thoukeys[.]zip | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
thoukeys.zip
Size 14.0MB
Sample261113-wa7fnset2w
SHA256 638dea90b4add08922d7fdf4f211169e838fc48ec32994a7c742bbde59c969db
MD5 66179971035a14ac2df52d3013b8ab12
SHA1 2b21b7b0d32f0126d1162295b34cfdc5bbd7295f
SHA512 3fd0defb3aea8fc5f0390df275b2d5ff5286179be0ead4cd1981be79649197fec32dd9bb62469c1288655c5fcc23d636a01251e5101ad8ece5f73d5df98551fc
SSDEEP 393216:cpyA594cMZh6nF9WLUZXFf6bBFOfDxccUEYncpXzOY:wyA5KccqzJFA8fDxYncpDL
TLSH
T11CE6331E6787EFCF0D0752D224476060BF28A7EEF883BB705611A8A6F758C87916D16C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

pyinstaller

Malware Config

Signatures

Detects Pyinstaller 1 IoCs

pyinstaller

resource	yara_rule
static1/unpack001/thoukeys/bore.exe	pyinstaller

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
unpack001/thoukeys/bore.exe
unpack001/thoukeys/thykey.exe

File Explorer

thoukeys.zip

.zip 14.0MB
thoukeys/bore.exe

.exe 9.9MB
bore.pyc

3KB
thoukeys/thykey.exe

.exe 14.6MB

thoukeys.zip

SHA256 638dea90b4add08922d7fdf4f211169e838fc48ec32994a7c742bbde59c969db
MD5 66179971035a14ac2df52d3013b8ab12
SHA1 2b21b7b0d32f0126d1162295b34cfdc5bbd7295f
SHA512 3fd0defb3aea8fc5f0390df275b2d5ff5286179be0ead4cd1981be79649197fec32dd9bb62469c1288655c5fcc23d636a01251e5101ad8ece5f73d5df98551fc
SSDEEP 393216:cpyA594cMZh6nF9WLUZXFf6bBFOfDxccUEYncpXzOY:wyA5KccqzJFA8fDxYncpDL
TLSH
T11CE6331E6787EFCF0D0752D224476060BF28A7EEF883BB705611A8A6F758C87916D16C
MD5 SHA1 SHA512 SSDEEP TLSH

Password

root

thoukeys/bore.exe

IMPHASH e3e80a143805ea18936c8f612e25d363
SHA256 0b5b09010474b2dc1eb2ae7e81253feb682704fc9f289f40d1c5f61265fb4d50
MD5 d927aee42422a52cd24ca14514c12c5b
SHA1 b21dc28ed1fd66eb9ae4bfa14636f8df071d9539
SHA512 e444ec30860d1d3a33c658fda452a2a7b4e61084519cecba5471844951f1d1dd1948a71269985bd55cb4abb24bd304386b9dca003ebc538ebfee87e3e99d8c4f
SSDEEP 196608:Vd0W8/9E66LkXMCHGLLc54i1wN+VPIcu9KYK39srRqZksfiU3PPkTMrROv5:VWW81OkXMCHWUj6cuIOeT3/PkT3
TLSH
T105A63388BBC400E8E897613DEDE02A97D6E974B503B486D74BF44EA12D632D4EE35713
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects Pyinstaller

pyinstaller
Unsigned PE

Checks for missing Authenticode signature.

Password

root

Minor OS version

Major OS version

Entry point

59248

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

user32

CreateWindowExW ShutdownBlockReasonCreate MsgWaitForMultipleObjects ShowWindow DestroyWindow RegisterClassW DefWindowProcW PeekMessageW DispatchMessageW TranslateMessage GetMonitorInfoW MonitorFromPoint GetCursorPos GetSystemMetrics PostMessageW GetMessageW MessageBoxW MessageBoxA SystemParametersInfoW DestroyIcon SetWindowLongPtrW GetWindowLongPtrW GetClientRect InvalidateRect ReleaseDC GetDC DrawTextW GetDialogBaseUnits EndDialog DialogBoxIndirectParamW MoveWindow SendMessageW

comctl32

ord380

kernel32

GetACP IsValidCodePage GetStringTypeW GetFileAttributesExW SetEnvironmentVariableW FlushFileBuffers LCMapStringW CompareStringW VirtualProtect GetCurrentDirectoryW HeapAlloc GetFileSizeEx GetConsoleOutputCP GetOEMCP GetCPInfo GetLastError FreeLibrary GetProcAddress LoadLibraryExW GetModuleHandleW MulDiv FormatMessageW CloseHandle GetCurrentProcess GetModuleFileNameW SetDllDirectoryW GetEnvironmentStringsW SetErrorMode GetCurrentProcessId OpenProcess QueryFullProcessImageNameW CreateToolhelp32Snapshot Process32FirstW Process32NextW CreateDirectoryW GetCommandLineW GetEnvironmentVariableW ExpandEnvironmentStringsW DeleteFileW FindClose FindFirstFileW FindNextFileW GetDriveTypeW RemoveDirectoryW GetTempPathW QueryPerformanceCounter QueryPerformanceFrequency WaitForSingleObject Sleep TerminateProcess GetExitCodeProcess CreateProcessW GetStartupInfoW LocalFree SetConsoleCtrlHandler K32EnumProcessModules K32GetModuleFileNameExW CreateFileW FindFirstFileExW GetFinalPathNameByHandleW MultiByteToWideChar WideCharToMultiByte SetFilePointerEx FreeEnvironmentStringsW GetProcessHeap GetTimeZoneInformation HeapSize HeapReAlloc WriteConsoleW SetEndOfFile CreateSymbolicLinkW GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter RtlUnwindEx SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection RtlLookupFunctionEntry EncodePointer RaiseException RtlPcToFileHeader GetCommandLineA GetFileInformationByHandle GetFileType PeekNamedPipe SystemTimeToTzSpecificLocalTime FileTimeToSystemTime ReadFile GetFullPathNameW SetStdHandle GetStdHandle WriteFile ExitProcess GetModuleHandleExW IsProcessorFeaturePresent RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter HeapFree GetConsoleMode ReadConsoleW

advapi32

GetTokenInformation OpenProcessToken ConvertSidToStringSidW ConvertStringSecurityDescriptorToSecurityDescriptorW

gdi32

SelectObject DeleteObject CreateFontIndirectW

Name

.text

Size

200KB

Virtual Size

200KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

82KB

Virtual Size

82KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

10KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

61KB

Virtual Size

64KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

thoukeys/thykey.exe

IMPHASH f2997636f237562ce14e2a81240a7ee6
SHA256 a6f5cda2302f174e0790d2d31325b0a91596c10d2d9ea94504f0640bfc9053db
MD5 30e0d7006406115e990a50d20d93fa74
SHA1 02f26aabb1c36b6203ca41cb04ab4db38fca39c4
SHA512 a67cb9588a3828eb1a95daea2db70f0d0300e9eab01d9c8dc4f8de6aac28c6b41107e6ae3ee69ad8a48a8519aefe6b1711e05810af7bdb73fb8e9400a82b9672
SSDEEP 196608:vWG3xCICMdU5My34+OcgswKEu4SYdw3x2:v64+fc
TLSH
T158F68CC777275CEEC9A50374CDA723293374F844371E6F332608A6206D676D89E4AA93
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Password

root

Minor OS version

Major OS version

Entry point

5072

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

RegCloseKey RegOpenKeyExW RegQueryValueExW

gdi32

BitBlt ChoosePixelFormat CombineRgn CreateBitmap CreateCompatibleBitmap CreateCompatibleDC CreateDCW CreateDIBSection CreateFontIndirectW CreateFontW CreatePen CreateRectRgn CreateSolidBrush DeleteDC DeleteObject DescribePixelFormat ExtTextOutW GetDIBits GetDeviceCaps GetDeviceGammaRamp GetICMProfileW GetPixelFormat GetTextExtentPoint32A GetTextExtentPoint32W GetTextMetricsW Rectangle SelectObject SetBkMode SetDeviceGammaRamp SetPixelFormat SetTextColor SwapBuffers

imm32

ImmAssociateContext ImmGetCandidateListW ImmGetCompositionStringW ImmGetContext ImmGetIMEFileNameA ImmNotifyIME ImmReleaseContext ImmSetCandidateWindow ImmSetCompositionStringW ImmSetCompositionWindow

kernel32

CancelIo CloseHandle CompareStringA CreateDirectoryW CreateEventW CreateFileA CreateFileW CreateProcessA CreateSemaphoreW CreateThread DeleteCriticalSection DeviceIoControl EnterCriticalSection EnumResourceNamesW ExitProcess FormatMessageA FormatMessageW FreeLibrary GetCurrentProcess GetCurrentThread GetCurrentThreadId GetEnvironmentVariableA GetFileSizeEx GetFileTime GetLastError GetLocaleInfoA GetModuleFileNameW GetModuleHandleExW GetModuleHandleW GetOverlappedResult GetProcAddress GetSystemInfo GetSystemPowerStatus GetSystemTimeAsFileTime GetThreadId GetTickCount GlobalAlloc GlobalLock GlobalMemoryStatusEx GlobalUnlock InitializeConditionVariable InitializeCriticalSection InitializeCriticalSectionAndSpinCount IsDBCSLeadByteEx IsDebuggerPresent LeaveCriticalSection LoadLibraryA LoadLibraryExW LoadLibraryW LocalFree MulDiv MultiByteToWideChar OutputDebugStringW QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReadFile ReleaseSemaphore ResetEvent RtlCaptureContext RtlLookupFunctionEntry RtlUnwindEx RtlVirtualUnwind SetEnvironmentVariableA SetErrorMode SetFilePointer SetFilePointerEx SetLastError SetThreadExecutionState SetThreadPriority SetUnhandledExceptionFilter Sleep SleepConditionVariableCS TerminateProcess TerminateThread TlsAlloc TlsFree TlsGetValue TlsSetValue TryEnterCriticalSection VerSetConditionMask VerifyVersionInfoW VirtualProtect VirtualQuery WaitForSingleObject WaitForSingleObjectEx WakeAllConditionVariable WakeConditionVariable WideCharToMultiByte WriteFile

msvcrt

__C_specific_handler ___lc_codepage_func ___mb_cur_max_func __getmainargs __initenv __iob_func __set_app_type __setusermatherr _amsg_exit _cexit _commode _errno _filelengthi64 _fileno _fmode _fstat64 _get_osfhandle _i64toa _initterm _isctype _lock _lseeki64 _ltoa _onexit _stricmp _strlwr _strnicmp _strrev _strupr _ui64toa _ultoa _unlock _wcsicmp _wcsnicmp _wfopen abort acos asin atan atof atoi bsearch calloc exit fclose ferror fflush fgetpos fgets fopen fprintf fputc fputs fread free fsetpos fwrite getc getenv getwc isalnum isalpha iscntrl isgraph islower isprint ispunct isspace isupper iswctype isxdigit ldexp localeconv log10 malloc memchr memcmp memcpy memmove memset putc putwc qsort rand realloc setlocale setvbuf signal strchr strcmp strcoll strerror strftime strlen strncmp strrchr strstr strtol strtoul strxfrm system tan tolower toupper towlower towupper ungetc ungetwc vfprintf wcscmp wcscoll wcsftime wcslen wcsncmp wcsstr wcsxfrm _strtoui64 _strtoi64 _write _read _itoa _fileno _fdopen

ole32

CLSIDFromString CoCreateInstance CoInitializeEx CoTaskMemFree CoUninitialize PropVariantClear

oleaut32

SysFreeString

setupapi

CM_Get_Device_IDA CM_Get_Parent CM_Locate_DevNodeA SetupDiDestroyDeviceInfoList SetupDiEnumDeviceInfo SetupDiEnumDeviceInterfaces SetupDiGetClassDevsA SetupDiGetDeviceInterfaceDetailA SetupDiGetDeviceRegistryPropertyA

shell32

DragAcceptFiles DragFinish DragQueryFileW SHGetFolderPathW ShellExecuteW

user32

AdjustWindowRectEx AttachThreadInput CallNextHookEx CallWindowProcW ChangeDisplaySettingsExW ClientToScreen ClipCursor CloseClipboard CopyImage CreateIconFromResource CreateIconIndirect CreateWindowExA CreateWindowExW DefWindowProcW DestroyIcon DestroyWindow DialogBoxIndirectParamW DispatchMessageW DrawTextW EmptyClipboard EndDialog EnumDisplayDevicesW EnumDisplayMonitors EnumDisplaySettingsW FillRect FlashWindowEx GetAsyncKeyState GetClassInfoExW GetClientRect GetClipCursor GetClipboardData GetClipboardSequenceNumber GetCursorPos GetDC GetDesktopWindow GetDlgItem GetDoubleClickTime GetFocus GetForegroundWindow GetKeyState GetKeyboardLayout GetKeyboardState GetMenu GetMessageExtraInfo GetMessageTime GetMessageW GetMonitorInfoW GetParent GetPropW GetRawInputData GetRawInputDeviceInfoA GetRawInputDeviceList GetSystemMetrics GetUpdateRect GetWindowLongPtrW GetWindowLongW GetWindowRect GetWindowTextLengthW GetWindowTextW GetWindowThreadProcessId IntersectRect InvalidateRect IsClipboardFormatAvailable IsIconic KillTimer LoadCursorW LoadIconW MapVirtualKeyW MessageBoxA MonitorFromPoint MonitorFromRect MonitorFromWindow MsgWaitForMultipleObjects OpenClipboard PeekMessageW PostMessageW PostThreadMessageW PtInRect RegisterClassExA RegisterClassExW RegisterClassW RegisterDeviceNotificationW RegisterRawInputDevices RegisterWindowMessageA ReleaseCapture ReleaseDC RemovePropW ScreenToClient SendMessageW SetActiveWindow SetCapture SetClipboardData SetCursor SetCursorPos SetFocus SetForegroundWindow SetLayeredWindowAttributes SetPropW SetTimer SetWindowLongPtrW SetWindowLongW SetWindowPos SetWindowRgn SetWindowTextW SetWindowsHookExW ShowWindow SystemParametersInfoA SystemParametersInfoW ToUnicode TrackMouseEvent TranslateMessage UnhookWindowsHookEx UnregisterClassA UnregisterClassW UnregisterDeviceNotification ValidateRect

version

GetFileVersionInfoA GetFileVersionInfoSizeA VerQueryValueA

winmm

timeBeginPeriod timeEndPeriod waveInAddBuffer waveInClose waveInGetDevCapsW waveInGetNumDevs waveInOpen waveInPrepareHeader waveInReset waveInStart waveInUnprepareHeader waveOutClose waveOutGetDevCapsW waveOutGetErrorTextW waveOutGetNumDevs waveOutOpen waveOutPrepareHeader waveOutReset waveOutUnprepareHeader waveOutWrite

Name

.text

Size

1.8MB

Virtual Size

1.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

111KB

Virtual Size

110KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

359KB

Virtual Size

359KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

98KB

Virtual Size

98KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

107KB

Virtual Size

106KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

16KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

13KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

Size

12KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/19

Size

5.2MB

Virtual Size

5.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/31

Size

204KB

Virtual Size

204KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/45

Size

1.1MB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/57

Size

259KB

Virtual Size

259KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/70

Size

153KB

Virtual Size

153KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/81

Size

2.8MB

Virtual Size

2.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/92

Size

509KB

Virtual Size

509KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/106

Size

12KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/122

Size

75KB

Virtual Size

75KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/138

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

thoukeys.zip

thoukeys/bore.exe

user32

comctl32

kernel32

advapi32

gdi32

generic

bore.pyc

thoukeys/thykey.exe

advapi32

gdi32

imm32

kernel32

msvcrt

ole32

oleaut32

setupapi

shell32

user32

version

winmm

generic