truebot | JC_05c72e77d14cee079ac94706759dfe77c27fe51731a1eca22b03352190087e9e

Sharing

Copy URL Twitter E-mail

General

Target
JC_05c72e77d14cee079ac94706759dfe77c27fe51731a1eca22b03352190087e9e
Size 403KB
Sample231006-pc9v9abb3v
SHA256 05c72e77d14cee079ac94706759dfe77c27fe51731a1eca22b03352190087e9e
MD5 eef48d1b50a6d56106b8bae8f7c50d6c
SHA1 e928ea32419b8f171a60717377b750e7ddeff39f
SHA512 d90650b2c4684711bb8e268c809c406a2a466b00ba8d15a450868a29400884ecdada2829f5aba687c049f20d7f005eeb3091b2ff0c688362609368ab7d587653
SSDEEP 6144:Kz9O5AYPJ8FpbuOQsMY39/rpx3NV+2yNmKiKmlNB4cTGg35G6WpBqT846fM0P8av:y9QLCbTpHrHQNeBCC8HtNCEh2V8
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

truebot

Malware Config

Extracted

Family

truebot

nefosferta.com/gate.php

Signatures

TrueBot payload 1 IoCs

resource	yara_rule
sample	family_truebot

Truebot family
truebot

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
JC_05c72e77d14cee079ac94706759dfe77c27fe51731a1eca22b03352190087e9e

File Explorer

JC_05c72e77d14cee079ac94706759dfe77c27fe51731a1eca22b03352190087e9e

.dll 403KB

JC_05c72e77d14cee079ac94706759dfe77c27fe51731a1eca22b03352190087e9e

IMPHASH 8537ecbd7502464f075fea2668650b1e
SHA256 05c72e77d14cee079ac94706759dfe77c27fe51731a1eca22b03352190087e9e
MD5 eef48d1b50a6d56106b8bae8f7c50d6c
SHA1 e928ea32419b8f171a60717377b750e7ddeff39f
SHA512 d90650b2c4684711bb8e268c809c406a2a466b00ba8d15a450868a29400884ecdada2829f5aba687c049f20d7f005eeb3091b2ff0c688362609368ab7d587653
SSDEEP 6144:Kz9O5AYPJ8FpbuOQsMY39/rpx3NV+2yNmKiKmlNB4cTGg35G6WpBqT846fM0P8av:y9QLCbTpHrHQNeBCC8HtNCEh2V8
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86

TrueBot payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

200010

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

GetEnvironmentVariableW CreateDirectoryA CreateFileA DeleteFileA FindFirstVolumeW GetShortPathNameW OutputDebugStringW EncodeSystemPointer DecodeSystemPointer GetLastError AddVectoredExceptionHandler DisconnectNamedPipe HeapCompact CancelSynchronousIo InitOnceInitialize WaitForSingleObject CreateMutexA CreateEventW GetCurrentProcess GetCurrentProcessId CreateThread SuspendThread CreateProcessA UpdateProcThreadAttribute OpenProcess GetSystemDirectoryA GetComputerNameExA VirtualAlloc VirtualProtect GetSystemFileCacheSize VirtualAllocExNuma IsWow64Process GetSystemWow64DirectoryA DisableThreadLibraryCalls FreeResource GetModuleHandleExW GetProcAddress LocalCompact GetShortPathNameA GlobalDeleteAtom GetCommModemStatus PurgeComm TransmitCommChar WaitCommEvent EraseTape DosDateTimeToFileTime CreateMailslotW lstrcpynA lstrcpynW lstrcatA UpdateResourceA GetPrivateProfileStringA WritePrivateProfileStringA CreateDirectoryExA CreateFileTransactedW ReOpenFile CheckNameLegalDOS8Dot3A MoveFileTransactedA GetNamedPipeHandleStateA UnregisterWait CreatePrivateNamespaceA FindActCtxSectionStringA FindActCtxSectionGuid FreeEnvironmentStringsA CreateSymbolicLinkA GetTimeFormatEx GetDateFormatEx CompareStringOrdinal MultiByteToWideChar GetACP CompareStringA FindNLSString GetCurrencyFormatW EnumDateFormatsExW IsValidLocale GetLocaleInfoEx GetNLSVersionEx WriteConsoleInputW WriteConsoleOutputW WriteFile OutputDebugStringA VerSetConditionMask FindFirstFileA GetSystemInfo GetVersionExA GetModuleHandleA GetModuleHandleW VerifyVersionInfoW VirtualFree GlobalFree LocalFree Process32First Process32Next CreateProcessW Wow64DisableWow64FsRedirection Wow64RevertWow64FsRedirection UnhandledExceptionFilter IsDebuggerPresent IsProcessorFeaturePresent DecodePointer WriteConsoleW SetFilePointerEx HeapReAlloc HeapSize SetStdHandle GetConsoleMode GetConsoleCP FlushFileBuffers GetStringTypeW GetProcessHeap FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetCPInfo GetOEMCP IsValidCodePage GetStartupInfoW FindNextFileA FindFirstFileExA DeleteFileW GetFileType lstrlenA lstrcpyA GlobalAlloc Process32NextW Process32FirstW CreateToolhelp32Snapshot lstrlenW lstrcatW lstrcpyW lstrcmpW LoadLibraryA GetSystemWow64DirectoryW GetSystemDirectoryW ExitProcess CloseHandle Sleep ReadFile GetFileSize FindFirstFileW FindClose GetNumaNodeProcessorMask CreateFileW GetStdHandle LCMapStringW HeapAlloc HeapFree WideCharToMultiByte QueryPerformanceCounter GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead TerminateProcess GetModuleFileNameA LoadLibraryExW FreeLibrary TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount DeleteCriticalSection LeaveCriticalSection EnterCriticalSection EncodePointer SetLastError InterlockedFlushSList RtlUnwind RaiseException SetUnhandledExceptionFilter

user32

SendMessageA PostMessageA BeginDeferWindowPos IsIconic IsDlgButtonChecked EnumClipboardFormats GetMessagePos IsCharLowerA GetMenu GetMenuItemID wsprintfA GetMenuCheckMarkDimensions TabbedTextOutA GetMessageA IsClipboardFormatAvailable RegisterWindowMessageA GetScrollRange RemovePropA GetDesktopWindow FindWindowA LoadBitmapA CharUpperA GetSystemMetrics FindWindowW CharUpperBuffW GetTopWindow wsprintfW AppendMenuA ReleaseDC GetDC

gdi32

SetStretchBltMode StretchBlt SelectObject GetDIBits DeleteObject DeleteDC CreateCompatibleDC CreateCompatibleBitmap Pie GetBkMode ExtFloodFill CreateICA CreateEllipticRgnIndirect CreateBitmap GetObjectA

advapi32

RegOpenKeyExW RegDeleteValueW RegDeleteValueA GetUserNameW RegUnLoadKeyW

shell32

ShellExecuteW ShellExecuteA SHGetSpecialFolderPathA SHGetSpecialFolderPathW

ole32

CoCreateGuid CoInitialize CoCreateInstance CoInitializeSecurity CoInitializeEx CoUninitialize

oleaut32

SysAllocString SysFreeString VariantInit VariantClear

shlwapi

StrChrA StrStrA

ws2_32

WSAStartup WSACleanup gethostbyname socket send recv htons closesocket connect

gdiplus

GdipDisposeImage GdipSaveImageToFile GdipGetImageEncodersSize GdipGetImageEncoders GdipCloneImage GdipAlloc GdipFree GdiplusStartup GdipLoadImageFromFile

netapi32

NetApiBufferFree NetWkstaGetInfo