Extracted

• • Target
    AvastProxy.exe
  • Size 56KB
  • SHA256 560055994a2290b3eb3f354afbf5ebcf4b8d78820f238eae70d76ece81b97c23
  • MD5 feac3e6946ab9b39c66a8756a4a7468f
  • SHA1 b490fbb91ebf327173940f3ed93f518191abb5e8
  • SHA512 55c3089d2744412e14032e66390d0ccb25fb995994baf77aee0bd315057543c39d13ee9344dab839ab041e4ca950e09c30a320f95cc8b0f1c69174d2e6562f3b
  • SSDEEP 768:alArI/PzmESYUawSgUhuGasKgFADGVih3:alccPz+cwSgUERsI
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  plugxpersistencetrojan

  • PlugX

    PlugX is a RAT (Remote Access Trojan) that has been around since 2008.

    trojanplugx

  • Executes dropped EXE

  • Loads dropped DLL

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Adds Run key to start application

    persistence
  behavioral1behavioral2
• • Target
    wsc.dll
  • Size 76KB
  • SHA256 a1640a83373a8ce9e80734418ee0b10d48d3d0d823883a519849b50710c9f46a
  • MD5 dc52696888f68d5b0e3d5e810c0d2a3c
  • SHA1 f72a97bf9ab09b3639c3c58c9c34d3675a507b87
  • SHA512 22cbe643038002e2d9dec7ffed7ba445ee1288571b445a8156c8bc533815bd330098893792b43c5592a881675a089f0b0229a230672569c62fa1032bec5ffcb2
  • SSDEEP 768:QVoWTrjr3eBjVgiHYSNjhCgk5NwF6fA6QzJhmlx3eBtBAmtXEty:QXTaySjCJm3mHuNtXEt
  • MD5 SHA1 SHA512 SSDEEP

  Score

  1^/10
  behavioral3behavioral4