beatdrop | 8bdd318996fb3a947d10042f85b6c6ed29547e1d6ebdc177d5d85fa26859e1ca[.]sample

Resubmissions

27/10/2022, 16:10

221027-tmvxascfh810

11/04/2022, 12:48

220411-p1slwaabh88

Sharing

Copy URL Twitter E-mail

General

Target
8bdd318996fb3a947d10042f85b6c6ed29547e1d6ebdc177d5d85fa26859e1ca.sample
Size 247KB
Sample221027-tmvxascfh8
SHA256 8bdd318996fb3a947d10042f85b6c6ed29547e1d6ebdc177d5d85fa26859e1ca
MD5 a0b4e7622728c317f37ae354b8bc3dbb
SHA1 bdfd9f8371e683e9013b74cc61a3583acf9206ad
SHA512 b5c660d3f69f6558c596861ae86731b8c9fa3f064eea0be62be9b20b79d2ffeab98873b72a81fb21b1b2f7c6d979ad42be03d917a52e33456b56a6d7d49a292c
SSDEEP 6144:Kw7pPIEmwwD8xijj1WSo0+doNzpCUBlHe:kEmfAM1+doXHe
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

beatdrop

Malware Config

Signatures

Beatdrop family
beatdrop

Detects BEATDROP loader 1 IoCs

resource	yara_rule
sample	family_beatdrop

File Explorer

8bdd318996fb3a947d10042f85b6c6ed29547e1d6ebdc177d5d85fa26859e1ca.sample

.dll 247KB

8bdd318996fb3a947d10042f85b6c6ed29547e1d6ebdc177d5d85fa26859e1ca.sample

IMPHASH 9b75c715589663e6b77818c77bb8e429
SHA256 8bdd318996fb3a947d10042f85b6c6ed29547e1d6ebdc177d5d85fa26859e1ca
MD5 a0b4e7622728c317f37ae354b8bc3dbb
SHA1 bdfd9f8371e683e9013b74cc61a3583acf9206ad
SHA512 b5c660d3f69f6558c596861ae86731b8c9fa3f064eea0be62be9b20b79d2ffeab98873b72a81fb21b1b2f7c6d979ad42be03d917a52e33456b56a6d7d49a292c
SSDEEP 6144:Kw7pPIEmwwD8xijj1WSo0+doNzpCUBlHe:kEmfAM1+doXHe
MD5 SHA1 SHA512 SSDEEP

windows x64

Detects BEATDROP loader

Minor OS version

Major OS version

Entry point

4944

Magic Number

523

Subsystem

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

advapi32

GetUserNameA

kernel32

CloseHandle CreateFileA CreateFileMappingA CreateSemaphoreW DeleteCriticalSection EnterCriticalSection GetComputerNameExA GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetLastError GetModuleHandleA GetModuleHandleW GetProcAddress GetSystemTimeAsFileTime GetThreadContext GetTickCount GetTimeZoneInformation InitializeCriticalSection IsDBCSLeadByteEx LeaveCriticalSection LoadLibraryW MapViewOfFile MultiByteToWideChar QueryPerformanceCounter RaiseException ReleaseSemaphore ResumeThread RtlAddFunctionTable RtlCaptureContext RtlLookupFunctionEntry RtlUnwindEx RtlVirtualUnwind SetLastError SetThreadContext SetUnhandledExceptionFilter Sleep TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue UnhandledExceptionFilter VirtualAlloc VirtualProtect VirtualQuery WaitForSingleObject WideCharToMultiByte WriteProcessMemory

msvcrt

___lc_codepage_func ___mb_cur_max_func __iob_func _amsg_exit _assert _ctime64 _errno _initterm _lock _unlock abort calloc fclose fopen fputc fputs free fwrite islower isspace isupper localeconv malloc memchr memcmp memcpy memmove memset realloc signal sprintf strcmp strerror strlen strncmp vfprintf wcslen _write _read _fileno

psapi

GetModuleInformation

wininet

HttpOpenRequestA HttpSendRequestA InternetCloseHandle InternetConnectA InternetOpenA InternetReadFile

ws2_32

WSAStartup gethostbyname gethostname inet_ntoa

Name

.text

Size

182KB

Virtual Size

181KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

464B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

33KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

11KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

13KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

512B

Virtual Size

68B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

88B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

1024B

Virtual Size

1024B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ