11195651845.zip
- SHA256 8c68d04eaf5388f87d6c05d202f53fe3c366f84ee08092d14aa4a00d66a6b760
Password
infected
Behavioral task
behavioral1
Sample
b3d7005a06021286c84ed7f8293cba966e0137df769e80579df7f3c6a2d3c1f3.dll
Resource
win7-20230712-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
b3d7005a06021286c84ed7f8293cba966e0137df769e80579df7f3c6a2d3c1f3.dll
Resource
win10v2004-20230703-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 11195651845.zip
- Size 204KB
- Sample230718-ztxmcsdh96
- SHA256 8c68d04eaf5388f87d6c05d202f53fe3c366f84ee08092d14aa4a00d66a6b760
- MD5 1681dd926ec9140b0338a772919db98d
- SHA1 dd4fb3d4ca144d23324ba57e19847a65066e53ba
- SHA512 21f63099925963b88cdaff3417decc483510945e0831ec7ea61b0397f3fb702cb8d5e047e8a21f4be656bd1952597f21bc2e6c1cf37209befb3981253b2736f4
- SSDEEP 6144:7rpf8Fa7HdWFDTpZLWtSgVr2ZRX7UE0k3:5f8FM9ES1UZRXz3
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Extracted
Family
-
truebot
C2
-
gbpooolfhbrb.com/gate.php
Signatures
- TrueBot payload 1 IoCs
resource yara_rule static1/unpack001/b3d7005a06021286c84ed7f8293cba966e0137df769e80579df7f3c6a2d3c1f3 family_truebot - Truebot family
File Explorer
-
11195651845.zip.zip 204KB
-
b3d7005a06021286c84ed7f8293cba966e0137df769e80579df7f3c6a2d3c1f3.dll 335KB
b3d7005a06021286c84ed7f8293cba966e0137df769e80579df7f3c6a2d3c1f3
- IMPHASH 7a25408ea12fbf11c65d8deb43d76b38
- SHA256 b3d7005a06021286c84ed7f8293cba966e0137df769e80579df7f3c6a2d3c1f3
- MD5 a637c909097b250da561b12ae33e7486
- SHA1 f71cc41357814b5c3b132aaaedd6a24ebbd0c102
- SHA512 a02a4244947a3ca24d65a356b8ae405b4620884d033d29570a411c539f6e55eca0c579ab3b61de9a14e4eaec66417e57974ee7b28bb03e2728c359cef3168ce3
- SSDEEP 6144:R1VH+po6EJ5IYW6eBveHVK8PNEt1ZJr0HkT7Npvm7sbnTH7Mx:3d4oR+YImEx/gkThp0wnTHYx
- MD5 SHA1 SHA512 SSDEEP
-
TrueBot payload
Password
infected
Digest
e0:97:fc:7a:9b:c1:ac:42:53:02:a4:38:be:ad:86:39:34:f7:33:d8
Digest Algorithm
sha1
PE Digests Matches
Trusted
Signing Certificate
CN=MALVINA RECRUITMENT LIMITED,O=MALVINA RECRUITMENT LIMITED,ST=London,C=GB
Chains
Aug 23, 2022
CN=MALVINA RECRUITMENT LIMITED,O=MALVINA RECRUITMENT LIMITED,ST=London,C=GB
CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB
Subject
CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
01
Issuer
CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jan 1, 2004 - Dec 31, 2028
Subject
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
Serial Number
48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Issuer
CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 25, 2021 - Dec 31, 2028
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 1, 2022 - Nov 9, 2031
Subject
CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB
Serial Number
62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Issuer
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Mar 22, 2021 - Mar 21, 2036
Subject
CN=MALVINA RECRUITMENT LIMITED,O=MALVINA RECRUITMENT LIMITED,ST=London,C=GB
Serial Number
7d:27:33:2c:3c:b3:a3:82:a4:fd:23:2c:5c:66:a2
Issuer
CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jun 17, 2022 - Jun 17, 2023
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Timestamp 2022 - 2,O=DigiCert\, Inc.,C=US
Serial Number
0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 29, 2022 - Mar 14, 2033
Minor OS version
Major OS version
Entry point
8351
Magic Number
267
Subsystem
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
lstrcpyW
lstrcmpW
GetNumaHighestNodeNumber
GetShortPathNameA
ReadFile
CreateTimerQueueTimer
ReplaceFileA
EraseTape
IsDBCSLeadByteEx
GetCurrentProcess
WriteConsoleA
RegisterWaitForSingleObject
OutputDebugStringA
VirtualAlloc
CancelDeviceWakeupRequest
GetFinalPathNameByHandleW
GetDriveTypeA
CreateJobObjectW
GetProductInfo
CompareStringOrdinal
LockFile
GetThreadPreferredUILanguages
DeleteAtom
AllocateUserPhysicalPages
EnumLanguageGroupLocalesA
GetTempPathW
IsBadHugeReadPtr
GetEnvironmentVariableA
CreateMutexA
WaitForSingleObject
GetLongPathNameTransactedA
CreateFileW
QueryThreadCycleTime
GetUserPreferredUILanguages
DuplicateHandle
GetACP
OpenProcess
ReadConsoleOutputCharacterA
MultiByteToWideChar
CancelSynchronousIo
GetNumberFormatA
CompareStringA
CopyFileA
GetLastError
UpdateProcThreadAttribute
GetConsoleProcessList
CreateFileA
GetSystemFileCacheSize
DisableThreadLibraryCalls
GetMailslotInfo
GetCommState
GlobalFlags
DeleteFileA
DeleteFileW
EnumSystemCodePagesA
WritePrivateProfileStringA
CreateThread
IsDBCSLeadByte
ExitProcess
DeleteFileTransactedW
FlushConsoleInputBuffer
WriteFileGather
FindAtomA
GetProcAddress
HeapQueryInformation
_lread
GetFileSize
FindAtomW
VerSetConditionMask
GetComputerNameW
EnumTimeFormatsA
GetNumaProximityNode
VerifyVersionInfoW
CreateProcessA
GetComputerNameExA
CreateMailslotA
GetProcessPriorityBoost
QueryPerformanceCounter
LocalUnlock
IsWow64Process
WriteFile
GetModuleHandleA
GetVersionExA
GlobalFree
GetSystemInfo
GetModuleHandleW
GetSystemTime
VirtualFree
Process32First
Process32Next
LocalFree
Wow64DisableWow64FsRedirection
Wow64RevertWow64FsRedirection
CreateProcessW
SetLastError
RtlUnwind
InterlockedFlushSList
DecodePointer
EncodePointer
WriteConsoleW
SetFilePointerEx
HeapReAlloc
HeapSize
SetStdHandle
GetConsoleMode
GetConsoleCP
FlushFileBuffers
GetStringTypeW
GetProcessHeap
FreeEnvironmentStringsW
CloseHandle
Process32FirstW
lstrcpyA
GlobalAlloc
lstrcatW
LoadLibraryA
Process32NextW
Sleep
GetSystemWow64DirectoryW
CreateToolhelp32Snapshot
lstrcatA
GetSystemDirectoryW
GetModuleFileNameW
lstrlenA
lstrlenW
LoadResource
GetModuleFileNameA
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetCPInfo
GetOEMCP
IsValidCodePage
FindNextFileA
FindFirstFileExA
FindClose
RaiseException
TerminateProcess
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetFileType
GetStdHandle
LCMapStringW
HeapAlloc
HeapFree
WideCharToMultiByte
GetModuleHandleExW
LoadLibraryExW
FreeLibrary
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
LeaveCriticalSection
GetCurrentProcessId
GetStartupInfoW
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
IsDebuggerPresent
UnhandledExceptionFilter
EnterCriticalSection
user32
EnumPropsA
ScrollDC
wvsprintfA
ReleaseDC
GetDoubleClickTime
GetSystemMetrics
GetDC
MessageBoxA
CreateIcon
EnumClipboardFormats
GetDialogBaseUnits
FindWindowA
GetNextDlgTabItem
wsprintfA
EnumWindows
CharUpperA
CharUpperBuffW
wsprintfW
FindWindowW
SendMessageA
gdi32
SelectObject
CreateCompatibleDC
StretchBlt
DeleteDC
SetStretchBltMode
DeleteObject
GetObjectA
GetClipBox
CreateRectRgnIndirect
GetDIBits
GetTextAlign
SelectPalette
CreateCompatibleBitmap
advapi32
GetUserNameW
RegCreateKeyExW
shell32
SHGetSpecialFolderPathA
SHGetSpecialFolderPathW
ShellExecuteA
ole32
CoUninitialize
CoInitializeSecurity
CoInitializeEx
CoCreateGuid
CoCreateInstance
CoInitialize
oleaut32
VariantInit
SysFreeString
VariantClear
SysAllocString
shlwapi
StrChrA
StrStrA
ws2_32
htons
recv
connect
socket
send
WSAStartup
gethostbyname
closesocket
WSACleanup
gdiplus
GdipFree
GdipDisposeImage
GdipAlloc
GdipCloneImage
GdipLoadImageFromFile
GdiplusStartup
GdipGetImageEncodersSize
GdipGetImageEncoders
GdipSaveImageToFile
netapi32
NetApiBufferFree
NetWkstaGetInfo
fff
Name
.text
Size
229KB
Virtual Size
228KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
37KB
Virtual Size
36KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.gfids
Size
512B
Virtual Size
288B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
35KB
Virtual Size
35KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
17KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ