Behavioral task
behavioral1
Sample
653ab3e59645ca9c1067c5bd3f4dcf00.exe
Resource
win7-20231025-en
General
-
Target
653ab3e59645ca9c1067c5bd3f4dcf00.exe
-
Size
7.3MB
-
MD5
653ab3e59645ca9c1067c5bd3f4dcf00
-
SHA1
b13fa9f91e2581173f4fd467ce750f0acc832b11
-
SHA256
7d25b4cbd88b49eda76adfa4331a3bd63cb04fb25a69509a4f69014575178715
-
SHA512
0ac11b6ba1076adb1b8fa988bc4d29a0df09a3d0f4618100ec09c73b39464a0db587b1cf792e5e28d754546282912418a1b5d93b7fa28af90eaf27d6b462f890
-
SSDEEP
98304:TRoeO6XTBJYazImknGzZr+HIPFtmOZ9G17xwFB5URUSKnaSOdroSCa:NoeO6XTYxmknGzwHIPHd9swFBubKT
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 1 IoCs
resource yara_rule sample family_blackmoon -
Mimikatz family
-
mimikatz is an open source tool to dump credentials on Windows 1 IoCs
resource yara_rule sample mimikatz -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 653ab3e59645ca9c1067c5bd3f4dcf00.exe -
NSIS installer 1 IoCs
resource yara_rule sample nsis_installer_2
Files
-
653ab3e59645ca9c1067c5bd3f4dcf00.exe.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 400KB - Virtual size: 399KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 28KB - Virtual size: 26KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 6.1MB - Virtual size: 6.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE