Behavioral task
behavioral1
Sample
2024-10-17_63a7ce5542e98f1986d74a6670524c42_hacktools_xiaoba.exe
Resource
win7-20240708-en
General
-
Target
2024-10-17_63a7ce5542e98f1986d74a6670524c42_hacktools_xiaoba
-
Size
3.7MB
-
MD5
63a7ce5542e98f1986d74a6670524c42
-
SHA1
74c4b45d30608cd8abc7460a9a6a8567e4f501a7
-
SHA256
4834e28d84a4531a407404ddd388385a42f59078cca1ea7e787b4d348ef0db92
-
SHA512
186e7550d5a2abe73293f8e5276e54637151bbf8707d00d3cb4650f9592f0842d16c135497aa9dbdbff21ed1bf9e8bb407c8a8cb194341ea4ab519eb4c5652f0
-
SSDEEP
49152:JzG1BqCBGJdodXAGRe5CFHtoBgmAZf1Nt:KBIKRAGRe5KquZp
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-10-17_63a7ce5542e98f1986d74a6670524c42_hacktools_xiaoba
Files
-
2024-10-17_63a7ce5542e98f1986d74a6670524c42_hacktools_xiaoba.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Sections
UPX0 Size: 2.5MB - Virtual size: 2.5MB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 1.1MB - Virtual size: 1.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.imports Size: 9KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE