megoocolab-runner_0[.]8[.]1_windows_amd64[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
megoocolab-runner_0.8.1_windows_amd64.zip
Size 3.4MB
Sample261113-zncd8sgv71
SHA256 2368c567027c42b890554117f9893d8340a3ac0df4294a1903b4ad107dbb545d
MD5 d5ca421b44ee4bef85de27c46628536f
SHA1 b1e6dc26320c38b2f834074acec781eb8c2beb7c
SHA512 1f2b668dba3cd80f739e7eca31e0926677694d685c77987d07f9656ceacdfaedba6301cd0dbac722f220fdc1e105fb56e40f6890425c4756e1c7ee4218927ad1
SSDEEP 98304:9pn41AZ4dIS5O1MoI/j7hUGu5kdC9E6xUeqCfoPbTkEOBEn5w83p:/SygSC/ZUGuOdCueqCfoDTBZnp5
TLSH
T1A6F533F76A0A15BB876CC96F12A6F319B391A32C8D0F49838779F3D7562514203CE99C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/megoocolab-runner.exe

File Explorer

megoocolab-runner_0.8.1_windows_amd64.zip

.zip 3.4MB
README.md

6KB
megoocolab-runner.exe

.exe 8.1MB

megoocolab-runner_0.8.1_windows_amd64.zip

SHA256 2368c567027c42b890554117f9893d8340a3ac0df4294a1903b4ad107dbb545d
MD5 d5ca421b44ee4bef85de27c46628536f
SHA1 b1e6dc26320c38b2f834074acec781eb8c2beb7c
SHA512 1f2b668dba3cd80f739e7eca31e0926677694d685c77987d07f9656ceacdfaedba6301cd0dbac722f220fdc1e105fb56e40f6890425c4756e1c7ee4218927ad1
SSDEEP 98304:9pn41AZ4dIS5O1MoI/j7hUGu5kdC9E6xUeqCfoPbTkEOBEn5w83p:/SygSC/ZUGuOdCueqCfoDTBZnp5
TLSH
T1A6F533F76A0A15BB876CC96F12A6F319B391A32C8D0F49838779F3D7562514203CE99C
MD5 SHA1 SHA512 SSDEEP TLSH

megoocolab-runner.exe

IMPHASH d42595b695fc008ef2c56aabd8efd68e
SHA256 574d06d747a2364bb205fd641c3f5015b777822cad9cc9e7b562d1bbacbf3a19
MD5 af22f1ab20d1be5931a40e1085ede84c
SHA1 7dd3e6f8c02c781a5e0687ed32b678de662da2b1
SHA512 806e54d33b35735470b03e56f0e77b79f28923c275d30b6d5c352e1e958c39e834df44580a1666c99f109155ef5babace8ce679b7069f95fe8e967ee8df2e9fc
SSDEEP 49152:wVQ2fu+SrC4mBN6NvhmsGXZ6zAKBTPJp7LMwT/X5eKBPaTlHPplqDtWkCJwe6gii:weXCtA5JdLMG/XtPaTlvw4gnLKtE2
TLSH
T15A863907E9A549E9C4A9D534CA229223BF717C495B3123D32B60F7282F77BD06EB9350
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

510368

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

.text

Size

3.7MB

Virtual Size

3.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

3.8MB

Virtual Size

3.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

410KB

Virtual Size

755KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

84KB

Virtual Size

84KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

512B

Virtual Size

180B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

74KB

Virtual Size

73KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.symtab

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

megoocolab-runner_0.8.1_windows_amd64.zip

README.md

megoocolab-runner.exe

kernel32

generic