u���mg��=lSm}��ym' ����*�NF�ɕӋ��H�_����Aw�# �8b*�$d�s��0� ��!$� #V)�T�� �3Г-Q�F}J�F�Y����\{14(?m���Ro��遀�'rn�/ LJ��l��.�^���XL��=�����% /]��빝��٪.��9A���F��������>��j�/�'VL�Ml��4���6ʱ��p�"x�7�{,b|o��>�UR������E��� w�4�v�+>A��G`c�`ɲ<K��f� K������9i|�v�S�~kΠ�В�1�J���+X����`(�5h�'˲9���jr�Q7R�NU�L���!A���|��H!�}9�l�9�:U��'�l`����$��D�^ ��7��k�:�2ƴ�a���k�S�)����3�����%tkWWqP�KٖB��pl�kN���Wrٚ��`�\瞻x��8�|��wQ��R�� -D�&��ߗ����+����@.�m�A��<j��pV)�h�FL�3p0� .���%��/9 +@����C��v4FZ�?�,�č,K�X��d��hp֓�H��Z^C�þ��3�JP��#'l���S���r�k������ ����j�Tr��;����&BFPS�PU8�NJTn�K�C�&C�����6#��{c����5�xc�F@C�"�4*� ��5�⫀8_�a� H�b4�[(g3����YS9!yU{X%[G�=����Y���d7�M�R�#u�x-Jp�3#,ř>5M��l�C�pe�Ң����c�cs�zy���<��2���QXI��dYgw-�r��z���U[ƺk�\x�Óݾ��D���dӯ�}-u����ޞ&�EI-�KI���B*�vE�$e@亐g�ܗ�/��0j�wy��b�ϋ( �@���}l{�<��քP�9b��Ap��N)�����i'���S�@�� ���:��*eq୴�)�S�K�������|���̄'���M'�)�� 9�������'TNR� J<�'v*_[�N��]���&�2��p`���1�RC����</�j�|�G���gp����2�j����� �uu�Ȓ|C���V5��h��Υ��TV��*�M��7�¹��KY�ᤡ0A9_�]P��v���qݰ��;�!#���8w�CI��60���K��k����eO�6N����NJ^ғ��U����Bi)���<'�.mC��Bj���RZ|&��*����"�|�ʨZ'�|��Z)A�H �����7��_H#"�@o���X?t�L�G��\�w�"w�ް5O�P�\8�W�c��(1D����h��h����䗜��t��1x����d�!�{a�4����t�0��`Y��PJ�ю��\`� ٔmr�T�r��l8X�"��]���@�B!��)�{�G�w߆�J|ղ�\��1F��(�{؋G����u��PN��e�������YG��߳�[I�ԯuX�f�cg`PA/G���L:��8&�N+��YχV|F3To�� u��,�~��9�d&~���7a0j�oØJe���I����^:����O�j�)Ah˶�WN{7F� VcY���8/Z,hQ�?�+��j�C,QWن���:��=��H�`�k��X�ض��*~�I�e�m�ṣ���u��e��$�T�LY����M��LY��O+Y��6�>��qU��7����0n�L�Mp�Ξ�����J18xP�%��\pJ�j������&�((�� ��,&`��l|ʑp�UiU�>b�������GϠ�@KS'����� ��"�~�k����(<�ze)*`�d���u_�!F�9*Ih�=��L�Hk�yBeM�]IU>��iq�����Wx[�G��� ,����$�d��|��')^�P?��Q���ŵ��Z�ج�n?�r��������M���������� U��# �O)�a �K}�'�z9�$v����9H�Ԇ�/�/���@ �ٗ�0�E��o�o<ޛ�xS��ȰA���h,j�RG��G�rs�x?n����������1Smr�d���Z���V]@�X<mG�y��n�e2�*�T��iEo6U��!�(W�A[��7���+S�;*����.&�#��G�4FiX�f���R�t�+���n�^�e���F+�13 H�pECv������R����x,Wiv���J��T��y���24L��)4ze����Pch��Р��#��� ������"�o5���=RN�-���Nl �\�&%+�F��E/�e�Hkv]����Z��E�:�����R�Zr������b��d��O�je���:J}[�0RcAR?�6��u��1���-��WP��c��7n�X�Q��i!sj�l�C���P�r�]8��O�K_D^)h���2�����Q��lmy���%���x}zV���m��Q���M8P�иQ�k6���ߕһ�:�����3�.mW+!�3{VM�Ƕ��Չ��xCt��⅃��]��f�X<���0K��M���0�s�E͞rפ�/7�ցi�~M_D�������b��/(�IjL�����l�(�`��RuQ����xH��@����|�ƞ��mS,;���ps��z��g?�e@J�`���S�^��ȚןT�hd����������߀� l�~ؐy����lɀ�)ǰ����%�/"S=s��sϓ��M���;�^��+�˩F%����tI�䆯��3Hc���?�ڧ�҄|w�L���[l'h�'��$`���[V��*[�\Kڳ/��_858U���,�����Z�"������J��D�X~��d�*�F�J�}C$��K}S��1��]��0���|]VӫJn~���^]�����m���VdS�m�U�� ����ϑ��0�4 ��L*ɝ8�<v*c���L���|����k3��{YV�BI� �V����K��!f�u�m�Jrn3�)`6��EH1 �����.j�t%�3���>��H���~��ɗ�Ř��A[�$�v��"eIp���~�jP��-�v� K[�� �{B
Overview
overview
7Static
static
3BoostBotv2.4.1.rar
windows7-x64
3BoostBotv2.4.1.rar
windows10-2004-x64
7Boost Bot.exe
windows7-x64
5Boost Bot.exe
windows10-2004-x64
5Instructions.txt
windows7-x64
1Instructions.txt
windows10-2004-x64
1config.json
windows7-x64
3config.json
windows10-2004-x64
3ngrok.exe
windows7-x64
1ngrok.exe
windows10-2004-x64
1Static task
static1
Behavioral task
behavioral1
Sample
BoostBotv2.4.1.rar
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
BoostBotv2.4.1.rar
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
Boost Bot.exe
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
Boost Bot.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral5
Sample
Instructions.txt
Resource
win7-20231129-en
Behavioral task
behavioral6
Sample
Instructions.txt
Resource
win10v2004-20240226-en
Behavioral task
behavioral7
Sample
config.json
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
config.json
Resource
win10v2004-20240226-en
Behavioral task
behavioral9
Sample
ngrok.exe
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
ngrok.exe
Resource
win10v2004-20240226-en
General
-
Target
BoostBotv2.4.1.rar
-
Size
21.0MB
-
MD5
d9f59251f24ae73ed0f5cbb9a0a991da
-
SHA1
85a4f1b92f98f9cd536bb4f5da3ba8095e79ab45
-
SHA256
607c7db5ae27a27a497c22390dd21fd0dd9e860074a8abb7a6cdb6b23bae6781
-
SHA512
613eb48a6b4b14d8bac7687329a943df519d672144c1503879d38985bc76429c5832b3ac2e22b0a25f88e69f6f7f18eaf7a09b8642f4977241379de50ed6a2dc
-
SSDEEP
393216:bCCmgFUXDqbWMU3vvfiPkwyi/QkyaR0LzffsXfzL4lYkJpWyghQqqS:GCmnX+qH/iMlamnfkANJpWygl
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Boost Bot.exe
Files
-
BoostBotv2.4.1.rar.rar
-
Boost Bot.exe.exe windows:6 windows x64 arch:x64
9cfc7e5db1974002df63adc9ba2c0f75
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
WriteFile
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
CharUpperBuffW
Exports
Exports
Sections
.text Size: - Virtual size: 5.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 5.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 127KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.xdata Size: - Virtual size: 180B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.zdebug_ Size: - Virtual size: 297B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.zdebug_ Size: - Virtual size: 945KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.zdebug_ Size: - Virtual size: 195KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.debug_g Size: - Virtual size: 48B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.zdebug_ Size: - Virtual size: 1.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.zdebug_ Size: - Virtual size: 1.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.zdebug_ Size: - Virtual size: 344KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.ZKa Size: - Virtual size: 135KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.symtab Size: - Virtual size: 999KB
IMAGE_SCN_MEM_READ
.=$J Size: - Virtual size: 4.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.t2` Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
..PB Size: 14.8MB - Virtual size: 14.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 132B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 17KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
Instructions.txt
-
config.json
-
ngrok.exe.exe windows:6 windows x64 arch:x64
ea509d361799935a94335b88f534a970
Code Sign
07:c8:7c:1c:68:a5:01:94:5c:04:66:53:18:96:81:5dCertificate
IssuerCN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=USNot Before13/07/2023, 00:00Not After08/08/2024, 23:59SubjectCN=ngrok\, Inc.,O=ngrok\, Inc.,L=San Diego,ST=California,C=US,1.2.840.113549.1.9.1=#0c11737570706f7274406e67726f6b2e636f6dExtended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate
IssuerCN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=USNot Before01/08/2022, 00:00Not After09/11/2031, 23:59SubjectCN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=USKey Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate
IssuerCN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=USNot Before23/03/2022, 00:00Not After22/03/2037, 23:59SubjectCN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16Certificate
IssuerCN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=USNot Before14/07/2023, 00:00Not After13/10/2034, 23:59SubjectCN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
af:e9:10:37:7e:b2:27:d1:8f:01:10:a7:7b:16:e2:26:70:de:ba:95:1d:18:4a:40:d2:5c:65:e1:4e:7e:4c:3aSigner
Actual PE Digestaf:e9:10:37:7e:b2:27:d1:8f:01:10:a7:7b:16:e2:26:70:de:ba:95:1d:18:4a:40:d2:5c:65:e1:4e:7e:4c:3aDigest Algorithmsha256PE Digest MatchestrueHeaders
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
WriteFile
WriteConsoleW
WerSetFlags
WerGetFlags
WaitForMultipleObjects
WaitForSingleObject
VirtualQuery
VirtualFree
VirtualAlloc
TlsAlloc
SwitchToThread
SuspendThread
SetWaitableTimer
SetUnhandledExceptionFilter
SetThreadPriority
SetProcessPriorityBoost
SetEvent
SetErrorMode
SetConsoleCtrlHandler
ResumeThread
RaiseFailFastException
PostQueuedCompletionStatus
LoadLibraryW
LoadLibraryExW
SetThreadContext
GetThreadContext
GetSystemInfo
GetSystemDirectoryA
GetStdHandle
GetQueuedCompletionStatusEx
GetProcessAffinityMask
GetProcAddress
GetErrorMode
GetEnvironmentStringsW
GetCurrentThreadId
GetConsoleMode
FreeEnvironmentStringsW
ExitProcess
DuplicateHandle
CreateWaitableTimerExW
CreateWaitableTimerA
CreateThread
CreateIoCompletionPort
CreateFileA
CreateEventA
CloseHandle
AddVectoredExceptionHandler
Sections
.text Size: 10.0MB - Virtual size: 10.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 12.9MB - Virtual size: 12.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 918KB - Virtual size: 1.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 250KB - Virtual size: 249KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.xdata Size: 512B - Virtual size: 168B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 204KB - Virtual size: 204KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.symtab Size: 512B - Virtual size: 4B
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.rsrc Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ