Behavioral task
behavioral1
Sample
7ec7ffec1926a1f945e328f7ca9561d2b3bd30d6b4078b4a5da5d2111d9d6636.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
7ec7ffec1926a1f945e328f7ca9561d2b3bd30d6b4078b4a5da5d2111d9d6636.exe
Resource
win10v2004-20241007-en
General
-
Target
7ec7ffec1926a1f945e328f7ca9561d2b3bd30d6b4078b4a5da5d2111d9d6636.exe
-
Size
3.5MB
-
MD5
89f65ad79caa39d402fc618dd3a49148
-
SHA1
3813282fab620579a437e3ca4f290fd41ef26f82
-
SHA256
7ec7ffec1926a1f945e328f7ca9561d2b3bd30d6b4078b4a5da5d2111d9d6636
-
SHA512
1acdef4ff4e2cefddcda05fbd91d0e91fbcb782b9491cbb76724aeeea507b8510c27a89ceac941616afa569c721a1f5d4d393964b028b8342356c6e3b2fd5a52
-
SSDEEP
49152:WqGZQ32yVtPaKzUn0xKWSWoJpHVtnDzNg33PNUZp94CE0FWAV1eOi:Wq/WKzUn0kWSDLnK3Gpw0Fref
Malware Config
Signatures
-
An open source browser data exporter written in golang. 1 IoCs
resource yara_rule static1/unpack001/out.upx family_hackbrowserdata -
Hackbrowserdata family
-
resource yara_rule sample upx -
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource 7ec7ffec1926a1f945e328f7ca9561d2b3bd30d6b4078b4a5da5d2111d9d6636.exe unpack001/out.upx
Files
-
7ec7ffec1926a1f945e328f7ca9561d2b3bd30d6b4078b4a5da5d2111d9d6636.exe.exe windows:6 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
UPX0 Size: - Virtual size: 6.5MB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 3.5MB - Virtual size: 3.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX2 Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
out.upx.exe windows:6 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
.text Size: 4.6MB - Virtual size: 4.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4.3MB - Virtual size: 4.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 267KB - Virtual size: 845KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 116KB - Virtual size: 115KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.xdata Size: 512B - Virtual size: 180B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 68KB - Virtual size: 67KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.symtab Size: 512B - Virtual size: 4B
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ