Static task
static1
Behavioral task
behavioral1
Sample
c76eaa1700b86d6dccf2662ec5dc92c884b72037c6d963a36705461b466ddb99.dll
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
c76eaa1700b86d6dccf2662ec5dc92c884b72037c6d963a36705461b466ddb99.dll
Resource
win10v2004-en-20220113
General
-
Target
c76eaa1700b86d6dccf2662ec5dc92c884b72037c6d963a36705461b466ddb99
-
Size
48KB
-
MD5
9f4863dc7d3ced05539183ddcb0a2f88
-
SHA1
5bfa025daa3724b7aaae25ceefb8e3166703c042
-
SHA256
c76eaa1700b86d6dccf2662ec5dc92c884b72037c6d963a36705461b466ddb99
-
SHA512
cfa8dc9f7816841a87ae1ef31a8d440f5881a5c4c066fbc097f5d654c02584081453499026764fcd723db6f6cb3a64e67e50da8e9b41b8814ef336022bf8072c
-
SSDEEP
384:7NkZuwciwjZ5TLiWnL/nZv/6MZuoQZ6d6PcLqnO8F3OOro95D4RkN5mOWsBlNi:7NkcJiYTtnL/J/ZHQ3FOfRrNCM
Malware Config
Signatures
-
DoubleBack x86 Payload 1 IoCs
Processes:
resource yara_rule sample family_doubleback_x86 -
Doubleback family
Files
-
c76eaa1700b86d6dccf2662ec5dc92c884b72037c6d963a36705461b466ddb99.dll windows x86
Code Sign
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 20KB - Virtual size: 20KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 104B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1024B - Virtual size: 792B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ