chaosbot | x608b3a079e79f78ffab2972007bead28467253bb98c9aa517a378ee277806b17[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
x608b3a079e79f78ffab2972007bead28467253bb98c9aa517a378ee277806b17.exe
Size 6.4MB
Sample260110-gla5aafs9a
SHA256 608b3a079e79f78ffab2972007bead28467253bb98c9aa517a378ee277806b17
MD5 9efb0ef7b7e17014d4879d06c9337c4b
SHA1 de841f854e9aa27f7ba3b3580e8633bacdc0cc4b
SHA512 d56876cd8d7cd7fde61cb112842de722cbe1c6b2ed95db69b9b57505c1883595d4ddd611a8708b0bf1b07292931898cacaf255142385a51b59a4115de477c608
SSDEEP 49152:bIJixbKNhhwH+ZxIl3cj3+g4UwZL+ms/H8ukwzhpYpx5jHzGalNm0pFx0E+Tni4v:bIbPlX/c8YFCoCiMBn+/+Jp
TLSH
T1A5664A17F26284E8C56AC074836A6232FA31BC8D47347AFB57D09B212F65BD06B3DB54
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

chaosbot

Malware Config

Signatures

Chaosbot family
chaosbot

Detects ChaosBot payload. 1 IoCs

resource	yara_rule
sample	family_chaosbot

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
x608b3a079e79f78ffab2972007bead28467253bb98c9aa517a378ee277806b17.exe

File Explorer

x608b3a079e79f78ffab2972007bead28467253bb98c9aa517a378ee277806b17.exe

.exe 6.4MB

x608b3a079e79f78ffab2972007bead28467253bb98c9aa517a378ee277806b17.exe

IMPHASH 019be66f01b97502160339f19fc18d4e
SHA256 608b3a079e79f78ffab2972007bead28467253bb98c9aa517a378ee277806b17
MD5 9efb0ef7b7e17014d4879d06c9337c4b
SHA1 de841f854e9aa27f7ba3b3580e8633bacdc0cc4b
SHA512 d56876cd8d7cd7fde61cb112842de722cbe1c6b2ed95db69b9b57505c1883595d4ddd611a8708b0bf1b07292931898cacaf255142385a51b59a4115de477c608
SSDEEP 49152:bIJixbKNhhwH+ZxIl3cj3+g4UwZL+ms/H8ukwzhpYpx5jHzGalNm0pFx0E+Tni4v:bIbPlX/c8YFCoCiMBn+/+Jp
TLSH
T1A5664A17F26284E8C56AC074836A6232FA31BC8D47347AFB57D09B212F65BD06B3DB54
MD5 SHA1 SHA512 SSDEEP TLSH

windows:0 windows x64 arch:x64

Detects ChaosBot payload.
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4852579

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

.\.\bcryptprimitives

ProcessPrng

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WakeByAddressSingle WaitOnAddress

././kernel32

GetConsoleOutputCP GetQueuedCompletionStatusEx FlushFileBuffers HeapSize LCMapStringW CreateIoCompletionPort CompareStringW GetModuleHandleA GetCurrentThread SetThreadStackGuarantee AddVectoredExceptionHandler LocalFree FormatMessageW SetFileCompletionNotificationModes FindNextFileW LoadLibraryA PostQueuedCompletionStatus FlsFree FlsSetValue FlsGetValue FlsAlloc HeapReAlloc GetSystemInfo Process32NextW Process32FirstW CreateToolhelp32Snapshot GetStringTypeW GetFileType SetStdHandle SetEnvironmentVariableW GetCPInfo GetModuleHandleW GetOEMCP GetACP IsValidCodePage GetCurrentProcessId GetProcAddress QueryPerformanceCounter GetSystemTimePreciseAsFileTime GetExitCodeProcess WaitForSingleObject GetOverlappedResult WaitForMultipleObjects GetLastError DuplicateHandle GetCurrentProcess FindClose GetStdHandle GetConsoleMode GetCommandLineW MultiByteToWideChar WriteConsoleW SetLastError QueryPerformanceFrequency GetCurrentDirectoryW WaitForSingleObjectEx lstrlenW CreateMutexA WideCharToMultiByte ReleaseMutex RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind GetEnvironmentVariableW GetFileInformationByHandle GetFileInformationByHandleEx CreateFileW SetFileInformationByHandle GetCommandLineA GetFullPathNameW GetFinalPathNameByHandleW GetModuleHandleExW ExitProcess WriteFile RtlPcToFileHeader GetEnvironmentStringsW FreeEnvironmentStringsW CompareStringOrdinal GetModuleFileNameW GetSystemDirectoryW GetWindowsDirectoryW CreateProcessW GetFileAttributesW InitializeProcThreadAttributeList UpdateProcThreadAttribute DeleteProcThreadAttributeList CreateNamedPipeW CreateThread WriteFileEx SleepEx ReadFileEx CreateEventW CancelIo ReadFile HeapAlloc GetProcessHeap FindFirstFileW DeleteFileW SetCurrentDirectoryW SetHandleInformation SetFilePointerEx LoadLibraryExW TlsFree TlsSetValue TlsGetValue FreeLibrary TlsAlloc InitializeCriticalSectionAndSpinCount DeleteCriticalSection LoadLibraryExA LeaveCriticalSection CloseHandle Sleep EnterCriticalSection RaiseException SwitchToThread HeapFree EncodePointer FindFirstFileExW GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent TerminateProcess RtlUnwindEx

././crypt32

CertOpenStore CertAddCertificateContextToStore CertFreeCertificateContext CertDuplicateStore CertEnumCertificatesInStore CertCloseStore CertGetCertificateChain CertDuplicateCertificateChain CertVerifyCertificateChainPolicy CertFreeCertificateChain CertDuplicateCertificateContext

./.\iphlpapi

GetAdaptersAddresses GetIpForwardTable

.\./ws2_32

ioctlsocket WSAIoctl bind WSACleanup connect WSASend socket send setsockopt recv getaddrinfo freeaddrinfo closesocket shutdown getpeername WSAStartup WSASocketW getsockname WSAGetLastError getsockopt

.\./ntdll

NtWriteFile NtCancelIoFileEx RtlNtStatusToDosError NtDeviceIoControlFile NtReadFile NtCreateFile

.\bcrypt

BCryptGenRandom

./advapi32

RegQueryValueExW SystemFunction036 RegCloseKey RegOpenKeyExW

.\secur32

InitializeSecurityContextW AcceptSecurityContext FreeContextBuffer DeleteSecurityContext FreeCredentialsHandle EncryptMessage DecryptMessage ApplyControlToken QueryContextAttributesW AcquireCredentialsHandleA

.\.\user32

GetMonitorInfoW EnumDisplaySettingsExW EnumDisplayMonitors

.\.\gdi32

DeleteDC GetObjectW SelectObject SetStretchBltMode DeleteObject CreateCompatibleBitmap GetDeviceCaps StretchBlt GetDIBits CreateDCW CreateCompatibleDC

.\oleaut32

SysFreeString SysStringLen GetErrorInfo

Name

Size

4.8MB

Virtual Size

4.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

Size

1.4MB

Virtual Size

1.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

Size

5KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

Size

70KB

Virtual Size

70KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

Size

163KB

Virtual Size

162KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

Size

30KB

Virtual Size

29KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

x608b3a079e79f78ffab2972007bead28467253bb98c9aa517a378ee277806b17.exe

.\.\bcryptprimitives

api-ms-win-core-synch-l1-2-0

././kernel32

././crypt32

./.\iphlpapi

.\./ws2_32

.\./ntdll

.\bcrypt

./advapi32

.\secur32

.\.\user32

.\.\gdi32

.\oleaut32

generic