Overview
overview
10Static
static
illusion B...me.url
windows7-x64
1illusion B...me.url
windows10-2004-x64
1illusion B...RY.exe
windows7-x64
10illusion B...RY.exe
windows10-2004-x64
10illusion B...ld.exe
windows7-x64
1illusion B...ld.exe
windows10-2004-x64
1illusion B...al.htm
windows7-x64
1illusion B...al.htm
windows10-2004-x64
1illusion B...n.html
windows7-x64
1illusion B...n.html
windows10-2004-x64
1illusion B...e.html
windows7-x64
1illusion B...e.html
windows10-2004-x64
1Static task
static1
Behavioral task
behavioral1
Sample
illusion Bot/Leeme.url
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
illusion Bot/Leeme.url
Resource
win10v2004-20220812-en
Behavioral task
behavioral3
Sample
illusion Bot/illusion_bot -russh-/BOTBINARY.exe
Resource
win7-20220812-en
Behavioral task
behavioral4
Sample
illusion Bot/illusion_bot -russh-/BOTBINARY.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral5
Sample
illusion Bot/illusion_bot -russh-/Build.exe
Resource
win7-20220812-en
Behavioral task
behavioral6
Sample
illusion Bot/illusion_bot -russh-/Build.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral7
Sample
illusion Bot/illusion_bot -russh-/Manual.htm
Resource
win7-20220812-en
Behavioral task
behavioral8
Sample
illusion Bot/illusion_bot -russh-/Manual.htm
Resource
win10v2004-20220901-en
Behavioral task
behavioral9
Sample
illusion Bot/illusion_bot -russh-/WebAdmin/Man.html
Resource
win7-20220812-en
Behavioral task
behavioral10
Sample
illusion Bot/illusion_bot -russh-/WebAdmin/Man.html
Resource
win10v2004-20220812-en
Behavioral task
behavioral11
Sample
illusion Bot/illusion_bot -russh-/WebAdmin/Readme.html
Resource
win7-20220812-en
Behavioral task
behavioral12
Sample
illusion Bot/illusion_bot -russh-/WebAdmin/Readme.html
Resource
win10v2004-20220812-en
General
-
Target
71e62e01db9e888aeb54d7e2f4326d253bc401ada1a0e70a030d766ba43c0acf
-
Size
199KB
-
MD5
ca8aaca4cd10a45579019eec9bfde4e8
-
SHA1
fe49bda1e5a10cad6045336ef7dabba2e8c50002
-
SHA256
71e62e01db9e888aeb54d7e2f4326d253bc401ada1a0e70a030d766ba43c0acf
-
SHA512
f30887cc48762350febd1bf16e2a62ca6f8d128e204c2967503e625a186f60e2559aa79944826009ade9cef029842e496d894de112925ded6b496353d80d93fd
-
SSDEEP
3072:i9v5MrOTSJg82t/3rB7b+CHwfGRb8P6g4d/q2gwTN37tNPXZISURZN3fg6dSHK78:i9xMr+qgXgQdCbwRrtNPaSQvjD4PH
Malware Config
Signatures
Files
-
71e62e01db9e888aeb54d7e2f4326d253bc401ada1a0e70a030d766ba43c0acf.7z
-
illusion Bot/Leeme.url.url
-
illusion Bot/illusion_bot -russh-/BOTBINARY.EXE.exe windows x86
2a6cf69ec1f2374fb62f74cdeda1d3a6
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetProcAddress
LoadLibraryA
GetModuleHandleA
MoveFileA
Sections
.text Size: 48KB - Virtual size: 47KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 24KB - Virtual size: 181KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
illusion Bot/illusion_bot -russh-/Build.exe.exe windows x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
MEW Size: 232KB - Virtual size: 232KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
�uۊ�� Size: 152KB - Virtual size: 152KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.mackt Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
illusion Bot/illusion_bot -russh-/Manual.htm.html
-
illusion Bot/illusion_bot -russh-/WebAdmin/Man.html.html
-
illusion Bot/illusion_bot -russh-/WebAdmin/Readme.html.html
-
illusion Bot/illusion_bot -russh-/WebAdmin/index.php
-
illusion Bot/illusion_bot -russh-/WebAdmin/updater.php