Behavioral task
behavioral1
Sample
ea419643de9a10a418292f1603f86bab0942f436af5e7a8309351ce552e68d2b.exe
Resource
win7-20220715-en
Behavioral task
behavioral2
Sample
ea419643de9a10a418292f1603f86bab0942f436af5e7a8309351ce552e68d2b.exe
Resource
win10v2004-20220721-en
General
-
Target
ea419643de9a10a418292f1603f86bab0942f436af5e7a8309351ce552e68d2b
-
Size
365KB
-
MD5
af76619743662c5e9ccfaa1f940b8354
-
SHA1
bf8e2c7b4a84ca177d7ae9c4ba6155d2dbc74b38
-
SHA256
ea419643de9a10a418292f1603f86bab0942f436af5e7a8309351ce552e68d2b
-
SHA512
be9eaaadc9cf5509e301c9908e555b2ac0dbf984aede52545a78b98ce459f222050e1d0fc01aa4afdca275d921f79c972b325de55a9d91285c1298e6b5291373
-
SSDEEP
6144:cxLA03gnBCrzHbklDubM1oFRgfHaSjcVfUpJqTyZp0KfgxcFmQoZgfHlgASbyz:cxLAzBCX7ktu2qg/aSjosL4Kfgo5oZ4/
Malware Config
Extracted
webmonitor
primeservers1.wm01.to:443
-
config_key
AP8PrfNym8htAX0Za6LL12tdOuH5BSPp
-
private_key
U6yRoBXHU
-
url_path
/recv5.php
Signatures
-
WebMonitor payload 1 IoCs
resource yara_rule static1/unpack001/out.upx family_webmonitor -
Webmonitor family
-
resource yara_rule sample upx
Files
-
ea419643de9a10a418292f1603f86bab0942f436af5e7a8309351ce552e68d2b.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 612KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 363KB - Virtual size: 364KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
out.upx.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 933KB - Virtual size: 932KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 10KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 656B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ