observer | f700c7059dcb4db8b23e7f31ec135b7b[.]bin

General

Target
f700c7059dcb4db8b23e7f31ec135b7b.bin
Size 158KB
Sample240508-elxbeacc46
SHA256 137596e6de74907857a5d4e94484ba638ac520d2c866910079eb98d24530a7c2
MD5 7ff994ac6cb2564ede94cc70f7c529e2
SHA1 08960d10795555f7bd48215ce58410830ed4914b
SHA512 479b49635b2e274652882c23e225294aba94bb675fdfda024eb306cec07946e7487a0617481ce0f639f16d9df677996ff2abc19a588aa9e28b870b5ac7ce66db
SSDEEP 3072:V7lZA+uJwow9k77/PllFeX36r58yY4Jk1wYjs/lU0Iux5i1VSY/DicGU:V7Rlo3l/8yY4k2Y4h3i1q7U
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

observer

Malware Config

Extracted

Family

observer

C2

http://91.103.252.17:8912

Signatures

Observer family
observer

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/b5e6dde637ff9dbc4dc8602c2340a4697009e2e4f1d876b9aaa6d7d0608cfcc6.exe

File Explorer

f700c7059dcb4db8b23e7f31ec135b7b.bin

.zip 158KB
b5e6dde637ff9dbc4dc8602c2340a4697009e2e4f1d876b9aaa6d7d0608cfcc6.exe

.exe 278KB

f700c7059dcb4db8b23e7f31ec135b7b.bin

SHA256 137596e6de74907857a5d4e94484ba638ac520d2c866910079eb98d24530a7c2
MD5 7ff994ac6cb2564ede94cc70f7c529e2
SHA1 08960d10795555f7bd48215ce58410830ed4914b
SHA512 479b49635b2e274652882c23e225294aba94bb675fdfda024eb306cec07946e7487a0617481ce0f639f16d9df677996ff2abc19a588aa9e28b870b5ac7ce66db
SSDEEP 3072:V7lZA+uJwow9k77/PllFeX36r58yY4Jk1wYjs/lU0Iux5i1VSY/DicGU:V7Rlo3l/8yY4k2Y4h3i1q7U
MD5 SHA1 SHA512 SSDEEP

Password

infected

b5e6dde637ff9dbc4dc8602c2340a4697009e2e4f1d876b9aaa6d7d0608cfcc6.exe

IMPHASH 34fc5754badd722e29654c8e5ce4f927
SHA256 b5e6dde637ff9dbc4dc8602c2340a4697009e2e4f1d876b9aaa6d7d0608cfcc6
MD5 f700c7059dcb4db8b23e7f31ec135b7b
SHA1 5f396e6e296ad01765c0e090dbb0130698531b91
SHA512 93f98687c55f6d1d6e58a42b8fe8de9ef8e5a7b0d9cefc9987d3d94b5332f1ea3672aefb97ae8aaf37a8b078a4206d83c4550f7fc2a0e58105d55f9fd3afc256
SSDEEP 6144:DOfB5WbIkhMXcZhRbW5mZceS2mlAOYE/u:K5cMsZXVAlqE2
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

0

Major OS version

6

Entry point

97616

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetModuleHandleA GetProcAddress GetConsoleWindow LoadLibraryA WideCharToMultiByte CopyFileExW ReadFile GetFileSizeEx HeapFree CreateFileW CloseHandle LoadLibraryW HeapAlloc GetProcessHeap ExpandEnvironmentStringsW DeleteFileW GetFileSize CopyFileW FindFirstFileExW FindNextFileW FindClose GetFileAttributesW OpenProcess CreateToolhelp32Snapshot Process32NextW Process32FirstW GetUserDefaultLangID MultiByteToWideChar GetNativeSystemInfo GlobalMemoryStatusEx GetLastError CreateProcessW GetUserDefaultUILanguage GetLocaleInfoW GetCurrentThreadId WaitForSingleObjectEx GetExitCodeThread GetStringTypeW EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx QueryPerformanceCounter CompareStringEx GetCPInfo GetSystemTimeAsFileTime GetModuleHandleW IsProcessorFeaturePresent IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW GetCurrentProcessId InitializeSListHead GetCurrentProcess TerminateProcess RaiseException RtlUnwind SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW ExitProcess GetModuleFileNameW GetStdHandle WriteFile GetCommandLineA GetCommandLineW CompareStringW LCMapStringW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW HeapReAlloc GetTimeZoneInformation GetFileType SetFilePointerEx IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle FlushFileBuffers GetConsoleOutputCP GetConsoleMode HeapSize WriteConsoleW

Sharing