Behavioral task
behavioral1
Sample
6875c5961cae993b45ccff4b62eb59f4266caa78c531182be615e0ea03ad4dee.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
6875c5961cae993b45ccff4b62eb59f4266caa78c531182be615e0ea03ad4dee.exe
Resource
win10v2004-20240226-en
General
-
Target
6875c5961cae993b45ccff4b62eb59f4266caa78c531182be615e0ea03ad4dee
-
Size
4.6MB
-
MD5
03e600a52b68709d073fcc01b2930a17
-
SHA1
68ff27b1ad790d0d123c6ce2e2ffa60ff6feaad9
-
SHA256
6875c5961cae993b45ccff4b62eb59f4266caa78c531182be615e0ea03ad4dee
-
SHA512
be534814c0e392d0760c81a0f099579be1c6af0187cf5b20d624a35025ce0337cf2cff05a20e8076ee912d015bbfe757e086c8a2d40aa09570c4278c18ae2946
-
SSDEEP
24576:soxwJ8Bq6LQfdc91f1THyW9ML99ehUZ39ZjqkLX8in3tUXtqdHpiJrlEptOuVXgk:sGSfSxMbdPZbjJeQt3VXgoF
Malware Config
Signatures
-
888rat family
-
Android 888 RAT payload 1 IoCs
resource yara_rule sample family_888rat -
Detects executables containing many references to VEEAM. Observed in ransomware 1 IoCs
resource yara_rule sample INDICATOR_SUSPICOUS_EXE_References_VEEAM -
Detects executables embedding registry key / value combination indicative of disabling Windows Defender features 1 IoCs
resource yara_rule sample INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender -
UPX dump on OEP (original entry point) 1 IoCs
resource yara_rule sample UPX -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 6875c5961cae993b45ccff4b62eb59f4266caa78c531182be615e0ea03ad4dee -
Office document contains embedded OLE objects 1 IoCs
Detected embedded OLE objects in Office documents.
resource yara_rule sample office_ole_embedded
Files
-
6875c5961cae993b45ccff4b62eb59f4266caa78c531182be615e0ea03ad4dee.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 36KB - Virtual size: 36KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 1024B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 193KB - Virtual size: 192KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ