Behavioral task
behavioral1
Sample
0ab1b8f93932c6123676ddfdd93866dd.exe
Resource
win7-20231215-en
General
-
Target
0ab1b8f93932c6123676ddfdd93866dd
-
Size
239KB
-
MD5
0ab1b8f93932c6123676ddfdd93866dd
-
SHA1
4ed7575412fb98117e18177b0cd27e6e8cc007ec
-
SHA256
cb594982df5891adec99e852d653e8683d21c9a512c6a445384cd63e13b81263
-
SHA512
9c06801a245ae0141c6a63c0d7e7282ae139029523df0eb24773f3afc5f058e405188ba87b194027096f4e6199bd1ff3e110a258aeae711c9de99a61f3854fed
-
SSDEEP
3072:e/jjlq7xQAC1EkXmI7s3MfxY2NgNgFSbH6H0ubRXIHrjUkDE9ZKdTHOYDg4x2z:z7xQA9nMfq23+ubRXxZKdTuqtU
Malware Config
Signatures
-
Async RAT payload 1 IoCs
resource yara_rule sample asyncrat -
Asyncrat family
-
Detect ZGRat V1 1 IoCs
resource yara_rule sample family_zgrat_v1 -
StormKitty payload 1 IoCs
resource yara_rule sample family_stormkitty -
Stormkitty family
-
Zgrat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0ab1b8f93932c6123676ddfdd93866dd
Files
-
0ab1b8f93932c6123676ddfdd93866dd.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 234KB - Virtual size: 234KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ