nighthawk | 55baad005084e7c41a43ec92fd37d3b05eec2a528b313c2cac252859db7a56af[.]bin[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
55baad005084e7c41a43ec92fd37d3b05eec2a528b313c2cac252859db7a56af.bin.exe
Size 754KB
Sample251115-evbfas1kh1
SHA256 55baad005084e7c41a43ec92fd37d3b05eec2a528b313c2cac252859db7a56af
MD5 c0be91bfec41194304957e8b39c04687
SHA1 c91d161e8ef176025434302a909271e7c0db36b6
SHA512 5156ccacb7b6b670a7abf4ac56c4ff0900b5a8a07b8e2647673b57e24f392d83ffa54744a1f22bda3fd400296c1e55669e42845efa4934a6d764b72ffe41b0e8
SSDEEP 12288:cXzeHQl0b2hO0RXOqmDxmFFqr+H0MMcOgk56k8eS4PMi1ncSDq:k6HQKbMh6DxEFq6UTakYY90sncSDq
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

nighthawk

Malware Config

Signatures

Detects Nighthawk C2 framework loader 1 IoCs

resource	yara_rule
sample	family_nighthawk_loader

Nighthawk family
nighthawk

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
55baad005084e7c41a43ec92fd37d3b05eec2a528b313c2cac252859db7a56af.bin.exe

File Explorer

55baad005084e7c41a43ec92fd37d3b05eec2a528b313c2cac252859db7a56af.bin.exe

.exe 754KB

55baad005084e7c41a43ec92fd37d3b05eec2a528b313c2cac252859db7a56af.bin.exe

IMPHASH b65649d17ba8ce657a9157e5347cbdba
SHA256 55baad005084e7c41a43ec92fd37d3b05eec2a528b313c2cac252859db7a56af
MD5 c0be91bfec41194304957e8b39c04687
SHA1 c91d161e8ef176025434302a909271e7c0db36b6
SHA512 5156ccacb7b6b670a7abf4ac56c4ff0900b5a8a07b8e2647673b57e24f392d83ffa54744a1f22bda3fd400296c1e55669e42845efa4934a6d764b72ffe41b0e8
SSDEEP 12288:cXzeHQl0b2hO0RXOqmDxmFFqr+H0MMcOgk56k8eS4PMi1ncSDq:k6HQKbMh6DxEFq6UTakYY90sncSDq
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

Detects Nighthawk C2 framework loader
Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

d2:05:1b:68:39:40:92:47:65:5b:1d:59:6d:69:8f:7a:dc:40:a9:40

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=www.google.com

Chains

Nov 14, 2025

Minor OS version

Major OS version

Entry point

114688

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

.uxgbxcl

Size

44KB

Virtual Size

44KB

Characteristics

IMAGE_SCN_MEM_READ

Name

.rdata

Size

35KB

Virtual Size

35KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

2KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

252B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.text

Size

503KB

Virtual Size

504KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.detourc

Size

79KB

Virtual Size

128KB

Characteristics

IMAGE_SCN_MEM_READ

Name

.profile

Size

79KB

Virtual Size

128KB

Characteristics

IMAGE_SCN_MEM_READ

55baad005084e7c41a43ec92fd37d3b05eec2a528b313c2cac252859db7a56af.bin.exe

PE Signature issue

kernel32

generic