Behavioral task
behavioral1
Sample
KeyGen.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
KeyGen.exe
Resource
win10v2004-20220901-en
Behavioral task
behavioral3
Sample
rBot.exe
Resource
win7-20220812-en
Behavioral task
behavioral4
Sample
rBot.exe
Resource
win10v2004-20221111-en
General
-
Target
bd27e611f1efc4eef94baccd5ba95982fedc8b4822c6b15a43b3a3d0773fc076
-
Size
1.4MB
-
MD5
fae45129357485b462f81ea23d62abd2
-
SHA1
ae9eb94044efed0d5c8cd4c86a66dfa9d775da7b
-
SHA256
bd27e611f1efc4eef94baccd5ba95982fedc8b4822c6b15a43b3a3d0773fc076
-
SHA512
f7965f8da773b48cc7737656056bd94925419e2eda1ba5390b5d5d8c78df4e99b9939f4cf6f3db39ca407724c428776c9d004d1c1cec6ec73da9b08e34b0fa94
-
SSDEEP
24576:QrB4PITHTU5rBhL4P8+oGZ13obLrbzD9u3TeGc+DX9Lc4y+VSffIngHIC6oa0RH/:kB4A7o5rBL+dY66qJIhASnIngooVp/
Malware Config
Signatures
-
Processes:
resource yara_rule static1/unpack001/rBot.exe themida
Files
-
bd27e611f1efc4eef94baccd5ba95982fedc8b4822c6b15a43b3a3d0773fc076.cab
-
KeyGen.exe.exe windows x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.PDX Size: - Virtual size: 628KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.PDX Size: 183KB - Virtual size: 184KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
rBot.exe.exe windows x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
Size: 90KB - Virtual size: 512KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Themida Size: 1.2MB - Virtual size: 2.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE