Behavioral task
behavioral1
Sample
8de152ee3fe8804423b7cb9335f5209544d3bcc0eb6dbff3f60555893d5c6696.dll
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
8de152ee3fe8804423b7cb9335f5209544d3bcc0eb6dbff3f60555893d5c6696.dll
Resource
win10v2004-20221111-en
General
-
Target
8de152ee3fe8804423b7cb9335f5209544d3bcc0eb6dbff3f60555893d5c6696
-
Size
60KB
-
MD5
286cf5c57228fa9e4f7902df95f50149
-
SHA1
c0b0f7dd51745cb07544059b00927aaf9317ec17
-
SHA256
8de152ee3fe8804423b7cb9335f5209544d3bcc0eb6dbff3f60555893d5c6696
-
SHA512
8ce23bfc3cfb8e080afec66488e28b725ca7c93c1ad7bdeb8757775b47e7abd90d37f9c5ac7ca3a244bcecc49a2a2bee0ba1548d08cb3ad466fda285863b83ec
-
SSDEEP
768:hO4apg9TJD/UFPvh45g1WmxValWf5uJMj9TX8Vd76o1x6:hHT+4mjw4IdZx
Malware Config
Signatures
-
DoubleBack x64 payload 1 IoCs
Processes:
resource yara_rule sample family_doubleback_x64 -
Doubleback family
Files
-
8de152ee3fe8804423b7cb9335f5209544d3bcc0eb6dbff3f60555893d5c6696.dll windows x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
.text Size: 35KB - Virtual size: 35KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 176B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 1024B - Virtual size: 792B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ