SpyBot Leechbot_r1[.]5a_private[.]rar | Triage

Sharing

Copy URL Twitter E-mail

General

Target

SpyBot Leechbot_r1.5a_private.rar
Size

325KB
MD5

fee0531a4bb6baae558752a149828f07
SHA1

bea8a478da9b432db00158ec1345401fa2ce4ab7
SHA256

b3643cc63b706fd7e6195f67d18ad46b08af17cffd24950d93277df29bb05f98
SHA512

c8e6804c778b5cc29c88575b7a6b48a9924c6db38adaf9e8af24fbcd18a8a1ad203ea6bcb34bc2e3c9d9a40550b4248d6b2cc4dce99be947d45cc33260ecc0ce
SSDEEP

6144:bw36v1k2YDvrW1bxXlN+slQ+jsJ4TbxsZhoOpfRP+2s+asxLh1p:bC6v1k2YDvrWjXl1lQYbxCoO/tacn

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
static1/unpack001/leechbot r1.5a private/compressor.exe	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/leechbot r1.5a private/compressor.exe

Files

SpyBot Leechbot_r1.5a_private.rar
.rar

Password: infected
leechbot r1.5a private/Readme.txt
leechbot r1.5a private/compil.bat
leechbot r1.5a private/compress.bat
leechbot r1.5a private/compressor.exe
.exe windows x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 132KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 90KB - Virtual size: 92KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tqn
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
leechbot r1.5a private/decompress.bat
leechbot r1.5a private/mydoom.txt
leechbot r1.5a private/pdoom.exe
leechbot r1.5a private/settings.h
leechbot r1.5a private/spybot.c