> Analysis · a9b5e7469c35_

~/packetpursuit $ cat /intel/analyses/a9b5e7469c35.../report.md

typeanalysisfamilyunclassified-dotnetconfidencelowcreated2026-06-27updated2026-06-27
SHA-256: a9b5e7469c35f0cd7da326f9894d002a8bbe77377a11bbc03551dcbadab3b47a

a9b5e7469c35f0cd7da326f9894d002a8bbe77377a11bbc03551dcbadab3b47a

Filename: Kopija_bankovnog_placanja.exe (Serbian banking lure). Static-only (CAPE skipped — no Windows guest). Confidence: low.

Build / RE

  • Format: PE32+ executable (console) x86-64 Mono/.Net assembly, 2 sections ^[file.txt]
  • Runtime: .NET Framework v4.0.30319 ^[strings.txt:3]
  • Compiler: ILC / Native AOT toolchain (timestamp 2024-07-03 20:42:01 UTC) ^[pefile.txt:40] ^[rabin2-info.txt]
  • Signing: Timestamped (Sectigo/USERTrust RSA chain) but unsigned — no valid Authenticode signature ^[binwalk.txt:7-10] ^[pefile.txt:138-139]
  • Obfuscation: None observed (no ConfuserEx, SmartAssembly, or IL obfuscation). VS_VERSIONINFO is randomized word-salad (CompanyName: Ufogohoqunuxuh, ProductName: Enuzojet, FileDescription: Agavinebuqa...) ^[pefile.txt:218-224]
  • Embedded resources: Standard .rsrc section (~17 KB) with RT_MANIFEST and VERSIONINFO; no encrypted payload blobs or bitmap stego ^[binwalk.txt] ^[pefile.txt:103-121]
  • Anti-analysis: FreeConsole present ^[strings.txt:99] — typical console-hide for stealth. No VM/debug checks observed.
  • Notable strings:
    • AesManaged, CreateDecryptor ^[strings.txt:59,224]
    • Get_Malware ^[strings.txt:111] — likely the entry-point or payload-retrieval method name
    • DataStore, DataStoreEntry ^[strings.txt:114,306] — suggests in-memory or clipboard data staging
    • ComplementaryStrings, CommaSeparatedValue ^[strings.txt:148,236] — string-manipulation helpers
    • GetText, SetText, IDataObject, System.Runtime.InteropServices.ComTypes.IDataObject.GetData ^[strings.txt:48-55,266,293-294] — OLE clipboard API surface
    • AmsiOpenSession, AmsiScanBuffer ^[strings.txt:145,147,191-192] — AMSI API references (likely for bypass, not defense)
    • kernel32.dll, Amsi_dll ^[strings.txt:173-175]

Deploy / ATT&CK

Tactic Technique Evidence
DEFENSE EVASION T1620 Reflective Code Loading Capa detects invoke .NET assembly method and unmanaged call ^[capa.txt]
DEFENSE EVASION T1027.002 Obfuscated Files or Information AES-managed payload decryption implied by AesManaged + CreateDecryptor ^[strings.txt:59,224]
DEFENSE EVASION T1562.001 Impair Defenses: Disable or Modify Tools AMSI API strings (AmsiOpenSession, AmsiScanBuffer) suggest AMSI patch/bypass intent ^[strings.txt:145,191]
EXECUTION T1059 Command and Scripting Interpreter .NET assembly with ExecuteMethod, GetMethod ^[strings.txt:65-66]
COLLECTION T1115 Clipboard Data Full IDataObject / GetText / SetText / OLE clipboard COM interop surface ^[strings.txt:48-55,266,293-294]
COLLECTION T1123 Audio Capture GetAudioStream, WaveAudio, audioBytes ^[strings.txt:177-178,204-205,233]
  • No dynamic evidence: CAPE detonation skipped (no Windows guest). All TTPs inferred from static strings/capa.
  • No network C2 observed: No hardcoded URLs, IPs, or socket strings. C2 may be runtime-resolved or absent (stand-alone clipper).
  • Attribution: None. DataStore/Get_Malware strings overlap with ~10 other unattributed .NET samples in corpus, but none have family labels. The Serbian banking-filename lure (Kopija_bankovnog_placanja.exe = "Copy of bank payment") is common in Balkan-targeted crimeware.

Capabilities (chainable)

  • aes-managed-payload-decryption
  • amsi-api-bypass
  • clipboard-hijack-ole-com
  • audio-capture-wave-stream
  • console-hide-freeconsole

Related

Report written 2026-06-27. Static-only; dynamic confirmation pending CAPE Windows guest.