jaffacakes118_Backdoor[.]Win32[.]Zerg[.]17[.]462993e84409b871ef04a721c04e29db

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_Backdoor.Win32.Zerg.17.462993e84409b871ef04a721c04e29db
Size 48KB
Sample261009-tprbwscc46
SHA256 79bd73720ed57a3821bde9569330a60e720591a0c288ed33c3ee2cf0be12e34e
MD5 462993e84409b871ef04a721c04e29db
SHA1 3dd73f1a3e0fb31156fc453f6be91477fa581a39
SHA512 494781b94b112d93151d6216ce3ee70b8e860380d89e57fc1d92a99b1e6838a4a32a661a617555a6d19c24576ac526d798b5615394cece0cb9c19cc491c46277
SSDEEP 768:3Kg9zPbw1bnqzLKkBeqKO6YssxQ1HZ2Gq1a2PAh1K6mogz:ag9zDw1bqzeAt6YssxQ1Z21QIoq
TLSH
T19B237C1678E0C437C18241F12C215E1BAFFF2D7606A59297CB546AAE7D32AC2D83E313
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_Backdoor.Win32.Zerg.17.462993e84409b871ef04a721c04e29db

File Explorer

jaffacakes118_Backdoor.Win32.Zerg.17.462993e84409b871ef04a721c04e29db

.exe 48KB

jaffacakes118_Backdoor.Win32.Zerg.17.462993e84409b871ef04a721c04e29db

IMPHASH ff822f821b907dd121314a05ea811e28
SHA256 79bd73720ed57a3821bde9569330a60e720591a0c288ed33c3ee2cf0be12e34e
MD5 462993e84409b871ef04a721c04e29db
SHA1 3dd73f1a3e0fb31156fc453f6be91477fa581a39
SHA512 494781b94b112d93151d6216ce3ee70b8e860380d89e57fc1d92a99b1e6838a4a32a661a617555a6d19c24576ac526d798b5615394cece0cb9c19cc491c46277
SSDEEP 768:3Kg9zPbw1bnqzLKkBeqKO6YssxQ1HZ2Gq1a2PAh1K6mogz:ag9zDw1bqzeAt6YssxQ1Z21QIoq
TLSH
T19B237C1678E0C437C18241F12C215E1BAFFF2D7606A59297CB546AAE7D32AC2D83E313
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

19399

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetModuleHandleA FreeLibrary GetProcAddress LoadLibraryA ExitProcess CreateProcessA CopyFileA lstrcmpA GetWindowsDirectoryA GlobalFree Sleep GetVersionExA GetComputerNameA CreateThread TerminateThread GlobalMemoryStatus GetSystemInfo GetDiskFreeSpaceA GetDriveTypeA lstrcatA GetModuleFileNameA WriteFile FindNextFileA FileTimeToSystemTime FileTimeToLocalFileTime FindFirstFileA GetCurrentDirectoryA SetCurrentDirectoryA Thread32Next Thread32First Process32Next Process32First CreateToolhelp32Snapshot TerminateProcess OpenProcess DeleteFileA SetPriorityClass GetCurrentProcess ResetEvent WaitForSingleObject CreateEventA SetEvent GlobalAlloc lstrcpyA ReadFile CreateFileA GetLastError lstrcpynA FindClose lstrlenA GetStringTypeW FreeEnvironmentStringsA HeapDestroy UnhandledExceptionFilter GetCommandLineA GetStartupInfoA GetVersion CloseHandle HeapSize HeapAlloc HeapFree RtlUnwind FreeEnvironmentStringsW VirtualFree GetStringTypeA IsBadCodePtr IsBadReadPtr SetUnhandledExceptionFilter GetFileType GetStdHandle SetHandleCount GetEnvironmentStringsW GetEnvironmentStrings HeapReAlloc MultiByteToWideChar VirtualAlloc HeapCreate LCMapStringW LCMapStringA WideCharToMultiByte GetOEMCP GetACP GetCPInfo IsBadWritePtr

user32

IsWindow MessageBoxA CharUpperA IsWindowVisible wsprintfA CharToOemA GetDesktopWindow EnumWindows ExitWindowsEx PostMessageA GetWindowTextA

advapi32

RegQueryValueExA RegSetValueExA RegCreateKeyA RegCloseKey RegOpenKeyExA GetUserNameA

shell32

ShellExecuteA

wsock32

recvfrom sendto ioctlsocket connect accept socket setsockopt htons bind listen getsockname WSAStartup gethostname gethostbyname WSACleanup inet_addr select WSAGetLastError inet_ntoa closesocket recv send htonl gethostbyaddr

winmm

timeGetTime