bot64.bin
First submission 2024-10-18 07:23:02
File details
| File type: | PE32+ executable (DLL) (GUI) x86-64, for MS Windows |
| Mime type: | application/x-dosexec |
| File size: | 284.5 KB (291328 bytes) |
| Compile time: | 2024-10-14 17:25:10 |
| MD5: | 9ef53eea53bc23a3501d4bae7fa76905 |
| SHA1: | f2e79cedf527c57a8f3698c216e9e0786e530780 |
| SHA256: | 95deedb793e8716b92271896435fd94a7585f699e20a308bb8349671db54cfc2 |
| Import Hash : | 5ce0d5a96a49e5bc172e9fc651bd9cca |
| Sections 6 | .text .rdata .data .pdata .rsrc .reloc |
| Directories 4 | import export resource relocation |
File features detected
Anti VM
Signed
XOR
OSINT Enrichments
| Virus Total: | 52/77 VT report date: 2024-10-17 15:32:53 |
| Malware Type 1 | trojan |
| Threat Type 3 | tinukebot meterpreter nekark |
URLs, FQDN and IP indicators 1
| URL | Host (FQDN/IP) | Date Added |
|---|---|---|
hXXp://176.111.174.140/api/bot64.bin  |
176.111.174.140 |
2024-10-18 07:23:02 |
PE Sections 0 suspicious
| Name | VAddress | VSize | Size | SHA1 | MD5 | Suspicious |
|---|---|---|---|---|---|---|
| .text | 0x1000 | 0x30a0c | 199680 | 4170968ea4cd50bfcab5c05886e6a69aea4ac37d | ff766bdbaac990cb5221e69739195292 | |
| .rdata | 0x32000 | 0xddf6 | 56832 | f29e3051a7ca75a93fd83adad86b186c77e7c1b9 | 511f38a95fb0fedbba51f37012842db4 | |
| .data | 0x40000 | 0xcc88 | 10240 | 3d23a80df0b4eb537f331b86dd42fe3392d8c827 | 2a30623590ad9dd19d356986c16f558d | |
| .pdata | 0x4d000 | 0x3234 | 13312 | c422c6bff98410d456b4104c81ca99f432320635 | 0d9584f9964a079befa078ebbda744d5 | |
| .rsrc | 0x51000 | 0x288 | 1024 | 19e141e48aa5f73ab78fc250ed36168e32e50816 | b2c856b073218d5fc79a1dd7114d8a5c | |
| .reloc | 0x52000 | 0x223e | 9216 | a82d08b4eae270aa3b252ed4f41044386e8a2db9 | 16217b4d788bf3ab7ed8038d09c9362c |
PE Resources 1
| Name | Language | Sublanguage | Offset | Size | Data |
|---|---|---|---|---|---|
| RT_MANIFEST | LANG_ENGLISH | SUBLANG_ENGLISH_US | 0x51060 | 548 |
Anti debug functions 7
| GetLastError |
| IsDebuggerPresent |
| IsProcessorFeaturePresent |
| OutputDebugStringW |
| RaiseException |
| TerminateProcess |
| UnhandledExceptionFilter |
Strings analysis - File found
| Binary |
| bot64.bin |
| Library |
| KERNEL32.dll |
| USER32.dll |
| mscoree.dll |
| ADVAPI32.dll |
| chrome.dll |
| WS2_32.dll |
| nss3.dll |
| ntdll.dll |
| MSVCRT.dll |
| child.dll |
| SHLWAPI.dll |
| PSAPI.DLL |
| GDI32.dll |
| KernelBase.dll |
| msedge.dll |
| secur32.dll |
| WININET.dll |
| opera_browser.dll |
| VERSION.dll |
| SHELL32.dll |
| Web Page |
| /GrXRYWt.php |
Strings analysis - Possible IPs found 1
| 176.111.174.140 |
Strings analysis - Possible URLs found 1
| http://schemas.microsoft.com/SMI/2005/WindowsSettings |
Import functions
PE Exports 1 suspicious
| Function | Address |
|---|---|
| ?ReflectiveLoader@@YA_KXZ | 0x18001aed0 |
| Name | Latest seen | MD5 |
|---|---|---|
| update.pack | 2024-10-15 05:21:02 | 9ae6451ef8b57a66983dc0496050f7c4 |