82d4025b84cf569ec82d21918d641540.bin
- SHA256 8e5d476356abbf94758416cbd43f86039932a64a2d16034e442e56aad8499563
Password
infected
Behavioral task
behavioral1
Sample
c042ad2947caf4449295a51f9d640d722b5a6ec6957523ebf68cddb87ef3545c.dll
Resource
win7-20230220-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
c042ad2947caf4449295a51f9d640d722b5a6ec6957523ebf68cddb87ef3545c.dll
Resource
win10v2004-20230220-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 82d4025b84cf569ec82d21918d641540.bin
- Size 209KB
- Sample230327-caqclsdb2x
- SHA256 8e5d476356abbf94758416cbd43f86039932a64a2d16034e442e56aad8499563
- MD5 a308cf331a5ec06437612950766a340f
- SHA1 79d2d76ed2172b7afb73e9d454193f3f79926db0
- SHA512 0aa8e0694e675b83f6adecb7a975e82e2deb8994d5e6cfc3cc7b6dee407982529bfc3ae132fdbe2767bf51f72c3d695e5afccb9db7bc4e32a65901d768b449e6
- SSDEEP 6144:FdpAJDucmoeUPn6f+ijOPB6U/7JEg0w305yLQSB8Ulr/1:F0J1Vn6fFOPIUdEro0er1
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- TrueBot payload 1 IoCs
resource yara_rule static1/unpack001/c042ad2947caf4449295a51f9d640d722b5a6ec6957523ebf68cddb87ef3545c.exe family_truebot - Truebot family
File Explorer
-
82d4025b84cf569ec82d21918d641540.bin.zip 209KB
-
c042ad2947caf4449295a51f9d640d722b5a6ec6957523ebf68cddb87ef3545c.exe.dll 378KB
c042ad2947caf4449295a51f9d640d722b5a6ec6957523ebf68cddb87ef3545c.exe
- IMPHASH 79e2b39522e3e57e722b4f61de6d5bbe
- SHA256 c042ad2947caf4449295a51f9d640d722b5a6ec6957523ebf68cddb87ef3545c
- MD5 82d4025b84cf569ec82d21918d641540
- SHA1 62f5a16d1ef20064dd78f5d934c84d474aca8bbe
- SHA512 4b310bc91a10b02b659c6d08b42578b85e42697cbfd41823d84443b559ad6efb46952ffda9ac322933ac0cc66d13ce9698e824084e53093d05cfe71fd6d59df5
- SSDEEP 6144:jstnb/4misK1vTrwKrdumJ9QbFQUU9YNj/GW9wz29nH9laVgm1GChaIdVNoxB6MT:A5/jisK1vQKrduY+FQ39YNj/H2QnW3w1
- MD5 SHA1 SHA512 SSDEEP
-
TrueBot payload
Password
infected
Digest
ff:3e:bd:59:04:7b:b8:82:28:b2:ea:ba:0f:3b:5a:21:60:3a:e4:4d
Digest Algorithm
sha1
PE Digests Matches
Trusted
Subject
CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
01
Issuer
CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jan 1, 2004 - Dec 31, 2028
Subject
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
Serial Number
48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Issuer
CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 25, 2021 - Dec 31, 2028
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 1, 2022 - Nov 9, 2031
Subject
CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB
Serial Number
62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Issuer
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Mar 22, 2021 - Mar 21, 2036
Subject
CN=SAVAS INVESTMENTS PTY LTD,O=SAVAS INVESTMENTS PTY LTD,ST=Victoria,C=AU
Serial Number
82:d2:24:32:3e:fa:65:06:0b:64:1f:51:fa:df:ef:02
Issuer
CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Oct 7, 2022 - Oct 7, 2023
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US
Serial Number
0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 21, 2022 - Nov 21, 2033
Minor OS version
Major OS version
Entry point
178276
Magic Number
523
Subsystem
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
kernel32
OutputDebugStringW
DecodeSystemPointer
GetLastError
WaitForSingleObject
CreateMutexW
GetCurrentProcess
CreateThread
CreateProcessW
OpenProcess
GetSystemDirectoryW
GetComputerNameExA
VirtualAllocEx
WriteProcessMemory
DisableThreadLibraryCalls
GetModuleFileNameW
GetModuleHandleExW
GetProcAddress
GlobalDeleteAtom
EraseTape
GetACP
CreateFileA
WriteFile
lstrcatA
VerSetConditionMask
FindFirstFileA
ReadFile
OutputDebugStringA
GetVersionExA
GetModuleHandleW
VerifyVersionInfoW
HeapAlloc
HeapFree
GetProcessHeap
ProcessIdToSessionId
LocalFree
Process32First
Process32Next
GetModuleFileNameA
LoadLibraryExW
FreeLibrary
WriteConsoleW
SetFilePointerEx
HeapReAlloc
HeapSize
SetStdHandle
GetConsoleMode
GetConsoleCP
FlushFileBuffers
GetShortPathNameW
DeleteFileA
CreateFileW
GetEnvironmentVariableW
lstrlenA
lstrcpyA
GlobalAlloc
Process32NextW
CloseHandle
Process32FirstW
CreateToolhelp32Snapshot
lstrcatW
lstrcpyW
LoadLibraryA
GetSystemWow64DirectoryW
ExitProcess
Sleep
GetSystemInfo
GetStringTypeW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
TlsFree
GetCPInfo
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
GetOEMCP
IsValidCodePage
FindNextFileA
FindFirstFileExA
FindClose
GetFileType
GetStdHandle
LCMapStringW
WideCharToMultiByte
LeaveCriticalSection
EnterCriticalSection
EncodePointer
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RtlUnwindEx
RtlPcToFileHeader
RaiseException
InterlockedFlushSList
SetLastError
MultiByteToWideChar
user32
FindWindowA
wsprintfA
wsprintfW
CharUpperA
advapi32
RevertToSelf
ImpersonateLoggedOnUser
GetTokenInformation
DuplicateTokenEx
CreateProcessAsUserW
LookupPrivilegeValueA
AdjustTokenPrivileges
OpenProcessToken
GetUserNameW
shell32
ShellExecuteW
SHGetSpecialFolderPathA
ole32
CoInitializeEx
CoInitializeSecurity
CoCreateInstance
CoInitialize
CoUninitialize
CoCreateGuid
oleaut32
VariantClear
VariantInit
SysAllocString
SysFreeString
userenv
DestroyEnvironmentBlock
CreateEnvironmentBlock
shlwapi
StrChrA
StrStrA
ws2_32
closesocket
connect
htons
socket
gethostbyname
WSACleanup
recv
send
WSAStartup
netapi32
NetApiBufferFree
NetWkstaGetInfo
ChkdskExs
Name
.text
Size
238KB
Virtual Size
238KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
49KB
Virtual Size
49KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.gfids
Size
512B
Virtual Size
224B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
66KB
Virtual Size
65KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ