Behavioral task
behavioral1
Sample
密保伴侣/mbbl.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
密保伴侣/mbbl.exe
Resource
win10v2004-20231222-en
Behavioral task
behavioral3
Sample
密保伴侣/新云软件.url
Resource
win7-20231215-en
Behavioral task
behavioral4
Sample
密保伴侣/新云软件.url
Resource
win10v2004-20231215-en
General
-
Target
3cb9132c50923a84da383c54a90d65b8
-
Size
375KB
-
MD5
3cb9132c50923a84da383c54a90d65b8
-
SHA1
ed03f8a918f387b29be95858f0c870e2574cba1f
-
SHA256
19d5c189504a233303d0875d2b407065f9c0b235a74df621c7eb2402da9d5242
-
SHA512
91564352f0d65682885f41406d090f25a2190d28eb8e2852e0819e1a40b776992679a516c86e277b72df2ba54c9b46062fc2d657c2e38ee546780292f116eaf2
-
SSDEEP
6144:NGSI7R36CSoVJmJIjxgOJZytm7TcvRilXNiiwHU+TtsdHKQMCoIs6WIaB:0ROelgUZfTcvCXNh+RsKQVwB
Malware Config
Signatures
-
resource yara_rule static1/unpack001/密保伴侣/mbbl.exe upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/密保伴侣/mbbl.exe
Files
-
3cb9132c50923a84da383c54a90d65b8.rar
-
密保伴侣/mbbl.exe.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 636KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 299KB - Virtual size: 300KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 38KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
密保伴侣/使用说明.mht.eml
-
密保伴侣/常见问题.txt
-
密保伴侣/新云软件.url.url
-
密保伴侣/更新说明.txt