Behavioral task
behavioral1
Sample
Client.exe
Resource
win10-20230621-en
General
-
Target
Client.exe
-
Size
63KB
-
MD5
b99fc66bf68c1e4c6d72c9d77c0c19c4
-
SHA1
1d291b340e56442959075a19ffb4854e393529f8
-
SHA256
445f0586918a8dc0f6ee18d7c847cb290f34fd9495eba36ae738c34188b3a0c0
-
SHA512
6bd3cb64e99045db038f55800e27f56688184e91382a03cd3edc6fa8006d6b5eff7daf163f80852b5bfcd0539387e84d3644544d434e8b307deb1249aca3d03d
-
SSDEEP
1536:yh3HaMmkefuYjsDAiENQVseNbIB2qK1N5v:S3GNjsD8YNOW1fv
Malware Config
Extracted
eaglerat
oxy01.duckdns.org:9875
oxy01.duckdns.org:7788
Signatures
-
Eaglerat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Client.exe
Files
-
Client.exe.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 61KB - Virtual size: 60KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ