Behavioral task
behavioral1
Sample
784bc607bd7bf047aec2c9d7445037bdb45d673ae9c30b9718b0f195cfb860e6.dll
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
784bc607bd7bf047aec2c9d7445037bdb45d673ae9c30b9718b0f195cfb860e6.dll
Resource
win10v2004-20220812-en
General
-
Target
784bc607bd7bf047aec2c9d7445037bdb45d673ae9c30b9718b0f195cfb860e6
-
Size
60KB
-
MD5
afdad4be32188bee71d4f891c479d821
-
SHA1
13f67ba774361761af8bedb0ffee0ab7b08e0dc4
-
SHA256
784bc607bd7bf047aec2c9d7445037bdb45d673ae9c30b9718b0f195cfb860e6
-
SHA512
8199ee1749f336a818efcb317cf8d72a8f82149d92db74f22539ec0e1ed3744e213c70b1114fdc49f8224ca06196df86379346982e43a77c6081e1909a8ee65c
-
SSDEEP
768:hO4apg9TJD/UFPvh45g1WmxValWf5uJMj9TX8Vd76o1x6:hHT+4mjw4IdZx
Malware Config
Signatures
-
DoubleBack x64 payload 1 IoCs
Processes:
resource yara_rule sample family_doubleback_x64 -
Doubleback family
Files
-
784bc607bd7bf047aec2c9d7445037bdb45d673ae9c30b9718b0f195cfb860e6.dll windows x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
.text Size: 35KB - Virtual size: 35KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 176B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 1024B - Virtual size: 792B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ