C:\projects\leaf-xnet\Leaf.xNet\obj\Release\net45\Leaf.xNet.pdb
Static task
static1
Behavioral task
behavioral1
Sample
YT Bot/Leaf.xNet.dll
Resource
win11-20240611-en
Behavioral task
behavioral2
Sample
YT Bot/YT_Bot.exe
Resource
win11-20240508-en
Behavioral task
behavioral3
Sample
YT Bot/Youtube-Viewers.exe.config
Resource
win11-20240611-en
Behavioral task
behavioral4
Sample
YT Bot/Youtube-Viewers.pdb
Resource
win11-20240508-en
General
-
Target
YT Bot Views & Livestreaming.zip
-
Size
2.3MB
-
MD5
f2bdd0579a2280355ec38e198db78189
-
SHA1
4df3afb4e833bed53b2614c7dd32710f21b4241c
-
SHA256
fafbed406afca0edefeb4a341ca4c20784129464e810ec66aa202c4f74c30605
-
SHA512
be7d81b64dc561736cab40182ed5cd181fed15347754213c42788360b43454ad280b9c80186b0af12a91d54e812b1aee40d4bc31f1361b7a46a09b302ba58ecf
-
SSDEEP
49152:6NqyMX9Jpc+H7iMjkACaC6t/FTucdt0U/8gbtGE9GX7gfzM7EH:6Nq5VbiMjjHC6t/FTlsU/8+f9GXMrKEH
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource unpack001/YT Bot/Leaf.xNet.dll
Files
-
YT Bot Views & Livestreaming.zip.zip
Password: ytbot
-
YT Bot/Leaf.xNet.dll.dll windows:4 windows x86 arch:x86
Password: ytbot
dae02f32a21e03ce65412f6e56942daa
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB Paths
Imports
mscoree
_CorDllMain
Sections
.text Size: 127KB - Virtual size: 126KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
YT Bot/YT_Bot.exe.exe windows:4 windows x86 arch:x86
Password: ytbot
Code Sign
08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate
IssuerCN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=USNot Before29-04-2021 00:00Not After28-04-2036 23:59SubjectCN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=USExtended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
0e:44:18:e2:de:de:36:dd:29:74:c3:44:3a:fb:5c:e5Certificate
IssuerCN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=USNot Before02-07-2021 00:00Not After10-07-2024 23:59SubjectCN=Google LLC,O=Google LLC,L=Mountain View,ST=California,C=USExtended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
01Certificate
IssuerCN=Dummy issuerNot Before01-01-2013 10:00Not After01-04-2013 10:00SubjectCN=Dummy certificate05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16Certificate
IssuerCN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=USNot Before14-07-2023 00:00Not After13-10-2034 23:59SubjectCN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate
IssuerCN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=USNot Before23-03-2022 00:00Not After22-03-2037 23:59SubjectCN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate
IssuerCN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=USNot Before01-08-2022 00:00Not After09-11-2031 23:59SubjectCN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=USKey Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
93:21:84:43:48:c3:f1:3a:cf:ca:a5:db:d3:cf:0b:32:7a:27:e2:e8:03:7b:d9:fd:dc:44:a2:ed:af:a8:da:a4Signer
Actual PE Digest93:21:84:43:48:c3:f1:3a:cf:ca:a5:db:d3:cf:0b:32:7a:27:e2:e8:03:7b:d9:fd:dc:44:a2:ed:af:a8:da:a4Digest Algorithmsha256PE Digest MatchesfalseHeaders
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Exports
Exports
���Ⱥ�πL��M�"����~fu��@~��Uס@Q�.�b�ὒ�^ɴTt���1.H�S|�"Hs��߀R>� s(��3�Qs��C딌��IW«�!MACB�_&[g���pΨ�QyF�G����m�l )�����K6�pѯ`�����V�t ������`�g���'��6N%�T'1~5Z�����9K��I)*�ܖ�-(}��{������X��ZƞkE��:��0�Měp��ͻ�������D����W�[+G)��NJt�l�����<�٧+-��?4�O��qqJ^X��[��^z�5�:d����Rf�0�mW�1[Ʒ���JrZz�"u�t�P�e��z(��7�2�%�G�\:�-�t܌T� ���D�����m[f�Wْ�Kd;1�S���H��]�=N=�z�{��H� �{��!����J����qXi�O���o�0 Q���$=$��_�����hE���oʸ�M��F�����̌���2I��S�2���0t*�O��=I���X?L\2�u6�r��IS~8�:��`I�U�=�[�^W%��(GN�m�',��(Q�?���FHs��B_2Sm�L�x�c����}d�&<��݃V֚@�bv�o������]LV@.���y0}�fgr���9��a��G��/����mbVr=��5�"�3' D �������T��P@�@3_�GyC���HڨQw��Nr��5��N�iuw�N Sy!�V�_o>ML��~&4�Vu9�.�ToFS��>��RܛXۋu���.�R���q�$������w/�2��K�ȶ�}�>��v�#w�f�$>D���)0�� � �9�g�"F+���G�?�j��S������r��Ub���:U ��zq�.��+���+sa��� 7�g�W�0/9� �x�WM�]�6���x#�7��͝ԭ<�{��]�pH$B�� �C�Y¬�gnZ�N��գ��Y䃔����"��!�Y�C@I� FG�+�_�A��n.P�u�fP�!la�� <s|�|{�%�c����fܐ<ƚ�o�ӳ���a�~S 2�����&��O3PV�.�Q�Y(��Ҿ1 t�H VP/�����-���N0A�����}L�r C��PbV��� �-��8� �QutTW���csv����+�e��./F&c�S�h�5c�R�*ͨ��)!$|è%�`m��ɀ"��mwƂ"�fG�����,��^�Tf�|��ة���F�.Lf�ȇ&X7L����)2����Փ3w��G��%�������x �][ё�M��[�[8�B�����^]Zk������<GRM�g8��4�>#Z�I�@����`���֯�'`����Շ�v�y -�fJ�2ϧ�y��[6�Q����+���cխ;aUX����ND�BG����&A;W��N6\�b ��ԧ~Kb�&V\�����Ί;�1��3���m��Q~NF��mz�P�Vq�]U��q� %�U����J�@k��w����ї���"8q�����"4XF�5�E�JV��<ˤ0�-J���(��C���P�6��e�R���K��z��M« /�&}/L*{+ٮ7�z�Y�FKWL����<�H��m�<k>�A����W�ׄ�����d��К�l�U����V��$z���"�@��^���|%���X�����`��b�S�-�@�����'b��� �.��E�g4��h��nJ� r�Ħv�P0�z/5^G~�����\��w�j����-���N�ճ�C�[(�E��Rz�{Ͻ�dLPZ�C[��Fx�DL`Tl(�����י�^�iV$�p���j3Xo���o��G�C��I�JD�l\<Iʈb@N�xJ��Y�9bch/���[�����E�4�����=]ǽ�q�c��)�,i�1�~F ��:V�o*UE+t5gktZ�$2�!�02n<њ�x��ǒ�e�.�vd�ku�J@���h����A�������أ��萬�2,\�X���,�����0��.���qk�|��qF:0k���cɑ+���.�ph��_Y\0��D�JWnL�"���������#x+��~�%I���S��v�RQD{�I�[N,M�p�%F(:���]�Ep��Ί���ʨ=�ݡ��� \�D_�gkʜ絎�=��w�3�#�c2�D�w��:��5 �ȅ.$`�:��g���&�F�aN8(*V���?@o����N�c�F�6-��JÌv�7� ��KJ[l�?_�{]��D�*�&�f�����2Y�:ffڭ�����|�[���X�zF�NC��z�Hѽ+nHo� ��m�o�JI�6�+�����3�B�Nܴ��V���F;h���A;�D"iוs ܠ������šlZR��no �bQ�g[K�JSfe�J���K�<P���Cc��㲊����mFP���ݕ[��)��$}���6��:���~����:;B�i{�1����. ��6W7-� "$}bӖt ��l䙯���`~�T7�k��n��~C~��hՀh��(�o��{X�O�`��U2��'蕃��瞍[XoV�S�f}�eB���3ar��%���>����1��b}�O��T�2�uSia�7x!�H?c�AC�tvWrT���]�hW:*�)��C�`�����p�ˡ��dʲ���7�eJA�[Q4�a�{������?���9�B���B�r��F��t �p��ɬ�[�d�Vv�7Q��q���ۯԠ��!���%)�������=���gŭ0��ڜ��`�2I��T��o�M���g�4�L$���+�D<���W�.l!�9&�)g�f�(���虚����!�$X��x7�}_L�*�T��p=�[f�Q�}� ����c���0X���h�^6����ߙ Kc�w�[n�̮+0h=� -��C�&E��韪��yf� 7�[4�H�7���"n�`~�����Vڞ�k�\.�(�YLjvmnDB]�q:>rھN���]���nl2=-���;x�w_uI��W�I�ު28�ۚ&����;ʴ��!���0�.��>�=����̓��uk�I��"D�a1�le�-�%��j����d���Rǔ?ҟ�R#��֪0���݈dr�f���9���6E&:��(�������a�� ��J���R]%GXB����2Mq�xC5T�9���j��¹�W��������/�����lk��_��ɦH���Q!��@�ΒR��7*Eo�WFz�z�U*� nk 2 _�D4T� %6�[��ާ>��5w�W��6[1bͻ8�;�M�Er���ޅ7� �,����@sճ�?-v�g�0O7��5�A�P^�~�f�)f�� �М����N��Z}�X&:W���'����ky�=���gˋ��&�F.�F�������`Ƌ�g��q��m���c���/.S"�S�'��=��Op$�^����= =���wm��&���"�6������2[������$+�0⾰��$2ۂ������R<tq,p(�ȫ��-�"�( �t���U;�="�Zª�8`.#�h��o^&���*�F>�*lF��Z-l���Q8�p-��~H��O��?v��q�����ǯ�q���3�͐)�T���L�l�$\>��� �����0���H��V��.���L8eU��64�����*�F�E�3Ę愡R�3�� r
Sections
Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 4KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 108KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 106KB - Virtual size: 108KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 202KB - Virtual size: 7.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
YT Bot/Youtube-Viewers.exe.config
-
YT Bot/Youtube-Viewers.pdb