90ba5aebd28cb029273ecea4d256e43c38e0e8a5cc7790b4c972ac3c07d9ac5c.zip
- SHA256 713f31ecca6817590455d9820cc2d8a2fb1f961051017f0a6091fa8e0460e001
Password
infected
Behavioral task
behavioral1
Sample
90ba5aebd28cb029273ecea4d256e43c38e0e8a5cc7790b4c972ac3c07d9ac5c.exe
Resource
win10v2004-20251016-en
windows10-2004-x64
3 signatures
150 seconds
General
- Target 90ba5aebd28cb029273ecea4d256e43c38e0e8a5cc7790b4c972ac3c07d9ac5c.zip
- Size 567KB
- Sample251124-t3lcssslbk
- SHA256 713f31ecca6817590455d9820cc2d8a2fb1f961051017f0a6091fa8e0460e001
- MD5 d64268cf7a35922a4de67c63058f8a41
- SHA1 000b4e16a6e513e690b4131e9bd3b47f9c12809f
- SHA512 0e1a7278e4913abde357010016677d3294e15e4087cde3b110ea7593450b606234739af5dd7e312e78749a1e67e18721a766ee81850d0d7285679990f185a4b2
- SSDEEP 12288:BRXO8wBc8PaFQKt/51R3HnlSujfI80rKfXHflMo9P:BRXO8wB6jtHJHnltfdYKX/lx9P
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Detects Nighthawk C2 framework loader 1 IoCs
resource yara_rule static1/unpack001/90ba5aebd28cb029273ecea4d256e43c38e0e8a5cc7790b4c972ac3c07d9ac5c.exe family_nighthawk_loader - Nighthawk family
- Codesign digest Mismatch 1 IoCs
File was altered after it was signed.
resource unpack001/90ba5aebd28cb029273ecea4d256e43c38e0e8a5cc7790b4c972ac3c07d9ac5c.exe
File Explorer
-
90ba5aebd28cb029273ecea4d256e43c38e0e8a5cc7790b4c972ac3c07d9ac5c.zip.zip 567KB
-
90ba5aebd28cb029273ecea4d256e43c38e0e8a5cc7790b4c972ac3c07d9ac5c.exe.exe 596KB
90ba5aebd28cb029273ecea4d256e43c38e0e8a5cc7790b4c972ac3c07d9ac5c.exe
- IMPHASH b65649d17ba8ce657a9157e5347cbdba
- SHA256 90ba5aebd28cb029273ecea4d256e43c38e0e8a5cc7790b4c972ac3c07d9ac5c
- MD5 e25ce00d0cfb7143c1c40549aa75ca0f
- SHA1 5b0e61346fbab484bd60fd90b7a43efce349be13
- SHA512 ee77257f00b078aa5154c7ef0d322146b6ba8694dc91821d38ccbeb9c0bfc0a2bcf9d1f62cc31cdb068a7ba931b224cefeb633093824462f1ba5d83ae346ce6c
- SSDEEP 12288:EDVtqePqLTXt8+Ml1n4SQQ95LQ17wkon73pz4ZdY51rm:EDVFP898LnS717wH9I01m
- MD5 SHA1 SHA512 SSDEEP
-
Detects Nighthawk C2 framework loader
-
Codesign digest Mismatch
File was altered after it was signed.
PE Signature issue
Digest
98:e7:c1:a3:e9:80:e2:2b:00:54:43:4c:c9:25:1a:a8:5a:9d:07:36
Digest Algorithm
sha1
PE Digests Matches
Not matched
Trusted
Not trusted
Signing Certificate
CN=www.google.com
Chains
Nov 21, 2025
Subject
CN=www.google.com
Serial Number
a6:4d:dc:9d:76:df:7c:ad:0a:92:6f:16:3e:b2:22:3c
Issuer
CN=GTS CA 1C3
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign
Ext Key Usages
ExtKeyUsageServerAuth, ExtKeyUsageClientAuth
Timespan
Sep 5, 2022 - Nov 28, 2022
Minor OS version
0
Major OS version
6
Entry point
114688
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
kernel32
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
GetModuleHandleW
RtlUnwindEx
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
RaiseException
GetStdHandle
WriteFile
GetModuleFileNameW
GetCurrentProcess
ExitProcess
TerminateProcess
GetModuleHandleExW
HeapAlloc
HeapFree
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetStdHandle
GetFileType
GetStringTypeW
LCMapStringW
GetProcessHeap
HeapSize
HeapReAlloc
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
SetFilePointerEx
CreateFileW
CloseHandle
WriteConsoleW
Name
.uxgbxcl
Size
44KB
Virtual Size
44KB
Characteristics
IMAGE_SCN_MEM_READ
Name
.rdata
Size
35KB
Virtual Size
35KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_RDATA
Size
512B
Virtual Size
252B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.text
Size
503KB
Virtual Size
504KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.detourc
Size
512B
Virtual Size
128KB
Characteristics
IMAGE_SCN_MEM_READ
Name
.profile
Size
512B
Virtual Size
128KB
Characteristics
IMAGE_SCN_MEM_READ
generic
count=11, id=260, version=27412,
count=5, id=259, version=27412,
count=138, id=261, version=27412,
count=37, id=261, version=30034,
count=16, id=260, version=30034,
count=9, id=259, version=30034,
count=3, id=257, version=27412,
count=84, id=1, productName=Unmarked objects,
count=1, id=265, version=30140,
count=1, id=255, version=30140,
count=1, id=258, version=30140,