E:\DrakeUI.Framework\DrakeUI.Framework\DrakeUI.Framework\obj\Release\DrakeUI.Framework.pdb
Behavioral task
behavioral1
Sample
C2Panel-main.zip
Resource
win7-20240221-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
C2Panel-main.zip
Resource
win10v2004-20240611-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
C2Panel-main/C2Panel.exe
Resource
win7-20240508-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral4
Sample
C2Panel-main/C2Panel.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
0 signatures
150 seconds
General
-
Target
C2Panel-main.zip
-
Size
6.7MB
-
MD5
34c7eba3592f6797e1e1a9c386078498
-
SHA1
652f7a2f273e97374e924c4d46bca34c0799fe7b
-
SHA256
33d5f473188dd21420a51528eb548e3c496378de3e6ff0e0acc1855b324c0a32
-
SHA512
063f6c443bf2413ad1bff0bb71cd223b5bc2dfd35a0ad06b83f6e5ed6878d5a155cacc31472f03ddbaf0c6b5ecf98d9ce1f8a2bf4a50cf10b34fb1fbff85540f
-
SSDEEP
196608:Cc8fq2ComB5bpXRCX2Xmb8jYYr3t/Wa6bfUognh+:CpGnNXRW2XOWvrd/Wa6DUog+
Score
7/10
Malware Config
Signatures
-
Obfuscated with Agile.Net obfuscator 1 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
Processes:
resource yara_rule static1/unpack001/C2Panel-main/LiveCharts.MAPS.dll agile_net -
Unsigned PE 7 IoCs
Checks for missing Authenticode signature.
Processes:
resource unpack001/C2Panel-main/C2Panel.exe unpack001/C2Panel-main/DrakeUI.Framework.dll unpack001/C2Panel-main/GeoIPCitys.dll unpack001/C2Panel-main/HVMRun64.dll unpack001/C2Panel-main/HVMRuntm.dll unpack001/C2Panel-main/LiveCharts.MAPS.dll unpack001/C2Panel-main/LiveCharts.dll
Files
-
C2Panel-main.zip.zip
-
C2Panel-main/C2Panel.exe.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 145KB - Virtual size: 144KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 329KB - Virtual size: 328KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.kbvtrz Size: 3KB - Virtual size: 4KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
C2Panel-main/DrakeUI.Framework.dll.dll windows:4 windows x86 arch:x86
dae02f32a21e03ce65412f6e56942daa
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB Paths
Imports
mscoree
_CorDllMain
Sections
.text Size: 1.6MB - Virtual size: 1.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
C2Panel-main/GeoIPCitys.dll.dll windows:4 windows x86 arch:x86
dae02f32a21e03ce65412f6e56942daa
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB Paths
C:\Users\EVLF\source\repos\GeoIPCitys\GeoIPCitys\obj\Debug\GeoIPCitys.pdb
Imports
mscoree
_CorDllMain
Sections
.text Size: 189KB - Virtual size: 189KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 904B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
C2Panel-main/HVMRun64.dll.dll windows:4 windows x64 arch:x64
2843de49dbfe3d6c40e1db4b51e9fa5e
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
Imports
kernel32
GetCurrentProcess
GetModuleFileNameA
__C_specific_handler
ReadFile
CloseHandle
CreateFileA
InitializeCriticalSection
GetModuleHandleA
IsBadReadPtr
SizeofResource
LockResource
LoadResource
FindResourceA
FindResourceExA
WideCharToMultiByte
FreeLibrary
GetProcAddress
LoadLibraryA
WaitForSingleObject
GetCurrentThreadId
GetTickCount
CreateEventA
DisableThreadLibraryCalls
lstrcatA
VirtualProtect
lstrlenA
Sleep
SetEvent
GetVolumeInformationA
GetWindowsDirectoryA
GetCurrentProcessId
MultiByteToWideChar
GetLastError
CompareStringA
CompareStringW
HeapFree
GetProcessHeap
SetFilePointer
QueryPerformanceCounter
GetEnvironmentStringsW
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
VirtualQuery
LeaveCriticalSection
EnterCriticalSection
SetEnvironmentVariableA
DeleteCriticalSection
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetConsoleMode
GetConsoleCP
HeapCreate
HeapSetInformation
SetStdHandle
WriteFile
IsValidCodePage
GetOEMCP
GetCPInfo
GetStartupInfoA
GetFileType
GetStdHandle
SetHandleCount
GetTimeZoneInformation
RtlVirtualUnwind
FlsAlloc
TlsSetValue
SetLastError
FlsFree
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
FlushFileBuffers
HeapDestroy
HeapAlloc
HeapReAlloc
HeapSize
GetACP
GetLocaleInfoA
GetThreadLocale
GetVersionExA
RaiseException
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlCaptureContext
RtlLookupFunctionEntry
RtlUnwindEx
RtlPcToFileHeader
GetSystemTimeAsFileTime
ExitThread
ResumeThread
CreateThread
ExitProcess
FlsSetValue
GetCommandLineA
FlsGetValue
TlsFree
user32
MessageBoxA
UnregisterClassA
wsprintfA
advapi32
RegQueryValueExA
RegCreateKeyExA
RegCloseKey
RegSetValueExA
oleaut32
SysAllocString
SafeArrayGetDim
SafeArrayGetElemsize
SafeArrayDestroyDescriptor
SafeArrayCreate
VariantCopyInd
VariantChangeType
SysStringLen
SafeArrayUnlock
SafeArrayLock
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayGetElement
SafeArrayDestroy
SafeArrayPutElement
VariantInit
SysFreeString
SysStringByteLen
SysAllocStringByteLen
SafeArrayCreateVector
SafeArrayAccessData
SafeArrayUnaccessData
GetErrorInfo
VariantClear
version
GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA
Exports
Exports
VMRuntime
Sections
.text Size: 353KB - Virtual size: 352KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 162KB - Virtual size: 161KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 115KB - Virtual size: 127KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 25KB - Virtual size: 25KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.hvm0 Size: 3.7MB - Virtual size: 3.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 15KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 1014B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
C2Panel-main/HVMRuntm.dll.dll windows:4 windows x86 arch:x86
b2ff0f091ba14e9fe411060ab1560c66
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GetCurrentProcess
GetModuleFileNameA
ReadFile
CloseHandle
CreateFileA
InitializeCriticalSection
GetModuleHandleA
InterlockedDecrement
IsBadReadPtr
SizeofResource
LockResource
LoadResource
FindResourceA
FindResourceExA
WideCharToMultiByte
FreeLibrary
GetProcAddress
LoadLibraryA
WaitForSingleObject
GetCurrentThreadId
GetTickCount
CreateEventA
DisableThreadLibraryCalls
lstrcatA
VirtualProtect
lstrlenA
Sleep
SetEvent
GetVolumeInformationA
GetWindowsDirectoryA
SetEnvironmentVariableA
GetCurrentProcessId
InterlockedExchange
MultiByteToWideChar
GetLastError
CompareStringA
CompareStringW
InterlockedIncrement
HeapFree
GetProcessHeap
SetFilePointer
QueryPerformanceCounter
GetEnvironmentStringsW
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
VirtualQuery
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
SetStdHandle
GetConsoleMode
GetConsoleCP
HeapCreate
VirtualFree
WriteFile
IsValidCodePage
GetOEMCP
GetCPInfo
GetStartupInfoA
GetFileType
GetStdHandle
SetHandleCount
GetTimeZoneInformation
SetLastError
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
FlushFileBuffers
HeapDestroy
HeapAlloc
HeapReAlloc
HeapSize
GetACP
GetLocaleInfoA
GetThreadLocale
GetVersionExA
RaiseException
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlUnwind
GetSystemTimeAsFileTime
ExitThread
ResumeThread
CreateThread
ExitProcess
VirtualAlloc
GetCommandLineA
user32
MessageBoxA
UnregisterClassA
wsprintfA
advapi32
RegQueryValueExA
RegCreateKeyExA
RegCloseKey
RegSetValueExA
oleaut32
SysAllocString
SafeArrayGetDim
SafeArrayGetElemsize
SafeArrayDestroyDescriptor
SafeArrayCreate
VariantCopyInd
VariantChangeType
SysStringLen
SafeArrayUnlock
SafeArrayLock
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayGetElement
SafeArrayDestroy
SafeArrayPutElement
VariantClear
VariantInit
SysFreeString
SysStringByteLen
SafeArrayCreateVector
SafeArrayAccessData
SafeArrayUnaccessData
GetErrorInfo
SysAllocStringByteLen
version
GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA
Exports
Exports
VMRuntime
Sections
.text Size: 264KB - Virtual size: 263KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 84KB - Virtual size: 83KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 112KB - Virtual size: 120KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.hvm0 Size: 1.7MB - Virtual size: 1.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 32KB - Virtual size: 30KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 1010B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
C2Panel-main/LiveCharts.MAPS.dll.dll windows:4 windows x86 arch:x86
dae02f32a21e03ce65412f6e56942daa
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB Paths
C:\Users\erand\Dropbox\Dev\ag.v66\Libraries\VMRuntime\obj\Trial\AgileDotNet.VMRuntime.pdb
Imports
mscoree
_CorDllMain
Sections
.text Size: 50KB - Virtual size: 50KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
C2Panel-main/LiveCharts.dll.dll windows:4 windows x86 arch:x86
dae02f32a21e03ce65412f6e56942daa
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
c:\Users\btord\Documents\Projects\LiveCharts\Core40\obj\Release\LiveCharts.pdb
Imports
mscoree
_CorDllMain
Sections
.text Size: 146KB - Virtual size: 146KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 912B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
C2Panel-main/LiveCharts.pdb
-
C2Panel-main/README.md