Static task
static1
Behavioral task
behavioral1
Sample
TribusCat.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
TribusCat.exe
Resource
win10v2004-20230220-en
General
-
Target
TribusCat.exe
-
Size
2.8MB
-
MD5
e09d53e4a547d3265c587ec3be308524
-
SHA1
39a258cdb40154446a70c0d76a7870337bf14578
-
SHA256
10bdab5083ce013c785dadb843c8d15195d2a4df564989f0bc6f43544be82293
-
SHA512
e8d3d2af304039957c3268a4b7bac8312783c79444ced42bba688b2a0c60da898df8b321fc530802b283a89f457d5a39da280a4a538c1a6d07f1fa479f58cb19
-
SSDEEP
49152:dGtlqW6IU6iSLVwASO+/qnXy3uYmpk9pXrxtJtBTaAS8SEd6T6DysV4t2uBw4nO5:s+SMkFL9OxgH02l0
Malware Config
Signatures
Files
-
TribusCat.exe.exe windows x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
.text Size: 16.3MB - Virtual size: 16.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 12.5MB - Virtual size: 12.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 151KB - Virtual size: 2.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 797KB - Virtual size: 796KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: 512B - Virtual size: 244B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 139KB - Virtual size: 46KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 104KB - Virtual size: 103KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ