jaffacakes118_Backdoor[.]Win32[.]Rbot[.]gen[.]96be4aeb54e6cc9768c6f147ccd1bcd8

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_Backdoor.Win32.Rbot.gen.96be4aeb54e6cc9768c6f147ccd1bcd8
Size 152KB
Sample261014-gty63szthy
SHA256 496a7914e46d85c1480a012d7a6966ed368d6c49942e4090052307679e0421a8
MD5 96be4aeb54e6cc9768c6f147ccd1bcd8
SHA1 2566018da744b207a78f3d4b888c61ffe7fef0d6
SHA512 f5f6c6e7674bd97362633cc18bb1497de02377af6803b7ab65969fa2d50b42f2f158f7b9ac566e9de1ae1501fe695c0b441a9062ef7c461b2d720700b785ccff
SSDEEP 3072:N0Rt+2j003GyW3zzMX4FcWry35ElUOXZouOSKGLEPwTa9Eo6:WRtnry3zzTFVry35mVXx9PLEkaQ
TLSH
T181E302027CD7893EC498727F4EE99E4E7665F1108D4AE5433E99CFFE28A2B4948104BD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_Backdoor.Win32.Rbot.gen.96be4aeb54e6cc9768c6f147ccd1bcd8

File Explorer

jaffacakes118_Backdoor.Win32.Rbot.gen.96be4aeb54e6cc9768c6f147ccd1bcd8

.exe 152KB

jaffacakes118_Backdoor.Win32.Rbot.gen.96be4aeb54e6cc9768c6f147ccd1bcd8

IMPHASH 32dd6568012bed0886c39c17a159f466
SHA256 496a7914e46d85c1480a012d7a6966ed368d6c49942e4090052307679e0421a8
MD5 96be4aeb54e6cc9768c6f147ccd1bcd8
SHA1 2566018da744b207a78f3d4b888c61ffe7fef0d6
SHA512 f5f6c6e7674bd97362633cc18bb1497de02377af6803b7ab65969fa2d50b42f2f158f7b9ac566e9de1ae1501fe695c0b441a9062ef7c461b2d720700b785ccff
SSDEEP 3072:N0Rt+2j003GyW3zzMX4FcWry35ElUOXZouOSKGLEPwTa9Eo6:WRtnry3zzTFVry35mVXx9PLEkaQ
TLSH
T181E302027CD7893EC498727F4EE99E4E7665F1108D4AE5433E99CFFE28A2B4948104BD
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

624627

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

Name

Size

Virtual Size

492KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

Size

95KB

Virtual Size

96KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

Size

3KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

Size

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

Size

39KB

Virtual Size

59KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

Size

6KB

Virtual Size

27KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

jaffacakes118_Backdoor.Win32.Rbot.gen.96be4aeb54e6cc9768c6f147ccd1bcd8

kernel32

generic