Behavioral task
behavioral1
Sample
e21c9b47594ee77595f2639afee9b36e44610c20d7ad32b78212ebefb84c9684.dll
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
e21c9b47594ee77595f2639afee9b36e44610c20d7ad32b78212ebefb84c9684.dll
Resource
win10v2004-20220812-en
General
-
Target
e21c9b47594ee77595f2639afee9b36e44610c20d7ad32b78212ebefb84c9684
-
Size
60KB
-
MD5
798f05d2bb5ab62fa751bd42e131f80b
-
SHA1
d1709725ddb27840cbe60c358cbc461d16f856a3
-
SHA256
e21c9b47594ee77595f2639afee9b36e44610c20d7ad32b78212ebefb84c9684
-
SHA512
c477e7d5e702d159eaa878634a6aaec5abad186ecc2ba9e065811d31fc95afe34291c74cf53dc24487e37cc7943712d31d4c30cbd3947b07c6dee65204e26b8e
-
SSDEEP
768:hO4apg9TJD/UFPvh45g1WmxValWf5uJMj9TX8Vd76o1x6:hHT+4mjw4IdZx
Malware Config
Signatures
-
DoubleBack x64 payload 1 IoCs
Processes:
resource yara_rule sample family_doubleback_x64 -
Doubleback family
Files
-
e21c9b47594ee77595f2639afee9b36e44610c20d7ad32b78212ebefb84c9684.dll windows x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
.text Size: 35KB - Virtual size: 35KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 176B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 1024B - Virtual size: 792B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ