Overview

overview

8

Static

static

8

JZ5U...վ.url

windows7-x64

1

JZ5U...վ.url

windows10-2004-x64

1

QQ�....4.exe

windows7-x64

8

QQ�....4.exe

windows10-2004-x64

8

ʹñض.url

windows7-x64

1

ʹñض.url

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    8687f7c25f054f9cf1c90f07ad96fa8d275bfb2c289c23813eeee561ce657a70

  • Size

    1.1MB

  • Sample

    221124-k2nxvsdb35

  • MD5

    ffd17749f947af0daa5f803b8b1753dd

  • SHA1

    2392ee1838edc93271c086d5fa60f84531de6b01

  • SHA256

    8687f7c25f054f9cf1c90f07ad96fa8d275bfb2c289c23813eeee561ce657a70

  • SHA512

    2788782350b20d6b81fa47f394d6feaf9c3a273f6168d1e542228b31fcbb6205943c302357b7b7c1be84ecde85ecf0d3ae2cc62ac5ea5b3447de1f5075bd4ba5

  • SSDEEP

    24576:S8wrDRKQ1v+s9ml1zj8d84nfxtTKQMFYja0WJ6gjhDXOLhLb:jAKfSi1X8d5nfjdMc+1OLx

Score
8/10
upxvmprotect

Malware Config

Targets

    • Target

      JZ5Uɫվ.url

    • Size

      111B

    • MD5

      3e8d917d0d10210cd051d7c251bcb9d9

    • SHA1

      92bd693746a70ebf302b1f30afbebe1e3d6f4a37

    • SHA256

      026cee18a5e42425585a1a324fe0894be7cb2fcb1869310ad2a38b73f96e89ef

    • SHA512

      f676fdeb3cb04db79075adb3e5957dc1722d71a6f7edd03f7cb28b3cce60183e52e952f30c74184799350f0963da5ed8b9b69dfee85eaed49dc724c38985176b

    Score
    1/10
    behavioral1behavioral2

    • Target

      QQռv2.4.exe

    • Size

      1.2MB

    • MD5

      d15c44dfcf8c645bfd58de688e2ef89f

    • SHA1

      c7211e7e547a58ee5bd0de718639608653c1815a

    • SHA256

      5be25a94729b627fe120053a8c6076a62074dc81ee27af1883e951d150408b71

    • SHA512

      43a000dd5bbb4c1380abe8eab0fb2414191da069b98387bd0eab5e38ce43d4c79fc142939b4c873eb77c34aee08d04a93a99f668cbaa7baf869db717cc1e9c4d

    • SSDEEP

      24576:oTncNfx9X01rFQgq2cNFrGRe3tYTuP2ZNH+LxWqHa5bBMx/np6mmERSM:oTcNwBVvcNV8wtaZeLxWZ2x/nr

    Score
    8/10
    upxvmprotect

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

      vmprotect
    behavioral3behavioral4

    • Target

      ʹñض.url

    • Size

      112B

    • MD5

      b72fb6817f28cc91c35322b3c9864a12

    • SHA1

      f075eca15246bc681083f3580b6224d43c02506b

    • SHA256

      e6a86be0cd8f1c493fdb1b9e841255fd36fd12cde26dd2054003603469f08a76

    • SHA512

      672e0794f73c6210558bad9a985c893704d82d4a203a394ed896c132c8d52ae9a32256c8456d29863e35e35b339b57d55835487c6cf37837e6cd3f5b4cf63b8c

    Score
    1/10
    behavioral5behavioral6

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

2
T1112

Install Root Certificate

1
T1130

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks