doubleback | 99a0c3a57918273a370a2e9af1dc967e92846821c2198fcdddfc732f8cd15ae1

Sharing

Copy URL Twitter E-mail

General

Target
99a0c3a57918273a370a2e9af1dc967e92846821c2198fcdddfc732f8cd15ae1
Size 33KB
Sample220201-pt9a2sebfl
SHA256 99a0c3a57918273a370a2e9af1dc967e92846821c2198fcdddfc732f8cd15ae1
MD5 1aeecb2827babb42468d8257aa6afdeb
SHA1 653f6938e5521cf70596fc4a3f1d8c8eef21959a
SHA512 846874d5488fe6aebe39f7c84cdf43bb3af418835bf3bc87a0a799c108d4966121a46a5e8f5d17bd98e5fb376d09169de48e7ea1129dd1b3df72b4508dff9f4c
SSDEEP 768:WKydBQh5PbYHNta3y5FH/to6vm6z8SW9Etuqv79peSKjSmCNX:I6Pul5p/to6OeMv+5NX
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

doubleback

Malware Config

Signatures

DoubleBack x64 Payload 1 IoCs

resource	yara_rule
sample	family_doubleback_x64

Doubleback family
doubleback

File Explorer

99a0c3a57918273a370a2e9af1dc967e92846821c2198fcdddfc732f8cd15ae1

.dll 33KB

99a0c3a57918273a370a2e9af1dc967e92846821c2198fcdddfc732f8cd15ae1

IMPHASH 1e757709ceb1787cc53882e57b128e4c
SHA256 99a0c3a57918273a370a2e9af1dc967e92846821c2198fcdddfc732f8cd15ae1
MD5 1aeecb2827babb42468d8257aa6afdeb
SHA1 653f6938e5521cf70596fc4a3f1d8c8eef21959a
SHA512 846874d5488fe6aebe39f7c84cdf43bb3af418835bf3bc87a0a799c108d4966121a46a5e8f5d17bd98e5fb376d09169de48e7ea1129dd1b3df72b4508dff9f4c
SSDEEP 768:WKydBQh5PbYHNta3y5FH/to6vm6z8SW9Etuqv79peSKjSmCNX:I6Pul5p/to6OeMv+5NX
MD5 SHA1 SHA512 SSDEEP

windows x64

DoubleBack x64 Payload

Minor OS version

Major OS version

Entry point

17132

Magic Number

523

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

CreateToolhelp32Snapshot Process32Next UnmapViewOfFile DeleteFileW CreateFileMappingW MapViewOfFile FlushFileBuffers GetProcAddress GetSystemTime GlobalSize GlobalLock GlobalUnlock GlobalAlloc Process32First RtlAddFunctionTable RtlDeleteFunctionTable GetComputerNameA GetVolumeInformationW CreateMutexW GetLastError OpenMutexW GetCurrentDirectoryA CreatePipe QueryFullProcessImageNameA WaitForSingleObject CreateProcessA CreateProcessW SetHandleInformation lstrcpyW GetModuleHandleW Sleep GlobalFree MultiByteToWideChar lstrlenW RtlZeroMemory VirtualFree GetFileSize ReadFile GetCurrentProcessId LocalFree CloseHandle lstrcmpA GetCurrentThreadId CreateFileW LocalAlloc OutputDebugStringA WriteFile lstrcpyA lstrlenA VirtualAlloc lstrcmpW

user32

GetSystemMetrics ReleaseDC GetDC wsprintfA wsprintfW

gdi32

CreateCompatibleDC DeleteObject SelectObject CreateCompatibleBitmap BitBlt

advapi32

RegQueryValueExW RegOpenKeyExA RegEnumKeyExA GetTokenInformation RegDeleteKeyW RegDeleteTreeW RegDeleteValueW RegEnumValueW CryptAcquireContextA CryptCreateHash CryptHashData CryptDestroyHash CryptGetHashParam CryptReleaseContext RegCreateKeyExW RegCloseKey RegSetValueExW RegOpenKeyExW GetUserNameA GetSidSubAuthority GetSidSubAuthorityCount OpenProcessToken

shell32

SHGetSpecialFolderPathW

ole32

StringFromGUID2 CreateStreamOnHGlobal GetHGlobalFromStream CoUninitialize CoInitialize

ntdll

LdrLoadDll NtWriteVirtualMemory NtResumeThread RtlImageDirectoryEntryToData NtTerminateThread LdrGetDllHandle LdrGetProcedureAddress NtGetContextThread NtFreeVirtualMemory ZwClose ZwMapViewOfSection ZwCreateSection ZwUnmapViewOfSection NtAllocateVirtualMemory ZwReadFile NtTerminateProcess NtClose RtlCreateUserThread NtSetContextThread

crypt32

CryptBinaryToStringA

wininet

InternetCloseHandle HttpQueryInfoA HttpOpenRequestA InternetCrackUrlA InternetSetOptionA HttpAddRequestHeadersA InternetReadFile InternetConnectA HttpSendRequestA InternetOpenA

urlmon

ObtainUserAgentString

gdiplus

GdiplusShutdown GdiplusStartup GdipSaveImageToStream GdipGetImageEncodersSize GdipCreateBitmapFromHBITMAP GdipGetImageEncoders GdipDisposeImage