update.pack
First submission 2024-10-15 05:01:02
Last sumbission 2024-10-15 05:21:02
File details
| File type: | PE32+ executable (DLL) (GUI) x86-64, for MS Windows |
| Mime type: | application/x-dosexec |
| File size: | 285.0 KB (291840 bytes) |
| Compile time: | 2024-10-07 20:39:36 |
| MD5: | 9ae6451ef8b57a66983dc0496050f7c4 |
| SHA1: | c6b385ba97d10e98dc3b318f1083883dbea7f9fc |
| SHA256: | 9c593359dd670a052b69353f80bef060a169f4df148a1e17686fb8190eab23a0 |
| Import Hash : | 5ce0d5a96a49e5bc172e9fc651bd9cca |
| Sections 6 | .text .rdata .data .pdata .rsrc .reloc |
| Directories 4 | import export resource relocation |
File features detected
Anti VM
Signed
XOR
OSINT Enrichments
| Virus Total: | 50/77 VT report date: 2024-10-15 03:55:09 |
| Malware Type 1 | trojan |
| Threat Type 2 | tinukebot hzbmh |
URLs, FQDN and IP indicators 2
| URL | Host (FQDN/IP) | Date Added |
|---|---|---|
hXXp://176.111.174.140/api/update.pack  |
176.111.174.140 |
2024-10-15 05:21:03 |
| hXXp://176.111.174.140/api/diamotrix.pack |
176.111.174.140 |
2024-10-15 05:01:02 |
PE Sections 0 suspicious
| Name | VAddress | VSize | Size | SHA1 | MD5 | Suspicious |
|---|---|---|---|---|---|---|
| .text | 0x1000 | 0x30a1c | 199680 | 71f5861fc005d6950ff537f0d74ca8c2efd7a45c | 8852e271975cfdde4413c4fd57f45709 | |
| .rdata | 0x32000 | 0xdf76 | 57344 | f186687acb8163c898f9932f2e9d160669233094 | 914bee6ea3d00321ea479be86a5fc4ad | |
| .data | 0x40000 | 0xcc88 | 10240 | 190d83e7916ca7cb0941784d50a1e3927e768136 | ecc65ebd16029be0e2aa2b26d94f182e | |
| .pdata | 0x4d000 | 0x3234 | 13312 | 09fbd34b947bde2720c2d3916696feffb3167f58 | 01002255959c9226f142a85a84a13c43 | |
| .rsrc | 0x51000 | 0x288 | 1024 | 19e141e48aa5f73ab78fc250ed36168e32e50816 | b2c856b073218d5fc79a1dd7114d8a5c | |
| .reloc | 0x52000 | 0x223e | 9216 | fa9301531436abd01694ee09efd2a93bc8cb17c3 | 9fffe7fa198ee6e41fc0189870ccbb43 |
PE Resources 1
| Name | Language | Sublanguage | Offset | Size | Data |
|---|---|---|---|---|---|
| RT_MANIFEST | LANG_ENGLISH | SUBLANG_ENGLISH_US | 0x51060 | 548 |
Anti debug functions 7
| GetLastError |
| IsDebuggerPresent |
| IsProcessorFeaturePresent |
| OutputDebugStringW |
| RaiseException |
| TerminateProcess |
| UnhandledExceptionFilter |
Strings analysis - File found
| Binary |
| bot64.bin |
| Library |
| KERNEL32.dll |
| USER32.dll |
| mscoree.dll |
| ADVAPI32.dll |
| chrome.dll |
| WS2_32.dll |
| nss3.dll |
| ntdll.dll |
| MSVCRT.dll |
| child.dll |
| SHLWAPI.dll |
| PSAPI.DLL |
| GDI32.dll |
| KernelBase.dll |
| msedge.dll |
| secur32.dll |
| WININET.dll |
| opera_browser.dll |
| VERSION.dll |
| SHELL32.dll |
| Web Page |
| /api.php |
Strings analysis - Possible IPs found 1
| 176.111.174.140 |
Strings analysis - Possible URLs found 1
| http://schemas.microsoft.com/SMI/2005/WindowsSettings |
Import functions
PE Exports 1 suspicious
| Function | Address |
|---|---|
| ?ReflectiveLoader@@YA_KXZ | 0x18001aedc |
| Name | Latest seen | MD5 |
|---|---|---|
| bot64.bin | 2024-10-18 07:23:02 | 9ef53eea53bc23a3501d4bae7fa76905 |