Overview

overview

10

Static

static

10

c/bin/libpq__.dll

windows10-2004-x64

1

c/bin/libpq__.dll

windows11-ltsc_2024-x64

1

c/bin/pg_config.exe

windows10-2004-x64

10

c/bin/pg_config.exe

windows11-ltsc_2024-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    64bit_postgresql-18.6-bin_20260914.zip
  • Size 2.1MB
  • Sample261103-b9lyssgg97
  • SHA256 0dcfdcb0407409278a1eb02b8c5c2b122257037522cb0bcec84939a2f7e8492d
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
warmcookiebackdoor

Malware Config

Extracted

Family

  • warmcookie

Targets

    • Target
      c/bin/libpq__.dll
    • Size 555KB
    • SHA256 9024b8fd2cb9e751318f3a1ae08339eb147223c313a76bf152d2807357e42c05
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral1behavioral2
    • Target
      c/bin/pg_config.exe
    • Size 114KB
    • SHA256 1b7c0163478b0c4ced02c59d580dbe151942d9fd6e1ca8e98105e78c121f70b5
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    backdoorwarmcookie

    • Family: Warmcookie, Badspace

      Warmcookie aka Badspace is a backdoor written in C++.

      backdoorwarmcookie
    behavioral3behavioral4

MITRE ATT&CK Matrix

Tasks