Behavioral task
behavioral1
Sample
31cba611dfa3fd35adc442007c43bb9ed7271e8a8146e16349642628b9f2662e.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
31cba611dfa3fd35adc442007c43bb9ed7271e8a8146e16349642628b9f2662e.exe
Resource
win10v2004-20240802-en
General
-
Target
31cba611dfa3fd35adc442007c43bb9ed7271e8a8146e16349642628b9f2662e
-
Size
6.9MB
-
MD5
105c7764946c4b5808d986b91e9ad697
-
SHA1
df75e78ee9f9a216b1e8b72f905595d23178f6a9
-
SHA256
31cba611dfa3fd35adc442007c43bb9ed7271e8a8146e16349642628b9f2662e
-
SHA512
b3c44d46b8ba5295d2204cde6809bb4d54f46698412b9ac1606dd04eae2f4a2d33ddac73b284e9b99517eefe670b9ffd661edd33bb0700ba676a0ef2c39a514b
-
SSDEEP
98304:spKXTBJYasmknGzZr+H5OfS7PFtmOb9G1r5v/nZVnivsAl0troSCa:nXTYpmknGzwH5OK7PH39kX/nivPlb
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 1 IoCs
resource yara_rule sample family_blackmoon -
Mimikatz family
-
mimikatz is an open source tool to dump credentials on Windows 1 IoCs
resource yara_rule sample mimikatz -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 31cba611dfa3fd35adc442007c43bb9ed7271e8a8146e16349642628b9f2662e -
NSIS installer 1 IoCs
resource yara_rule sample nsis_installer_2
Files
-
31cba611dfa3fd35adc442007c43bb9ed7271e8a8146e16349642628b9f2662e.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 368KB - Virtual size: 364KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 28KB - Virtual size: 26KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5.4MB - Virtual size: 5.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE