Static task
static1
Behavioral task
behavioral1
Sample
bf9f31608deb672c319e79660504179b7f5c837cb5a5a21fed94bb8b7555401f.exe
Resource
win7-20220223-en
Behavioral task
behavioral2
Sample
bf9f31608deb672c319e79660504179b7f5c837cb5a5a21fed94bb8b7555401f.exe
Resource
win10v2004-en-20220112
General
-
Target
bf9f31608deb672c319e79660504179b7f5c837cb5a5a21fed94bb8b7555401f
-
Size
2.7MB
-
MD5
e3383885e03608cd7784ba4690493e26
-
SHA1
b87077a44d2a2e75a3ded415feea4056be1559f0
-
SHA256
bf9f31608deb672c319e79660504179b7f5c837cb5a5a21fed94bb8b7555401f
-
SHA512
e957d2582e13a998cf3dc165be7a3852df19f469f212411545bc73afb36944be842826c0105045d47d9b4e9ef52f26f0612ce83ca37064efb567a3a420efb93f
Malware Config
Signatures
-
VashSorena Golang Binary 1 IoCs
Processes:
resource yara_rule sample family_vashsorena -
Vashsorena family
Files
-
bf9f31608deb672c319e79660504179b7f5c837cb5a5a21fed94bb8b7555401f.exe windows x64
1c2a6fbef41572f4c9ce8acb5a63cde7
Code Sign
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
Imports
winmm
timeEndPeriod
timeBeginPeriod
ws2_32
WSAGetOverlappedResult
kernel32
WriteFile
WriteConsoleW
WaitForSingleObject
VirtualQuery
VirtualFree
VirtualAlloc
SwitchToThread
SetWaitableTimer
SetUnhandledExceptionFilter
SetProcessPriorityBoost
SetEvent
SetErrorMode
SetConsoleCtrlHandler
LoadLibraryA
LoadLibraryW
GetSystemInfo
GetStdHandle
GetQueuedCompletionStatus
GetProcessAffinityMask
GetProcAddress
GetEnvironmentStringsW
GetConsoleMode
FreeEnvironmentStringsW
ExitProcess
DuplicateHandle
CreateThread
CreateIoCompletionPort
CreateEventA
CloseHandle
AddVectoredExceptionHandler
Sections
.text Size: 867KB - Virtual size: 867KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1.0MB - Virtual size: 1.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 96KB - Virtual size: 214KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
/4 Size: 512B - Virtual size: 276B
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
/19 Size: 125KB - Virtual size: 124KB
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
/32 Size: 33KB - Virtual size: 33KB
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
/46 Size: 11KB - Virtual size: 10KB
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
/63 Size: 15KB - Virtual size: 15KB
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
/80 Size: 512B - Virtual size: 34B
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
/99 Size: 231KB - Virtual size: 231KB
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
/112 Size: 127KB - Virtual size: 126KB
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
/124 Size: 44KB - Virtual size: 44KB
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.idata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.symtab Size: 186KB - Virtual size: 186KB
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ