bot[.]rar | Triage

Sharing

Copy URL Twitter E-mail

General

Target

bot.rar
Size

150KB
MD5

a6398d27a47d7db321a61b6d7b29b9f1
SHA1

713592a06e096ba7e8d024082129d8c8478bc2e2
SHA256

6bfa3321173a8fad07f669d59e2e0db74bf234d51cd6dabba7ccc6afefafa4eb
SHA512

1ac8b55bb49f0ae82b5ddc5fd806ccafc3968f7eedcef9d0cf882a05093b6bee193c9a81ddd25dfa950099d0dc919dd46f25480044abbb44f8dd63b9cadaf772
SSDEEP

3072:diKgfsFNWiPQWDWJ1KXikVIh4b3RdYhlAuNT9u9OqlcT2:diKgkFNWhWTXikqhV59nIcT2

Score

3^/10

Malware Config

Signatures

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
unpack002/StreamBot-main/Leaf.xNet.dll
unpack002/StreamBot-main/StreamBot.exe

Files

bot.rar
.rar
StreamBot-main.zip
.zip
StreamBot-main/Leaf.xNet.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

C:\projects\leaf-xnet\Leaf.xNet\obj\Release\net45\Leaf.xNet.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 127KB - Virtual size: 126KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
StreamBot-main/Leaf.xNet.xml
.xml .js polyglot
StreamBot-main/README.md
StreamBot-main/StreamBot.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Users\maria\Desktop\Youtube-Viewers-main\Youtube-Viewers\obj\Release\StreamBot.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 107KB - Virtual size: 107KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
StreamBot-main/proxy/http.txt
StreamBot-main/proxy/socks4.txt
StreamBot-main/proxy/socks5.txt
tools/socks4.txt

Sharing

General

Malware Config

Signatures

Files

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

mscoree

Sections

.text Size: 127KB - Virtual size: 126KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 512B - Virtual size: 12B

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

mscoree

Sections

.text Size: 15KB - Virtual size: 15KB

.rsrc Size: 107KB - Virtual size: 107KB

.reloc Size: 512B - Virtual size: 12B

.text
Size: 127KB - Virtual size: 126KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 12B

.text
Size: 15KB - Virtual size: 15KB

.rsrc
Size: 107KB - Virtual size: 107KB

.reloc
Size: 512B - Virtual size: 12B