Behavioral task
behavioral1
Sample
04eda4f12e90afe1cf9c05209a0f6d24.exe
Resource
win7-20230831-en
General
-
Target
04eda4f12e90afe1cf9c05209a0f6d24.bin
-
Size
6.6MB
-
MD5
04eda4f12e90afe1cf9c05209a0f6d24
-
SHA1
19500f93fe60628d757cc45720f7e027b3dbb479
-
SHA256
1d23cb5e1998f4990da80d6ba99d09dc9feeca91452a885628180035ae23a6c1
-
SHA512
97e85ebf5729de3eee50f194533c3f1d92560276d779a104c0d72cd954cdf4e7618eea0fb3388394efc3534f6a9fc7a1d16c0015b64ca5c3f9a50519aa0934bd
-
SSDEEP
49152:RNx1bIo8EVUcavppa2Bpi5h7vL70XWIB+jDUVlS013UQ5HGtJ4ZRJIUwH7:RNxJOE3g3a2e5h7v0R3HHGkZR6
Malware Config
Signatures
-
Async RAT payload 1 IoCs
resource yara_rule sample asyncrat -
Asyncrat family
-
Detect Xworm Payload 1 IoCs
resource yara_rule sample family_xworm -
StormKitty payload 1 IoCs
resource yara_rule sample family_stormkitty -
Stormkitty family
-
Xworm family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 04eda4f12e90afe1cf9c05209a0f6d24.bin
Files
-
04eda4f12e90afe1cf9c05209a0f6d24.bin.exe windows:5 windows x86
9222d372923baed7aa9dfa28449a94ea
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CreateFileA
FindResourceA
FreeLibrary
LoadResource
WriteFile
SizeofResource
GetProcAddress
LoadLibraryA
LockResource
EnumResourceNamesA
CloseHandle
FreeResource
GetWindowsDirectoryA
OutputDebugStringA
GetTempPathA
GetModuleHandleW
ExitProcess
DecodePointer
EncodePointer
GetCommandLineA
HeapSetInformation
GetStartupInfoW
RaiseException
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapAlloc
GetLastError
HeapFree
IsProcessorFeaturePresent
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
LoadLibraryW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
GetStdHandle
GetModuleFileNameW
Sleep
HeapSize
GetModuleFileNameA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
GetFileType
HeapCreate
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
RtlUnwind
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapReAlloc
LCMapStringW
MultiByteToWideChar
GetStringTypeW
shell32
ShellExecuteA
SHGetSpecialFolderPathA
Sections
.text Size: 30KB - Virtual size: 30KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 6.6MB - Virtual size: 6.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ