chaosbot | cdc73afb92617d9e2e0b6f2f22587f5f57316250a25b7bb8477a80628703e7b7[.]bin

Sharing

Copy URL Twitter E-mail

General

Target
cdc73afb92617d9e2e0b6f2f22587f5f57316250a25b7bb8477a80628703e7b7.bin
Size 6.3MB
Sample251017-r6xtwsfk61
SHA256 cdc73afb92617d9e2e0b6f2f22587f5f57316250a25b7bb8477a80628703e7b7
MD5 b86e103ec9ed0ecccc08a4e91d57bde9
SHA1 0cab24694f662e2bd081fd6e4509e583930140d0
SHA512 e0ee081bbf2ddcecb27e5f47e84c838cba6df2500b8c9fb7a85d8002acf35a8717c2b25045c4e5a38dc80ee9189e6d5060466eb1703e36b6c4224633bf214f24
SSDEEP 49152:MIJixbKNhhwH+ZxIl3cj3+g4UwZL+ms/H8ukwzhpYpx5jHzGalNm0pFx0E+Tni4O:MIbPlX/c8YFCoCK1Bn+/+4Q
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

chaosbot

Malware Config

Signatures

Chaosbot family
chaosbot

Detects ChaosBot payload. 1 IoCs

resource	yara_rule
sample	family_chaosbot

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
cdc73afb92617d9e2e0b6f2f22587f5f57316250a25b7bb8477a80628703e7b7.bin

File Explorer

cdc73afb92617d9e2e0b6f2f22587f5f57316250a25b7bb8477a80628703e7b7.bin

.exe 6.3MB

cdc73afb92617d9e2e0b6f2f22587f5f57316250a25b7bb8477a80628703e7b7.bin

IMPHASH a8ebd0d0bf42e700555831b3ceed18e4
SHA256 cdc73afb92617d9e2e0b6f2f22587f5f57316250a25b7bb8477a80628703e7b7
MD5 b86e103ec9ed0ecccc08a4e91d57bde9
SHA1 0cab24694f662e2bd081fd6e4509e583930140d0
SHA512 e0ee081bbf2ddcecb27e5f47e84c838cba6df2500b8c9fb7a85d8002acf35a8717c2b25045c4e5a38dc80ee9189e6d5060466eb1703e36b6c4224633bf214f24
SSDEEP 49152:MIJixbKNhhwH+ZxIl3cj3+g4UwZL+ms/H8ukwzhpYpx5jHzGalNm0pFx0E+Tni4O:MIbPlX/c8YFCoCK1Bn+/+4Q
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

Detects ChaosBot payload.
Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

74:da:6d:66:d7:b5:ec:48:ee:84:60:bd:01:1c:3e:1e:83:90:ed:0e:04:3d:3e:9c:93:dc:6a:04:89:24:54:86

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

SERIALNUMBER=3582691,CN=Google LLC,O=Google LLC,L=Mountain View,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Chains

Sep 9, 2025

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

Serial Number

0b:50:cf:24:6b:26:3e:fd:85:a7:29:31:51:58:f3:ff

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 8, 2024 - Apr 10, 2027

Minor OS version

Major OS version

Entry point

4852580

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

discord_control.pdb

bcryptprimitives

ProcessPrng

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WakeByAddressSingle WaitOnAddress

kernel32

GetConsoleOutputCP GetQueuedCompletionStatusEx FlushFileBuffers HeapSize LCMapStringW CreateIoCompletionPort CompareStringW GetModuleHandleA GetCurrentThread SetThreadStackGuarantee AddVectoredExceptionHandler LocalFree FormatMessageW SetFileCompletionNotificationModes FindNextFileW LoadLibraryA PostQueuedCompletionStatus FlsFree FlsSetValue FlsGetValue FlsAlloc HeapReAlloc GetSystemInfo Process32NextW Process32FirstW CreateToolhelp32Snapshot GetStringTypeW GetFileType SetStdHandle SetEnvironmentVariableW GetCPInfo GetModuleHandleW GetOEMCP GetACP IsValidCodePage GetCurrentProcessId GetProcAddress QueryPerformanceCounter GetSystemTimePreciseAsFileTime GetExitCodeProcess WaitForSingleObject GetOverlappedResult WaitForMultipleObjects GetLastError DuplicateHandle GetCurrentProcess FindClose GetStdHandle GetConsoleMode GetCommandLineW MultiByteToWideChar WriteConsoleW SetLastError QueryPerformanceFrequency GetCurrentDirectoryW WaitForSingleObjectEx lstrlenW CreateMutexA WideCharToMultiByte ReleaseMutex RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind GetEnvironmentVariableW GetFileInformationByHandle GetFileInformationByHandleEx CreateFileW SetFileInformationByHandle GetCommandLineA GetFullPathNameW GetFinalPathNameByHandleW GetModuleHandleExW ExitProcess WriteFile RtlPcToFileHeader GetEnvironmentStringsW FreeEnvironmentStringsW CompareStringOrdinal GetModuleFileNameW GetSystemDirectoryW GetWindowsDirectoryW CreateProcessW GetFileAttributesW InitializeProcThreadAttributeList UpdateProcThreadAttribute DeleteProcThreadAttributeList CreateNamedPipeW CreateThread WriteFileEx SleepEx ReadFileEx CreateEventW CancelIo ReadFile HeapAlloc GetProcessHeap FindFirstFileW DeleteFileW SetCurrentDirectoryW SetHandleInformation SetFilePointerEx LoadLibraryExW TlsFree TlsSetValue TlsGetValue FreeLibrary TlsAlloc InitializeCriticalSectionAndSpinCount DeleteCriticalSection LoadLibraryExA LeaveCriticalSection CloseHandle Sleep EnterCriticalSection RaiseException SwitchToThread HeapFree EncodePointer FindFirstFileExW GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent TerminateProcess RtlUnwindEx

crypt32

CertOpenStore CertAddCertificateContextToStore CertFreeCertificateContext CertDuplicateStore CertEnumCertificatesInStore CertCloseStore CertGetCertificateChain CertDuplicateCertificateChain CertVerifyCertificateChainPolicy CertFreeCertificateChain CertDuplicateCertificateContext

iphlpapi

GetAdaptersAddresses GetIpForwardTable

ws2_32

ioctlsocket WSAIoctl bind WSACleanup connect WSASend socket send setsockopt recv getaddrinfo freeaddrinfo closesocket shutdown getpeername WSAStartup WSASocketW getsockname WSAGetLastError getsockopt

ntdll

NtWriteFile NtCancelIoFileEx RtlNtStatusToDosError NtDeviceIoControlFile NtReadFile NtCreateFile

bcrypt

BCryptGenRandom

advapi32

RegQueryValueExW SystemFunction036 RegCloseKey RegOpenKeyExW

secur32

InitializeSecurityContextW AcceptSecurityContext FreeContextBuffer DeleteSecurityContext FreeCredentialsHandle EncryptMessage DecryptMessage ApplyControlToken QueryContextAttributesW AcquireCredentialsHandleA

user32

GetMonitorInfoW EnumDisplaySettingsExW EnumDisplayMonitors

gdi32

DeleteDC GetObjectW SelectObject SetStretchBltMode DeleteObject CreateCompatibleBitmap GetDeviceCaps StretchBlt GetDIBits CreateDCW CreateCompatibleDC

oleaut32

SysFreeString SysStringLen GetErrorInfo

Sharing

General

Malware Config

Signatures

File Explorer

cdc73afb92617d9e2e0b6f2f22587f5f57316250a25b7bb8477a80628703e7b7.bin

PE Signature issue

bcryptprimitives

api-ms-win-core-synch-l1-2-0

kernel32

crypt32

iphlpapi

ws2_32

ntdll

bcrypt

advapi32

secur32

user32

gdi32

oleaut32

generic