Overview

overview

7

Static

static

3

ibackupbot_setup.exe

windows11-21h2-x64

7

$PLUGINSDI...ns.dll

windows11-21h2-x64

3

$PLUGINSDI...LL.dll

windows11-21h2-x64

3

$PLUGINSDI...nu.dll

windows11-21h2-x64

3

$PLUGINSDI...em.dll

windows11-21h2-x64

3

iBackupBot...32.exe

windows11-21h2-x64

1

iBackupBot...64.exe

windows11-21h2-x64

1

iBackupBot...st.exe

windows11-21h2-x64

7

$PLUGINSDI...LL.dll

windows11-21h2-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ibackupbot_setup.exe

  • Size

    13.9MB

  • Sample

    240419-lm9fpaeh3v

  • MD5

    7e140a4824a2c2e43879fdcba2beb673

  • SHA1

    18d46a304cbc99553d7d39bc4d3c5c08a0d612c9

  • SHA256

    58d80782c3fb365c3dc4cd812bae64b0a0d3e1d981e11ccb32c7e6219395b90e

  • SHA512

    bcf9f594d1387c1fe51fbdf83609b80c5e367be3cbde114e81adfd2a78a06b6db417a9d57f93ef5907084324c38582152c058ad89d966953c827ee964fd2b5a4

  • SSDEEP

    393216:M0uaMGEcTI5K42z8s3XhX8nIcXKKG9SrdGMP6hx:M0Y0IpsUrBrjPkx

Score
7/10

Malware Config

Targets

    • Target

      ibackupbot_setup.exe

    • Size

      13.9MB

    • MD5

      7e140a4824a2c2e43879fdcba2beb673

    • SHA1

      18d46a304cbc99553d7d39bc4d3c5c08a0d612c9

    • SHA256

      58d80782c3fb365c3dc4cd812bae64b0a0d3e1d981e11ccb32c7e6219395b90e

    • SHA512

      bcf9f594d1387c1fe51fbdf83609b80c5e367be3cbde114e81adfd2a78a06b6db417a9d57f93ef5907084324c38582152c058ad89d966953c827ee964fd2b5a4

    • SSDEEP

      393216:M0uaMGEcTI5K42z8s3XhX8nIcXKKG9SrdGMP6hx:M0Y0IpsUrBrjPkx

    Score
    7/10

    • Loads dropped DLL

    behavioral1

    • Target

      $PLUGINSDIR/InstallOptions.dll

    • Size

      14KB

    • MD5

      20f3184efe7edddfef3325efc25d12a5

    • SHA1

      8db4c500d73f9525a7e9834df6caea2e70189939

    • SHA256

      0e014352b64abc431d97460d79757cbafbf6ba997c08b608c294e1f582af269a

    • SHA512

      433188957a4603c9c61ec698a720021aacf61f46ccc32d5a11bcb6f2d0b1f01e5680635707d8a0ec7a9ef2aa2a85d6dec07ded452e4cb9e280062c0bed555c1a

    • SSDEEP

      192:v4n3T5aK+dHCMR1aQR9RuZl3WWmU7WYZsw1JpVGnrjWK72dwF7dBOne:wn3T5KdHCMRD/R1cOnrjW+BO

    Score
    3/10
    behavioral2

    • Target

      $PLUGINSDIR/LangDLL.dll

    • Size

      5KB

    • MD5

      ea60c7bd5edd6048601729bd31362c16

    • SHA1

      6e6919d969eb61a141595014395b6c3f44139073

    • SHA256

      4e72c8b4d36f128b25281440e59e39af7ec2080d02e024f35ac413d769d91f39

    • SHA512

      f9dc35220697153bb06e3a06caf645079881cb75aed008dbe5381ecaf3442d5be03500b36bbca8b3d114845fac3d667ddf4063c16bc35d29bbea862930939993

    • SSDEEP

      48:im1nEhqneMPUptuMMNvimk2BAZuMTRCpYEvJdUJvR0J6of5dwe:F1jpl9NLBAZuYtR0xd

    Score
    3/10
    behavioral3

    • Target

      $PLUGINSDIR/StartMenu.dll

    • Size

      7KB

    • MD5

      a09bcf528d02f89f9befa78937ca7d7b

    • SHA1

      3cbcb0fdc32a8f21d6d557cc4c3bb6c4ee246b6f

    • SHA256

      5a31abf36c0ed5e74295b7d7db5a2b09d8aa308483612b7b0bc04771000ac8ad

    • SHA512

      ad4bbc478c028d4b8b890ea60a26ecae1c0dfacad872d150bfb1c334d7f52f2963123c45cef4ee0d773d9b3e143dde2c3d8da92ea9f703e44c5ee873a873b95c

    • SSDEEP

      96:QgiqVPb3X8K8Kdr3gEq6nNdMk6Qiw290+q6LDtJ1tT3hhEl7y:QgiqVPgK8K9eIdE9B/tThg7

    Score
    3/10
    behavioral4

    • Target

      $PLUGINSDIR/System.dll

    • Size

      11KB

    • MD5

      55a26d7800446f1373056064c64c3ce8

    • SHA1

      80256857e9a0a9c8897923b717f3435295a76002

    • SHA256

      904fd5481d72f4e03b01a455f848dedd095d0fb17e33608e0d849f5196fb6ff8

    • SHA512

      04b8ab7a85c26f188c0a06f524488d6f2ac2884bf107c860c82e94ae12c3859f825133d78338fd2b594dfc48f7dc9888ae76fee786c6252a5c77c88755128a5b

    • SSDEEP

      192:MPtkumJX7zBE2kGwfy9S9VkPsFQ1Mx1c:97O2k5q9wA1Mxa

    Score
    3/10
    behavioral5

    • Target

      iBackupBot for iPad iPhone/iBackupBot-32.exe

    • Size

      22.8MB

    • MD5

      ed9a8e267ac421708f7de341065a6692

    • SHA1

      fda73ca0ffe1a6db7e2af3dfc6f88ac2c75e9bb3

    • SHA256

      b4dd824bbc72f95d4be04dffb29a59a03bfcf76639151565859467e68e558f78

    • SHA512

      67d51678a896acdc7646b4d26cc093156063cb26365aa79f3e8f2788ff4423a222ee379ab3569e380f94fe7435d316c774c78fd88dba73f6d93ae0b233f4ca69

    • SSDEEP

      393216:YvaTgXt4xxWDq7lXTbG/ObNgEJogzdu6owxy98IXPK+N4NzhKCBywYDYZLK0WiEE:IXtwQ8XTbjQQ9yzNYh

    Score
    1/10
    behavioral6

    • Target

      iBackupBot for iPad iPhone/iBackupBot-64.exe

    • Size

      21.7MB

    • MD5

      5e85eec7364cbc3c9150f98ffabb7e12

    • SHA1

      5fb844fc82361f9b30be4b18f0ae758f3705aa77

    • SHA256

      0f5b2cc294971f5f19a07701066b43a8b474403d0b6f8973942bab1e4f6559da

    • SHA512

      a9d45f2d20d5accac59ca9980cc124c1e9b80630f6119a80567c41b5e37d24cba9c38872d5365f07820bb91917b256f09c81cbfb13d4a9ca8ed35eb5c284878a

    • SSDEEP

      393216:a4+lk1Qt9IJAJRHqT/aDWZPz+sctU6v8w/ZgDizduQ:a4V1QcJAPaqWBz+sctU6v8w/Zgw

    Score
    1/10
    behavioral7

    • Target

      iBackupBot for iPad iPhone/uninst.exe

    • Size

      64KB

    • MD5

      7838ecb4ca21ef1518939d3bc5cb8793

    • SHA1

      d67921104b7a27bb4025c1f41b459b33d222c55c

    • SHA256

      fe8cc751a470879f7ff09ec9b9e1ffe8374a23fe1a202e7ba86590fbda53f0f2

    • SHA512

      2896e155d9c8af6dc722af7129dcd532ea20782520eb39c87b44cc3bc589fba520f325227e4b86cbc0ac97ce8776ae55e11cf718e9ca22860eaafb1ed6ed8fb3

    • SSDEEP

      1536:JU+dcy3fxBk9UmZHs/hcaFgdLeAyN/WmaE5rWEbgfjmK:JNzPHk9MpcaFceAWSH7mK

    Score
    7/10

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral8

    • Target

      $PLUGINSDIR/LangDLL.dll

    • Size

      5KB

    • MD5

      ea60c7bd5edd6048601729bd31362c16

    • SHA1

      6e6919d969eb61a141595014395b6c3f44139073

    • SHA256

      4e72c8b4d36f128b25281440e59e39af7ec2080d02e024f35ac413d769d91f39

    • SHA512

      f9dc35220697153bb06e3a06caf645079881cb75aed008dbe5381ecaf3442d5be03500b36bbca8b3d114845fac3d667ddf4063c16bc35d29bbea862930939993

    • SSDEEP

      48:im1nEhqneMPUptuMMNvimk2BAZuMTRCpYEvJdUJvR0J6of5dwe:F1jpl9NLBAZuYtR0xd

    Score
    3/10
    behavioral9

MITRE ATT&CK Enterprise v15

Tasks