Extracted

• • Target

    AvastProxy.exe

  • Size

    56KB

  • MD5

    feac3e6946ab9b39c66a8756a4a7468f

  • SHA1

    b490fbb91ebf327173940f3ed93f518191abb5e8

  • SHA256

    560055994a2290b3eb3f354afbf5ebcf4b8d78820f238eae70d76ece81b97c23

  • SHA512

    55c3089d2744412e14032e66390d0ccb25fb995994baf77aee0bd315057543c39d13ee9344dab839ab041e4ca950e09c30a320f95cc8b0f1c69174d2e6562f3b

  • SSDEEP

    768:alArI/PzmESYUawSgUhuGasKgFADGVih3:alccPz+cwSgUERsI

  Score

  10^/10

  plugxpersistencetrojan

  • PlugX

    PlugX is a RAT (Remote Access Trojan) that has been around since 2008.

    trojanplugx

  • Executes dropped EXE

  • Loads dropped DLL

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Adds Run key to start application

    persistence
  behavioral1behavioral2

• • Target

    wsc.dll

  • Size

    76KB

  • MD5

    dc52696888f68d5b0e3d5e810c0d2a3c

  • SHA1

    f72a97bf9ab09b3639c3c58c9c34d3675a507b87

  • SHA256

    a1640a83373a8ce9e80734418ee0b10d48d3d0d823883a519849b50710c9f46a

  • SHA512

    22cbe643038002e2d9dec7ffed7ba445ee1288571b445a8156c8bc533815bd330098893792b43c5592a881675a089f0b0229a230672569c62fa1032bec5ffcb2

  • SSDEEP

    768:QVoWTrjr3eBjVgiHYSNjhCgk5NwF6fA6QzJhmlx3eBtBAmtXEty:QXTaySjCJm3mHuNtXEt

  Score

  1^/10
  behavioral3behavioral4