daxin | 4b058945c9f2b8d8ebc485add1101ba5[.]bin

General

Target
4b058945c9f2b8d8ebc485add1101ba5.bin
Size 70KB
Sample260930-alg49swzf1
SHA256 e7af7bcb86bd6bab1835f610671c3921441965a839673ac34444cf0ce7b2164e
MD5 4b058945c9f2b8d8ebc485add1101ba5
SHA1 37e6450c7cd6999d080da94b867ba23faa8c32fe
SHA512 5da51df4cc0e10dc0d7800c067daa64a3d2e1c230e008b0be04532dad0a0e4f3a73a4df3fefa92dd612985b4b9d7de9f9f72b245169b307d01864fe17ab5ffb1
SSDEEP 1536:ARM1VWgS1lYpKCNTzc8jt4riPJdBnH2dXDGZ8W8tGVxJ:AhgUup7NQiP9H2dz08dsVxJ
TLSH
T17C636CCA22A41079D4BBC27DC9A1963FE7F2745113600BCF826147EA2F13BE5A739325
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

rootkit backdoor daxin

Malware Config

Signatures

Family: Daxin
A highly sophisticated backdoor being used by China-linked threat actors.
rootkit backdoor daxin

Daxin payload 1 IoCs

resource	yara_rule
sample	family_daxin

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
4b058945c9f2b8d8ebc485add1101ba5.bin

File Explorer

4b058945c9f2b8d8ebc485add1101ba5.bin

.sys 70KB

4b058945c9f2b8d8ebc485add1101ba5.bin

IMPHASH 6150c5c5e078c5bf23006689a41058cd
SHA256 e7af7bcb86bd6bab1835f610671c3921441965a839673ac34444cf0ce7b2164e
MD5 4b058945c9f2b8d8ebc485add1101ba5
SHA1 37e6450c7cd6999d080da94b867ba23faa8c32fe
SHA512 5da51df4cc0e10dc0d7800c067daa64a3d2e1c230e008b0be04532dad0a0e4f3a73a4df3fefa92dd612985b4b9d7de9f9f72b245169b307d01864fe17ab5ffb1
SSDEEP 1536:ARM1VWgS1lYpKCNTzc8jt4riPJdBnH2dXDGZ8W8tGVxJ:AhgUup7NQiP9H2dz08dsVxJ
TLSH
T17C636CCA22A41079D4BBC27DC9A1963FE7F2745113600BCF826147EA2F13BE5A739325
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Daxin payload
Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

cb:65:c6:f9:f4:11:89:2d:13:ff:e8:ba:1c:b5:e9:c4:be:2c:0a:25

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=Anhua Xinda (Beijing) Technology Co.\, Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Anhua Xinda (Beijing) Technology Co.\, Ltd.,L=Beijing,ST=Beijing,C=CN

Chains

Sep 25, 2026

CN=Anhua Xinda (Beijing) Technology Co.\, Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Anhua Xinda (Beijing) Technology Co.\, Ltd.,L=Beijing,ST=Beijing,C=CN

Subject

CN=Anhua Xinda (Beijing) Technology Co.\, Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Anhua Xinda (Beijing) Technology Co.\, Ltd.,L=Beijing,ST=Beijing,C=CN

Serial Number

38:7c:94:76:e2:83:20:26:45:94:84:63:17:d4:65:40

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jun 28, 2011 - Jun 27, 2014

Subject

Serial Number

61:19:93:e4:00:00:00:00:00:1c

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Feb 22, 2011 - Feb 22, 2021

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

1

Major OS version

6

Entry point

148208

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ntoskrnl.exe

wcsncmp IoAllocateMdl _stricmp sprintf RtlLengthRequiredSid _strnicmp ExAllocatePoolWithTag vsprintf IoDeleteSymbolicLink ExFreePoolWithTag RtlAnsiStringToUnicodeString NtWriteFile RtlCreateAcl PsLookupProcessByProcessId NtQuerySystemInformation _wcsnicmp ZwReadFile RtlSetDaclSecurityDescriptor KeInitializeApc IoDeleteDevice NtFsControlFile KeInsertQueueApc MmGetSystemRoutineAddress IoCreateFile atoi _snprintf ZwQuerySystemInformation KeReleaseSpinLock RtlAddAccessAllowedAce RtlImageDirectoryEntryToData KeDetachProcess ZwOpenFile ZwCreateFile PsCreateSystemThread ZwQueryValueKey PsTerminateSystemThread ZwFreeVirtualMemory KeQueryTimeIncrement ObReferenceObjectByHandle KeWaitForSingleObject KeAttachProcess PsGetVersion PsThreadType RtlCompareUnicodeString ZwOpenProcess ZwQueryInformationProcess IoCreateSymbolicLink ObfDereferenceObject IoCreateDevice ZwTerminateProcess ZwQueryInformationFile KeWaitForMultipleObjects ZwWriteFile NtReadFile PsLookupThreadByThreadId RtlLengthSid RtlCreateSecurityDescriptor ZwAllocateVirtualMemory ZwOpenKey KeAcquireSpinLockRaiseToDpc RtlUnicodeStringToInteger MmIsAddressValid ZwDeviceIoControlFile IofCompleteRequest ZwClose MmMapLockedPagesSpecifyCache KeDelayExecutionThread MmUserProbeAddress MmBuildMdlForNonPagedPool memchr ZwWaitForSingleObject RtlInitUnicodeString

ndis.sys

NdisAllocateMemoryWithTag NdisAllocateNetBufferAndNetBufferList NdisMSendNetBufferListsComplete NdisReturnNetBufferLists NdisAllocateNetBufferListPool NdisFreeMemory NdisMIndicateStatus NdisFreeMdl NdisFreeNetBufferListPool NdisFreeNetBufferList NdisSendNetBufferLists

Name

.text

Size

54KB

Virtual Size

54KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

73KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

INIT

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

944B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

4b058945c9f2b8d8ebc485add1101ba5.bin

PE Signature issue

ntoskrnl.exe

ndis.sys

generic