wraith_ikhvapokav[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
wraith_ikhvapokav.exe
Size 3.5MB
Sample261107-txe9lads4v
SHA256 f89f63bf4ab4b6cc6259a242b9d2b064925b8c9ff3bf6d7c933c9da9dd5c425e
MD5 6fc714908e1aa5c3fbb66d1ef381ad4e
SHA1 38c28cfb544473d938885bf803568c20ba42031b
SHA512 e2236e9f7e973c36f5ba5c5377f9f03122e0c8a2e2882c872622ea3665db430b9a753d346ab1658d5905ed4ef5c6d71179fe05304786ae3993dcdc382553cbab
SSDEEP 49152:cPkhgKEBl4HtB9adpLjQCYuvK5AOY8d06y83dSVIk2L39KVBtw2dSJgHY7vMHPSG:VeuvBdS6k4OdMgHpH1Gn+7
TLSH
T199069E43FAA581E8C09EC178C7179233EB72BC8D5A20A79B27D45A113F63B625F9D314
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
wraith_ikhvapokav.exe

File Explorer

wraith_ikhvapokav.exe

.exe 3.5MB

wraith_ikhvapokav.exe

IMPHASH 187acce38a5d8d4afecd9afa24228c05
SHA256 f89f63bf4ab4b6cc6259a242b9d2b064925b8c9ff3bf6d7c933c9da9dd5c425e
MD5 6fc714908e1aa5c3fbb66d1ef381ad4e
SHA1 38c28cfb544473d938885bf803568c20ba42031b
SHA512 e2236e9f7e973c36f5ba5c5377f9f03122e0c8a2e2882c872622ea3665db430b9a753d346ab1658d5905ed4ef5c6d71179fe05304786ae3993dcdc382553cbab
SSDEEP 49152:cPkhgKEBl4HtB9adpLjQCYuvK5AOY8d06y83dSVIk2L39KVBtw2dSJgHY7vMHPSG:VeuvBdS6k4OdMgHpH1Gn+7
TLSH
T199069E43FAA581E8C09EC178C7179233EB72BC8D5A20A79B27D45A113F63B625F9D314
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2322360

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

wraith.pdb

kernel32

GetFileInformationByHandle SetLastError GetStdHandle GetConsoleMode GetConsoleOutputCP WriteConsoleW SetHandleInformation GetFullPathNameW GetTimeZoneInformationForYear LocalFree SetFileTime SetFileInformationByHandle GetFileInformationByHandleEx GetSystemTimePreciseAsFileTime GetTempPathW CopyFileExW GetSystemInfo FindNextFileW GetComputerNameExW FindFirstFileExW GlobalMemoryStatusEx FindClose FlushFileBuffers GetTickCount GetSystemTime GetSystemTimeAsFileTime FreeLibrary GetFileSize UnlockFile DeleteFileW DeleteFileA GetFileAttributesExW GetFileAttributesA GetDiskFreeSpaceA GetTempPathA GetFileAttributesW SetEndOfFile GetFullPathNameA SetFilePointer LockFile GetDiskFreeSpaceW GetTickCount64 AreFileApisANSI CloseHandle SystemTimeToFileTime GetLastError SetFilePointerEx EnterCriticalSection InitializeCriticalSection RaiseException ReadFile HeapCreate WriteFile OutputDebugStringA UnlockFileEx CreateMutexW UnmapViewOfFile HeapValidate OutputDebugStringW FlushViewOfFile CreateFileA LoadLibraryW HeapCompact HeapDestroy LockFileEx FormatMessageA CreateFileMappingW MapViewOfFile LoadLibraryExA Sleep LeaveCriticalSection CreateWaitableTimerExW GetModuleFileNameW ExitProcess CreateDirectoryW CreateFileW CreateThread QueryPerformanceCounter QueryPerformanceFrequency GetEnvironmentVariableW HeapAlloc FlsSetValue IsThreadAFiber FlsFree GetModuleHandleExW FlsAlloc MultiByteToWideChar FormatMessageW GetModuleHandleW RtlVirtualUnwind WideCharToMultiByte ReleaseMutex CreateMutexA lstrlenW WaitForSingleObjectEx RtlLookupFunctionEntry TryEnterCriticalSection DeleteCriticalSection UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent InitializeSListHead SetWaitableTimer HeapSize GetCurrentProcessId WaitForSingleObject GetProcessHeap HeapFree GlobalLock GlobalAlloc GetModuleHandleA GlobalUnlock CreateToolhelp32Snapshot Process32FirstW Process32NextW IsDebuggerPresent LoadLibraryA GetProcAddress GetCurrentProcess VirtualProtect AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread HeapReAlloc GetCurrentThreadId GetCurrentDirectoryW RtlCaptureContext

ntdll

RtlNtStatusToDosError NtReadFile NtWriteFile

oleaut32

SysFreeString SysStringLen

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WaitOnAddress WakeByAddressSingle

bcryptprimitives

ProcessPrng

advapi32

SystemFunction036 RegOpenKeyExW RegCloseKey RegCreateKeyExW GetTokenInformation OpenProcessToken RegSetValueExW GetUserNameW

bcrypt

BCryptGenRandom

user32

GetAsyncKeyState GetForegroundWindow GetWindowTextW GetKeyState GetKeyboardState GetKeyboardLayout MapVirtualKeyW ToUnicodeEx GetClipboardSequenceNumber GetClipboardData EmptyClipboard CloseClipboard SetClipboardData OpenClipboard MessageBoxW

shell32

ShellExecuteW

crypt32

CryptUnprotectData

ws2_32

recv getsockname WSAGetLastError WSASocketW closesocket WSAStartup ioctlsocket setsockopt WSASend getaddrinfo getpeername connect select getsockopt WSADuplicateSocketW freeaddrinfo WSARecv send

vcruntime140

memset __CxxFrameHandler3 memcpy memmove memcmp memchr strchr strrchr __C_specific_handler __current_exception __current_exception_context

api-ms-win-crt-string-l1-1-0

wcslen strlen strcspn strcmp strspn strncmp

api-ms-win-crt-heap-l1-1-0

realloc _set_new_mode free _msize malloc

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-time-l1-1-0

_localtime64_s

api-ms-win-crt-math-l1-1-0

fabs __setusermatherr _dclass log

api-ms-win-crt-runtime-l1-1-0

_beginthreadex _endthreadex _set_app_type terminate _configure_narrow_argv _initialize_narrow_environment _get_initial_narrow_environment _initterm _initterm_e exit _exit __p___argc __p___argv _cexit _c_exit _register_thread_local_exe_atexit_callback _register_onexit_function _initialize_onexit_table _seh_filter_exe _crt_atexit

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale