dorkbot | jaffacakes118_HEUR[.]Trojan[.]Win32[.]Generic[.]10df76c0acec0b23e1e6f6628e3df716

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_HEUR.Trojan.Win32.Generic.10df76c0acec0b23e1e6f6628e3df716
Size 94KB
Sample261013-2vlycsdf46
SHA256 8d6b0c49edbd84184f3e252ecf9c206b70c1e987e980e1fcd9d99bbb73094963
MD5 10df76c0acec0b23e1e6f6628e3df716
SHA1 b9462d0b39bb4c9b20cd29fe21dee30a358d736e
SHA512 5c97a9cc2a96e6532d32657e7246c57d72613bf77147fa4da7d1c5678cb985d02d0f416a3171126ab3f4fce362ac7191083d807d6f3f861d273f2f6f439a37cf
SSDEEP 1536:3v6QFiwYlh1o0PSqbe3j7d0Yl/TyC9R6z8W3J7PVsuiZae/yx2N4Yj:lFi3h1zaqi3uO/hQJ7PyHZ9/6U
TLSH
T152935C53FD40D031E6F2583FAA786BB6843DD935072BE9D363A069D50A744D3A93E30A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

worm dorkbot

Malware Config

Signatures

Family: Dorkbot
Dorkbot is a worm written in C++.
worm dorkbot

Detects Dorkbot worm 1 IoCs

resource	yara_rule
sample	family_dorkbot

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_HEUR.Trojan.Win32.Generic.10df76c0acec0b23e1e6f6628e3df716

File Explorer

jaffacakes118_HEUR.Trojan.Win32.Generic.10df76c0acec0b23e1e6f6628e3df716

.exe 94KB

jaffacakes118_HEUR.Trojan.Win32.Generic.10df76c0acec0b23e1e6f6628e3df716

IMPHASH 001f79fcd3f02e15b6ce3a0f62930c1c
SHA256 8d6b0c49edbd84184f3e252ecf9c206b70c1e987e980e1fcd9d99bbb73094963
MD5 10df76c0acec0b23e1e6f6628e3df716
SHA1 b9462d0b39bb4c9b20cd29fe21dee30a358d736e
SHA512 5c97a9cc2a96e6532d32657e7246c57d72613bf77147fa4da7d1c5678cb985d02d0f416a3171126ab3f4fce362ac7191083d807d6f3f861d273f2f6f439a37cf
SSDEEP 1536:3v6QFiwYlh1o0PSqbe3j7d0Yl/TyC9R6z8W3J7PVsuiZae/yx2N4Yj:lFi3h1zaqi3uO/hQJ7PyHZ9/6U
TLSH
T152935C53FD40D031E6F2583FAA786BB6843DD935072BE9D363A069D50A744D3A93E30A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Detects Dorkbot worm
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

67856

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

dnsapi

DnsQuery_A DnsFree

secur32

ApplyControlToken InitializeSecurityContextA DecryptMessage EncryptMessage AcquireCredentialsHandleW FreeContextBuffer QueryContextAttributesW DeleteSecurityContext FreeCredentialsHandle InitializeSecurityContextW

shell32

SHGetFileInfoA ShellExecuteA SHGetSpecialFolderPathW

wininet

InternetQueryDataAvailable HttpQueryInfoA InternetOpenUrlA InternetOpenA HttpQueryInfoW InternetQueryOptionW InternetCloseHandle InternetReadFile

shlwapi

PathAppendW StrStrIA PathAppendA PathFindExtensionA

ws2_32

closesocket connect htons send WSAStartup WSACleanup inet_addr inet_ntoa WSAGetLastError recv setsockopt ioctlsocket select ntohs gethostbyname sendto getpeername socket

msvcrt

strncat isalnum vsprintf strrchr toupper strncmp memmove isxdigit _strnicmp ??2@YAPAXI@Z _snwprintf strchr strtok _stricmp _vsnprintf _wcsnicmp _memicmp strncpy sprintf _snprintf printf _strcmpi sscanf atoi ??3@YAXPAX@Z wcsrchr strstr wcsstr memset

kernel32

GetWindowsDirectoryA GetModuleFileNameA OpenMutexA GetLogicalDriveStringsA CreateDirectoryA GetFileSize LockFile SetCurrentDirectoryA FindFirstFileA FindNextFileA FindClose CopyFileW FlushFileBuffers GetLocaleInfoA GetVolumeInformationW lstrcatA ExitProcess CreateProcessW VirtualAlloc DeviceIoControl SetFilePointer lstrcpynA LocalAlloc LocalFree lstrcpyW SetFileAttributesA DeleteFileA lstrcpynW lstrcatW GetTempFileNameW DeleteFileW GetWindowsDirectoryW CreateThread InterlockedCompareExchange GetModuleFileNameW GetVersionExA CreateMutexA UnmapViewOfFile InterlockedIncrement CreateFileMappingA OpenFileMappingA MapViewOfFile ReleaseMutex WaitForSingleObject OpenProcess CreateRemoteThread IsWow64Process VirtualAllocEx VirtualFreeEx CreateFileA WaitForMultipleObjects GetOverlappedResult DisconnectNamedPipe lstrcpyA MoveFileExA lstrcmpA WideCharToMultiByte MoveFileExW lstrcmpW ExitThread MultiByteToWideChar GetFileAttributesA SetFileAttributesW GetFileAttributesW LoadLibraryW CloseHandle SetFileTime CreateFileW GetFileTime GetSystemTimeAsFileTime WriteFile GetModuleHandleW GetLastError ReadFile GetTickCount HeapAlloc GetProcessHeap HeapFree lstrlenA Sleep WriteProcessMemory ReadProcessMemory InitializeCriticalSection LeaveCriticalSection EnterCriticalSection HeapReAlloc SetEvent ConnectNamedPipe CreateNamedPipeA CreateEventA

user32

RegisterClassExA CreateWindowExA RegisterDeviceNotificationA GetMessageA TranslateMessage DispatchMessageA DefWindowProcA wsprintfW wvsprintfA MessageBoxA

advapi32

RegSetValueExW CryptDestroyHash CryptHashData RegOpenKeyExA RegSetValueExA RegNotifyChangeKeyValue RegCreateKeyExW CryptGetHashParam RegCloseKey OpenProcessToken LookupPrivilegeValueA AdjustTokenPrivileges CryptAcquireContextA CryptCreateHash CryptReleaseContext

ole32

CoInitialize CoCreateInstance