Behavioral task
behavioral1
Sample
brbbot.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
brbbot.exe
Resource
win10v2004-20240412-en
General
-
Target
brbbot.zip
-
Size
38KB
-
MD5
5fa37b9e997a5a2f2ae42827dbf9ce6e
-
SHA1
35b0e81bfc00f120e64dee0114cef7c677478017
-
SHA256
3a407b1a344c694f1e1ca56be15ab2511db137dbd978c7131e872a8f2f01f133
-
SHA512
c8cd0e1cb6b0cbd3b54b023541187949ec95dbf5db7ed867501c00bbcde5d57de3ef594c703d31c53701f3dad4d0c2605a386c4143b71436020c2fd0c9e0677b
-
SSDEEP
768:31AW5sfCeRfnkOGjACcV8iDL6HvYXhaflxVvt89jd5nId8gKr6f:3+0sfCeRfk18CcsvYRafPVKjsymf
Malware Config
Extracted
brbbot
brb.3dtuts.by
Signatures
-
Brbbot family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource unpack001/brbbot.exe
Files
-
brbbot.zip.zip
Password: infected
-
brbbot.exe.exe windows:5 windows x64 arch:x64
475b069fec5e5868caeb7d4d89236c89
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
advapi32
RegSetValueExA
RegOpenKeyExA
RegDeleteValueA
RegFlushKey
RegCloseKey
CryptAcquireContextW
CryptDeriveKey
CryptReleaseContext
CryptEncrypt
CryptCreateHash
CryptDestroyKey
CryptDecrypt
CryptDestroyHash
CryptHashData
wininet
HttpSendRequestA
InternetQueryDataAvailable
InternetReadFile
InternetCloseHandle
HttpQueryInfoA
InternetConnectA
InternetOpenA
HttpOpenRequestA
InternetSetOptionA
ws2_32
gethostbyname
WSACleanup
WSAStartup
inet_ntoa
gethostname
kernel32
CreateFileW
HeapSize
WriteConsoleW
SetStdHandle
LoadLibraryW
GetStringTypeW
LCMapStringW
LeaveCriticalSection
EnterCriticalSection
CreateFileA
FindResourceA
LoadResource
HeapAlloc
HeapFree
GetProcessHeap
WriteFile
SizeofResource
GetLastError
LockResource
GetModuleHandleA
CloseHandle
GetComputerNameA
HeapReAlloc
MoveFileExA
WaitForSingleObject
SetEvent
GetModuleHandleW
GetSystemWow64DirectoryA
CreateProcessA
GetSystemDirectoryA
GetEnvironmentVariableA
CopyFileA
CreateEventW
GetModuleFileNameA
DeleteFileA
GetFileSize
ReadFile
WideCharToMultiByte
GetProcAddress
GetTempFileNameA
GetTempPathA
FlushFileBuffers
GetConsoleMode
GetCommandLineW
GetStartupInfoW
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
EncodePointer
DecodePointer
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
FlsGetValue
FlsSetValue
FlsFree
SetLastError
GetCurrentThreadId
FlsAlloc
ExitProcess
GetStdHandle
GetModuleFileNameW
RtlUnwindEx
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
DeleteCriticalSection
HeapSetInformation
GetVersion
HeapCreate
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
Sleep
MultiByteToWideChar
SetFilePointer
GetConsoleCP
user32
GetDC
Sections
.text Size: 49KB - Virtual size: 48KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 14KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 192B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 774B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ