brbbot | brbbot[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
brbbot.zip
Size 38KB
Sample240413-rf3bpagh9w
SHA256 3a407b1a344c694f1e1ca56be15ab2511db137dbd978c7131e872a8f2f01f133
MD5 5fa37b9e997a5a2f2ae42827dbf9ce6e
SHA1 35b0e81bfc00f120e64dee0114cef7c677478017
SHA512 c8cd0e1cb6b0cbd3b54b023541187949ec95dbf5db7ed867501c00bbcde5d57de3ef594c703d31c53701f3dad4d0c2605a386c4143b71436020c2fd0c9e0677b
SSDEEP 768:31AW5sfCeRfnkOGjACcV8iDL6HvYXhaflxVvt89jd5nId8gKr6f:3+0sfCeRfk18CcsvYRafPVKjsymf
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

brbbot

Malware Config

Extracted

Family

brbbot

brb.3dtuts.by

Signatures

Brbbot family
brbbot

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/brbbot.exe

File Explorer

brbbot.zip

.zip 38KB
brbbot.exe

.exe 74KB

brbbot.zip

SHA256 3a407b1a344c694f1e1ca56be15ab2511db137dbd978c7131e872a8f2f01f133
MD5 5fa37b9e997a5a2f2ae42827dbf9ce6e
SHA1 35b0e81bfc00f120e64dee0114cef7c677478017
SHA512 c8cd0e1cb6b0cbd3b54b023541187949ec95dbf5db7ed867501c00bbcde5d57de3ef594c703d31c53701f3dad4d0c2605a386c4143b71436020c2fd0c9e0677b
SSDEEP 768:31AW5sfCeRfnkOGjACcV8iDL6HvYXhaflxVvt89jd5nId8gKr6f:3+0sfCeRfk18CcsvYRafPVKjsymf
MD5 SHA1 SHA512 SSDEEP

Password

infected

brbbot.exe

IMPHASH 475b069fec5e5868caeb7d4d89236c89
SHA256 f47060d0f7de5ee651878eb18dd2d24b5003bdb03ef4f49879f448f05034a21e
MD5 1c7243c8f3586b799a5f9a2e4200aa92
SHA1 4db5a8e237937b6d7b435a8506b8584121a7e9e3
SHA512 56cdf52cfcc102d2c8cc90e5a298eeaefd44002061108b0d6b330bb93c3590b3f8b2c3c4e1fa208fafeefa7dafa092bd0f57d3cf905382f88b9f66a5d84357fd
SSDEEP 1536:b6sMD3H8V3jsUnHLiREsTbDV/48OO4vh47483gLi9+LSG:b6srVzJiRrTHVORe75g4+LS
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

16276

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

RegSetValueExA RegOpenKeyExA RegDeleteValueA RegFlushKey RegCloseKey CryptAcquireContextW CryptDeriveKey CryptReleaseContext CryptEncrypt CryptCreateHash CryptDestroyKey CryptDecrypt CryptDestroyHash CryptHashData

wininet

HttpSendRequestA InternetQueryDataAvailable InternetReadFile InternetCloseHandle HttpQueryInfoA InternetConnectA InternetOpenA HttpOpenRequestA InternetSetOptionA

ws2_32

gethostbyname WSACleanup WSAStartup inet_ntoa gethostname

kernel32

CreateFileW HeapSize WriteConsoleW SetStdHandle LoadLibraryW GetStringTypeW LCMapStringW LeaveCriticalSection EnterCriticalSection CreateFileA FindResourceA LoadResource HeapAlloc HeapFree GetProcessHeap WriteFile SizeofResource GetLastError LockResource GetModuleHandleA CloseHandle GetComputerNameA HeapReAlloc MoveFileExA WaitForSingleObject SetEvent GetModuleHandleW GetSystemWow64DirectoryA CreateProcessA GetSystemDirectoryA GetEnvironmentVariableA CopyFileA CreateEventW GetModuleFileNameA DeleteFileA GetFileSize ReadFile WideCharToMultiByte GetProcAddress GetTempFileNameA GetTempPathA FlushFileBuffers GetConsoleMode GetCommandLineW GetStartupInfoW TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext EncodePointer DecodePointer GetCPInfo GetACP GetOEMCP IsValidCodePage FlsGetValue FlsSetValue FlsFree SetLastError GetCurrentThreadId FlsAlloc ExitProcess GetStdHandle GetModuleFileNameW RtlUnwindEx FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount InitializeCriticalSectionAndSpinCount GetFileType DeleteCriticalSection HeapSetInformation GetVersion HeapCreate QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime Sleep MultiByteToWideChar SetFilePointer GetConsoleCP

user32

GetDC