Overview
overview
7Static
static
316b03b4215...er.exe
windows7-x64
716b03b4215...er.exe
windows10-2004-x64
76a2456dd06...er.exe
windows7-x64
36a2456dd06...er.exe
windows10-2004-x64
398d3d31514...na.exe
windows7-x64
398d3d31514...na.exe
windows10-2004-x64
3e5ec1d3bbf...hi.exe
windows7-x64
3e5ec1d3bbf...hi.exe
windows10-2004-x64
3Static task
static1
Behavioral task
behavioral1
Sample
16b03b421568cfc34236c1fce7814cad_BotManager.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
16b03b421568cfc34236c1fce7814cad_BotManager.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral3
Sample
6a2456dd060cf2863e3c7623ad4a7004_BotFarmer.exe
Resource
win7-20231129-en
Behavioral task
behavioral4
Sample
6a2456dd060cf2863e3c7623ad4a7004_BotFarmer.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral5
Sample
98d3d315144ea91f8eed28702d096277_BotFarmerLuna.exe
Resource
win7-20231215-en
Behavioral task
behavioral6
Sample
98d3d315144ea91f8eed28702d096277_BotFarmerLuna.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral7
Sample
e5ec1d3bbf3e65a60e2aa8058a9e62b0_BotFarmerSatoshi.exe
Resource
win7-20231215-en
Behavioral task
behavioral8
Sample
e5ec1d3bbf3e65a60e2aa8058a9e62b0_BotFarmerSatoshi.exe
Resource
win10v2004-20231215-en
General
-
Target
aabb9b75f800dae296581ed801daa0f13ed0bba09bca86cf85a1d334412a8a0c
-
Size
2.2MB
-
MD5
eb26248977d76bbd0af5a4998383ae84
-
SHA1
c7f8ad259a825263e9cdd98e4b95e18c291b4e4e
-
SHA256
aabb9b75f800dae296581ed801daa0f13ed0bba09bca86cf85a1d334412a8a0c
-
SHA512
99632b390cc010397804c1f1c0c3a5ac108edf02ffb1de95338d4b8e9b6874f55c66501f808d9e72fdb00f88c51331976de522010973f9eec0b394948b7c4ea3
-
SSDEEP
49152:942tAG2mGLZgyqQrqNzNDYz6amN0UJenGTe3IxyUS3Smg4Czi13jgJZ3XRx2:tAzlgIIJYz8SUNk739jgJthw
Malware Config
Signatures
-
Unsigned PE 4 IoCs
Checks for missing Authenticode signature.
resource unpack001/16b03b421568cfc34236c1fce7814cad_BotManager.exe_ unpack001/6a2456dd060cf2863e3c7623ad4a7004_BotFarmer.exe_ unpack001/98d3d315144ea91f8eed28702d096277_BotFarmerLuna.exe_ unpack001/e5ec1d3bbf3e65a60e2aa8058a9e62b0_BotFarmerSatoshi.exe_
Files
-
aabb9b75f800dae296581ed801daa0f13ed0bba09bca86cf85a1d334412a8a0c.zip
-
16b03b421568cfc34236c1fce7814cad_BotManager.exe_.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
Q( Size: 77KB - Virtual size: 76KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text Size: 109KB - Virtual size: 109KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Size: 512B - Virtual size: 16B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
-
6a2456dd060cf2863e3c7623ad4a7004_BotFarmer.exe_.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
::>J> Size: 659KB - Virtual size: 658KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text Size: 191KB - Virtual size: 191KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 21KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Size: 512B - Virtual size: 16B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
-
98d3d315144ea91f8eed28702d096277_BotFarmerLuna.exe_.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
R5g'\ Size: 694KB - Virtual size: 694KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text Size: 185KB - Virtual size: 184KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 21KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Size: 512B - Virtual size: 16B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
-
e5ec1d3bbf3e65a60e2aa8058a9e62b0_BotFarmerSatoshi.exe_.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
49RB 0J Size: 631KB - Virtual size: 631KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text Size: 183KB - Virtual size: 183KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 21KB - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Size: 512B - Virtual size: 16B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ