8f685b087c2cfbe6cba3f9fbc8b3de50

Sharing

Copy URL Twitter E-mail

General

Target

8f685b087c2cfbe6cba3f9fbc8b3de50
Size

19.7MB
MD5

8f685b087c2cfbe6cba3f9fbc8b3de50
SHA1

b20c18536a07d6f7a45d20d5de4c4231f4f7e8a2
SHA256

41bcb452b3dc3c46f90fc5430f6bc340109824777e9da4049da80af29a0d6871
SHA512

090bcc4f8fde416933b49497faf8664d73b11ee102a561f79cc6e38c907ffdb8adf2d3c5000e70e32135b3d6bb34b44db2dc536df296963fb00fdf95c27bf9ee
SSDEEP

393216:igluUXCtdG4905/8rhnXllJL+WQyvbvuVkrsDJxkNWf817kkj0keb:nsBQRhMFXllJLNQyzBKONWf6Qb

Score

1^/10

Malware Config

Signatures

Files

8f685b087c2cfbe6cba3f9fbc8b3de50
.zip
SBotCL_Tray.exe
.exe windows:5 windows x86 arch:x86

baa93d47220682c04d92f7797d9224ce

Code Sign

06:a0:99:61:0d:35:b1:25:d0:82:72:7d:4b:89:65:20
Certificate

Issuer

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

15/01/2019, 00:00

Not After

14/01/2021, 23:59

Subject

CN=Ulrich Kunath,O=Ulrich Kunath,POSTALCODE=10557,STREET=Europaplatz 2,L=Berlin,ST=Berlin,C=DE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/11/2018, 00:00

Not After

31/12/2030, 23:59

Subject

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0b
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

31/12/2015, 00:00

Not After

09/07/2019, 18:40

Subject

CN=COMODO SHA-1 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

7e:0b:e5:e6:49:28:73:95:c2:3f:36:f5:34:fe:2c:7d:52:b7:45:2e
Signer

Actual PE Digest

7e:0b:e5:e6:49:28:73:95:c2:3f:36:f5:34:fe:2c:7d:52:b7:45:2e

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

lstrcpy

comctl32

InitCommonControls

Sections

Size: 1.2MB - Virtual size: 3.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 43KB - Virtual size: 95KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Size: 512B - Virtual size: 3.9MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

xlebckbg
Size: 2.1MB - Virtual size: 2.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

kctxdbyc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.taggant
Size: 8KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
SBot_2.1.55.exe
.exe windows:5 windows x86 arch:x86

baa93d47220682c04d92f7797d9224ce

Code Sign

06:a0:99:61:0d:35:b1:25:d0:82:72:7d:4b:89:65:20
Certificate

Issuer

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

15/01/2019, 00:00

Not After

14/01/2021, 23:59

Subject

CN=Ulrich Kunath,O=Ulrich Kunath,POSTALCODE=10557,STREET=Europaplatz 2,L=Berlin,ST=Berlin,C=DE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/11/2018, 00:00

Not After

31/12/2030, 23:59

Subject

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

2b:73:db:74:63:11:4c:5a:5b:32:4a:f2:30:57:72:49
Certificate

Issuer

CN=COMODO Time Stamping CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

02/05/2019, 00:00

Not After

30/05/2020, 10:48

Subject

CN=Sectigo SHA-1 Time Stamping Signer,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

62:5c:4d:90:8c:d5:42:fb:ab:2e:a5:73:3f:f1:54:19
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

27/04/2011, 00:00

Not After

30/05/2020, 10:48

Subject

CN=COMODO Time Stamping CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

42:1a:f2:94:09:84:19:1f:52:0a:4b:c6:24:26:a7:4b
Certificate

Issuer

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Not Before

07/06/2005, 08:09

Not After

30/05/2020, 10:48

Subject

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

73:4a:9e:6e:af:f1:96:8c:d6:f9:e3:58:c0:3a:f4:c8:f5:a4:f5:25
Signer

Actual PE Digest

73:4a:9e:6e:af:f1:96:8c:d6:f9:e3:58:c0:3a:f4:c8:f5:a4:f5:25

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

lstrcpy

comctl32

InitCommonControls

Sections

Size: 2.3MB - Virtual size: 9.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 26KB - Virtual size: 93KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Size: 512B - Virtual size: 7.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

bnctoryt
Size: 4.4MB - Virtual size: 4.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

tgxmurni
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.taggant
Size: 8KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
SBot_Addendum.exe
.exe windows:5 windows x86 arch:x86

baa93d47220682c04d92f7797d9224ce

Code Sign

06:a0:99:61:0d:35:b1:25:d0:82:72:7d:4b:89:65:20
Certificate

Issuer

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

15/01/2019, 00:00

Not After

14/01/2021, 23:59

Subject

CN=Ulrich Kunath,O=Ulrich Kunath,POSTALCODE=10557,STREET=Europaplatz 2,L=Berlin,ST=Berlin,C=DE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/11/2018, 00:00

Not After

31/12/2030, 23:59

Subject

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0b
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

31/12/2015, 00:00

Not After

09/07/2019, 18:40

Subject

CN=COMODO SHA-1 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

a7:61:e9:65:b5:7c:e2:cf:6d:e6:38:bc:58:be:a5:e0:0d:7e:5d:4b
Signer

Actual PE Digest

a7:61:e9:65:b5:7c:e2:cf:6d:e6:38:bc:58:be:a5:e0:0d:7e:5d:4b

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

lstrcpy

comctl32

InitCommonControls

Sections

Size: 41KB - Virtual size: 108KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Size: 512B - Virtual size: 3.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

ekckzbgo
Size: 1.9MB - Virtual size: 1.9MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

gaderxtd
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.taggant
Size: 8KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
navdata/cnav01.dat
navdata/cnav02.dat
navdata/cnav03.dat
navdata/cnav04.dat
navdata/cnav05.dat
navdata/cnav06.dat
navdata/cnav07.dat
navdata/cnav10.dat
navdata/cnav11.dat
navdata/cnav12.dat
navdata/cnav13.dat
navdata/cnav14.dat
navdata/cnav15.dat
navdata/cnav16.dat
navdata/cnav18.dat
navdata/cnav19.dat
navdata/cnav20.dat
navdata/cnav21.dat
navdata/cnav22.dat
navdata/cnav25.dat
navdata/cnav26.dat
navdata/nav01.dat
navdata/nav02.dat
navdata/nav03.dat
navdata/nav04.dat
navdata/nav05.dat
navdata/nav06.dat
navdata/nav07.dat
navdata/nav08.dat
navdata/nav09.dat
navdata/nav10.dat
navdata/nav11.dat
navdata/nav12.dat
navdata/nav13.dat
navdata/nav14.dat
navdata/nav15.dat
navdata/nav16.dat
navdata/nav17.dat
navdata/nav20.dat
navdata/nav22.dat
navdata/nav30.dat
navdata/nav31.dat
navdata/nav32.dat
navdata/nav33.dat
navdata/nav34.dat
navdata/nav35.dat
navdata/nav36.dat
navdata/nav37.dat
navdata/nav38.dat
navdata/nav39.dat
navdata/nav40.dat
navdata/nav43.dat
navdata/nav44.dat
navdata/nav45.dat
navdata/nav46.dat
navdata/nav47.dat
navdata/nav48.dat
navdata/nav49.dat
navdata/nav50.dat
navdata/nav51.dat
navdata/nav52.dat
navdata/nav53.dat
navdata/nav54.dat
navdata/nav55.dat
navdata/nav56.dat
navdata/nav57.dat
navdata/nav58.dat
navdata/nav59.dat
navdata/nav60.dat
navdata/nav61.dat

Sharing

General

Malware Config

Signatures

Files

baa93d47220682c04d92f7797d9224ce

Code Sign

06:a0:99:61:0d:35:b1:25:d0:82:72:7d:4b:89:65:20Certificate

Extended Key Usages

Key Usages

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6aCertificate

Extended Key Usages

Key Usages

16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0bCertificate

Extended Key Usages

Key Usages

7e:0b:e5:e6:49:28:73:95:c2:3f:36:f5:34:fe:2c:7d:52:b7:45:2eSigner

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

comctl32

Sections

Size: 1.2MB - Virtual size: 3.0MB

.rsrc Size: 43KB - Virtual size: 95KB

.idata Size: 512B - Virtual size: 4KB

Size: 512B - Virtual size: 3.9MB

xlebckbg Size: 2.1MB - Virtual size: 2.1MB

kctxdbyc Size: 512B - Virtual size: 4KB

.taggant Size: 8KB - Virtual size: 12KB

baa93d47220682c04d92f7797d9224ce

Code Sign

06:a0:99:61:0d:35:b1:25:d0:82:72:7d:4b:89:65:20Certificate

Extended Key Usages

Key Usages

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6aCertificate

Extended Key Usages

Key Usages

2b:73:db:74:63:11:4c:5a:5b:32:4a:f2:30:57:72:49Certificate

Extended Key Usages

Key Usages

62:5c:4d:90:8c:d5:42:fb:ab:2e:a5:73:3f:f1:54:19Certificate

Extended Key Usages

Key Usages

42:1a:f2:94:09:84:19:1f:52:0a:4b:c6:24:26:a7:4bCertificate

Key Usages

73:4a:9e:6e:af:f1:96:8c:d6:f9:e3:58:c0:3a:f4:c8:f5:a4:f5:25Signer

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

comctl32

Sections

Size: 2.3MB - Virtual size: 9.6MB

.rsrc Size: 26KB - Virtual size: 93KB

.idata Size: 512B - Virtual size: 4KB

Size: 512B - Virtual size: 7.8MB

bnctoryt Size: 4.4MB - Virtual size: 4.4MB

tgxmurni Size: 512B - Virtual size: 4KB

.taggant Size: 8KB - Virtual size: 12KB

baa93d47220682c04d92f7797d9224ce

Code Sign

06:a0:99:61:0d:35:b1:25:d0:82:72:7d:4b:89:65:20Certificate

Extended Key Usages

Key Usages

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6aCertificate

Extended Key Usages

Key Usages

16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0bCertificate

Extended Key Usages

Key Usages

a7:61:e9:65:b5:7c:e2:cf:6d:e6:38:bc:58:be:a5:e0:0d:7e:5d:4bSigner

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

comctl32

06:a0:99:61:0d:35:b1:25:d0:82:72:7d:4b:89:65:20
Certificate

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0b
Certificate

7e:0b:e5:e6:49:28:73:95:c2:3f:36:f5:34:fe:2c:7d:52:b7:45:2e
Signer

.rsrc
Size: 43KB - Virtual size: 95KB

.idata
Size: 512B - Virtual size: 4KB

xlebckbg
Size: 2.1MB - Virtual size: 2.1MB

kctxdbyc
Size: 512B - Virtual size: 4KB

.taggant
Size: 8KB - Virtual size: 12KB

06:a0:99:61:0d:35:b1:25:d0:82:72:7d:4b:89:65:20
Certificate

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

2b:73:db:74:63:11:4c:5a:5b:32:4a:f2:30:57:72:49
Certificate

62:5c:4d:90:8c:d5:42:fb:ab:2e:a5:73:3f:f1:54:19
Certificate

42:1a:f2:94:09:84:19:1f:52:0a:4b:c6:24:26:a7:4b
Certificate

73:4a:9e:6e:af:f1:96:8c:d6:f9:e3:58:c0:3a:f4:c8:f5:a4:f5:25
Signer

.rsrc
Size: 26KB - Virtual size: 93KB

.idata
Size: 512B - Virtual size: 4KB

bnctoryt
Size: 4.4MB - Virtual size: 4.4MB

tgxmurni
Size: 512B - Virtual size: 4KB

.taggant
Size: 8KB - Virtual size: 12KB

06:a0:99:61:0d:35:b1:25:d0:82:72:7d:4b:89:65:20
Certificate

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0b
Certificate

a7:61:e9:65:b5:7c:e2:cf:6d:e6:38:bc:58:be:a5:e0:0d:7e:5d:4b
Signer

.rsrc
Size: 3KB - Virtual size: 5KB

.idata
Size: 512B - Virtual size: 4KB

ekckzbgo
Size: 1.9MB - Virtual size: 1.9MB

gaderxtd
Size: 512B - Virtual size: 4KB

.taggant
Size: 8KB - Virtual size: 12KB