Analysis
- max time kernel
142s - max time network
156s - platform
windows10-2004_x64 - resource
win10v2004-20231127-en - resource tags
arch:x64arch:x86image:win10v2004-20231127-enlocale:en-usos:windows10-2004-x64system - submitted
08/12/2023, 02:24
Behavioral task
behavioral1
Sample
003e17a485ffe8083eae7577d0fd21fccfc894ed82b2af71b6594946185568bf.exe
Resource
win7-20231020-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
003e17a485ffe8083eae7577d0fd21fccfc894ed82b2af71b6594946185568bf.exe
Resource
win10v2004-20231127-en
3 signatures
150 seconds
General
- Target 003e17a485ffe8083eae7577d0fd21fccfc894ed82b2af71b6594946185568bf.exe
- Size 5.1MB
- Sample231208-cv81fsaa61
- SHA256 003e17a485ffe8083eae7577d0fd21fccfc894ed82b2af71b6594946185568bf
- MD5 5750306ef3dcf99a04349bce1ea25583
- SHA1 5375320a2fdfbf9840f8fb8bca71ad5b3a61be66
- SHA512 a64624445a16bba87cebea142edb0a9efd282a3f9ca80a78b91e8b30926b3ae41fe29a45aa3361f0ca857d9a886cee23f8518cf71f924df8505e94e5a978d7d8
- SSDEEP 98304:6TOVQ8/uApHmXhkNduD+DdDxzhaKb70n/pe9aCnzyZnRVpCc:6yVQyn1mRkPDdXun/pPseJLp
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Sliver 32-bit implant (with and without --debug flag at compile) 8 IoCs
slive 32bit malware detected.
resource yara_rule behavioral2/memory/3496-1-0x0000000000890000-0x00000000019BD000-memory.dmp sliver_32bit behavioral2/memory/3496-2-0x0000000000890000-0x00000000019BD000-memory.dmp sliver_32bit behavioral2/memory/3496-3-0x0000000000890000-0x00000000019BD000-memory.dmp sliver_32bit behavioral2/memory/3496-5-0x0000000000890000-0x00000000019BD000-memory.dmp sliver_32bit behavioral2/memory/3496-6-0x0000000000890000-0x00000000019BD000-memory.dmp sliver_32bit behavioral2/memory/3496-11-0x0000000000890000-0x00000000019BD000-memory.dmp sliver_32bit behavioral2/memory/3496-13-0x0000000000890000-0x00000000019BD000-memory.dmp sliver_32bit behavioral2/memory/3496-14-0x0000000000890000-0x00000000019BD000-memory.dmp sliver_32bit - Sliver Custom Detection 8 IoCs
slive malware detected.
resource yara_rule behavioral2/memory/3496-1-0x0000000000890000-0x00000000019BD000-memory.dmp slive_custom behavioral2/memory/3496-2-0x0000000000890000-0x00000000019BD000-memory.dmp slive_custom behavioral2/memory/3496-3-0x0000000000890000-0x00000000019BD000-memory.dmp slive_custom behavioral2/memory/3496-5-0x0000000000890000-0x00000000019BD000-memory.dmp slive_custom behavioral2/memory/3496-6-0x0000000000890000-0x00000000019BD000-memory.dmp slive_custom behavioral2/memory/3496-11-0x0000000000890000-0x00000000019BD000-memory.dmp slive_custom behavioral2/memory/3496-13-0x0000000000890000-0x00000000019BD000-memory.dmp slive_custom behavioral2/memory/3496-14-0x0000000000890000-0x00000000019BD000-memory.dmp slive_custom -
resource yara_rule behavioral2/memory/3496-0-0x0000000000890000-0x00000000019BD000-memory.dmp upx behavioral2/memory/3496-1-0x0000000000890000-0x00000000019BD000-memory.dmp upx behavioral2/memory/3496-2-0x0000000000890000-0x00000000019BD000-memory.dmp upx behavioral2/memory/3496-3-0x0000000000890000-0x00000000019BD000-memory.dmp upx behavioral2/memory/3496-5-0x0000000000890000-0x00000000019BD000-memory.dmp upx behavioral2/memory/3496-6-0x0000000000890000-0x00000000019BD000-memory.dmp upx behavioral2/memory/3496-11-0x0000000000890000-0x00000000019BD000-memory.dmp upx behavioral2/memory/3496-13-0x0000000000890000-0x00000000019BD000-memory.dmp upx behavioral2/memory/3496-14-0x0000000000890000-0x00000000019BD000-memory.dmp upx