File: input_file.bin

Field Value
Parser FooParser
File Path C:/input_file.bin
Description SuperMalware Implant
Architecture
MD5 1e50210a0202497fb79bc38b6ade6c34
SHA1 baf34551fecb48acc3da868eb85e1b6dac9de356
SHA256 1307990e6ba5ca145eb35e99182a9bec46531bc54ddf656a602c780fa0240dee
Compile Time

Alphabet

Alphabet Base
0123456789ABCDEF 16
ABCDEFGHIJKLMNOPQRSTUVWXYZ234567= 32
ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/= 64

Credential

Username Password
admin 123456
mruser
secrets
admin pass

Decoded String

Value Key Algorithm
GetProcess
badstring 0xffffxor

Email Address

Value
email@bad.com

Encryption Key

Key Algorithm Mode Iv
0x68656c6c6f ("hello")rc4
0xffffffff aes ecb 0x00000000
0xffff xor

Event

Value
MicrosoftExist

Injection Process

Value
svchost

Interval

Value
3

Mission ID

Value
target4

Mutex

Value
ithinkimalonenow

Path

Path Directory Path Name Is Dir
C:\windows\temp\1\log\keydb.txtC:\windows\temp\1\logkeydb.txt False
%APPDATA%\foo %APPDATA% foo True
C:\foo\bar.txt C:\foo bar.txt False
malware.exeFalse
%System%\svohost.exe %System% svohost.exeFalse

Pipe

Value
\.\pipe\namedpipe

RSA Private Key

Value 
Modulus (n):
    187 (0xbb)
Public Exponent (e):
    7 (0x7)
Private Exponent (d):
    23 (0x17)
p:
    17 (0x11)
q:
    11 (0xb)
d mod (p-1):
    7 (0x7)
d mod (q-1):
    3 (0x3)
(inverse of q) mod p:
    14 (0xe)

RSA Public Key

Value 
Modulus (n):
    187 (0xbb)
Public Exponent (e):
    7 (0x7)

Registry

Tags Path Key Value Data
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\UpdaterHKLM\Software\Microsoft\Windows\CurrentVersion\RunUpdaterc:\update.exe
HKLM\Foo\Bar
tag2 Baz

Service

Name Display Name Description Image
WindowsUserManagementWindows User ManagementProvides a common management to access information about windows user.%System%\svohost.exe

Socket

Address PortNetwork Protocol Listen
bad.com 21tcp
1635udp
4568tcp True
10.11.10.13 443
192.168.1.1 80tcp
badhost.com 21

URL

Tags Url Address PortPath Application Protocol Network Protocol Username Password
https://10.11.10.13:443/images/baner.jpg10.11.10.13 443/images/baner.jpghttps
proxy 192.168.1.1 80 tcp admin pass
ftp://badhost.com:21 badhost.com 21 ftp admin pass

UUID

Value
654e5cff-817c-4e3d-8b01-47a6f45ae09a

User Agent

Value
Mozilla/4.0 (compatible; MISE 6.0; Windows NT 5.2)

Version

Value
3.1

Miscellaneous

Tags Key Value
misc_info some miscellaneous info
random_data b'\xde\xad\xbe\xef'
keylogger True
tag1 misc_integer432

Residual Files

Filename Description MD5 Arch Compile Time
config.xmlExtracted backdoor Foo config file8c41f2802904e53469390845cfeb2b28

File Tree

<input_file.bin (1e50210a0202497fb79bc38b6ade6c34) : SuperMalware Implant>