Overview

overview

8

Static

static

8

QQ邮箱�...PI.dll

windows7-x64

1

QQ邮箱�...PI.dll

windows10-2004-x64

1

QQ邮箱�...��.doc

windows7-x64

4

QQ邮箱�...��.doc

windows10-2004-x64

1

QQ邮箱�...er.dll

windows7-x64

1

QQ邮箱�...er.dll

windows10-2004-x64

1

QQ邮箱�...te.exe

windows7-x64

1

QQ邮箱�...te.exe

windows10-2004-x64

1

QQ邮箱�...��.url

windows7-x64

1

QQ邮箱�...��.url

windows10-2004-x64

1

QQ邮箱�...��.url

windows7-x64

1

QQ邮箱�...��.url

windows10-2004-x64

1

QQ邮箱�...��.doc

windows7-x64

4

QQ邮箱�...��.doc

windows10-2004-x64

1

QQ邮箱�...��.exe

windows7-x64

8

QQ邮箱�...��.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    7c47c65f1aa589c33355d80b1dc26625a313d71538ea966ea921a90db11193ef

  • Size

    2.8MB

  • Sample

    221124-l1hvwsac31

  • MD5

    435f8b9442e686cd9c387a977bbe62e2

  • SHA1

    4be55ecca56e13240ca1c552c5e29a31ee4039a5

  • SHA256

    7c47c65f1aa589c33355d80b1dc26625a313d71538ea966ea921a90db11193ef

  • SHA512

    1aca3f9259bfcfced68bd61f6fbfe2ea853595dd400fabbfc6bd36072a40b35b294a5121b8b9e3149e85e78602bbdc0b607b27a19b312e2dbb9a06c1f07da824

  • SSDEEP

    49152:JIUJOI9qAjhgFSNt9ReYiHqvRbIqHSyJX5LL9lS4CiIBgQMLNjhByk3gM9Hcw:JIUIZNIJeqpbICV5LLFQMLFhT7D

Score
8/10
aspackv2vmprotect

Malware Config

Targets

    • Target

      QQ邮箱群发王1.0/ESPI.dll

    • Size

      1.3MB

    • MD5

      9fbb1e0bd621a5331b8dffb5d2989955

    • SHA1

      0dc57f3c98cabd09f15ca7d4457e4c61a2c10ae7

    • SHA256

      71a1b830c0265e8daa71f9ec6ac7875f34058c6b6c496061678192f109f162b0

    • SHA512

      3b4f7f8df77bae2a3a2d4808ff33c5e2a3ca9b6bef5ae6ba7c779688ef10fb17b3ac9ef1d083e763247a0aa81eb7938c6e487e2941561ae0048f2e1347855a09

    • SSDEEP

      24576:BgcA9GTCNJIj8wLXjS9mauEe2gqjKq+/lCPDvDmeAJMI//B9jztlpLUjEtiyb2gu:BjAUCvIj8wLXjS9mauEe2gqjKq+/lCPZ

    Score
    1/10
    behavioral1behavioral2

    • Target

      QQ邮箱群发王1.0/QQ邮箱群发器 说明.doc

    • Size

      699KB

    • MD5

      2176270020fe6666505c93684eafd30a

    • SHA1

      3665db496067762458453487d6953a95df9b8cbd

    • SHA256

      5d973b4d54cd779d5b5371d68de358964a358f90df0fbe7952859b50afe79e4d

    • SHA512

      87fb0a950a2e19f90cbbac315864cb8f738a300a156af128fa2b64b21e60880a8d83c99388886f104fbb427496ed437050d82c4baaebc5477da5e0a2011d88d9

    • SSDEEP

      12288:XXDzRaRC2NX69QcD/fk9OzRpxDisMuD3hlZn7x0QuqR:XzQCqoQ41Pn3hjVQ

    Score
    4/10
    behavioral3behavioral4

    • Target

      QQ邮箱群发王1.0/UUWiseHelper.dll

    • Size

      275KB

    • MD5

      0acd9b058b3232b5c91242e24c39ac9c

    • SHA1

      42871e8b89e6425f7872e1cf8fac3e337f021ebb

    • SHA256

      1b3017c2998dad80a86cc759d8f63341a196d281591cbc2ea4d426426bf32ce0

    • SHA512

      92ae4079bafb58a5e5beef30f0155c06bf38eaa5022eafdee46ba7967df153d5d534a915a2d1be6c1ab6b58b8ca90ecc7f24f4ef4fbbb6ca226f552b03942a6c

    • SSDEEP

      6144:wR5HZVMrXa07zts3Xf7mNod1NwCTCXETH:M5Vi17ztimNo5wwCs

    Score
    1/10
    behavioral5behavioral6

    • Target

      QQ邮箱群发王1.0/update.exe

    • Size

      366KB

    • MD5

      03e506fe4bf0fb8491cfe5d6da260048

    • SHA1

      a474fd981625554107af2b797d1e31c9c0bbe03b

    • SHA256

      98edbb7826a589a7fbde096aca0e5507d26984b263e2b7cd1f509628749b739a

    • SHA512

      1024b44da7eab0eabfa1689d00d4aa58be2d6f6c43adff02fc694d5f7b8c34768a019db5adbc696b8c9178cafe5be02bc75fdffe9616893891fc39b09fcc74de

    • SSDEEP

      6144:/WBaS9ail2H4zEyf/bJLL4owVDlSbTdboSDnQ:+BB241LWVDgbTpoSDn

    Score
    1/10
    behavioral7behavioral8

    • Target

      QQ邮箱群发王1.0/华彩联盟论坛.url

    • Size

      195B

    • MD5

      058c6dd31a6a2d90f0a773170084821a

    • SHA1

      81fcaeb55848e7ee386522e516fd1650bff0f31b

    • SHA256

      4ce090788a79b4ee816322f0fa57e7020f1108911fc6cdf1ec7b437cd2187782

    • SHA512

      bd9feff103ba9c78d89da0e7205a4f9f18e3bc87b3a26a987b667124539efbd2d3b6fc26e06ff8dffac61241ae1d4915ddfe784c34c15f4b4374b358e630a3e8

    Score
    1/10
    behavioral10behavioral9

    • Target

      QQ邮箱群发王1.0/华彩软件站-使用必读.url

    • Size

      195B

    • MD5

      584c19af540c6f9f9228f18b41c54d07

    • SHA1

      5a3eee9fab9d553f5edddef0cc06630e35446dd8

    • SHA256

      ee0e7e1a20dd376bd088291e97394ad8c2b43f6638e69179a288e8d2c986d9df

    • SHA512

      69207b24fff3a72ed5861685a667034f9597fdd1cf1b4bce941e295f7424562db1628da32f036f9fb5f9d63ff12b3a4058bbfe38f562a9c52c46f7b310f1a2c9

    Score
    1/10
    behavioral11behavioral12

    • Target

      QQ邮箱群发王1.0/用户必看.doc

    • Size

      28KB

    • MD5

      daab88be3ff0b23a15033fa8d2b4502a

    • SHA1

      49ba9aaaa7bb1d89417d4f8aa78412a0680de981

    • SHA256

      5406547f60942f1caaafdc532b04154211bea22b1be6aa4a7af52d9503a7ed73

    • SHA512

      62572f5d841dfe29bc07f73620c0d9eabe66c8f83ef2299df3993ed912e7e69a3ab7295565bee566974fbbe3bc307c219c1c95293abb9733bf11549192870d61

    • SSDEEP

      96:zia1MauDzdaDjdZCo2WoEi4iaOJv/KmteL3a2PeyBe66qutKCIwRrCxJSAx2/Fdg:+qUzdmZC1fEmnlYraPIr

    Score
    4/10
    behavioral13behavioral14

    • Target

      QQ邮箱群发王1.0/破障QQ邮箱营销王免费版.exe

    • Size

      1.9MB

    • MD5

      d4a4b9cc8ff6fc75744696deea858ed4

    • SHA1

      0b9e8388791ca64ab6be18a97d7d3dabc3c585e6

    • SHA256

      8f1fd41629e91f1d00404165b6773a152c60cca2f7122f71ed7fab3c400bdca5

    • SHA512

      ab0446866805b3295dca7398216a78b78f5ed9df0ad4097732963a9f2e50f7c9c1c8daf5da4aa568e81d7cf58172985a713f8d15ebf2ad05a64c74fb940df591

    • SSDEEP

      49152:EYmKX4skTCsN+UnJc4ZGJEYxyle+reTPBPAwKKQAZ+:EqkT24ZGJEyyleTTNA2QAZ

    Score
    8/10
    vmprotect

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

      vmprotect
    behavioral15behavioral16

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

2
T1112

Credential Access

Discovery

Query Registry

4
T1012

System Information Discovery

4
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks