merlin | merlinAgent-Windows-x64[.]exe

Resubmissions

11/08/2023, 17:47

230811-wc8frafe9910

10/08/2023, 17:14

230810-vr3y5shd4t10

10/08/2023, 17:10

230810-vp753shc8w10

Sharing

Copy URL Twitter E-mail

General

Target
merlinAgent-Windows-x64.exe
Size 9.6MB
Sample230810-vr3y5shd4t
SHA256 68bc9c85149fde2a5fd2591042065aca4a3af8f108d17951f773058c090f57e9
MD5 fb02c0bff8c56abca12053b7cf81855f
SHA1 faf053d435580a1db262406d4ee472ae5f3be76b
SHA512 02b3de8a73b26477fdeff16eccb333f4e4e36dcc0a99078c36ca5533e919e1a0e0e49903e0e3c8c536e971b8bbb144275987b7ba64f7a0903a3a7c947b9f0f8e
SSDEEP 49152:UX2f8JnDn955rzrb/TZvO90d7HjmAFd4A64nsfJgANV0jdd5VQYlQLnTdzCQkvnV:UJIYVOJGkucr6GE4Xq3lJv
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

merlin

Malware Config

Signatures

Merlin family
merlin

Merlin payload 1 IoCs

resource	yara_rule
sample	family_merlin

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
merlinAgent-Windows-x64.exe

File Explorer

merlinAgent-Windows-x64.exe

.exe 9.6MB

merlinAgent-Windows-x64.exe

IMPHASH 9cbefe68f395e67356e2a5d8d1b285c0
SHA256 68bc9c85149fde2a5fd2591042065aca4a3af8f108d17951f773058c090f57e9
MD5 fb02c0bff8c56abca12053b7cf81855f
SHA1 faf053d435580a1db262406d4ee472ae5f3be76b
SHA512 02b3de8a73b26477fdeff16eccb333f4e4e36dcc0a99078c36ca5533e919e1a0e0e49903e0e3c8c536e971b8bbb144275987b7ba64f7a0903a3a7c947b9f0f8e
SSDEEP 49152:UX2f8JnDn955rzrb/TZvO90d7HjmAFd4A64nsfJgANV0jdd5VQYlQLnTdzCQkvnV:UJIYVOJGkucr6GE4Xq3lJv
MD5 SHA1 SHA512 SSDEEP

windows x64

Merlin payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

421920

Magic Number

523

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

Name

.text

Size

4.7MB

Virtual Size

4.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

4.4MB

Virtual Size

4.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

490KB

Virtual Size

933KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

86KB

Virtual Size

86KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.symtab

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

merlinAgent-Windows-x64.exe

kernel32