���������` �ď��N7t�q�k28�pS9 �dp%�l�,4���0�)B:'��Mc��so�YL�Lۅ������9@w�I���3��`��_�Fzo��������Ң&!~�QMa����^˲a��i`Tdv�3ؾb����LB�3t"������<�%-��̡�Q��P�^��)"���ôѳ18���&�n�l�4�^Hfʭzt��ޮ>�>�eAT9�IC��1�~mՊ�]i�T�@LHD�X�<^���!Y��s��t�+z�='m�W���c\��� �}�۰��L5q��Fo�*���w��x�g�vg����,��ZC��w��y�>��{��;y��s1)oVr���\٪���1R��ر*�x5n*��<]����� ���R4; �<W/��l�H�^GT,�gp�~-&��>g�DZ?ɦ���*�8�R��6zwX8���-GP���v֟���(78TN���}.8���I�+��(���Q�w�X:��a����2.O~�`�ti$��AK=L~yvf�h�UH���ԧl&'���Xs��X�%��2�{���� �� N��I����T�i� ��ԇg�� \�Ny �����M�=�x�����3����T5Jc��"������Ya��&:%� �i{�,j��J��&�N.MG��E���y��k�z���T�`�vֶ�_/gg�-b#Kk;���.�3CV�`�]�d�Z����r�b���S��^ RO*4�~k�g+jY��x�����E�;�y!Cb!Zo|۫8�Eҧk c:����brҠ�$#��t���pÊ;�8���fG g�Jx{�k�H#7F�<�u��0��{��j�Y,���f�##x�}2��4IB�:�`���ٕ��U�*�ꦨ���|S�2�v�}�(����������B�'��F���������Eź9�D���g�N�(8!�����5�O�26��t)�c��٠cd�����0�G���(D�d�t�N�Q��J���q��_�RȔ�ẙ��j"�%&{}!r0��A�e�2�5d�`F��U)��@B��kO���0P�,�xx��S���M�М^�@�O �M���J8z�t����+I��.w�*߮�������Q���VWGj�1�z�'r��<�1����u��8�6�E�4���}Ǽ��� ?�����$p����/S՜�f�($;���y�{�s�e��l��y������%;V3e�����+��Vݞyc1�Ys�'�R鬙?EgsŴ!Y�/I4���OD�H���,R�=}�\U�TN'�M����I�X���3�������v/�[c��o��|bBﹴ����A����OաV$�"��T��]�����o9�\-%}=~!�f@�nӨ���@O�"����tX," %��.Z���� �,������&��%-q��kʭ�t���XK��Z��o�d����N ��gc�M��!YR�*������b�߬p���ަ-���������=���>�03 Lrԝ(����EL����E�e��!}d�}����*�>��_��*�v���`��Fg�3b���\z��c�r�pȻL�e]�/�f�V�H'����G��Ě�+�3fyen��@'��?`���_�|�B��XԘ\��;���|c¹)�H0�̚]���L�h+�������iL�ȊO�5mC�I���nl�N��yi��f���/��)[���5%U^u�. ���k��M#hl��,��j�2���o\��=�g��r'5��}OmJ�h��I�!��d+߽~_N�c0�\NC*�5_rY̿7��)�����hW_�_p�F��:p��+�IΦ�n�*+ʰ U������c���8}�4�a����=�O�����B���8V�w��ԏB�Q"�3��~*��hٲ�wn(�4lȅ,Z$;N|٫1ѪK+�6`m�����@f�<�~�����k.��M]�1�N���(+���,���e�����D?��77'Nv ���Ѭ�^$����L��#*���R�p��0w�s(6ӬS���s�8�]�m���q��8BE������dJ��$���%T�[t���|ƞ|��Y�#o���#*p�x4�������"+W�)f�lMh�W!���Z�h P_�q���K1�7i LL��K����V���Pf@��{�p���,D�i�Cٔ0��AY��pᗐ�����n~/���� �k���{y[���.�<v�\��s�LV��س��уXߧx�,`���!�m�>>�@�E�q�;�>B�X�y�]y�ݯ��֝�avc�a���(�/��)�DG~��!�xz�Ou�3����$��<���Z����6�j���H#���� q�Jј. J$��@4���ɟ��8��XA���x��&[���{����ܒ`I��K�dKa��$1�u+]���x��`��Y����Gp�ճ��e������l�{ 1^�.����ܳ�-Tu��>�%�)��`�Bz�Խ3�Ͳ(��������CV�mK�g�];��Ew1��7n&28���n�]b@���㝠P{1��0YF�>�d�G�$���9��u�VQiJ1e��Z��� q`I�^����� �Ss{Y�p?�����2���\�S��)>N����ӭe���9^������|��!�)���;��2��c�����s��躭b��C�`��w�e��۹����4�hz�=����x���Ͼ��)�����~�P�\t����nT �b}�8��?Q�ˈ��Fo��}�BwJx���p�� g���"��g-ܒ�����{1 I�HC012XX���D���r1�ɵ�S���ɘn�v�ѣ�{��S$E��=�D6(7~w�P�r���mh��AM1�G��4����%,��؍!�<a'��"�,D*6z��V�r!�:#����{� �:���ڳ�>�:�?��?���e,��4#�-��K��b�Lݮ�X�=���9����ġA�0HL9�D����s�L\"�B�A�1!����i4�i���w�\��fQIn�z�z�S�9�}Ki8zO�����M��˰l���=���O����{�Ç���M�oc��P:���y @��;Mlk�����Y�P����0��Tn� ���A����ޙ!�3��oxٮ��_���|;#P+q�PMo5ic�v��sU��Y�Qg�p��½�4�%�NwjiRm��!>Z%v��h3U�l�����؟�A�2�y2j������t:��/���FW"�M9�Y&h�>�ՒlZ�/��¼*��'�����h���T���7hH���[52�������O�}�4�*R�W������1,p��7�1a�� d4��������[Jy�J���ة�/�*:gT$T�?a���| �4�FQ˭Y�ne�r��>$:/g[ 6pk�X|9�h��o\����"e�im�A�bd��Y@���tr{��f�U%i� � �i 4nľ�h��Vh ��Pu����-�L��}c�3I��˂�L��5��Ǥ�Ԭ��3�[b��Ϧ\8N �E)��Ȧ����M21��V���Fh���'j5C� a�5i��'�*ĿϸP��F��C �x���!Q ]D!����+�Y����݆�n�۹���}/�;������������zd�4M���\`�]�+Vf\a��Oj%\S0ٷJ�J�7����
Static task
static1
Behavioral task
behavioral1
Sample
VXBot.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
VXBot.exe
Resource
win10-20231020-en
Behavioral task
behavioral3
Sample
VXBot.exe
Resource
win10v2004-20231023-en
General
-
Target
VXBot.exe
-
Size
4.2MB
-
MD5
b90b35efd8e00ebf13a6536f9058684e
-
SHA1
169b8e407abe1a715522b076d4d3cfa3f62131b4
-
SHA256
986023c6a7663021d5a48295a8d5b55b47d0ee3e2b4f55cfeb7618b293db5f0a
-
SHA512
6dca0b8e0f81c2a8de97aab7ffee755ce8b8c2c97dbb9d54a4d8e32ede79daa0e6de599e1d5b5e5cc459fceba94c959d1bd430685ec3ad08cdd952241288e401
-
SSDEEP
98304:zL6FMFlU77vqnliY7Uvz50NyF8kjYKGz8KUjF2e:3YMFl0784tb5QC7jYKGz8P0
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource VXBot.exe
Files
-
VXBot.exe.exe windows:6 windows x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Exports
Exports
Sections
Size: 352KB - Virtual size: 692KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 209KB - Virtual size: 452KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 785KB - Virtual size: 792KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 112KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 111KB - Virtual size: 112KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 11.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2.8MB - Virtual size: 2.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE