observer | 4c47b27ba86d4fd26be721c10075bf1d4b226607e4118dfc401325c2d5978c53

General

Target
4c47b27ba86d4fd26be721c10075bf1d4b226607e4118dfc401325c2d5978c53
Size 139KB
Sample240417-rj72cabd48
SHA256 4c47b27ba86d4fd26be721c10075bf1d4b226607e4118dfc401325c2d5978c53
MD5 9083c77ee6e292b2c07315f82a3e558a
SHA1 ee61ba7e7f361a7255ed3add85d663426d1177c6
SHA512 249768b2be0dce7bca7a15988738fb7a5ba6f240763ce1f42e72e405e71d962183f336a35f7dbc207a6ca65ad21f371a23db6389550e5b2b070ff9724ece0c25
SSDEEP 3072:ibK+7TwVIwFO+8WGA6w06MEOd1FkIRBlHl2vK/DO1FZqiaA:iWYd7U6wvMpHBlHl2vKEFF
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

observer

Malware Config

Extracted

Family

observer

C2

http://5.42.66.25:3000

Signatures

Observer family
observer

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/24bb4fc117aa57fd170e878263973a392d094c94d3a5f651fad7528d5d73b58a.exe

File Explorer

4c47b27ba86d4fd26be721c10075bf1d4b226607e4118dfc401325c2d5978c53

.zip 139KB
24bb4fc117aa57fd170e878263973a392d094c94d3a5f651fad7528d5d73b58a.exe

.exe 250KB

4c47b27ba86d4fd26be721c10075bf1d4b226607e4118dfc401325c2d5978c53

SHA256 4c47b27ba86d4fd26be721c10075bf1d4b226607e4118dfc401325c2d5978c53
MD5 9083c77ee6e292b2c07315f82a3e558a
SHA1 ee61ba7e7f361a7255ed3add85d663426d1177c6
SHA512 249768b2be0dce7bca7a15988738fb7a5ba6f240763ce1f42e72e405e71d962183f336a35f7dbc207a6ca65ad21f371a23db6389550e5b2b070ff9724ece0c25
SSDEEP 3072:ibK+7TwVIwFO+8WGA6w06MEOd1FkIRBlHl2vK/DO1FZqiaA:iWYd7U6wvMpHBlHl2vKEFF
MD5 SHA1 SHA512 SSDEEP

Password

infected

24bb4fc117aa57fd170e878263973a392d094c94d3a5f651fad7528d5d73b58a.exe

IMPHASH b8de15954925e9e1385222064bd30fad
SHA256 24bb4fc117aa57fd170e878263973a392d094c94d3a5f651fad7528d5d73b58a
MD5 2d2b66d90495c1236f2e557172bf0f1c
SHA1 a06d203ae9cbe26a3c2e389f1c361ac49ef54c08
SHA512 6c41ed49223001453c9e014fb16ca8f1ac8345f181fc92c6abefee8118a316133f74d37e67ca2fff2c1a1859b8aea95207b22b2515573875bb95a4af9a52bcce
SSDEEP 3072:5LPEI6w9gdroG/X2jOVYHfWfo/CTHOU9Kp4O58eJZygmOVYOdqTnHLnwPclIFaFT:VbExY/6uMTrO58K9F8TnHKUoGcy
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

89202

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetModuleHandleA GetProcAddress ReadFile GetFileSizeEx HeapFree CreateFileW CloseHandle HeapAlloc GetProcessHeap ExpandEnvironmentStringsW TerminateProcess OpenProcess DeleteFileW GetFileSize FindFirstFileExW FindNextFileW FindClose GetFileAttributesW CreateToolhelp32Snapshot Process32NextW Process32FirstW GetUserDefaultLangID MultiByteToWideChar GetNativeSystemInfo GlobalMemoryStatusEx LoadLibraryW GetLastError CreateProcessW GetUserDefaultUILanguage GetLocaleInfoW GetCurrentThreadId WaitForSingleObjectEx GetExitCodeThread GetStringTypeW WideCharToMultiByte EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx ReleaseSRWLockExclusive WakeAllConditionVariable QueryPerformanceCounter CompareStringEx GetCPInfo GetSystemTimeAsFileTime GetModuleHandleW IsProcessorFeaturePresent IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW GetCurrentProcessId InitializeSListHead GetCurrentProcess RaiseException RtlUnwind SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW ExitProcess GetModuleFileNameW GetStdHandle WriteFile CompareStringW LCMapStringW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW HeapReAlloc GetTimeZoneInformation GetFileType SetFilePointerEx IsValidCodePage GetACP GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle FlushFileBuffers GetConsoleOutputCP GetConsoleMode HeapSize WriteConsoleW

Sharing