10715184148.zip
- SHA256 13ebc58483ffd78ed294096ebcb7020c422ca63576b8312d743451387996201e
Password
infected
Behavioral task
behavioral1
Sample
ff8c8c8bfba5f2ba2f8003255949678df209dbff95e16f2f3c338cfa0fd1b885.dll
Resource
win10v2004-20230221-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 10715184148.zip
- Size 278KB
- Sample230613-mn432afg73
- SHA256 13ebc58483ffd78ed294096ebcb7020c422ca63576b8312d743451387996201e
- MD5 f483c3220688638a68fb75d05fff27bb
- SHA1 a8a83a539bc378efaec4b4512894bcebc1a03051
- SHA512 d758801385c8e47d83ea6706cc3422095ce8a953cf8948a95e4d01c8dabdebae7ff9c084610ce90f16bc1adfadecf9cdf01382e2f09d37a79dc941d7a0a498fd
- SSDEEP 6144:l0r+rch9/RoJbl04FXetXqvU1ZK1ywBf3wbxUqk1tKSgWMKmqT9b:l2D+JBxut6vU1Zkgb7etvmqT9b
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- TrueBot payload 1 IoCs
resource yara_rule static1/unpack001/ff8c8c8bfba5f2ba2f8003255949678df209dbff95e16f2f3c338cfa0fd1b885 family_truebot - Truebot family
File Explorer
-
10715184148.zip.zip 278KB
-
ff8c8c8bfba5f2ba2f8003255949678df209dbff95e16f2f3c338cfa0fd1b885.dll 490KB
ff8c8c8bfba5f2ba2f8003255949678df209dbff95e16f2f3c338cfa0fd1b885
- IMPHASH 79e2b39522e3e57e722b4f61de6d5bbe
- SHA256 ff8c8c8bfba5f2ba2f8003255949678df209dbff95e16f2f3c338cfa0fd1b885
- MD5 b7fed593e8eb3646f876367b56725e6c
- SHA1 9e7a2464f53ce74d840eb84077472bc29fd1ba05
- SHA512 ef102b4d26a3db6064ad35d2d42f1b3a075c603dd2454fff41092863e5373e3a77d1d230902767798683a9e8b2d53cf7dd5f5fcf82738ababca39df60b2a2a86
- SSDEEP 12288:eYLqJ60GhUrH16yGIalE1LYNj/OuoU+f8Q3lDlKx/4ux0SQmG:bqM0GhUrHMUYNj/OuoVf8QVDG/NG
- MD5 SHA1 SHA512 SSDEEP
-
TrueBot payload
Password
infected
Digest
86:90:eb:df:d1:da:37:8e:c5:98:ef:59:f8:9b:f0:8d:9d:22:41:d5
Digest Algorithm
sha1
PE Digests Matches
Trusted
Signing Certificate
CN=SAVAS INVESTMENTS PTY LTD,O=SAVAS INVESTMENTS PTY LTD,ST=Victoria,C=AU
Chains
Feb 7, 2023
CN=SAVAS INVESTMENTS PTY LTD,O=SAVAS INVESTMENTS PTY LTD,ST=Victoria,C=AU
CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB
Subject
CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
01
Issuer
CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jan 1, 2004 - Dec 31, 2028
Subject
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
Serial Number
48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Issuer
CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 25, 2021 - Dec 31, 2028
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 1, 2022 - Nov 9, 2031
Subject
CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB
Serial Number
62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Issuer
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Mar 22, 2021 - Mar 21, 2036
Subject
CN=SAVAS INVESTMENTS PTY LTD,O=SAVAS INVESTMENTS PTY LTD,ST=Victoria,C=AU
Serial Number
82:d2:24:32:3e:fa:65:06:0b:64:1f:51:fa:df:ef:02
Issuer
CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Oct 7, 2022 - Oct 7, 2023
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US
Serial Number
0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 21, 2022 - Nov 21, 2033
Minor OS version
Major OS version
Entry point
251796
Magic Number
523
Subsystem
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
kernel32
OutputDebugStringW
DecodeSystemPointer
GetLastError
WaitForSingleObject
CreateMutexW
GetCurrentProcess
CreateThread
CreateProcessW
OpenProcess
GetSystemDirectoryW
GetComputerNameExA
VirtualAllocEx
WriteProcessMemory
DisableThreadLibraryCalls
GetModuleFileNameW
GetModuleHandleExW
GetProcAddress
GlobalDeleteAtom
EraseTape
GetACP
CreateFileA
WriteFile
lstrcatA
VerSetConditionMask
FindFirstFileA
ReadFile
OutputDebugStringA
GetVersionExA
GetModuleHandleW
VerifyVersionInfoW
HeapAlloc
HeapFree
GetProcessHeap
ProcessIdToSessionId
LocalFree
Process32First
Process32Next
GetModuleFileNameA
LoadLibraryExW
FreeLibrary
WriteConsoleW
SetFilePointerEx
HeapReAlloc
HeapSize
SetStdHandle
GetConsoleMode
GetConsoleCP
FlushFileBuffers
GetShortPathNameW
DeleteFileA
CreateFileW
GetEnvironmentVariableW
lstrlenA
lstrcpyA
GlobalAlloc
Process32NextW
CloseHandle
Process32FirstW
CreateToolhelp32Snapshot
lstrcatW
lstrcpyW
LoadLibraryA
GetSystemWow64DirectoryW
ExitProcess
Sleep
GetSystemInfo
GetStringTypeW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
TlsFree
GetCPInfo
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
GetOEMCP
IsValidCodePage
FindNextFileA
FindFirstFileExA
FindClose
GetFileType
GetStdHandle
LCMapStringW
WideCharToMultiByte
LeaveCriticalSection
EnterCriticalSection
EncodePointer
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RtlUnwindEx
RtlPcToFileHeader
RaiseException
InterlockedFlushSList
SetLastError
MultiByteToWideChar
user32
FindWindowA
wsprintfA
wsprintfW
CharUpperA
advapi32
RevertToSelf
ImpersonateLoggedOnUser
GetTokenInformation
DuplicateTokenEx
CreateProcessAsUserW
LookupPrivilegeValueA
AdjustTokenPrivileges
OpenProcessToken
GetUserNameW
shell32
ShellExecuteW
SHGetSpecialFolderPathA
ole32
CoInitializeEx
CoInitializeSecurity
CoCreateInstance
CoInitialize
CoUninitialize
CoCreateGuid
oleaut32
VariantClear
VariantInit
SysAllocString
SysFreeString
userenv
DestroyEnvironmentBlock
CreateEnvironmentBlock
shlwapi
StrChrA
StrStrA
ws2_32
closesocket
connect
htons
socket
gethostbyname
WSACleanup
recv
send
WSAStartup
netapi32
NetApiBufferFree
NetWkstaGetInfo
ChkdskExs
Name
.text
Size
310KB
Virtual Size
310KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
49KB
Virtual Size
49KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.gfids
Size
512B
Virtual Size
224B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
105KB
Virtual Size
105KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ