Trojan.MSIL.Heracles.YE
Table of Contents
Analysis Report
General information
| Family Name: | Trojan.MSIL.Heracles.YE |
|---|---|
| Signature status: | No Signature |
Known Samples
Known Samples
This section lists other file samples believed to be associated with this family.|
MD5:
0110add815e924c4da617fa60e4c2cf1
SHA1:
649cfcb6e6c86014570666fe6b3ac5087ae4cf10
SHA256:
89BD93F5D70BD9E4C9619F51786D3566F3758D50CE405325ED112A9EAF1AEA7F
File Size:
9.46 MB, 9457152 bytes
|
|
MD5:
f145af39a0bd1fe3fa199fce567b8dd7
SHA1:
04ee056ae715c5ff7e23b73a99600f67df63b9bd
SHA256:
EBD0D19A6FAB4306027FCB3FBD5CD6E146595E3ED1A2C910030A23D2A65057E6
File Size:
8.45 MB, 8447550 bytes
|
|
MD5:
f4b4c99dcf304a672a0ed4d16014bfa9
SHA1:
a5719d65bf4d2791d03bebdb76ce2901aefff47b
SHA256:
2C118CE9250AE9FFB95E9C5B3A18A4A94ADDC82F32EC56D28B20056FC5C1B663
File Size:
7.53 MB, 7527660 bytes
|
|
MD5:
ab1adea7856532d9e49c35d5fde303f2
SHA1:
e14a59b8ee50647e37ad46addb0e06c3aa8b476c
SHA256:
06BEE243A9A4F4CD02F3FFE8B5FB3F0F848280B4F96880A9BC30664BA06AC912
File Size:
8.84 MB, 8836787 bytes
|
|
MD5:
665db85cc8b35041c80b036fdb532f51
SHA1:
bca3b2accadbf8438d73b0d7327655f52ab60854
SHA256:
240772475556B1DD296338BED41B005D8655B34D94A54E83EBEA89DF5B1622E4
File Size:
8.83 MB, 8826880 bytes
|
Show More
|
MD5:
e7da24902279eb005a7fa61043f3be88
SHA1:
69b9edb0e0dd7005d60683fa9744803dbd3bff61
SHA256:
066BC9386A74D5D03D6B82DA6C1A8B971BCABA663027AEDBFE907BF678C9C536
File Size:
7.46 MB, 7464448 bytes
|
|
MD5:
88599babd9df02422be1a8a9ac051352
SHA1:
4e17f22e3a3f2fdcb894c49f21fd14c0068b7b6b
SHA256:
80C535D696DF99D536875CE114F00340914F7F407CEEAC2E5B4FC9A111A65EE9
File Size:
6.36 MB, 6355304 bytes
|
|
MD5:
ff34d6f994acf51ffd97cec3eeaccd75
SHA1:
94e029aad4804a9f78d341e285069f6e4617e4be
SHA256:
D430677C6C2082C04456D9E13E1C1081F602F08843EBE59FD356FE683662B8AB
File Size:
7.05 MB, 7049955 bytes
|
|
MD5:
2a6315b78fcfa264027522e73c42f0ee
SHA1:
2f16f17dd79bbfdd4fefb97dd8eda8c68f411abd
SHA256:
814DDD49AEF0DBF1AD28CF758E969D8DC86B77F540116E4026E2B827030B9E8A
File Size:
6.32 MB, 6318893 bytes
|
|
MD5:
c68fc4915dc96b8352bb18f1880dbdd0
SHA1:
215accbdbc5b0a27acd4476c91d890e2388a8de1
SHA256:
B1603381AF961C7F6FF0FBE99219387559F409244122378BFDABE22E72BDA643
File Size:
8.40 MB, 8396882 bytes
|
|
MD5:
30e6d191d999e0506775b739ebc222a4
SHA1:
862a6ddaf5224d794d2e0acb935236d092e053ae
SHA256:
0E5D31C59AA4B34F560A67D56650C2C1D2F180B647C93CACA7D3899BBC1CA1BE
File Size:
7.45 MB, 7446092 bytes
|
Windows Portable Executable Attributes
- File doesn't have "Rich" header
- File doesn't have debug information
- File doesn't have exports table
- File doesn't have relocations information
- File doesn't have security information
- File is .NET application
- File is 32-bit executable
- File is either console or GUI application
- File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
- File is Native application (NOT .NET application)
Show More
- File is not packed
- IMAGE_FILE_DLL is not set inside PE header (Executable)
- IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)
File Icons
File Icons
This section displays icon resources found within family samples. Malware often replicates icons commonly associated with legitimate software to mislead users into believing the malware is safe.
Windows PE Version Information
Windows PE Version Information
This section displays values and attributes that have been set in the Windows file version information data structure for samples within this family. To mislead users, malware actors often add fake version information mimicking legitimate software.| Name | Value |
|---|---|
| Assembly Version | 1.0.0.0 |
| Comments |
|
| Company Name |
|
| File Description |
Show More
|
| File Version |
|
| Internal Name |
|
| Legal Copyright |
|
| Original Filename |
Show More
|
| Product Name |
Show More
|
| Product Version |
|
File Traits
- .NET
- HighEntropy
- x86
Files Modified
Files Modified
This section lists files that were created, modified, moved and/or deleted by samples in this family. File system activity can provide valuable insight into how malware functions on the operating system.| File | Attributes |
|---|---|
| \device\namedpipe | Generic Read,Write Attributes |
| \device\namedpipe | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsa51bc.tmp\nsexec.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsb43e7.tmp\nsexec.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nskd096.tmp\nsexec.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsna8bf.tmp\nsexec.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsqbe06.tmp\nsexec.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsse17e.tmp\nsexec.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsv41a5.tmp\nsexec.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsx9523.tmp\nsexec.dll | Generic Write,Read Attributes |
Registry Modifications
Registry Modifications
This section lists registry keys and values that were created, modified and/or deleted by samples in this family. Windows Registry activity can provide valuable insight into malware functionality. Additionally, malware often creates registry values to allow itself to automatically start and indefinitely persist after an initial infection has compromised the system.| Key::Value | Data | API Name |
|---|---|---|
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\conhost.exe | RegNtPreCreateKey | |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\conhost.exe | ณ詚谯ǜ | RegNtPreCreateKey |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\conhost.exe | ኳ룧鎷ǜ | RegNtPreCreateKey |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\conhost.exe | 潴踽镝ǜ | RegNtPreCreateKey |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\conhost.exe | 䰝隍飲ǜ | RegNtPreCreateKey |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\conhost.exe | RegNtPreCreateKey | |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\conhost.exe | 믬냦ꋌǜ | RegNtPreCreateKey |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\conhost.exe | 㪈ǜ | RegNtPreCreateKey |
Windows API Usage
Windows API Usage
This section lists Windows API calls that are used by the samples in this family. Windows API usage analysis is a valuable tool that can help identify malicious activity, such as keylogging, security privilege escalation, data encryption, data exfiltration, interference with antivirus software, and network request manipulation.| Category | API |
|---|---|
| Syscall Use |
Show More
|
| User Data Access |
|
| Encryption Used |
|
| Anti Debug |
|
| Process Manipulation Evasion |
|
| Process Shell Execute |
|
Shell Command Execution
Shell Command Execution
This section lists Windows shell commands that are run by the samples in this family. Windows Shell commands are often leveraged by malware for nefarious purposes and can be used to elevate security privileges, download and launch other malware, exploit vulnerabilities, collect and exfiltrate data, and hide malicious activity.
powershell -Command "Add-MpPreference -ExclusionPath \"C:\Users\Jzwuefna\AppData\Local\""
|
powershell -Command "Add-MpPreference -ExclusionPath \"C:\Users\Xeaxopcm\AppData\Local\""
|
powershell -Command "Add-MpPreference -ExclusionPath \"C:\Users\Gnvkurpa\AppData\Local\""
|
powershell -Command "Add-MpPreference -ExclusionPath \"C:\Users\Oyxjswrp\AppData\Local\""
|
powershell -Command "Add-MpPreference -ExclusionPath \"C:\Users\Gluqdbkc\AppData\Local\""
|
Show More
powershell -Command "Add-MpPreference -ExclusionPath \"C:\Users\Uawbzybe\AppData\Local\""
|
powershell -Command "Add-MpPreferencaY23a1aY23a1 -ExclusionPath \"C:\Users\Wenbvarw\AppData\Local\""
|
powershell -Command "Add-MpPreferencaS95a1aS95a1 -ExclusionPath \"C:\Users\Tasnrpla\AppData\Local\""
|
