vbot[.]zip | Triage™

resource
unpack001/V-Bot.exe

vbot.zip

SHA256 3ae4724b000e6658ef25cffbef1f658377c5bd637c922f9a585eec3be53ebee5
MD5 37deda3db3c0e388706e5cb1e95c2df1
SHA1 2d7a2110cbefb0b41c6dad43e4fd31034cf9e501
SHA512 b99fe7d8e30d7db2b8e8e0f11aa90c0607220fdc77fa3ddfa423e2ce4de38396cb2b8b461b12e6fb5a86f3e3211f7862685803d60eee84c7d0296fd6a14341cb
SSDEEP 12288:c611nUWR5WrO/4RzYZYzGVMAX5PozhpXy07L/PKgA00gB56LM:coR5WC/mqQPiBevXl2g2q56o
TLSH
T135B42353CEBA69A2CA4AD23784DA3B0DB36D94CB15B49DE731600A0146C6450FE7F63F
MD5 SHA1 SHA512 SSDEEP TLSH

INSTALAR.bat

SHA256 64b4485d72dbc3d1c853a117da52c9c670af0ebea9547564bd8deaaff7b8838b
MD5 14fc3d13429ea75a9d0dfc6265db9d1b
SHA1 d0aa326ccb5a01ac551e3dda6c5fbe562fa80b8e
SHA512 9a27a7bec0d1d8314ea2236ff26c0113d4c8263f4248f0214f1f89c0e30f69826cf973954042c0e2e311c6b0e1a08ffdfddced8696a602bf8890411f04d908b1
TLSH
T1F84131EB739C8063F6B206AFAF89916F741BA0630889D9DD34454030548F3446BFAAC3
MD5 SHA1 SHA512 TLSH

LEIA-ME.txt

SHA256 16a292cb8b3ff041c9602817ec97a52fe0e1e1eee9cc52bc880c490e57e37f70
MD5 fd25b07dc1d80e8776ac9b98adc98ac2
SHA1 632f07a1a64bd8485f216bec92e4b29584ecb012
SHA512 60fc88e21fb38113323cf35326ceec6506e1f90e921cf5b12fa89ae53d0b7e4c990e4cd5ed223654485a8b70f4dc4b254e39e3edef49a7648f910918be08d76f
SSDEEP 96:BzWibB0Gt+6y8uHxbympV3y77dFMVMBjruep30upFcXRc3xymp/3YX2:BS+Oc6smbMbJB3uo0zXRc3xymt+2
TLSH
T159F1E81A6D8F03E83931C38173494107EAA85017BC558147F97F9A53ABE4B40D25FA8F
MD5 SHA1 SHA512 SSDEEP TLSH

V-Bot.bat

SHA256 dd1a056227d4e90a457538555f50f72e2015fda02776e0777eb501fdf1df5705
MD5 f1b5a2328c4d8a3c0389e10cf6ed183e
SHA1 7d2890cb41398d5523cb19b026351a0407ceb4cd
SHA512 564702e1dd8a5ef37646cde48d5e73cc54f0acc111204c33b4d9ad83db76aa4d6afeec008410bcfee27c19d24e7e6bee40ae2e9acc052f3f93f6aabc3531356b
TLSH
T1A6E07D8521045386F873467D81E456B3746FC007023001D030302932740F5C980AAACA
MD5 SHA1 SHA512 TLSH

V-Bot.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 25dfb64f32d5eb81040d2308dd338f65ca1a013e4ccad6cf79b4d2d4dc41661b
MD5 21da6b3dc9638a20b1a879cb636d8195
SHA1 1802a61f930b87264709da9f7dfc137cacd774b4
SHA512 460355ac32723340817e2746ffe44d36f3e37a4ae68c38940bf419855c6800f94e7353ec5655d43b062652e6d95041c57b65902dc66c61eb5226f4106a2eb2de
SSDEEP 96:lWQwZrRK6nlhdduzp6PxTrvra8kG9rht5zNt:lWQwnrnlhbdrvJJ7
TLSH
T1B623111B8F77F040FE6A01B18763CA81EE53EFB80510429DA885C679692D534BFE2F16
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10206

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

banner.png

SHA256 c144a3ac9b346ecb768bac74cf322dced9de8fee1907389d4b41614d1b4af767
MD5 e955c6d3c6661f57115b5a6db03f5f27
SHA1 96a32dd7146ebe8eaded61ee5bc9981fe668ce0a
SHA512 68a3b963ae0753b82a64ca30fde2d7b17838319e0785481d37ab6216a6c239fc101f8fdee6289e8d95330bf916f68ad47a09385ff24a9af4da098d1f75e81724
SSDEEP 12288:qw1V4aR5crO/s7zYZ2zGLMUX5hAzh9Xyi7H1LK0ig0GBj:bR5cC/Cqa3u323XRo0+Mj
TLSH
T14CA42353CABE69E78A4ED22644DB6B15B33994CF157199E332600A0142CA450FDBF73F
MD5 SHA1 SHA512 SSDEEP TLSH

vbot-gui.ps1

SHA256 29cfce887ef1e4113dfa990658d032007f89d66550706470e773ea5c7b8c7efb
MD5 3aa4b9a9b93020a146f7823b52ee0c67
SHA1 e1dc4c2e5bc548b718ccf1983e790fac85bcbafc
SHA512 58af6da9919ceb79eab9f187470998b7aae52f26b9019f0c9e8aa57b788de3004e18bb7e3399d5d74ac56ac2a130123b0ad159ecd5bdbe4482b4eb92cc62904e
SSDEEP 384:4t1oKnvXWlET20ovDf8CK5zecuxxOAyKnjetwOPSNk3TyDSQu19MtNLpmcxuDeV8:6XgkZsdrTF2I0yXBXKnSpwytfJl5zud
TLSH
T181F2943D321FD1A84B97619FC99BE4829E6611332008DE4536DFE6C4DF8E168C378B59
MD5 SHA1 SHA512 SSDEEP TLSH

vbot-worker.ps1

SHA256 6cd9f9078617c9904af20c143e7c105bb97b4f6e3f114498ada2291794c644f8
MD5 077746f97fabb70ee60e8c6d8988afae
SHA1 95b73aa310389e10259441f30c7d665b70d4a879
SHA512 604b27d9f115dca8753912f809747587f9899971c8df97f0e6223cae13076f51056e91abf4e200dcd3fcf25d277eacbd777bd4b98b731ad1330ff5d624b63698
SSDEEP 384:SDQ7eGoKhAE+NkF6qafA5sk7M6DvxI05d2pFmDRZU3N/:jeEviyxa45Zvasd8cDRZU3N
TLSH
T13E92D6293C0A515A21F3933AFDC6811AFE7E002B89064604FABEC5C55FF4B19872DE57
MD5 SHA1 SHA512 SSDEEP TLSH

vbot.ico

SHA256 1c94ce415b8214c57287abbe58b1e47a0a814004d2907beed47c7879b7daa108
MD5 028fe0a9cdfaa0bbdb0dac204fb89518
SHA1 330895348ba07ef7f3bf61ba5d2dec713f25f3ad
SHA512 6230f2d0642981facde5e7c8ac0a1dc58bfaacd44a356fc33b541436d44362c62f99cf4ed41e81b8e0c5fbe388280bbed1beeffe248b8348988a82d47a4552b0
SSDEEP 24:I/imIMnHqhra8ky+UcdScanFBJlpgknT49p+eIqOjA2GyBd/tvaO:dMKhra8kj7YB/nT9rdj/tv
TLSH
T18503215B8F77F040FE2A00B58B63CA84ED47EFB8055001D9A882D679652D834BFE2F16
MD5 SHA1 SHA512 SSDEEP TLSH

vbot.zip

INSTALAR.bat

LEIA-ME.txt

V-Bot.bat

V-Bot.exe

mscoree

dotnet

banner.png

vbot-gui.ps1

vbot-worker.ps1

vbot.ico

Sharing

General

Malware Config

Extracted

Signatures

File Explorer

vbot.zip

INSTALAR.bat

LEIA-ME.txt

V-Bot.bat

V-Bot.exe

mscoree

dotnet

banner.png

vbot-gui.ps1

vbot-worker.ps1

vbot.ico