Behavioral task
behavioral1
Sample
FirPE-V1.8.2.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
FirPE-V1.8.2.exe
Resource
win10v2004-20220812-en
General
-
Target
FirPE-V1.8.2.exe
-
Size
759.7MB
-
MD5
a7f3ac636b00af43ce730b385f548f7f
-
SHA1
474ce8701ba3160376a323f1375d59c40dcba974
-
SHA256
1bdf517e9d33730c551e511d16d79bebc5d9475ea81fdd3f60051ebf97752641
-
SHA512
9797e63f2d4fa19a7bfb53ff10342e7f02f6ade54c940305161230916aa93d210c3fa73e3527c2d0a00e4f435d3bda94aee3a3e724e8f71408b1ed4768bfb43e
-
SSDEEP
12582912:Ni3Oth+4vyD2xGdO7LkKfyTn+gjsDdxXnoJ421Pa1HSQdXL1:G4qDldO/kKfW+gYX2PaZSQdZ
Malware Config
Signatures
-
Bazar/Team9 Backdoor payload 1 IoCs
resource yara_rule sample BazarBackdoorVar3 -
Bazarbackdoor family
-
Raccoon family
-
resource yara_rule sample upx -
NSIS installer 1 IoCs
resource yara_rule sample nsis_installer_2
Files
-
FirPE-V1.8.2.exe.exe windows x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 11.7MB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 18.4MB - Virtual size: 18.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 146KB - Virtual size: 148KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE