Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
7Static
static
3ibackupbot_setup.exe
windows11-21h2-x64
7$PLUGINSDI...ns.dll
windows11-21h2-x64
3$PLUGINSDI...LL.dll
windows11-21h2-x64
3$PLUGINSDI...nu.dll
windows11-21h2-x64
3$PLUGINSDI...em.dll
windows11-21h2-x64
3iBackupBot...32.exe
windows11-21h2-x64
1iBackupBot...64.exe
windows11-21h2-x64
1iBackupBot...st.exe
windows11-21h2-x64
7$PLUGINSDI...LL.dll
windows11-21h2-x64
3Analysis
-
max time kernel
144s -
max time network
94s -
platform
windows11-21h2_x64 -
resource
win11-20240412-en -
resource tags
arch:x64arch:x86image:win11-20240412-enlocale:en-usos:windows11-21h2-x64system -
submitted
19/04/2024, 09:40
Static task
static1
Behavioral task
behavioral1
Sample
ibackupbot_setup.exe
Resource
win11-20240412-en
Behavioral task
behavioral2
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win11-20240412-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/LangDLL.dll
Resource
win11-20240412-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/StartMenu.dll
Resource
win11-20240412-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/System.dll
Resource
win11-20240412-en
Behavioral task
behavioral6
Sample
iBackupBot for iPad iPhone/iBackupBot-32.exe
Resource
win11-20240412-en
Behavioral task
behavioral7
Sample
iBackupBot for iPad iPhone/iBackupBot-64.exe
Resource
win11-20240412-en
Behavioral task
behavioral8
Sample
iBackupBot for iPad iPhone/uninst.exe
Resource
win11-20240412-en
Behavioral task
behavioral9
Sample
$PLUGINSDIR/LangDLL.dll
Resource
win11-20240412-en
General
-
Target
iBackupBot for iPad iPhone/iBackupBot-64.exe
-
Size
21.7MB
-
MD5
5e85eec7364cbc3c9150f98ffabb7e12
-
SHA1
5fb844fc82361f9b30be4b18f0ae758f3705aa77
-
SHA256
0f5b2cc294971f5f19a07701066b43a8b474403d0b6f8973942bab1e4f6559da
-
SHA512
a9d45f2d20d5accac59ca9980cc124c1e9b80630f6119a80567c41b5e37d24cba9c38872d5365f07820bb91917b256f09c81cbfb13d4a9ca8ed35eb5c284878a
-
SSDEEP
393216:a4+lk1Qt9IJAJRHqT/aDWZPz+sctU6v8w/ZgDizduQ:a4V1QcJAPaqWBz+sctU6v8w/Zgw
Malware Config
Signatures
-
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4148 iBackupBot-64.exe 4148 iBackupBot-64.exe