backseat-loader-patched[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
backseat-loader-patched.exe
Size 14.9MB
Sample260811-e2rqvswbkb
SHA256 986769f2959e53d32b47704a273fb57a76ca77f00f65d3bc9f69973a2346ac2a
MD5 f94cfde74af5f9b2a7f11a6f55f12b1c
SHA1 836446cadc452531711f7c8287aa5b13956b40e5
SHA512 60b6f64b9c6d208f83a0b14a93d31762bcd51c58c4689e321b6d447917099e33b32ff7a6e1dc67989170b659620690033cda15901a089271d502ea672b54dc25
SSDEEP 393216:zBbsrnloIBp+UjATGsDHQl4opVnUk8Qu3AADefzrBcteL4sXRp3em:zBe1BP4NQyopVnDu3NefzdUsBQm
TLSH
T12CF63369AFC572E8D4CB65785EC7259FB75830E643B059CF2A5C31CA2E63BC80B35206
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
backseat-loader-patched.exe

File Explorer

backseat-loader-patched.exe

.exe 14.9MB

backseat-loader-patched.exe

IMPHASH 85c37a99e449e7f2f24e64fd1fe56db7
SHA256 986769f2959e53d32b47704a273fb57a76ca77f00f65d3bc9f69973a2346ac2a
MD5 f94cfde74af5f9b2a7f11a6f55f12b1c
SHA1 836446cadc452531711f7c8287aa5b13956b40e5
SHA512 60b6f64b9c6d208f83a0b14a93d31762bcd51c58c4689e321b6d447917099e33b32ff7a6e1dc67989170b659620690033cda15901a089271d502ea672b54dc25
SSDEEP 393216:zBbsrnloIBp+UjATGsDHQl4opVnUk8Qu3AADefzrBcteL4sXRp3em:zBe1BP4NQyopVnDu3NefzdUsBQm
TLSH
T12CF63369AFC572E8D4CB65785EC7259FB75830E643B059CF2A5C31CA2E63BC80B35206
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

59168

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

GetStdHandle WriteFile OutputDebugStringA GetModuleFileNameW GetTempPathW CreateMutexW CreateFileW GetModuleHandleA Sleep GetLastError FillConsoleOutputCharacterW GetCurrentThread LockResource DeleteFileW CloseHandle CreateThread LoadResource GetCurrentProcess FillConsoleOutputAttribute GetThreadContext GetProcAddress ExitProcess FreeLibrary GetTempFileNameW SetConsoleCursorPosition SetConsoleTitleW LoadLibraryExW IsDebuggerPresent GetComputerNameA CheckRemoteDebuggerPresent WriteConsoleW HeapSize GetProcessHeap SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW SetLastError GetConsoleScreenBufferInfo FindResourceW SizeofResource FindNextFileW FindFirstFileExW FindClose HeapReAlloc GetOEMCP GetACP IsValidCodePage SetFilePointerEx GetFileSizeEx ReadFile GetConsoleOutputCP FlushFileBuffers EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW WideCharToMultiByte EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer MultiByteToWideChar LCMapStringEx GetStringTypeW GetCPInfo QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW RtlLookupFunctionEntry RtlUnwindEx RtlPcToFileHeader RaiseException FlsAlloc FlsGetValue FlsSetValue FlsFree GetConsoleCP IsProcessorFeaturePresent TerminateProcess GetModuleHandleExW GetCommandLineA GetCommandLineW HeapAlloc HeapFree GetConsoleMode SetConsoleMode ReadConsoleInputW ReadConsoleW RtlCaptureContext RtlVirtualUnwind UnhandledExceptionFilter GetFileType VirtualProtect RtlUnwind

user32

FindWindowW SetWindowsHookExW PostThreadMessageW UnhookWindowsHookEx GetWindowThreadProcessId

advapi32

FreeSid CheckTokenMembership AllocateAndInitializeSid

dbghelp

ImageDirectoryEntryToData

bcrypt

BCryptGenRandom BCryptOpenAlgorithmProvider BCryptDecrypt BCryptDestroyKey BCryptEncrypt BCryptGenerateSymmetricKey BCryptCreateHash BCryptCloseAlgorithmProvider BCryptDestroyHash BCryptHashData BCryptSetProperty BCryptFinishHash

winhttp

WinHttpCloseHandle WinHttpOpenRequest WinHttpReadData WinHttpOpen WinHttpReceiveResponse WinHttpConnect WinHttpSendRequest

Name

.text

Size

187KB

Virtual Size

186KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

81KB

Virtual Size

80KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

10KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

14.7MB

Virtual Size

14.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

backseat-loader-patched.exe

kernel32

user32

advapi32

dbghelp

bcrypt

winhttp

generic