Hostile ^93% gem 6,416,127 installs Download

ruby_smb 3.3.13

Metasploit framework dependency

“A pure Ruby implementation of the SMB Protocol Family”

JScript dropper that executes payload via rundll32Injected SPIP filter executes request value

SHA-25672e5b7a929722337adb538b03784109759c27cedb9fc1e5f08569cfd634a9f6c

URLhttps://rubygems.org/downloads/ruby_smb-3.3.13.gem

MaleculeK(Te)O(La)H₇(Cm₃Cr₄Db₄FOs₅Po₆U)Md₂(Pa₂)

Evidence

ReflectiveLoader export or name string uso_trigger.x64.dll · 0x17356–0x174e6

⋯7 more rows
0x173c6747269676765722e7836342e646c6c00trigger.x64.dll.
0x173d63f5265666c6563746976654c6f616465?ReflectiveLoade
0x173e672404059415f4b50454158405a00308er@@[email protected].
0x173f601000000000000000000a49001000000................
⋯15 more rows

Writable .text section ppr_flatten_rec.x86.dll · 0x380–0x650

⋯7 more rows
0x3f000000000000000000000000000000000................
0x400558bec8b45045dc3558bec83ec3033c0U...E.].U....03.
0x4105356578945e48945e08945ec8945dc89SVW.E..E..E..E..
0x42045e8e8d9ffffff8bf0b84d5a00006639E.........MZ..f9
0x4300675178b463c8d48c081f9bf03000077.u..F<.H.......w
0x44009813c305045000074034eebdc64a130..<0PE..t.N..d.0
0x4500000008975fcc745d002000000c745d4....u..E......E.
0x460010000008b400c8b5814895df085db0f[email protected]..]....
0x47084b00100008b532833c90fb77b248a02......S(3...{$..
0x480c1c90d3c610fb6c0720383c1e003c881...<a...r.......
0x490c7ffff0000426685ff75e381f95bbc4a.....Bf..u...[.J
0x4a06a0f85cf0000008b7b10c745f8040000j.......{..E....
0x4b0008b473c8b44387803c78945d88b7020..G<.D8x...E..p 
0x4c08b402403f703c78945f48bd88b0e03cf.@$.....E.......
0x4d033d28a01c1ca0d0fbec003d0418a01843...........A...
0x4e0c075f181fa8e4e0eec741881faaafc0d.u....N..t......
0x4f07c741081fa54caaf91740881faf232f6|t...T...t....2.
0x5000e755d8b45d80fb70b8b401c8d048803.u].E.....@.....
0x510c781fa8e4e0eec75098b0003c78945e4....N..u......E.
0x520eb3181faaafc0d7c75098b0003c78945.1.....|u......E
0x530e0eb2081fa54caaf9175098b0003c789.. ..T...u......
0x54045eceb0f81faf232f60e75078b0003c7E......2..u.....
0x5508945e88b45f805ffff00008945f8eb03.E..E.......E...
0x5608b45f86a025983c60403d96685c00f85.E.j.Y.....f....
0x57058ffffffeb7e81f95d68fa3c75798b53X....~..]h.<uy.S
0x580108b423c8b44107803c28945d88b75d8..B<.D.x...E..u.
0x5908b58208b402403da03c28945f433c040.X .@$.....E.3.@
0x5a08945f88b0b03ca33ff8a01c1cf0d0fbe.E.....3........
0x5b0c003f8418a0184c075f181ffb80a4c53...A....u.....LS
0x5c075218b45f40fb7088b461c8d04888b04u!.E.....F......
0x5d01003c28945dc8b45f805ffff00008945....E..E.......E
0x5e0f8eb038b45f86a0259014df483c30466....E.j.Y.M....f
0x5f085c075af8b5df0837de4007418837de0..u..]..}..t..}.
0x600007412837dec00740c837de800740683.t..}..t..}..t..
0x6107ddc00750d8b1b895df085db0f8553fe}..u....].....S.
0x620ffff8b75fc8b5e3c6a4003de68003000...u..^<[email protected].
0x63000895df0ff73506a00ff55ecff73508b..]..sPj..U..sP.
0x640f857897df4ff55e88b53548bce85d274.W.}..U..ST....t
0x650128bc72bc68945d88bf08a0188040e41...+..E........A

Stdcall ReflectiveLoader export symbol ppr_flatten_rec.x86.dll · 0xf0ea–0xf27a

⋯7 more rows
0xf15a74656e5f7265632e7838362e646c6c00ten_rec.x86.dll.
0xf16a5f5265666c6563746976654c6f616465_ReflectiveLoade
0xf17a724034000000ec010100000000000000r@4.............
0xf18a0000cc0301001cc00000000301000000................
⋯15 more rows

References high-risk Windows token privilege vncdll.x64.dll · 0x13a60–0x13cf0

⋯7 more rows
0x13ad03123494e460000003123514e414e00001#INF...1#QNAN..
0x13ae05265666c6563746976654c6f61646572ReflectiveLoader
0x13af000000000000000005c5c2e5c70697065........\\.\pipe
0x13b005c25303858000000494d470000000000\%08X...IMG.....
0x13b104944525f564e435f444c4c0000000000IDR_VNC_DLL.....
0x13b202f76202f633a30782530387000000000/v /c:0x%08p....
0x13b306e74646c6c0000004e74517565756541ntdll...NtQueueA
0x13b4070635468726561640000000002000000pcThread........
0x13b506b65726e656c33322e646c6c00000000kernel32.dll....
⋯5 more rows
0x13bb06f6c6553657373696f6e496400000000oleSessionId....
0x13bc05365446562756750726976696c656765SeDebugPrivilege
0x13bd000000000000000006b65726e656c3332........kernel32
0x13be00000000000000000437265617465546f........CreateTo
0x13bf06f6c68656c703332536e617073686f74olhelp32Snapshot
0x13c00000000000000000050726f6365737333........Process3
0x13c10324669727374000050726f63657373332First..Process3
0x13c20324e65787400000063737273732e65782Next...csrss.ex
0x13c3065000000000000000000000000000000e...............
0x13c4070000000000000000000000000000000p...............
⋯11 more rows

References the Windows debugger output API vncdll.x64.dll · 0x151aa–0x1546a

⋯7 more rows
0x1521a6e416e645370696e436f756e7400ce04nAndSpinCount...
0x1522a5465726d696e61746550726f63657373TerminateProcess
0x1523a0000d304546c73416c6c6f630000d504....TlsAlloc....
⋯14 more rows
0x1532a40034c6f61644c696272617279457857@.LoadLibraryExW
0x1533a00008c034f7574707574446562756753....OutputDebugS
0x1534a7472696e67570000da02486561705265tringW....HeapRe
0x1535a416c6c6f630094045365745374644861Alloc...SetStdHa
⋯17 more rows

No evidence locations were recorded for this file. Raw result