuaXFeTRbBJyNq
TLSH
T1FD46330322706D79A134F46CF3D54BE372906EBE35A1AA212C7770F97C692F25A9C1C9
MD5 SHA1 SHA512 SSDEEP TLSH

ttsrs.exe

IMPHASH a798dfc41709ac55ce651dce3f494822
SHA256 907ab9928347fa2251a25faa3e195e591a95e484d597e13bed04f94f0334c3d6
MD5 12fd96baed89e57f6f6305a1c8fa341e
SHA1 65db32a2b67a23b680afc36add1bf292df663075
SHA512 6ffd79662fac3e64d001a467e65224f552bf9b8ea31ae73d288e18122bfa156cddd9fe53babd0c19b9c9d8cc4a55dd52006297620e12d508715385838dc47b59
SSDEEP 98304:4EDPYglppPh6GwHjp9vft2BX4uG99YN4n/npLA+74I+fi5WBo:Bb5Pda0G99a0p8WFN
TLSH
T133C67B21BE8695E8C56AC4B4C34687B38A3534CB0B35BAFF40C495753E6AAF55F3821C
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

6709920

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ttsrs.pdb

kernel32

SetConsoleCursorInfo WaitForMultipleObjects GetStdHandle SetConsoleActiveScreenBuffer HeapFree GetProcessHeap CreateConsoleScreenBuffer WriteConsoleW GetNumberOfConsoleInputEvents ReadConsoleInputW FillConsoleOutputAttribute FillConsoleOutputCharacterA CreateFileW SetConsoleTextAttribute SetConsoleCursorPosition SetNamedPipeHandleState GetConsoleMode GetConsoleScreenBufferInfo GetFileInformationByHandle GetCurrentThread GlobalFree GetLastError SetLastError TlsAlloc GetModuleHandleA Sleep GetProcAddress InitializeSRWLock ReleaseSRWLockExclusive ReleaseSRWLockShared AcquireSRWLockExclusive AcquireSRWLockShared InitOnceExecuteOnce GetTimeZoneInformationForYear SetConsoleMode GetFileInformationByHandleEx GetConsoleCursorInfo MoveFileExW GetQueuedCompletionStatusEx CancelIoEx PostQueuedCompletionStatus WriteFile GetOverlappedResult ReadFile SetFileCompletionNotificationModes CreateIoCompletionPort SetHandleInformation HeapAlloc FormatMessageW GetSystemTimeAsFileTime DuplicateHandle GetCurrentProcess ReadConsoleW TlsSetValue TlsGetValue GetFinalPathNameByHandleW CloseHandle InitializeSListHead FindNextFileW GetModuleHandleW GetFileType GetFileAttributesW SetWaitableTimer CreateWaitableTimerExW GetConsoleOutputCP GetModuleFileNameW DeleteFileW DeviceIoControl CreateSymbolicLinkW ReleaseMutex CreateMutexA LoadLibraryA WaitForSingleObjectEx SwitchToThread GetSystemInfo ExitProcess FindClose FindFirstFileExW lstrlenW GetCommandLineW GetEnvironmentVariableW GetCurrentDirectoryW SetThreadStackGuarantee AddVectoredExceptionHandler SetFilePointerEx CreateDirectoryW GetEnvironmentStringsW SetUnhandledExceptionFilter GetExitCodeProcess CreateProcessW GetWindowsDirectoryW GetSystemDirectoryW CancelIo GetSystemTimePreciseAsFileTime RtlLookupFunctionEntry RtlCaptureContext ReadFileEx GetCurrentProcessId CreateEventW CreateThread QueryPerformanceCounter QueryPerformanceFrequency HeapReAlloc SetFileTime SetFileInformationByHandle GetCurrentThreadId GetFullPathNameW SleepEx WriteFileEx WaitForSingleObject FreeEnvironmentStringsW CompareStringOrdinal LoadLibraryW RtlVirtualUnwind MultiByteToWideChar WideCharToMultiByte GlobalSize GlobalUnlock GlobalAlloc GlobalLock

advapi32

RegCloseKey RegCreateKeyExW ImpersonateAnonymousToken RevertToSelf RegCreateKeyTransactedW RegQueryValueExW RegOpenKeyExW RegOpenKeyTransactedW SystemFunction036

bcryptprimitives

ProcessPrng

user32

GetKeyboardLayout ToUnicodeEx EmptyClipboard SetClipboardData GetClipboardData OpenClipboard RegisterClipboardFormatW CloseClipboard GetForegroundWindow GetWindowThreadProcessId IsClipboardFormatAvailable

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WaitOnAddress WakeByAddressAll

ws2_32

closesocket getpeername select WSAStartup WSACleanup freeaddrinfo getaddrinfo WSAIoctl setsockopt shutdown bind WSASocketW send recv connect ioctlsocket WSASend getsockopt getsockname WSAGetLastError

crypt32

CertOpenStore CertAddEncodedCertificateToStore CertCloseStore CertFreeCertificateChainEngine CertSetCertificateContextProperty CertCreateCertificateChainEngine CertVerifyCertificateChainPolicy CertFreeCertificateContext CertFreeCertificateChain CertGetCertificateChain

bcrypt

BCryptGenRandom

ntdll

NtCancelIoFileEx NtOpenFile NtCreateFile NtWriteFile RtlNtStatusToDosError NtDeviceIoControlFile NtReadFile NtCreateNamedPipeFile

vcruntime140

memcpy __CxxFrameHandler3 memcmp memmove memset strchr memchr _CxxThrowException __C_specific_handler __current_exception __current_exception_context

api-ms-win-crt-runtime-l1-1-0

terminate _get_initial_narrow_environment _crt_atexit _wassert _register_onexit_function _seh_filter_exe _c_exit abort _initialize_onexit_table _errno strerror _register_thread_local_exe_atexit_callback _cexit _initterm _initialize_narrow_environment _configure_narrow_argv _initterm_e __p___argv exit _exit _set_app_type __p___argc

api-ms-win-crt-string-l1-1-0

strcat_s strcmp strlen

api-ms-win-crt-math-l1-1-0

pow ldexp trunc truncf ceil __setusermatherr round

api-ms-win-crt-heap-l1-1-0

_set_new_mode malloc free realloc calloc

api-ms-win-crt-stdio-l1-1-0

_setmode fwrite __stdio_common_vsprintf_s fread __acrt_iob_func _fileno fopen ferror feof __stdio_common_vsprintf __stdio_common_vsscanf fclose fseek __stdio_common_vfprintf __stdio_common_vsnprintf_s fflush ftell _set_fmode fgets __p__commode

api-ms-win-crt-convert-l1-1-0

strtol

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-utility-l1-1-0

bsearch

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

OnigDefaultCaseFoldFlag OnigDefaultSyntax OnigEncodingASCII OnigEncodingUTF8 OnigSyntaxASIS OnigSyntaxEmacs OnigSyntaxGnuRegex OnigSyntaxGrep OnigSyntaxJava OnigSyntaxOniguruma OnigSyntaxPerl OnigSyntaxPerl_NG OnigSyntaxPosixBasic OnigSyntaxPosixExtended OnigSyntaxPython OnigSyntaxRuby aws_lc_0_39_1_jent_entropy_collector_alloc aws_lc_0_39_1_jent_entropy_collector_free aws_lc_0_39_1_jent_entropy_init aws_lc_0_39_1_jent_entropy_init_ex aws_lc_0_39_1_jent_entropy_switch_notime_impl aws_lc_0_39_1_jent_read_entropy aws_lc_0_39_1_jent_read_entropy_safe aws_lc_0_39_1_jent_set_fips_failure_callback aws_lc_0_39_1_jent_version onig_builtin_cmp onig_builtin_count onig_builtin_error onig_builtin_fail onig_builtin_max onig_builtin_mismatch onig_builtin_skip onig_builtin_total_count onig_callout_tag_is_exist_at_callout_num onig_copy_encoding onig_copy_syntax onig_copyright onig_end onig_error_code_to_str onig_foreach_name onig_free onig_free_body onig_free_match_param onig_free_match_param_content onig_get_arg_by_callout_args onig_get_args_num_by_callout_args onig_get_callback_each_match onig_get_callout_data onig_get_callout_data_by_callout_args onig_get_callout_data_by_callout_args_self onig_get_callout_data_by_callout_args_self_dont_clear_old onig_get_callout_data_by_tag onig_get_callout_data_by_tag_dont_clear_old onig_get_callout_data_dont_clear_old onig_get_callout_in_by_callout_args onig_get_callout_name_by_name_id onig_get_callout_num_by_callout_args onig_get_callout_num_by_tag onig_get_callout_tag_end onig_get_callout_tag_start onig_get_capture_range_in_callout onig_get_capture_tree onig_get_case_fold_flag onig_get_contents_by_callout_args onig_get_contents_end_by_callout_args onig_get_current_by_callout_args onig_get_default_case_fold_flag onig_get_encoding onig_get_match_stack_limit_size onig_get_name_id_by_callout_args onig_get_options onig_get_parse_depth_limit onig_get_passed_args_num_by_callout_args onig_get_progress_callout onig_get_regex_by_callout_args onig_get_retraction_callout onig_get_retry_counter_by_callout_args onig_get_retry_limit_in_match onig_get_retry_limit_in_search onig_get_right_range_by_callout_args onig_get_start_by_callout_args onig_get_string_by_callout_args onig_get_string_end_by_callout_args onig_get_subexp_call_limit_in_search onig_get_subexp_call_max_nest_level onig_get_syntax onig_get_syntax_behavior onig_get_syntax_op onig_get_syntax_op2 onig_get_syntax_options onig_get_used_stack_size_in_callout onig_initialize onig_initialize_encoding onig_initialize_match_param onig_is_error_code_needs_param onig_match onig_match_with_param onig_name_to_backref_number onig_name_to_group_numbers onig_new onig_new_match_param onig_noname_group_capture_is_active onig_number_of_capture_histories onig_number_of_captures onig_number_of_names onig_reg_init onig_region_clear onig_region_copy onig_region_free onig_region_init onig_region_new onig_region_resize onig_region_set onig_regset_add onig_regset_free onig_regset_get_regex onig_regset_get_region onig_regset_new onig_regset_number_of_regex onig_regset_replace onig_regset_search onig_regset_search_with_param onig_scan onig_search onig_search_with_param onig_set_callback_each_match onig_set_callout_data onig_set_callout_data_by_callout_args onig_set_callout_data_by_callout_args_self onig_set_callout_data_by_tag onig_set_callout_of_name onig_set_callout_user_data_of_match_param onig_set_capture_num_limit onig_set_default_case_fold_flag onig_set_default_syntax onig_set_match_stack_limit_size onig_set_match_stack_limit_size_of_match_param onig_set_meta_char onig_set_parse_depth_limit onig_set_progress_callout onig_set_progress_callout_of_match_param onig_set_retraction_callout onig_set_retraction_callout_of_match_param onig_set_retry_limit_in_match onig_set_retry_limit_in_match_of_match_param onig_set_retry_limit_in_search onig_set_retry_limit_in_search_of_match_param onig_set_subexp_call_limit_in_search onig_set_subexp_call_max_nest_level onig_set_syntax_behavior onig_set_syntax_op onig_set_syntax_op2 onig_set_syntax_options onig_set_verb_warn_func onig_set_warn_func onig_setup_builtin_monitors_by_ascii_encoded_name onig_unicode_define_user_property onig_version onigenc_get_default_encoding onigenc_get_left_adjust_char_head onigenc_get_prev_char_head onigenc_get_right_adjust_char_head onigenc_get_right_adjust_char_head_with_prev onigenc_init onigenc_is_valid_mbc_string onigenc_set_default_caseconv_table onigenc_set_default_encoding onigenc_step_back onigenc_str_bytelen_null onigenc_strdup onigenc_strlen onigenc_strlen_null