sessionmanager | 4ba880c1080b2bb71989b267576f145fe5500a5672f73750bfcefb72a3d4c651

General

Target
4ba880c1080b2bb71989b267576f145fe5500a5672f73750bfcefb72a3d4c651
Size 188KB
Sample240410-mxbsvada69
SHA256 4ba880c1080b2bb71989b267576f145fe5500a5672f73750bfcefb72a3d4c651
MD5 2410d0d7c20597d9b65f237f9c4ce6c9
SHA1 cd807d416897d84c8aeeccf92096186ffe62cf58
SHA512 54b04d63f76c8ad86d1bb65982b10a4cb41b8a840224f93469cb17ba8e157d7c1794e22a84660911a1e033388e28080b606971b059e30ca51a3d54150426b8f8
SSDEEP 3072:6WLoO17293SCUOPsjdZpn5O7w4vPmGpEuslwL/QodYhythqRUc:1LoO1KTUOPsjdjM043mGmu9jXaRU
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

backdoor sessionmanager

Malware Config

Signatures

Detected SessionManager backdoor 1 IoCs

backdoor

resource	yara_rule
sample	family_sessionmanager

Sessionmanager family
sessionmanager

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4ba880c1080b2bb71989b267576f145fe5500a5672f73750bfcefb72a3d4c651

File Explorer

4ba880c1080b2bb71989b267576f145fe5500a5672f73750bfcefb72a3d4c651

.dll 188KB

4ba880c1080b2bb71989b267576f145fe5500a5672f73750bfcefb72a3d4c651

IMPHASH 32a4ca59d11bf33698e41e21488c4887
SHA256 4ba880c1080b2bb71989b267576f145fe5500a5672f73750bfcefb72a3d4c651
MD5 2410d0d7c20597d9b65f237f9c4ce6c9
SHA1 cd807d416897d84c8aeeccf92096186ffe62cf58
SHA512 54b04d63f76c8ad86d1bb65982b10a4cb41b8a840224f93469cb17ba8e157d7c1794e22a84660911a1e033388e28080b606971b059e30ca51a3d54150426b8f8
SSDEEP 3072:6WLoO17293SCUOPsjdZpn5O7w4vPmGpEuslwL/QodYhythqRUc:1LoO1KTUOPsjdjM043mGmu9jXaRU
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

Detected SessionManager backdoor

backdoor
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

35144

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\Users\GodLike\Desktop\t\t4\SessionManagerV3Module\x64\Release\sessionmanagermodule.pdb

kernel32

OutputDebugStringA DebugBreak ReadFile CreatePipe GetLastError CloseHandle CreateProcessA SetEndOfFile HeapReAlloc HeapSize GetTimeZoneInformation WriteConsoleW GetProcessHeap SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetCPInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW GetModuleHandleW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlPcToFileHeader EncodePointer RaiseException RtlUnwindEx InterlockedFlushSList SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW CreateFileW GetDriveTypeW GetFileType PeekNamedPipe SystemTimeToTzSpecificLocalTime FileTimeToSystemTime ExitProcess GetModuleHandleExW GetModuleFileNameA MultiByteToWideChar WideCharToMultiByte HeapFree HeapAlloc SetFilePointerEx GetConsoleMode ReadConsoleW GetStdHandle FlushFileBuffers WriteFile GetConsoleCP DeleteFileW GetACP GetCurrentDirectoryW GetFullPathNameW CompareStringW LCMapStringW SetStdHandle GetStringTypeW FindClose FindFirstFileExA FindNextFileA IsValidCodePage GetOEMCP

ws2_32

__WSAFDIsSet closesocket gethostbyname select WSASetLastError inet_addr send socket connect inet_ntoa recv getsockopt htons ioctlsocket WSAGetLastError

Name

.text

Size

123KB

Virtual Size

122KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

50KB

Virtual Size

49KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gfids

Size

512B

Virtual Size

228B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

4ba880c1080b2bb71989b267576f145fe5500a5672f73750bfcefb72a3d4c651

kernel32

ws2_32

generic