Behavioral task
behavioral1
Sample
2024-10-01_9ddecfb5cdc6b0de55af64420cbeba1b_blackenergy_hacktools_mamba_nedsym_ngrbot_pos_trickbot_u.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
2024-10-01_9ddecfb5cdc6b0de55af64420cbeba1b_blackenergy_hacktools_mamba_nedsym_ngrbot_pos_trickbot_u.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-10-01_9ddecfb5cdc6b0de55af64420cbeba1b_blackenergy_hacktools_mamba_nedsym_ngrbot_pos_trickbot_utkonos_webshell-shell_wirefire_zcrypt_zxxz
-
Size
5.0MB
-
MD5
9ddecfb5cdc6b0de55af64420cbeba1b
-
SHA1
e0eec08b09bfdb96852284a9f861f737fb94a3b1
-
SHA256
a63cf7d5defb5312767bda89a219d79201c420e64596944fa58b9c57de74d069
-
SHA512
dacfbfb42d8ef3945e5825f490e75c85d30c73f091f15026998ea936e488ce09c174f455286c6456a34758aa312779432df50470df4db9fce2bd883009f2e042
-
SSDEEP
49152:4WSFAA/DFbf43+P6LCrh59Jls1iYhYWYHxhrLEVUvZWlarmAeLzC/QRm0iYm6qQo:oNDrSqh6AemVVHJZ
Malware Config
Signatures
-
888rat family
-
Android 888 RAT payload 1 IoCs
resource yara_rule sample family_888rat -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-10-01_9ddecfb5cdc6b0de55af64420cbeba1b_blackenergy_hacktools_mamba_nedsym_ngrbot_pos_trickbot_utkonos_webshell-shell_wirefire_zcrypt_zxxz
Files
-
2024-10-01_9ddecfb5cdc6b0de55af64420cbeba1b_blackenergy_hacktools_mamba_nedsym_ngrbot_pos_trickbot_utkonos_webshell-shell_wirefire_zcrypt_zxxz.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.xray Size: 5.0MB - Virtual size: 5.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE