brbbot | f47060d0f7de5ee651878eb18dd2d24b5003bdb03ef4f49879f448f05034a21e[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
f47060d0f7de5ee651878eb18dd2d24b5003bdb03ef4f49879f448f05034a21e.exe
Size 74KB
Sample240414-b8v53sda68
SHA256 f47060d0f7de5ee651878eb18dd2d24b5003bdb03ef4f49879f448f05034a21e
MD5 1c7243c8f3586b799a5f9a2e4200aa92
SHA1 4db5a8e237937b6d7b435a8506b8584121a7e9e3
SHA512 56cdf52cfcc102d2c8cc90e5a298eeaefd44002061108b0d6b330bb93c3590b3f8b2c3c4e1fa208fafeefa7dafa092bd0f57d3cf905382f88b9f66a5d84357fd
SSDEEP 1536:b6sMD3H8V3jsUnHLiREsTbDV/48OO4vh47483gLi9+LSG:b6srVzJiRrTHVORe75g4+LS
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

brbbot

Malware Config

Extracted

Family

brbbot

brb.3dtuts.by

Signatures

Brbbot family
brbbot

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f47060d0f7de5ee651878eb18dd2d24b5003bdb03ef4f49879f448f05034a21e.exe

File Explorer

f47060d0f7de5ee651878eb18dd2d24b5003bdb03ef4f49879f448f05034a21e.exe

.exe 74KB

f47060d0f7de5ee651878eb18dd2d24b5003bdb03ef4f49879f448f05034a21e.exe

IMPHASH 475b069fec5e5868caeb7d4d89236c89
SHA256 f47060d0f7de5ee651878eb18dd2d24b5003bdb03ef4f49879f448f05034a21e
MD5 1c7243c8f3586b799a5f9a2e4200aa92
SHA1 4db5a8e237937b6d7b435a8506b8584121a7e9e3
SHA512 56cdf52cfcc102d2c8cc90e5a298eeaefd44002061108b0d6b330bb93c3590b3f8b2c3c4e1fa208fafeefa7dafa092bd0f57d3cf905382f88b9f66a5d84357fd
SSDEEP 1536:b6sMD3H8V3jsUnHLiREsTbDV/48OO4vh47483gLi9+LSG:b6srVzJiRrTHVORe75g4+LS
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

16276

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

RegSetValueExA RegOpenKeyExA RegDeleteValueA RegFlushKey RegCloseKey CryptAcquireContextW CryptDeriveKey CryptReleaseContext CryptEncrypt CryptCreateHash CryptDestroyKey CryptDecrypt CryptDestroyHash CryptHashData

wininet

HttpSendRequestA InternetQueryDataAvailable InternetReadFile InternetCloseHandle HttpQueryInfoA InternetConnectA InternetOpenA HttpOpenRequestA InternetSetOptionA

ws2_32

gethostbyname WSACleanup WSAStartup inet_ntoa gethostname

kernel32

CreateFileW HeapSize WriteConsoleW SetStdHandle LoadLibraryW GetStringTypeW LCMapStringW LeaveCriticalSection EnterCriticalSection CreateFileA FindResourceA LoadResource HeapAlloc HeapFree GetProcessHeap WriteFile SizeofResource GetLastError LockResource GetModuleHandleA CloseHandle GetComputerNameA HeapReAlloc MoveFileExA WaitForSingleObject SetEvent GetModuleHandleW GetSystemWow64DirectoryA CreateProcessA GetSystemDirectoryA GetEnvironmentVariableA CopyFileA CreateEventW GetModuleFileNameA DeleteFileA GetFileSize ReadFile WideCharToMultiByte GetProcAddress GetTempFileNameA GetTempPathA FlushFileBuffers GetConsoleMode GetCommandLineW GetStartupInfoW TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext EncodePointer DecodePointer GetCPInfo GetACP GetOEMCP IsValidCodePage FlsGetValue FlsSetValue FlsFree SetLastError GetCurrentThreadId FlsAlloc ExitProcess GetStdHandle GetModuleFileNameW RtlUnwindEx FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount InitializeCriticalSectionAndSpinCount GetFileType DeleteCriticalSection HeapSetInformation GetVersion HeapCreate QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime Sleep MultiByteToWideChar SetFilePointer GetConsoleCP

user32

GetDC