beatdrop | 95bbd494cecc25a422fa35912ec2365f3200d5a18ea4bfad5566432eb0834f9f

Sharing

Copy URL Twitter E-mail

General

Target
95bbd494cecc25a422fa35912ec2365f3200d5a18ea4bfad5566432eb0834f9f
Size 248KB
Sample240410-p15ansbc7z
SHA256 95bbd494cecc25a422fa35912ec2365f3200d5a18ea4bfad5566432eb0834f9f
MD5 e031c9984f65a9060ec1e70fbb84746b
SHA1 b01950ed9b1929fee04a9c23ac49e3de89e37228
SHA512 5dd1f004516b9fc0f0c36bca22dafaed9103191ebeea291e8d6f32f9b01b77fb18a0c4c5d04bd760a38651380a3680ede8b07f3d522f710b3df228ac8d934a2b
SSDEEP 6144:Gv77pPt5CRJRYHdhtxESU6FmixSG8aKUBYA/D1Q:GvX5C/qdhMZpG8a2A5Q
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

beatdrop

Malware Config

Signatures

Beatdrop family
beatdrop

Detects BEATDROP loader 1 IoCs

resource	yara_rule
sample	family_beatdrop

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
95bbd494cecc25a422fa35912ec2365f3200d5a18ea4bfad5566432eb0834f9f

File Explorer

95bbd494cecc25a422fa35912ec2365f3200d5a18ea4bfad5566432eb0834f9f

.dll 248KB

95bbd494cecc25a422fa35912ec2365f3200d5a18ea4bfad5566432eb0834f9f

IMPHASH 4f864dde5fd2f4565df1d722bbda3acd
SHA256 95bbd494cecc25a422fa35912ec2365f3200d5a18ea4bfad5566432eb0834f9f
MD5 e031c9984f65a9060ec1e70fbb84746b
SHA1 b01950ed9b1929fee04a9c23ac49e3de89e37228
SHA512 5dd1f004516b9fc0f0c36bca22dafaed9103191ebeea291e8d6f32f9b01b77fb18a0c4c5d04bd760a38651380a3680ede8b07f3d522f710b3df228ac8d934a2b
SSDEEP 6144:Gv77pPt5CRJRYHdhtxESU6FmixSG8aKUBYA/D1Q:GvX5C/qdhMZpG8a2A5Q
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x64 arch:x64

Detects BEATDROP loader
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4944

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED IMAGE_FILE_DLL

PDB paths

advapi32

GetUserNameA RegCloseKey RegOpenKeyExA RegQueryValueExA RegSetValueExA

kernel32

CloseHandle CreateFileA CreateFileMappingA CreateSemaphoreW DeleteCriticalSection EnterCriticalSection GetBinaryTypeA GetComputerNameExA GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetLastError GetModuleHandleA GetModuleHandleW GetProcAddress GetSystemTimeAsFileTime GetTickCount GetTimeZoneInformation InitializeCriticalSection IsDBCSLeadByteEx LeaveCriticalSection LoadLibraryW MapViewOfFile MultiByteToWideChar QueryPerformanceCounter RaiseException ReleaseSemaphore RtlAddFunctionTable RtlCaptureContext RtlLookupFunctionEntry RtlUnwindEx RtlVirtualUnwind SetLastError SetUnhandledExceptionFilter Sleep TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue UnhandledExceptionFilter VirtualAlloc VirtualProtect VirtualQuery WaitForSingleObject WideCharToMultiByte WriteProcessMemory

msvcrt

___lc_codepage_func ___mb_cur_max_func __iob_func _amsg_exit _assert _ctime64 _errno _initterm _lock _unlock abort calloc fclose fopen fputc fputs free fwrite islower isspace isupper localeconv malloc memchr memcmp memcpy memmove memset realloc signal sprintf strcmp strerror strlen strncmp vfprintf wcslen _write _read _fileno

psapi

GetModuleInformation

shell32

SHGetFolderPathA

wininet

HttpOpenRequestA HttpSendRequestA InternetCloseHandle InternetConnectA InternetOpenA InternetReadFile

ws2_32

WSAStartup gethostbyname gethostname inet_ntoa

Name

.text

Size

182KB

Virtual Size

181KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

464B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

33KB

Virtual Size

33KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

11KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

13KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

512B

Virtual Size

80B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

88B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

1024B

Virtual Size

1024B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

95bbd494cecc25a422fa35912ec2365f3200d5a18ea4bfad5566432eb0834f9f

advapi32

kernel32

msvcrt

psapi

shell32

wininet

ws2_32

generic