truebot | sample2[.]dll

Sharing

Copy URL Twitter E-mail

General

Target
sample2.dll
Size 378KB
Sample230515-2q6f7sha2z
SHA256 695d8751897ea00816875374e0cd7df5e1e1a2f26d29c63647708fe4c649168c
MD5 f66637b3a6173fdd36a0fa7b8363e603
SHA1 0755522db43dd0f314636f74153517148e281e88
SHA512 f68a4cf7bcd7b62b0fd2390b87e852f388e091fdabced8e9fb00c69d513abf1cdba00e6c5b75f852a135738196592cd313b505afc4163c92bc5be492fce5afab
SSDEEP 6144:jstnb/4misK1vTrwKrdumJ9QbFQUU9YNj/GW9wz29nH9laVgm1GChaIdVNoxB6MT:A5/jisK1vQKrduY+FQ39YNj/H2QnW3w1
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

truebot

Malware Config

Signatures

TrueBot payload 1 IoCs

resource	yara_rule
sample	family_truebot

Truebot family
truebot

File Explorer

sample2.dll

.dll 378KB

sample2.dll

IMPHASH 79e2b39522e3e57e722b4f61de6d5bbe
SHA256 695d8751897ea00816875374e0cd7df5e1e1a2f26d29c63647708fe4c649168c
MD5 f66637b3a6173fdd36a0fa7b8363e603
SHA1 0755522db43dd0f314636f74153517148e281e88
SHA512 f68a4cf7bcd7b62b0fd2390b87e852f388e091fdabced8e9fb00c69d513abf1cdba00e6c5b75f852a135738196592cd313b505afc4163c92bc5be492fce5afab
SSDEEP 6144:jstnb/4misK1vTrwKrdumJ9QbFQUU9YNj/GW9wz29nH9laVgm1GChaIdVNoxB6MT:A5/jisK1vQKrduY+FQ39YNj/H2QnW3w1
MD5 SHA1 SHA512 SSDEEP

windows x64

TrueBot payload

PE Signature issue

Digest

19:2e:3a:6f:4f:68:e0:57:e7:a0:b7:07:ea:2d:bc:5a:61:3c:32:8d

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Subject

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jan 1, 2004 - Dec 31, 2028

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Serial Number

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 25, 2021 - Dec 31, 2028

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Serial Number

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=SAVAS INVESTMENTS PTY LTD,O=SAVAS INVESTMENTS PTY LTD,ST=Victoria,C=AU

Serial Number

82:d2:24:32:3e:fa:65:06:0b:64:1f:51:fa:df:ef:02

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 7, 2022 - Oct 7, 2023

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Serial Number

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 21, 2022 - Nov 21, 2033

Minor OS version

Major OS version

Entry point

178276

Magic Number

523

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

OutputDebugStringW DecodeSystemPointer GetLastError WaitForSingleObject CreateMutexW GetCurrentProcess CreateThread CreateProcessW OpenProcess GetSystemDirectoryW GetComputerNameExA VirtualAllocEx WriteProcessMemory DisableThreadLibraryCalls GetModuleFileNameW GetModuleHandleExW GetProcAddress GlobalDeleteAtom EraseTape GetACP CreateFileA WriteFile lstrcatA VerSetConditionMask FindFirstFileA ReadFile OutputDebugStringA GetVersionExA GetModuleHandleW VerifyVersionInfoW HeapAlloc HeapFree GetProcessHeap ProcessIdToSessionId LocalFree Process32First Process32Next GetModuleFileNameA LoadLibraryExW FreeLibrary WriteConsoleW SetFilePointerEx HeapReAlloc HeapSize SetStdHandle GetConsoleMode GetConsoleCP FlushFileBuffers GetShortPathNameW DeleteFileA CreateFileW GetEnvironmentVariableW lstrlenA lstrcpyA GlobalAlloc Process32NextW CloseHandle Process32FirstW CreateToolhelp32Snapshot lstrcatW lstrcpyW LoadLibraryA GetSystemWow64DirectoryW ExitProcess Sleep GetSystemInfo GetStringTypeW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA TlsFree GetCPInfo TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount DeleteCriticalSection GetOEMCP IsValidCodePage FindNextFileA FindFirstFileExA FindClose GetFileType GetStdHandle LCMapStringW WideCharToMultiByte LeaveCriticalSection EnterCriticalSection EncodePointer RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlUnwindEx RtlPcToFileHeader RaiseException InterlockedFlushSList SetLastError MultiByteToWideChar

user32

FindWindowA wsprintfA wsprintfW CharUpperA

advapi32

RevertToSelf ImpersonateLoggedOnUser GetTokenInformation DuplicateTokenEx CreateProcessAsUserW LookupPrivilegeValueA AdjustTokenPrivileges OpenProcessToken GetUserNameW

shell32

ShellExecuteW SHGetSpecialFolderPathA

ole32

CoInitializeEx CoInitializeSecurity CoCreateInstance CoInitialize CoUninitialize CoCreateGuid

oleaut32

VariantClear VariantInit SysAllocString SysFreeString

userenv

DestroyEnvironmentBlock CreateEnvironmentBlock

shlwapi

StrChrA StrStrA

ws2_32

closesocket connect htons socket gethostbyname WSACleanup recv send WSAStartup

netapi32

NetApiBufferFree NetWkstaGetInfo

Name

.text

Size

238KB

Virtual Size

238KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

49KB

Virtual Size

49KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gfids

Size

512B

Virtual Size

224B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

66KB

Virtual Size

65KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ