followersbot[.]exe | Triage

Resubmissions

08-05-2024 01:59

240508-cexbqacf91 10

08-05-2024 01:58

240508-cdzepafc24 8

Sharing

General

Target

followersbot.exe
Size

29.8MB
MD5

1d8e95b4a436b4dd8e00eb84cf225246
SHA1

25f0654c804e56279a2f4e03fd940584a3db082f
SHA256

773a273b2c81ea4a0f308de30d377850b309a261a86418f580ec406d8e86f692
SHA512

43f43002d5e4d56b9902f45814b6b8735b4b62bab4a50199105784ac00f48fca0ae0564cbc1ebac1a5965745ab0a4d3144bb143d6bebd417f972d30e47ace514
SSDEEP

786432:1Q7YWt1MOSmwvIUciBDtfhuLhAzvlWOkzrLC+fA/I/AUbbZCaTAQ:1QJMOS1v7c2fuhoqviI/xbbZCap

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
followersbot.exe

Files

followersbot.exe
.exe windows:4 windows x64 arch:x64

02549ff92b49cce693542fc9afb10102

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED

Imports

msvcrt

malloc
memset
_get_pgmptr
getenv
sprintf
__argc
__argv
_environ
_XcptFilter
__set_app_type
_controlfp
__getmainargs
exit

kernel32

Sleep
CreateProcessA
SetUnhandledExceptionFilter

Sections

.text
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 29.7MB - Virtual size: 29.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 3KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 144B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 496B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ