Behavioral task
behavioral1
Sample
brbbot.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
brbbot.exe
Resource
win10v2004-20230831-en
General
-
Target
220616-jddasahadk_pw_infected.zip
-
Size
36KB
-
MD5
6a478c151a603d20cf91a06416efc8a9
-
SHA1
71e21b354c97291ee6f35557c6fe8cbe1fa33138
-
SHA256
d31bb0a409a7e8ed1ddb4d2322c9678dc5f3334e721d832ead214a36c3370b27
-
SHA512
a697a48b75604527bdc1a83b66c6c5474900407d8f135f4addf2d48677e5ed632d0e30ed29aff589bfe52652b5097e69e31dd8e4e428e913a889c22e39ae5f4a
-
SSDEEP
768:m375qx/uTFudn/0ytp5TFRxZxyzayLxAFtfEA55t2C90We:cguQtp5RRxZxyzhLWfEA3YWe
Malware Config
Extracted
brbbot
brb.3dtuts.by
Signatures
-
Brbbot family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack002/brbbot.exe
Files
-
220616-jddasahadk_pw_infected.zip.zip
Password: infected
-
brbbot.zip.zip
Password: malware
-
brbbot.exe.exe windows x64
Password: infected
475b069fec5e5868caeb7d4d89236c89
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
advapi32
RegSetValueExA
RegOpenKeyExA
RegDeleteValueA
RegFlushKey
RegCloseKey
CryptAcquireContextW
CryptDeriveKey
CryptReleaseContext
CryptEncrypt
CryptCreateHash
CryptDestroyKey
CryptDecrypt
CryptDestroyHash
CryptHashData
wininet
HttpSendRequestA
InternetQueryDataAvailable
InternetReadFile
InternetCloseHandle
HttpQueryInfoA
InternetConnectA
InternetOpenA
HttpOpenRequestA
InternetSetOptionA
ws2_32
gethostbyname
WSACleanup
WSAStartup
inet_ntoa
gethostname
kernel32
CreateFileW
HeapSize
WriteConsoleW
SetStdHandle
LoadLibraryW
GetStringTypeW
LCMapStringW
LeaveCriticalSection
EnterCriticalSection
CreateFileA
FindResourceA
LoadResource
HeapAlloc
HeapFree
GetProcessHeap
WriteFile
SizeofResource
GetLastError
LockResource
GetModuleHandleA
CloseHandle
GetComputerNameA
HeapReAlloc
MoveFileExA
WaitForSingleObject
SetEvent
GetModuleHandleW
GetSystemWow64DirectoryA
CreateProcessA
GetSystemDirectoryA
GetEnvironmentVariableA
CopyFileA
CreateEventW
GetModuleFileNameA
DeleteFileA
GetFileSize
ReadFile
WideCharToMultiByte
GetProcAddress
GetTempFileNameA
GetTempPathA
FlushFileBuffers
GetConsoleMode
GetCommandLineW
GetStartupInfoW
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
EncodePointer
DecodePointer
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
FlsGetValue
FlsSetValue
FlsFree
SetLastError
GetCurrentThreadId
FlsAlloc
ExitProcess
GetStdHandle
GetModuleFileNameW
RtlUnwindEx
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
DeleteCriticalSection
HeapSetInformation
GetVersion
HeapCreate
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
Sleep
MultiByteToWideChar
SetFilePointer
GetConsoleCP
user32
GetDC
Sections
.text Size: 49KB - Virtual size: 48KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 14KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 192B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 774B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ