doubleback | cl[.]dll | Triage

Sharing

General

Target

cl.dll
Size

60KB
MD5

3818348bf02665342f21837a7bbcfe7a
SHA1

7da458e626acf26b5228280c16910957c08a196b
SHA256

f77eaf7513d509f9caa244d8016f010efa5a9513947e9a6dfedea6855ee93179
SHA512

381c120181e95fa9446133152e164f11a67330f4665abf9924805866b8fdfde202311ee0ef00ae7508a967687272ac8ff382a57a0c9643dbde9ec2dbe83360ae
SSDEEP

768:hO4apg9TJD/UFPvh45g1WmxValWf5uJMj9TX8Vd76o1x6:hHT+4mjw4IdZx

Score

10^/10

doubleback

Malware Config

Signatures

DoubleBack x64 payload 1 IoCs

resource	yara_rule
sample	family_doubleback_x64

Doubleback family
doubleback

Files

cl.dll
.dll windows x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Sections

.text
Size: 35KB - Virtual size: 35KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 792B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ