doubleback | b[.]dll | Triage

Sharing

General

Target

b.dll
Size

60KB
MD5

4c666511f3efd8d7b0475811d852019a
SHA1

34e952cf23b05521d83150004407f49001c4bc66
SHA256

a3632a2fe9589b8ea96b38cb9218fc38677c13b89914da047970ff980a22f79e
SHA512

cfdc9d4ed0599bcb9cef45d00626eb73208560085de1044a03b85c7b77d45c9219772aa28b0df643598dbfcc9d48db6a3be1cde3786e3899e2f0455f4375314f
SSDEEP

768:hO4apg9TJD/UFPvh45g1WmxValWf5uJMj9TX8I+d76o1x6:hHT+4mjw4+dZx

Score

10^/10

doubleback

Malware Config

Signatures

DoubleBack x64 payload 1 IoCs

resource	yara_rule
sample	family_doubleback_x64

Doubleback family
doubleback

Files

b.dll
.dll windows x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Sections

.text
Size: 35KB - Virtual size: 35KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 792B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ