Behavioral task
behavioral1
Sample
5006811a703df8ac836954f2908fcfdd.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
5006811a703df8ac836954f2908fcfdd.exe
Resource
win10v2004-20231222-en
General
-
Target
5006811a703df8ac836954f2908fcfdd
-
Size
3.3MB
-
MD5
5006811a703df8ac836954f2908fcfdd
-
SHA1
e896d804aa2a53c28ef22200b2bac084bae72916
-
SHA256
2e255146db3c8b948afff2f4d560543627ad7555e411f340a2eb2a4d8cc9372c
-
SHA512
7940083782690785b37ff529122f4a92de77259c2101104e38a4a3db43c3130a24610072fc6a50dc5ededacceecefefe763f3087565f0c9ab02a7e24cc76561c
-
SSDEEP
24576:huLnVMpdbm/ftgjGohV25TnXiwGXRZmZybZEiE6EhJ1sMvMbe+pZD:h4l81gLBjyL0J1sMvMbPh
Malware Config
Extracted
bruteratel
�t�����l�;�*]������I��u�qq������;S�z{��k�@=t��T�������w��M�_߿��3#ǽFS����a��ǭ���r��1�y+?���ٰ�x֯^I�Z���(\�1)J���q�֩���J�uX��m;���� ��T��'�������ߪ>���*?`8}�D��L�����ݸ��#����ZN����^�ې�!��Y+��m�����E�H���fBw_�-.��C�+��x�����ǻ��8���ISCW��s�G⡇�S_��Cw�3�pJ��AQ@W�1��s}�o��[����w�<�v��U��=�6�;�Z2t{ך��W�����$Z��SO,ܱ���+\��`�E(`���@��g� �����j�z�_����l2WobLX��/�x��<t�ڀ�:�:���9��4����o�Y�R>C����Kn`i���#���puO��j����O��?J�UI������F[�ZM�u��4�,���\�3��~� _21�WH��W~��p�>�����AY�i��h�Y9:ʪŋY�n �=��O\�]���`�1H+1��k[tO��P͵��lz�k�E����u����?{�Z�'�R%�h-̩�������Y߲ ��lx���B��5���+G3+h8X��w���l�tǭZ�V���Y����<�"�rA��������T�j��{�W��x���
L�7xB��ɡk��۟Ʊ�P�5�b��h�f�B]��7�v�8a���q��1�tf�Z���hHT�F�����U��^=�{�a��F��cP �q���1d��:JUϐ��UC�BK�CZ3q�XDt��nY�^".m� ����]��Tn��b�{$����M �k��P�7��0&E`n���˴�+֮CG��;��J� m�!�� �1}�a�1M!R�
�`�ؼ0O*u=:�=e�[�Iy�Ք]�`����pkG(O�G5=�`>�8�т���Dz�W��XQk�0��oilJ��Jv3/���M[�M�'���ꕎ��X7`Ե�.]Hs:����mChBh��}K�N �B�1'�C���kjf�+�4�N=���Ϯ���������7^%�w�8��y����ߠ��������m�~F;v�9�AQپV�UpPxƖc�^����'��_��E�R��d�?�������l4�+�ZKu�:�{�j8�r��_Ү�1��M��Ew]��[���\?���?"~>�y�J?���˿����Q\���U�Z�>
-
c2_auth
'a�$��uX<��N�DTpj�^@�v�䦙���2)_!� R �Gh#��(�՝�<����2xҳY�g���x_OpCp8���\(z� ��4�X��}�a,}�+�\���'���4��QU��hEDBh��H�=������6`�a�k�X(Kh#1:�o��Ҫ �X9��ӓ1D�!���7��*��ۀ-����vэ�vv��ӓ����)��J�z(l���y���1��`Si��z���l��[���;��;%\�i^����p�q6�!͇�4�2Y*[n���{^fn�Y��Sj��~���?Y}� �}���[�j���f3�� N���s��w�_,��[���/3���i��A����'3�_�'m6� �U��[Oh��v�&�����a���_[gOI�E��@Y�4/�s��?
-
uri
/
/�]_�?
/���e��?Įko&ll��2���lP���K�1�a1�g��*��ݳVb��x��'�\$�c#�����Z��U�X�W̭���P/�U�3m.��Uj�r�4��(Yر���&q��#Q��`Xq�ȱW���w�����'4������Y������tl&���+�����%��p�b@b����d��%�r������8� �����z�[�����}h�a/�'�k�`�y\����e��R�n�3���y���������⫄����}���)~:F
-
user_agent
/�]_�?
Signatures
-
Bruteratel family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5006811a703df8ac836954f2908fcfdd
Files
-
5006811a703df8ac836954f2908fcfdd.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Sections
CODE Size: 818KB - Virtual size: 818KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 4KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 11KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 16B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 54KB - Virtual size: 53KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 2.4MB - Virtual size: 2.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ