ducktail | Standard v2[.]8[.]0[.]0[.]zip

Resubmissions

29/04/2026, 00:18

260429-alq26saz4q10

29/04/2026, 00:05

260429-adfapsay9k10

28/04/2026, 23:57

260428-3zwtssft5110

Sharing

Copy URL Twitter E-mail

General

Target
Standard v2.8.0.0.zip
Size 45.7MB
Sample260429-adfapsay9k
SHA256 d5a1aec6eb585ba82c40191b118f35aadb1c139786f7a71d43f8177f3f2b998d
MD5 1069e57f55274b7a2bad942dd5c6f67f
SHA1 37b93a147603fb01bc7b3d5a95a79025256045c1
SHA512 7b46f9d5b828cbfff55d08494639d9b3ad2c69ab2114995e184fd21c1582ec6c6770d61385e81325fa4b9f97e23d87b6443756b7d5ff85a703d5d16e34389fd6
SSDEEP 786432:xbiS9Q6W4tyxOXR1v9SnNXLCI1qmNxF5tHrlTwhSLzFHLVo1HzPWA3StTVDdb3Cz:lvt7R1v9SNXumqEP5BrlT2Sv9xCicETM
TLSH
T1F7B7339CA07571F12B1FA0E8E5CE26E9CB595ED1A2BB1D340E07B6D5CA582F76B031C0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

stealer ducktail trojan infostealer spyware xamalicious

Malware Config

Signatures

Family: Ducktail
Ducktail is a single file deployment stealer written in C#.
stealer ducktail
Family: Xamalicious
Xamalicious is an Android backdoor malware implemented with Xamarin framework first seen in December 2023.
trojan infostealer spyware xamalicious

Android Xamalicious payload 1 IoCs

resource	yara_rule
static1/unpack001/Standard.Desktop.exe	family_xamalicious

Detect Ducktail Third Stage Payload 1 IoCs

resource	yara_rule
static1/unpack001/Standard.Desktop.exe	ducktail_3rd_stage

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Standard.Desktop.exe

File Explorer

Standard v2.8.0.0.zip

.zip 45.7MB
Standard.Desktop.exe

.exe 107.2MB
appsettings.json

568B

Standard v2.8.0.0.zip

SHA256 d5a1aec6eb585ba82c40191b118f35aadb1c139786f7a71d43f8177f3f2b998d
MD5 1069e57f55274b7a2bad942dd5c6f67f
SHA1 37b93a147603fb01bc7b3d5a95a79025256045c1
SHA512 7b46f9d5b828cbfff55d08494639d9b3ad2c69ab2114995e184fd21c1582ec6c6770d61385e81325fa4b9f97e23d87b6443756b7d5ff85a703d5d16e34389fd6
SSDEEP 786432:xbiS9Q6W4tyxOXR1v9SnNXLCI1qmNxF5tHrlTwhSLzFHLVo1HzPWA3StTVDdb3Cz:lvt7R1v9SNXumqEP5BrlT2Sv9xCicETM
TLSH
T1F7B7339CA07571F12B1FA0E8E5CE26E9CB595ED1A2BB1D340E07B6D5CA582F76B031C0
MD5 SHA1 SHA512 SSDEEP TLSH

Standard.Desktop.exe

IMPHASH bb3ac2c21e02c68abcad237dc3fa6d00
SHA256 d284e1b7ac9d8fec4cac3ce0a920170e2541882623fc8cf4f41cc5bb2c1f85c8
MD5 cb773e1a565f5ea7f28d0277d0400dbf
SHA1 be2f72c903bdb5c95c609cac5ef5ddff7269be63
SHA512 91823b79509c9c3b829fc045af86e908d19632a154dc44134a9f3c31ecbc6b751db3355bcf837c17cc0268286279276272a0a19e9f1fc9a7207df912fb4bc3fc
SSDEEP 786432:OJqNlihOa9yh5baRH3tMnSorOWrIOBGDG6QebRA/pUc43ZXh1AZpRGCQ8QYxtMt8:Uq7ihOaE8XtMFOWUOBd6mBa5fAnqt8
TLSH
T1F938BF02F7A58E3AC4BE8130D1724225D771F48A7351E78F3688A6BD3F933905E66366
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Android Xamalicious payload
Detect Ducktail Third Stage Payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

72368

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\a\_work\1\s\artifacts\obj\win-x64.Release\corehost\apphost\standalone\apphost.pdb

kernel32

FreeLibrary LoadLibraryExW OutputDebugStringW FindFirstFileExW EnterCriticalSection GetFullPathNameW FindNextFileW GetCurrentProcess GetModuleHandleExW GetModuleFileNameW LeaveCriticalSection GetEnvironmentVariableW GetModuleHandleW MultiByteToWideChar GetFileAttributesExW LoadLibraryA DeleteCriticalSection WideCharToMultiByte IsWow64Process TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount GetProcAddress GetWindowsDirectoryW FindResourceW GetLastError ActivateActCtx FindClose CreateActCtxW SetLastError RaiseException RtlPcToFileHeader RtlUnwindEx InitializeSListHead GetCurrentProcessId IsDebuggerPresent IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetStringTypeW SwitchToThread GetCurrentThreadId InitializeCriticalSectionEx EncodePointer DecodePointer LCMapStringEx QueryPerformanceCounter GetSystemTimeAsFileTime

user32

MessageBoxW

shell32

ShellExecuteW

advapi32

RegOpenKeyExW RegGetValueW DeregisterEventSource RegisterEventSourceW ReportEventW RegCloseKey

api-ms-win-crt-runtime-l1-1-0

_invoke_watson __p___argc _exit exit _initterm_e _initterm _get_initial_wide_environment _initialize_wide_environment _configure_wide_argv _set_app_type _seh_filter_exe _cexit _crt_atexit _register_onexit_function _errno _initialize_onexit_table abort _c_exit _register_thread_local_exe_atexit_callback terminate __p___wargv

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func _set_fmode fputwc __p__commode fputws _wfsopen fflush __stdio_common_vfwprintf __stdio_common_vsnwprintf_s __stdio_common_vswprintf setvbuf

api-ms-win-crt-heap-l1-1-0

calloc _set_new_mode free _callnewh malloc

api-ms-win-crt-string-l1-1-0

wcsncmp toupper strcmp strlen _wcsdup wcsnlen strcpy_s

api-ms-win-crt-convert-l1-1-0

wcstoul _wtoi

api-ms-win-crt-time-l1-1-0

wcsftime _gmtime64_s _time64

api-ms-win-crt-locale-l1-1-0

___mb_cur_max_func _configthreadlocale ___lc_codepage_func ___lc_locale_name_func __pctype_func _lock_locales setlocale _unlock_locales

api-ms-win-crt-math-l1-1-0

__setusermatherr