Behavioral task
behavioral1
Sample
23112023_1603_codernna.exe
Resource
win7-20231025-en
General
-
Target
23112023_1603_codernna.jpg
-
Size
139KB
-
MD5
efffba1927f6a92ca8fdfd5e2ba33440
-
SHA1
0abcdc71a738365d74b25463f41f1bdb6b7fe6ef
-
SHA256
ddf1c022c77790790f19379b260177048ea28f8dfacb0f5c8c8514fd699ab836
-
SHA512
2494b115754b58615cfc11c9252968e96430cb960c2dd48acb9bee68c738450f98976b01c71311d1673d39ccb0c69e42983c79d7e9e76a102a9d11e1a37092d2
-
SSDEEP
3072:M29tg/kwgE8vU6aGmKRfxbYwkn4IIXxHJ1GU0I8EUL5nTUzi:T9mswtKRZbewHajLa
Malware Config
Extracted
asyncrat
AWS | 3Losh
NNa
buike.kozow.com:6606
buike.kozow.com:7707
buike.kozow.com:8808
AsyncMut9348u95iuj3485u843u584iji34hr79duyh 9u324hiur934uiruu98
-
delay
3
-
install
false
-
install_folder
%AppData%
Signatures
Files
-
23112023_1603_codernna.jpg.exe windows:4 windows x86 arch:x86
Password: infected
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 62KB - Virtual size: 61KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ