doubleback | da482b46353f652ea536d29cc0709537512dbee701e8d026497676e8cf4ad36b | Triage

Sharing

General

Target

da482b46353f652ea536d29cc0709537512dbee701e8d026497676e8cf4ad36b
Size

52KB
MD5

9bb745f96f1afe73dc77f640d968c8a2
SHA1

f13287ed1cefa1da141005158d8db2f3b1505d08
SHA256

da482b46353f652ea536d29cc0709537512dbee701e8d026497676e8cf4ad36b
SHA512

b5cde3dbd779e9567e98dc63bbbd0ae23aa1d786cb7ce5af1639ef7400764afa26528e811e66310622bd564908edf6c65a385fe5697eee100f7c6a1612848581
SSDEEP

768:1aAQaSH1F5D82DP0ZchCWRUjKtus6raeuLKfaNR3Q:rkp8A0SM06SX3Q

Score

10^/10

doubleback

Malware Config

Signatures

DoubleBack x64 Payload 1 IoCs

Processes:

resource	yara_rule
sample	family_doubleback_x64

Doubleback family
doubleback

Files

da482b46353f652ea536d29cc0709537512dbee701e8d026497676e8cf4ad36b
.dll windows x64

Code Sign

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Sections

.text
Size: 27KB - Virtual size: 26KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 624B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ