General

  • Target

    2024-06-08_c090ce5201eea93c4be6b3dea882bb44_avaddon_byakugan_pos_zxxz

  • Size

    74.1MB

  • MD5

    c090ce5201eea93c4be6b3dea882bb44

  • SHA1

    48b68fb60865185a07659cd5af9cfee63a694a88

  • SHA256

    417557360a253367693908f7ff4e8b3de05835667f52fa431ad6bda608d1d5c5

  • SHA512

    c35e59a2fee9ad90c3e9aa9caf54bd0f88afceb329d0fc2b0ee9dded4ca945acfdd856ec60655365b213e8a3dbe695c710235c7d2b3d73dd1aa898b0974673e2

  • SSDEEP

    393216:f1Du8BtuBw2FEL3Z3aLUoQvo6LP/SgbSpYvKEh1EdKwlGQKPJuGsiTfREsrgCYf1:fMguj8Q4VfvWqFTrYAzN7chAcdlB

Score
10/10

Malware Config

Signatures

  • Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 1 IoCs
  • Detects Windows executables referencing non-Windows User-Agents 1 IoCs
  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 1 IoCs
  • Detects executables Discord URL observed in first stage droppers 1 IoCs
  • Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs
  • Detects executables containing URLs to raw contents of a Github gist 1 IoCs
  • Detects executables containing possible sandbox analysis VM names 1 IoCs
  • Detects executables containing possible sandbox analysis VM usernames 1 IoCs
  • Detects executables containing possible sandbox system UUIDs 1 IoCs
  • Detects executables referencing virtualization MAC addresses 1 IoCs
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 2024-06-08_c090ce5201eea93c4be6b3dea882bb44_avaddon_byakugan_pos_zxxz
    .exe windows:6 windows x64 arch:x64

    4d0fb8dc9ee470058274f448bebbb85f


    Headers

    Imports

    Exports

    Sections