Overview
overview
3Static
static
3fast/AdbWinApi.dll
windows7-x64
3fast/AdbWinApi.dll
windows10-2004-x64
3fast/AdbWinUsbApi.dll
windows7-x64
1fast/AdbWinUsbApi.dll
windows10-2004-x64
3fast/GingerBreak
debian-9-armhf
fast/adb.exe
windows7-x64
1fast/adb.exe
windows10-2004-x64
1fast/flash_image
debian-9-armhf
1fast/zergRush
debian-9-armhf
Analysis
-
max time kernel
122s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
22/12/2023, 13:40
Static task
static1
Behavioral task
behavioral1
Sample
fast/AdbWinApi.dll
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
fast/AdbWinApi.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral3
Sample
fast/AdbWinUsbApi.dll
Resource
win7-20231129-en
Behavioral task
behavioral4
Sample
fast/AdbWinUsbApi.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral5
Sample
fast/GingerBreak
Resource
debian9-armhf-20231222-en
Behavioral task
behavioral6
Sample
fast/adb.exe
Resource
win7-20231215-en
Behavioral task
behavioral7
Sample
fast/adb.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral8
Sample
fast/flash_image
Resource
debian9-armhf-20231215-en
Behavioral task
behavioral9
Sample
fast/zergRush
Resource
debian9-armhf-20231222-en
General
-
Target
fast/AdbWinUsbApi.dll
-
Size
59KB
-
MD5
5f23f2f936bdfac90bb0a4970ad365cf
-
SHA1
12e14244b1a5d04a261759547c3d930547f52fa3
-
SHA256
041c6859bb4fc78d3a903dd901298cd1ecfb75b6be0646b74954cd722280a407
-
SHA512
49a7769d5e6cb2fda9249039d90465f7a4e612805bba48b7036456a3bbd230e4d13da72e4ade5155ddc08fe460735ec8d6df3bb11b72ff28e1149221e2fc3048
-
SSDEEP
768:HLNk0yiFYWkgALpW+QvSugX0wUepQNXTQXdF+Q+An70edrqqOkIW:+yY8wugEwOVEXdz70e4gI
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1220 wrote to memory of 3040 1220 rundll32.exe 28 PID 1220 wrote to memory of 3040 1220 rundll32.exe 28 PID 1220 wrote to memory of 3040 1220 rundll32.exe 28 PID 1220 wrote to memory of 3040 1220 rundll32.exe 28 PID 1220 wrote to memory of 3040 1220 rundll32.exe 28 PID 1220 wrote to memory of 3040 1220 rundll32.exe 28 PID 1220 wrote to memory of 3040 1220 rundll32.exe 28