Static task
static1
Behavioral task
behavioral1
Sample
0d80dfd6210c601119788192d13201c70ad7ec9375a3f308ee1322aaab79cb85.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
0d80dfd6210c601119788192d13201c70ad7ec9375a3f308ee1322aaab79cb85.exe
Resource
win10v2004-20220414-en
General
-
Target
0d80dfd6210c601119788192d13201c70ad7ec9375a3f308ee1322aaab79cb85
-
Size
361KB
-
MD5
92175d22a32d45d8d1beadf1e99ad9f6
-
SHA1
13dfbe33cc691dd6533c45d001970f5e6b0e26d0
-
SHA256
0d80dfd6210c601119788192d13201c70ad7ec9375a3f308ee1322aaab79cb85
-
SHA512
5ea867093683a1a4f920ad0d4a35b3ce935be982a44ada394d74213dcdea70aff66a93eb782c345c3bbf0bb3ea2f4afb28e6e96d3f08e8eee0997b778d3ac187
-
SSDEEP
6144:CBaFE4883mQyNJH3iHRdWATq0YNZH89oQKnDPT2IggL/phAjn1xN:C6EsmQkHSHPBGRz89oQKD72nYrm
Malware Config
Extracted
webmonitor
pitbullcant.wm01.to:443
-
config_key
A7HOB9ROz2LrVrPGPRzC4MVB2KltDr7S
-
private_key
i9KVkEro3
-
url_path
/recv5.php
Signatures
-
WebMonitor Payload 1 IoCs
Processes:
resource yara_rule static1/unpack001/out.upx family_webmonitor -
Webmonitor family
-
Processes:
resource yara_rule sample upx
Files
-
0d80dfd6210c601119788192d13201c70ad7ec9375a3f308ee1322aaab79cb85.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 600KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 359KB - Virtual size: 360KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
out.upx.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 917KB - Virtual size: 917KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 10KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 656B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ