Static task
static1
Behavioral task
behavioral1
Sample
HALKBANK.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
HALKBANK.exe
Resource
win10v2004-20220414-en
General
-
Target
d4210b182cdbdd284a65756202bf9ada7d7b574223a75cab4732a392e9320a4f
-
Size
858KB
-
MD5
3418a6f13f352101023b701babbe72c8
-
SHA1
5097af862fce82fe1bb24b6e17c8fb3000c552fe
-
SHA256
d4210b182cdbdd284a65756202bf9ada7d7b574223a75cab4732a392e9320a4f
-
SHA512
51ada865847bf45f4a3066f02aa38fa97c886bc69621db87041eaee3f9b203926eaa4cfac86d4e9aa385382ff5902ed8536381847e604357a788e3480a4cf163
-
SSDEEP
24576:t+jyCPweUqeIK6sbkWMnsX4hV/3bmWWwMLuJ:t+e8wRvhyzsIP/3awMLE
Malware Config
Signatures
-
MassLogger Main Payload 1 IoCs
Processes:
resource yara_rule static1/unpack001/HALKBANK.exe family_masslogger -
Masslogger family
Files
-
d4210b182cdbdd284a65756202bf9ada7d7b574223a75cab4732a392e9320a4f.zip
-
HALKBANK.exe.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 2.5MB - Virtual size: 2.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 33KB - Virtual size: 33KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ