Behavioral task
behavioral1
Sample
Trojan.Win32.Bublik.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
Trojan.Win32.Bublik.exe
Resource
win10v2004-20230220-en
General
-
Target
Trojan.Win32.Bublik.eqpo-3ff72dec9147bbeca1ba901c42a10bf37f846d7fcaa465a8572f44c124f9c321
-
Size
156KB
-
MD5
c211b81def5a75ec9d294d5431f3f650
-
SHA1
68c241aaddc70a2303cc163edc4071fe160de49b
-
SHA256
3ff72dec9147bbeca1ba901c42a10bf37f846d7fcaa465a8572f44c124f9c321
-
SHA512
590488e0ce0913574d01e0860c0cef54d41830cba5ed163261383f1d4654f2673bc26feedb6f80a4daf45085dfe4e013ee1fb1190dd50718be07c840f57cf9da
-
SSDEEP
3072:TbdCHnRnlEmrvniE+uE+C6Xa2POKakxEDSnHnJ4k:fdCHtl7LniE+uE+HBxEDSH
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Trojan.Win32.Bublik.eqpo-3ff72dec9147bbeca1ba901c42a10bf37f846d7fcaa465a8572f44c124f9c321
Files
-
Trojan.Win32.Bublik.eqpo-3ff72dec9147bbeca1ba901c42a10bf37f846d7fcaa465a8572f44c124f9c321.exe windows x86
d54d5bcac030bde2a9097a8750b4294d
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetWindowsDirectoryW
CreateActCtxA
GetLastError
GetTimeFormatW
GetCurrentDirectoryA
GetFileSizeEx
GetVolumeInformationW
GetCompressedFileSizeW
GetComputerNameA
CreateConsoleScreenBuffer
MultiByteToWideChar
lstrcmpiA
VirtualProtect
DebugBreak
DeleteFileA
lstrcpyW
BuildCommDCBA
DeleteAtom
CreateHardLinkW
IsBadWritePtr
DebugActiveProcess
GetCurrentProcessId
DeleteFileW
GetCurrentThreadId
SetComputerNameW
SetThreadAffinityMask
GetSystemDirectoryA
CreateThread
FoldStringA
GetEnvironmentVariableA
GetTimeZoneInformation
GetModuleFileNameW
GetOEMCP
GetSystemDirectoryW
BackupRead
GetDateFormatW
GetSystemTime
QueryPerformanceCounter
DebugSetProcessKillOnExit
Sleep
SetThreadIdealProcessor
LoadLibraryA
InterlockedExchange
FreeLibrary
GetProcAddress
LocalAlloc
RaiseException
user32
GetSubMenu
CreateMenu
GetQueueStatus
GetKeyboardLayoutNameA
GetMenuDefaultItem
GetMenu
GetActiveWindow
IsCharLowerA
FindWindowW
IsWindowEnabled
IntersectRect
GetWindowRect
FindWindowExA
IsMenu
GetThreadDesktop
GetCapture
FindWindowExW
IsRectEmpty
GetTopWindow
IsChild
GetForegroundWindow
GetWindowTextLengthA
FindWindowA
GetClientRect
GetClipboardOwner
Sections
.text Size: 72KB - Virtual size: 68KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 20KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 36KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.CRT Size: 16KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 1008B
IMAGE_SCN_MEM_READ