persistance.exe

First submission 2024-10-14 17:45:02

File details

File type: PE32+ executable (console) x86-64, for MS Windows
Mime type: application/x-dosexec
File size: 2648.63 KB (2712196 bytes)
Compile time: 2024-09-22 20:30:14
MD5: fb79af307b85682b1133f775dafcab83
SHA1: de2c8852c3b37bf589af631872df810fbad3a554
SHA256: fa04b82bc420f171b60b70316bba828de05782a3fd946cce7169b3a431af909a
Import Hash : 90e515923c3b276848e352c938e51804
Sections 19 .text .data .rdata .pdata .xdata .bss .idata .CRT .tls .rsrc .reloc /4 /19 /31 /45 /57 /70 /81 /97
Directories 4 import resource tls relocation

File features detected

Is DLL
Packers
Anti Debug
Anti VM
Signed
XOR

OSINT Enrichments

Virus Total: 31/77 VT report date: 2024-10-14 17:19:14
Malware Type 1 trojan
Threat Type 3 tasker dhhxc nekark

URLs, FQDN and IP indicators 1

URL Host (FQDN/IP) Date Added
hXXp://130.61.181.50/ransomware/persistance.exe VirusTotal Report 130.61.181.50 VirusTotal Report 2024-10-14 17:45:03

PE Sections 3 suspicious

Name VAddress VSize Size SHA1 MD5 Suspicious
.text 0x1000 0xba598 763392 3704a594c22b34a61623266265574a7579852808 c9f5044633b66585430d8691ca736e35
.data 0xbc000 0x2f40 12288 f82bbbc0b4740558d0a9999a9933238f1a6542b8 b350a38892ea6e36ea9594427fe94dff
.rdata 0xbf000 0x10e00 69120 772cbab2d0a0e76fcdc100f8c0630fbda631eb30 5555e8cb6bd3196204ccbb9ffe1310ec
.pdata 0xd0000 0xbf94 49152 3d233efc537a2d9a3c31f4fdaadd7b11701c402f 9a2bac6b913e9790413ec6046d74b15b
.xdata 0xdc000 0x10b24 68608 0a63d29949e757c5f5322e080a582ffe6382b046 61548f69667fbc93cde0491428fc628e
.bss 0xed000 0xd30 0 da39a3ee5e6b4b0d3255bfef95601890afd80709 d41d8cd98f00b204e9800998ecf8427e
.idata 0xee000 0x150c 5632 3b529b35c8e751b6218dffaa55b2ee0b38d14f5c fb30be41f4755ad25e1f8fc22b0708ed
.CRT 0xf0000 0x68 512 7f3f48870c6a1805c8e77fc9535a9abbd0a198e2 0148a710148f0fd988027ade1751507b
.tls 0xf1000 0x10 512 5c3eb80066420002bc3dcc7ca4ab6efad7ed4ae5 bf619eac0cdf3f68d496ea9344137e8b
.rsrc 0xf2000 0x4e8 1536 4fa0a867f6888732eea3783848ad269812818cba fa71eec3251932053b41fd475f7874bf
.reloc 0xf3000 0x1644 6144 76b893533525c87af87ce5ecebc7ed0d0b4f996c 30287ab0a15e1e7afd55c7099f6d1aa6
/4 0xf5000 0x5d0 1536 6f0dc4066e9dfd6ea415e17797f27fc1cbe2e55d dcb315c074480093d5b7b76cd2143543
/19 0xf6000 0x11f28 73728 cedd66a511f9dbc20aa93a722295dcd17df9bddc e85e187657ba9efc971fccac6db3a540
/31 0x108000 0xd5d 3584 bc50f77e931c067d3bffd301158045304d1d9c7b f843920baedf44d228ce8bac7bb350b2
/45 0x109000 0x154e 5632 670541d3933aca22a881c64b1d3a416a317d94df 9bdb2bdeed0b7fdc5e5a53683d3ad171
/57 0x10b000 0x1810 6656 ccb6bab0ee74eccc874c51fee5db6fcfb1a1c303 9fc2416f4909843b6f110f6c44dba974
/70 0x10d000 0x531 1536 aaa7b7d637435ff646ae3679c7a4c77800a07e4e f2194843463a2edafc799d2d77c1b5dd
/81 0x10e000 0x690 2048 c9c424ef6e4d672ab010baddfdaf17e9efca1cae a4ff79c14767d2668c94e4b6a9f6c9c0
/97 0x10f000 0x3d0 1024 5df2560eff394b8d7ee9e03aebf9a1bd2bdf8775 636eaf15e5eb9902ae3e5bfc1ea0ae7a

PE Resources 1

Name Language Sublanguage Offset Size Data
RT_MANIFEST LANG_NEUTRAL SUBLANG_NEUTRAL 0xf2058 1167

Anti debug functions 4

GetLastError
IsDebuggerPresent
OutputDebugStringA
RaiseException

Strings analysis - File found

Library
ADVAPI32.dll
MSVCRT.dll
SHELL32.dll
KERNEL32.dll

Strings analysis - Possible IPs found 1

130.61.181.50

Strings analysis - Possible URLs found 1

https://H

Import functions