Overview
overview
7Static
static
7SuperOneCl...pi.dll
windows7-x64
3SuperOneCl...pi.dll
windows10-2004-x64
3SuperOneCl...pi.dll
windows7-x64
3SuperOneCl...pi.dll
windows10-2004-x64
3SuperOneCl...ck.exe
windows7-x64
1SuperOneCl...ck.exe
windows10-2004-x64
1SuperOneCl...er.apk
android-9-x86
SuperOneCl...er.apk
android-10-x64
SuperOneCl...er.apk
android-11-x64
SuperOneCl...db.exe
windows7-x64
1SuperOneCl...db.exe
windows10-2004-x64
1SuperOneCl...blinux
ubuntu-18.04-amd64
SuperOneCl...usybox
debian-9-armhf
1SuperOneCl...neuter
debian-9-armhf
1SuperOneCl...hecage
debian-9-armhf
SuperOneCl...qlite3
debian-9-armhf
SuperOneCl.../su-v1
debian-9-armhf
SuperOneCl.../su-v2
debian-9-armhf
SuperOneCl.../su-v3
debian-9-armhf
Analysis
-
max time kernel
41s -
max time network
33s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
24-11-2022 03:18
Static task
static1
Behavioral task
behavioral1
Sample
SuperOneClickv1.7-ShortFuse/AdbWinApi.dll
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
SuperOneClickv1.7-ShortFuse/AdbWinApi.dll
Resource
win10v2004-20221111-en
Behavioral task
behavioral3
Sample
SuperOneClickv1.7-ShortFuse/AdbWinUsbApi.dll
Resource
win7-20221111-en
Behavioral task
behavioral4
Sample
SuperOneClickv1.7-ShortFuse/AdbWinUsbApi.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral5
Sample
SuperOneClickv1.7-ShortFuse/SuperOneClick.exe
Resource
win7-20221111-en
Behavioral task
behavioral6
Sample
SuperOneClickv1.7-ShortFuse/SuperOneClick.exe
Resource
win10v2004-20221111-en
Behavioral task
behavioral7
Sample
SuperOneClickv1.7-ShortFuse/Superuser.apk
Resource
android-x86-arm-20220823-en
Behavioral task
behavioral8
Sample
SuperOneClickv1.7-ShortFuse/Superuser.apk
Resource
android-x64-20220823-en
Behavioral task
behavioral9
Sample
SuperOneClickv1.7-ShortFuse/Superuser.apk
Resource
android-x64-arm64-20220823-en
Behavioral task
behavioral10
Sample
SuperOneClickv1.7-ShortFuse/adb.exe
Resource
win7-20221111-en
Behavioral task
behavioral11
Sample
SuperOneClickv1.7-ShortFuse/adb.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral12
Sample
SuperOneClickv1.7-ShortFuse/adblinux
Resource
ubuntu1804-amd64-20221111-en
Behavioral task
behavioral13
Sample
SuperOneClickv1.7-ShortFuse/busybox
Resource
debian9-armhf-20221111-en
Behavioral task
behavioral14
Sample
SuperOneClickv1.7-ShortFuse/psneuter
Resource
debian9-armhf-20221111-en
Behavioral task
behavioral15
Sample
SuperOneClickv1.7-ShortFuse/rageagainstthecage
Resource
debian9-armhf-20221111-en
Behavioral task
behavioral16
Sample
SuperOneClickv1.7-ShortFuse/sqlite3
Resource
debian9-armhf-20221111-en
Behavioral task
behavioral17
Sample
SuperOneClickv1.7-ShortFuse/su-v1
Resource
debian9-armhf-20221111-en
Behavioral task
behavioral18
Sample
SuperOneClickv1.7-ShortFuse/su-v2
Resource
debian9-armhf-20221111-en
Behavioral task
behavioral19
Sample
SuperOneClickv1.7-ShortFuse/su-v3
Resource
debian9-armhf-20221111-en
General
-
Target
SuperOneClickv1.7-ShortFuse/AdbWinApi.dll
-
Size
94KB
-
MD5
47a6ee3f186b2c2f5057028906bac0c6
-
SHA1
fde9c22a2cfcd5e566cec2e987d942b78a4eeae8
-
SHA256
14a51482aa003db79a400f4b15c158397fe6d57ee6606b3d633fa431a7bfdf4b
-
SHA512
6a2675de0c445c75f7d5664ebe8f0e2f69c3312c50156161e483927e40235140d5e28e340112ac552d6462366143890a8ce32dbf65bd37e27cb1ea290fe14584
-
SSDEEP
1536:npCxybY0FS6MqS6WvgD9xj03TabrFvY5J6sCGt:npo0k6ZWVTaif6sCG
Malware Config
Signatures
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1476 852 WerFault.exe rundll32.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
rundll32.exerundll32.exedescription pid process target process PID 528 wrote to memory of 852 528 rundll32.exe rundll32.exe PID 528 wrote to memory of 852 528 rundll32.exe rundll32.exe PID 528 wrote to memory of 852 528 rundll32.exe rundll32.exe PID 528 wrote to memory of 852 528 rundll32.exe rundll32.exe PID 528 wrote to memory of 852 528 rundll32.exe rundll32.exe PID 528 wrote to memory of 852 528 rundll32.exe rundll32.exe PID 528 wrote to memory of 852 528 rundll32.exe rundll32.exe PID 852 wrote to memory of 1476 852 rundll32.exe WerFault.exe PID 852 wrote to memory of 1476 852 rundll32.exe WerFault.exe PID 852 wrote to memory of 1476 852 rundll32.exe WerFault.exe PID 852 wrote to memory of 1476 852 rundll32.exe WerFault.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\SuperOneClickv1.7-ShortFuse\AdbWinApi.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:528 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\SuperOneClickv1.7-ShortFuse\AdbWinApi.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:852 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 852 -s 2523⤵
- Program crash
PID:1476