adaptixc2 | 030a3a7894bfd533354a56510c0c946234a1fcb319f963a2db5658feef7cb2f0[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
030a3a7894bfd533354a56510c0c946234a1fcb319f963a2db5658feef7cb2f0.exe
Size 99KB
Sample260914-t9tmrabf85
SHA256 030a3a7894bfd533354a56510c0c946234a1fcb319f963a2db5658feef7cb2f0
MD5 5b186d8f9c61fb7649331f6906693323
SHA1 ecf18975f1fa2864d1707c1928ba6c296f9e7a59
SHA512 34f6fa6ac6353918448359ba55abc9c0974bae58960e641c40de3414b6b538bae6102d52631c27346fe4ba3d0b6837bbebd8ad9305377f0da4537f4ae4d31f04
SSDEEP 1536:1BssDQ1WuFoCm2d41rV7OXx+svZcp1xeOTZnkDvIkHvTE4HkH9fjEn4Pv:VQtodUDhFo4EdfjEn4Pv
TLSH
T1F1A36137E6B3D49DC05EC278BF8794B3A5E07C280530251A5781A6223B6FD7C6FBA190
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

trojan backdoor rat adaptixc2

Malware Config

Extracted

Family

adaptixc2

update.javashell.com

Attributes

port
8443
url_path
/updates/check.php
user_agent
Mozilla/5.0 (Windows NT 6.2; rv:20.0) Gecko/20121202 Firefox/20.0

Signatures

Family: AdaptixC2
AdaptixC2 is an open-source C2 framework written in C++.
rat trojan backdoor adaptixc2

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
030a3a7894bfd533354a56510c0c946234a1fcb319f963a2db5658feef7cb2f0.exe

File Explorer

030a3a7894bfd533354a56510c0c946234a1fcb319f963a2db5658feef7cb2f0.exe

.exe 99KB

030a3a7894bfd533354a56510c0c946234a1fcb319f963a2db5658feef7cb2f0.exe

IMPHASH 69dc25b2b4528e88b41ee428ab7cf705
SHA256 030a3a7894bfd533354a56510c0c946234a1fcb319f963a2db5658feef7cb2f0
MD5 5b186d8f9c61fb7649331f6906693323
SHA1 ecf18975f1fa2864d1707c1928ba6c296f9e7a59
SHA512 34f6fa6ac6353918448359ba55abc9c0974bae58960e641c40de3414b6b538bae6102d52631c27346fe4ba3d0b6837bbebd8ad9305377f0da4537f4ae4d31f04
SSDEEP 1536:1BssDQ1WuFoCm2d41rV7OXx+svZcp1xeOTZnkDvIkHvTE4HkH9fjEn4Pv:VQtodUDhFo4EdfjEn4Pv
TLSH
T1F1A36137E6B3D49DC05EC278BF8794B3A5E07C280530251A5781A6223B6FD7C6FBA190
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5328

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

Name

.text

Size

89KB

Virtual Size

89KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

1024B

Virtual Size

1024B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

1024B

Virtual Size

528B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

512B

Virtual Size

408B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

104B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

512B

Virtual Size

288B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

030a3a7894bfd533354a56510c0c946234a1fcb319f963a2db5658feef7cb2f0.exe

kernel32

msvcrt

libstdc++-6

generic