rbxbanasyncwiper[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

rbxbanasyncwiper.exe
Size

173KB
MD5

173f40e170d7e3c436eab2f2f902df16
SHA1

a920274e626b975406467328eda2875d4f255bed
SHA256

5f311f701749e248c01b61eb409c5da9d5f418a79de6b2122f0269af82fb4287
SHA512

9f313f3ea6f42f8ce38f726d1aad68d8c1cf67486391c098a371ed7c08409e95e237bade1a81dfbe97789265c5880d9182109f940d1e53d8fb9af314ea99b757
SSDEEP

3072:nascOrIcN0C3Jk8XInKWQb9JVzGQqMxKJBp+JhXsYZJa1MU/O:ascOrIcNV3Jkc0KJVzGnBp+r/Ja15O

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
rbxbanasyncwiper.exe

Files

rbxbanasyncwiper.exe
.exe windows:6 windows x64 arch:x64

f4b46daa86eb0ef988e1df5f7484e3ab

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

rbxbanasyncwiper.pdb

Imports

api-ms-win-core-synch-l1-2-0

WaitOnAddress
WakeByAddressAll
WakeByAddressSingle

kernel32

GetCurrentProcess
SetFileInformationByHandle
GetCurrentProcessId
HeapFree
UnhandledExceptionFilter
HeapReAlloc
lstrlenW
ReleaseMutex
GetProcessHeap
HeapAlloc
FindClose
CreateFileW
GetFileInformationByHandleEx
GetEnvironmentVariableW
FindFirstFileW
DeleteFileW
GetCurrentDirectoryW
IsDebuggerPresent
SetLastError
RtlVirtualUnwind
RtlLookupFunctionEntry
GetModuleHandleW
FormatMessageW
ExitProcess
MultiByteToWideChar
WriteConsoleW
WideCharToMultiByte
ReadConsoleW
GetFullPathNameW
GetModuleHandleA
GetProcAddress
RtlCaptureContext
QueryPerformanceCounter
GetCurrentThreadId
WaitForSingleObjectEx
LoadLibraryA
CreateMutexA
WaitForSingleObject
GetCurrentThread
SetThreadStackGuarantee
AddVectoredExceptionHandler
GetLastError
SetUnhandledExceptionFilter
CloseHandle
GetSystemTimeAsFileTime
GetConsoleMode
GetStdHandle
GetFileType
InitializeSListHead
GetFileInformationByHandle
IsProcessorFeaturePresent

ntdll

RtlNtStatusToDosError
NtReadFile
NtWriteFile

vcruntime140

memcmp
memset
memmove
_CxxThrowException
__C_specific_handler
__current_exception
memcpy
__CxxFrameHandler3
__current_exception_context

api-ms-win-crt-runtime-l1-1-0

exit
_exit
__p___argc
__p___argv
_cexit
_c_exit
_register_thread_local_exe_atexit_callback
_set_app_type
_configure_narrow_argv
_initialize_onexit_table
_get_initial_narrow_environment
_register_onexit_function
_crt_atexit
terminate
_initialize_narrow_environment
_initterm
_seh_filter_exe
_initterm_e

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

_set_fmode
__p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

free
_set_new_mode

Sections

.text
Size: 123KB - Virtual size: 123KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 41KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 840B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 976B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f4b46daa86eb0ef988e1df5f7484e3ab

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

api-ms-win-core-synch-l1-2-0

kernel32

ntdll

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

Sections

.text Size: 123KB - Virtual size: 123KB

.rdata Size: 41KB - Virtual size: 41KB

.data Size: 512B - Virtual size: 840B

.pdata Size: 6KB - Virtual size: 5KB

.reloc Size: 1024B - Virtual size: 976B

.text
Size: 123KB - Virtual size: 123KB

.rdata
Size: 41KB - Virtual size: 41KB

.data
Size: 512B - Virtual size: 840B

.pdata
Size: 6KB - Virtual size: 5KB

.reloc
Size: 1024B - Virtual size: 976B