Behavioral task
behavioral1
Sample
Rybkdr.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
Rybkdr.exe
Resource
win10v2004-20231127-en
General
-
Target
6958207d220f5e4779476143888ecc491ff86ae881e74dd1791dc5f7b57ee096.img
-
Size
1.2MB
-
MD5
f9b1a13cd14eaba6c7e18dd17a2d274c
-
SHA1
bcecb8013d3fdc4715789eb20e91f2e7fa22fa54
-
SHA256
6958207d220f5e4779476143888ecc491ff86ae881e74dd1791dc5f7b57ee096
-
SHA512
b9571e87cab4fe78bc88d22de0e18137a0c315b8dbcaf3d4cd2589272ae31c97e867a20ea6b9f4082c31415692ab26917bfe15222927a20a01188f80b763d83d
-
SSDEEP
24576:T1uC5JT92RkNSIXtzdf1ZOS0e42xWVYknV3G/Z:8KfRdtsS0e4GIV3GR
Malware Config
Signatures
-
Detect PureLogs payload 2 IoCs
resource yara_rule sample family_purelogs static1/unpack001/Rybkdr.exe family_purelogs -
Purelogs family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Rybkdr.exe
Files
-
6958207d220f5e4779476143888ecc491ff86ae881e74dd1791dc5f7b57ee096.img.iso
-
Rybkdr.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 1.1MB - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ