Behavioral task
behavioral1
Sample
Firefox Installer.exe
Resource
win10-20230703-en
General
-
Target
Firefox Installer.exe
-
Size
188KB
-
MD5
d8754b62c9e5fa6a98480f4ff45a2272
-
SHA1
97187ad5f282caa38a08c2af5178d2d2508f2807
-
SHA256
661cb7d69264a4953e0ec5d87b533e9e79c1b893b090d720a79692f7fb8f2a50
-
SHA512
f0c1905dc644d7d394cea141c9a10dc7c85c591cc18d689f1f68615936dd5aabf84617f8bc4056d41801b5356e5af479d6384a95b9f5404ec20d5a52de1570b1
-
SSDEEP
3072:oJZKnPE2YyJzELtyTRyYeY8lNgoiJ+sX8HFvytbaN+feQAcoQntK+C7VieM3SFZK:oJZKBI0RyYeY4eoiJ+sCFv9BPTQwX3Mp
Malware Config
Signatures
-
Vanilla Rat payload 1 IoCs
resource yara_rule sample vanillarat -
Vanillarat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Firefox Installer.exe
Files
-
Firefox Installer.exe.exe windows x86
Password: 344
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 122KB - Virtual size: 121KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.sdata Size: 512B - Virtual size: 182B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 64KB - Virtual size: 63KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ