Behavioral task
behavioral1
Sample
Keymaker-TechABlack/KeyGeneratot Bandicam @blackhatmonk.exe
Resource
win10v2004-20240802-en
General
-
Target
Keymaker-TechABlack (infected).zip
-
Size
220KB
-
MD5
208dff5454dd4e85cc3973c6f292437b
-
SHA1
78a33149f43a9c14587cd0ddd7e230601a53c721
-
SHA256
e7f43903e47a3daca0f6da5d35c5320c2668843d7bca7668ab3c94ca41bd1a3d
-
SHA512
f750ea84b9f73e73423bf66b507fcb542f137ef4ee8866762b248909f480f0dd049af69e707a1b011a8386c4b410ab2009a7bea61cc7793c02357db6e4ee1774
-
SSDEEP
6144:bELkS6HfR04E3sA87QwLbBSFRSOWRRLRM47gQiHQc7B:wLkRu4E8AmBqpWxP7gQCQc1
Malware Config
Signatures
-
Async RAT payload 1 IoCs
resource yara_rule static1/unpack001/Keymaker-TechABlack/KeyGeneratot Bandicam @blackhatmonk.exe family_asyncrat -
Asyncrat family
-
StormKitty payload 1 IoCs
resource yara_rule static1/unpack001/Keymaker-TechABlack/KeyGeneratot Bandicam @blackhatmonk.exe family_stormkitty -
Stormkitty family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Keymaker-TechABlack/KeyGeneratot Bandicam @blackhatmonk.exe
Files
-
Keymaker-TechABlack (infected).zip.zip
Password: infected
-
Keymaker-TechABlack/KeyGeneratot Bandicam @blackhatmonk.exe.exe windows:4 windows x86 arch:x86
Password: infected
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 475KB - Virtual size: 474KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
Keymaker-TechABlack/file_id.diz
-
Keymaker-TechABlack/techajen.nfo