Behavioral task
behavioral1
Sample
brbbot.exe
Resource
win11-20240802-en
General
-
Target
brbbot.zip
-
Size
36KB
-
MD5
a4691acdc9f3fe60c083079c91ad97d7
-
SHA1
8328770ce075931ff6db6c5cd86ff9cdc0001256
-
SHA256
c6745630a65c38aa182de51fccbb7280cb851c210501581cc0e0df3c420034fc
-
SHA512
653fcde9dae354493952deacb66d6e1b9655b34dca232f5d0903f4780dc6194c75be6c181a50a89576e21eb0e9f0aa4333e546c168527d1ce495bb10efeae103
-
SSDEEP
768:RustM0uVsO9B6Pw2XtzCP4h6UBh2jAftM4:PtM0uVb9CbXU6rejA1h
Malware Config
Extracted
brbbot
brb.3dtuts.by
Signatures
-
Brbbot family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource unpack001/brbbot.exe
Files
-
brbbot.zip.zip
Password: malware
-
brbbot.exe.exe windows:5 windows x64 arch:x64
Password: malware
475b069fec5e5868caeb7d4d89236c89
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
advapi32
RegSetValueExA
RegOpenKeyExA
RegDeleteValueA
RegFlushKey
RegCloseKey
CryptAcquireContextW
CryptDeriveKey
CryptReleaseContext
CryptEncrypt
CryptCreateHash
CryptDestroyKey
CryptDecrypt
CryptDestroyHash
CryptHashData
wininet
HttpSendRequestA
InternetQueryDataAvailable
InternetReadFile
InternetCloseHandle
HttpQueryInfoA
InternetConnectA
InternetOpenA
HttpOpenRequestA
InternetSetOptionA
ws2_32
gethostbyname
WSACleanup
WSAStartup
inet_ntoa
gethostname
kernel32
CreateFileW
HeapSize
WriteConsoleW
SetStdHandle
LoadLibraryW
GetStringTypeW
LCMapStringW
LeaveCriticalSection
EnterCriticalSection
CreateFileA
FindResourceA
LoadResource
HeapAlloc
HeapFree
GetProcessHeap
WriteFile
SizeofResource
GetLastError
LockResource
GetModuleHandleA
CloseHandle
GetComputerNameA
HeapReAlloc
MoveFileExA
WaitForSingleObject
SetEvent
GetModuleHandleW
GetSystemWow64DirectoryA
CreateProcessA
GetSystemDirectoryA
GetEnvironmentVariableA
CopyFileA
CreateEventW
GetModuleFileNameA
DeleteFileA
GetFileSize
ReadFile
WideCharToMultiByte
GetProcAddress
GetTempFileNameA
GetTempPathA
FlushFileBuffers
GetConsoleMode
GetCommandLineW
GetStartupInfoW
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
EncodePointer
DecodePointer
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
FlsGetValue
FlsSetValue
FlsFree
SetLastError
GetCurrentThreadId
FlsAlloc
ExitProcess
GetStdHandle
GetModuleFileNameW
RtlUnwindEx
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
DeleteCriticalSection
HeapSetInformation
GetVersion
HeapCreate
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
Sleep
MultiByteToWideChar
SetFilePointer
GetConsoleCP
user32
GetDC
Sections
.text Size: 49KB - Virtual size: 48KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 14KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 192B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 774B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ