Static task
static1
Behavioral task
behavioral1
Sample
655b1643db3679764d779f1fc284b647b69285e8cd7bb28a8a235140eff42376.dll
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
655b1643db3679764d779f1fc284b647b69285e8cd7bb28a8a235140eff42376.dll
Resource
win10v2004-en-20220113
General
-
Target
655b1643db3679764d779f1fc284b647b69285e8cd7bb28a8a235140eff42376
-
Size
52KB
-
MD5
9f7a7c1f9c1a46cc97307ca3c657d8cd
-
SHA1
6bfc7b2816f5d67c1dc9366d810a683ed82105a4
-
SHA256
655b1643db3679764d779f1fc284b647b69285e8cd7bb28a8a235140eff42376
-
SHA512
ced3e0191ec93aad8beaa56253b3cce131d81a365c03b101c8dc26e4eaff4f576fccb710a40f2012fc8ad3eeb06e1775458a38350d3abff3cdc16ff6e7f34539
-
SSDEEP
768:WKydBQh5PbYHNta3y5FH/to6vm6z8SW9Etuqv79pemOjSmCNX:I6Pul5p/to6OeMZ+5NX
Malware Config
Signatures
-
DoubleBack x64 Payload 1 IoCs
Processes:
resource yara_rule sample family_doubleback_x64 -
Doubleback family
Files
-
655b1643db3679764d779f1fc284b647b69285e8cd7bb28a8a235140eff42376.dll windows x64
Code Sign
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
.text Size: 25KB - Virtual size: 24KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 176B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 1024B - Virtual size: 588B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ