af26bff5368152b30f035ee3b33d528f481c42b50958a20b08f137789c21eaf0

Sharing

Copy URL

Twitter E-mail

General

Target

af26bff5368152b30f035ee3b33d528f481c42b50958a20b08f137789c21eaf0
Size

27.8MB
Sample

221124-rc5yeahd44
MD5

9b88dd6b4c4e00c59e734e1b41cdde24
SHA1

57a841807c153f5fdcb9e047abcdf31a01ee14d3
SHA256

af26bff5368152b30f035ee3b33d528f481c42b50958a20b08f137789c21eaf0
SHA512

85fb5705b2dcbb670b5fc0ee5752628385e0aeff45db452b67633f5e2cdb2386e007906779defb108a2edc7123d567af75f65b091d20ea0228d89c14a9435246
SSDEEP

786432:ThZnqM0lo0bFV+S15kIX3slpT/16E/Ivr:FQZo0yq55Hsl7D/Ivr

Score

8^/10

macro macro_on_action

Malware Config

Targets

- Target
  
  邱山、渠道、三株设计图纸（修编版）/三珠中桥/桥梁/三珠中桥修订稿（存档）/P1~7桥梁说明.doc
- Size
  
  2.7MB
- MD5
  
  8f5e7163c74e4a758743757f9ef13993
- SHA1
  
  218170d76017ce23dd349350e43d41540464dc7c
- SHA256
  
  4406ae4c8f2b03c774bd1df962dcdc2d6e478b4bf263beb1d00cdb993c8107bb
- SHA512
  
  cb9a906c3874791ce6ae84df1ee6e3bb41534e26b18ccf21bd8fa0bd78cc78a5d29a7535543b0622ed5d2b478025ad5fc092abb5c84a03723f85df0619e77a5d
- SSDEEP
  
  49152:P9/Temow3X/UVzAlEZhUoNnfS8YnD9lERWOKIV5jy9:U7EqMgGo9aplTO7NA
Score

1^/10
behavioral1 behavioral2
- Target
  
  邱山、渠道、三株设计图纸（修编版）/三珠中桥/桥梁/三珠中桥修订稿（存档）/P35 工程数量表.xls
- Size
  
  936KB
- MD5
  
  8e5215539023de164f1948bbe8e7e96c
- SHA1
  
  4ca19fb35f7ae2026facef495923d7d83ec24ece
- SHA256
  
  4e26593e2895fec503bf615d8c2dae09b3c0d3819644712d40905af5399357ea
- SHA512
  
  9d2a42c28c401e77802244602686228cc3ffe4c53ae31b5f9aec5dce23f41f449620dab6c4926866fd610bd6a959a5b20d16ef494437bf6c2d72e2ea1554705f
- SSDEEP
  
  6144:lsB1Z4QxV3FsB1Z4QxV3XFsB1Z4QxV3o+C7sB1Z4QxV3VbCsB1Z4QxV3msB1Z4QJ:OB1+B1uB1JCAB1lhB1ZB1dzzz
Score

1^/10
behavioral3 behavioral4
- Target
  
  邱山、渠道、三株设计图纸（修编版）/三珠中桥/桥梁/三珠中桥修订稿（存档）/P39 三珠中桥桩基总体设计表.xls
- Size
  
  683KB
- MD5
  
  0bd226d533e88715c970ac50f110e5eb
- SHA1
  
  38bb9992c6e876700226144e1904b8ae34faa1e4
- SHA256
  
  ee9edbcddb1952720aae20b904966ba1140d703c255238183ca3b85158541fc2
- SHA512
  
  844e6f950fb8d72f4c8fbb54e1b6f6a0c3d5c9f40222b10debebaab9e55f7d2efec59010346f5e50a14196ed8455512f62093b06c94aae996c2168bb2b071f05
- SSDEEP
  
  1536:JrrrJrHHNHPyNrYqGu/fgPrMsl/HORZPRFP7Z95m7rREr5tYzh96/iRbsfBKATVq:aA7H90WeBfOV7oVNzzzw
Score

1^/10
behavioral5 behavioral6
- Target
  
  邱山、渠道、三株设计图纸（修编版）/三珠中桥/桥梁/三珠中桥修订稿（存档）/P55 三珠中桥桥墩、桩基钢筋布置图（二）.xls
- Size
  
  703KB
- MD5
  
  cd2e2a38454fa02b49da38e412ebece6
- SHA1
  
  24c9cd7150a0f396ce5d8ad613d813d4f0a91018
- SHA256
  
  17c12ba3de0f2355e1f6c54dfe6484848cea4b1d219644573a668f913fd9a204
- SHA512
  
  07a68fb4d491d09e3fe0afbd053bced8123ecdfba62118b37c26694fc53e7c0d7475965135bdd494214f19b3617cbe5f1b4b511da686d72b7b6d50fc72e03f1f
- SSDEEP
  
  3072:QOhd2wTatKoKLwOo59br27hPJ0L1RIXma6c0J2+O6EzzzM:PwQMPnPl27hKHI2ae4hzzz
Score

1^/10
behavioral7 behavioral8
- Target
  
  邱山、渠道、三株设计图纸（修编版）/三珠中桥/桥梁/三珠中桥修订稿（存档）/P80 安全设施工程量汇总表.xls
- Size
  
  398KB
- MD5
  
  88872cfb888c7b705e4544dccd2c6f27
- SHA1
  
  b5bab486be1aebb09dbd8cccf0909eac8313705d
- SHA256
  
  278de953d18d422f5b584da254e7a147e04dd348c5ff9f102363285d99976535
- SHA512
  
  46bc59942115484aa7a99b23964cd4d49cbb1fffc3b64ed34a7a921f3b34e56c01fd96dc7c95d6e51ef396682757497d418bf4b42f172307c1bf4c261563a903
- SSDEEP
  
  1536:xyyylua3fKbKWe8yX5h4HYg+BU4DyjofhuMZ95S9BfRxEb:cu3jC
Score

1^/10
behavioral10 behavioral9
- Target
  
  邱山、渠道、三株设计图纸（修编版）/三珠中桥/桥梁/三珠中桥修订稿（存档）/p0 第三册本册目录.doc
- Size
  
  407KB
- MD5
  
  9f373ff7da131074299d9e8b9340041a
- SHA1
  
  58869132f7697e5c77ae244970fc690a5f15d2e2
- SHA256
  
  3d56739501228708e26562b7ce2b9858758a4d24f2b4313973606009084c35eb
- SHA512
  
  0573bd4737a2fb0b3733521729ea93921ae4550f4eed55c8f5b40d619b2abb6382fdd299962e3d71e6fa4e16ef8f0719d82bfe7baf2b889fce4693a9b134a852
- SSDEEP
  
  384:q1A+83CorjAdnX62H001E8H0HvHvHgEe9GdO5Ox8Btosl8T2RGOh:R+ICI0pREeckThbRGO
Score

4^/10
behavioral11 behavioral12
- Target
  
  邱山、渠道、三株设计图纸（修编版）/三珠中桥/桥梁/三珠中桥修订稿（存档）/封面及扉页.doc
- Size
  
  400KB
- MD5
  
  53268b401f53416a6bce58a336cab0a6
- SHA1
  
  e524d8faea9440cd780dbbd9f7323d5183e973f2
- SHA256
  
  d696f118054c6cea9df14398eabaf6875b181f42eca8f19e0366e3805cac4e95
- SHA512
  
  99654d23781f4f23f532472395542b51c1c615b68f0d66af888bb08c6668505bcd2c13e02853cd65abab08300331ad6244bb538bbba1b5f222502ab979ff3bdc
- SSDEEP
  
  384:enaSqA8/UVJeE7OjaJ7Bs62tPoooMe0ZkzcmG1tAJkP8tayl8T2RGOO:XAFdioooMLkutA0sbRGO
Score

4^/10
behavioral13 behavioral14
- Target
  
  邱山、渠道、三株设计图纸（修编版）/三珠中桥/桥梁/三珠中桥修订稿（存档）/本册目录图号打印EXCEl..xls
- Size
  
  546KB
- MD5
  
  e9dea5f8774e3b3447a5aab99ef4ad5f
- SHA1
  
  2b2ba3af85205c4322fbf86115dc93ef5c03b8d9
- SHA256
  
  b6a0fe8b19ecc7fbd87990ed8879a85b187b4dc7b919eb71a795a2330af84158
- SHA512
  
  8150bafaa9c7cf53622456ca3719bea6f1fef8ae821a1ea869c2a5993a0e948296bdd88d14689038c9e7486a04d19d1095f1dce25464f770bf25e0be99d08111
- SSDEEP
  
  1536:+yyyy23f4Uf95h4YHoUDjy4gB+BtZ95UG5ugyIPHnDCURw87zzzhNsW:NR5ufIPHnDCjEzzzL
Score

1^/10
behavioral15 behavioral16
- Target
  
  邱山、渠道、三株设计图纸（修编版）/三珠中桥/桥梁/三珠中桥修订稿（存档）/目录.xls
- Size
  
  470KB
- MD5
  
  e561611b24b3ca12ed4e6727a89f78c5
- SHA1
  
  0c2bdfa32ddca06597a89912c491c19a44bde510
- SHA256
  
  e247818dd9716028fe51cc1eba5e74906153c78e9a9d0ccef7ce187931a6a7de
- SHA512
  
  88cf95d5e3429b6e76fcabbc43dfeb21800d7c2d6e0895fdef97d327fbb4bd42cc310fd3697b308e21d8013f46b415d3d39732fd71916c8533e2bd692a5714fc
- SSDEEP
  
  1536:7jjjjnZu+bER+njnNuEwYBhWxNSyjBp4apLZ95e4g3gYgz09IARH4K7L8H:ip+c68
Score

1^/10
behavioral17 behavioral18
- Target
  
  邱山、渠道、三株设计图纸（修编版）/三珠中桥/用地拆迁图表/13公路用地表.xls
- Size
  
  32KB
- MD5
  
  9a5f7ad9221012fd113e2d4ecc81fcc4
- SHA1
  
  d9dffef6f417e27787f737ca0793e2e3dd6ab8e7
- SHA256
  
  a78125340fab0c81685b15aac5af9c81078fc8e218f55b1e1a87f8a894330b98
- SHA512
  
  75b17c6dc30b433c2aa11489ee06b500e614c6b80b8de4b515c1696a9119b315b6cca61388d74bd50fb3200fe2ca3420a1cf1066b6e009a05ea8b20f98c0f3d8
- SSDEEP
  
  768:3eeeq+CtWF9pRsSNiWhB4yajNR2drhQn6c78Rmv1Jx57aZM9yJGwQZUKNbTBtn5I:3eeeq+CtWF9pRsSNiWhB4yajwrhQn6cu
Score

1^/10
behavioral19 behavioral20
- Target
  
  邱山、渠道、三株设计图纸（修编版）/三珠中桥/用地拆迁图表/13拆迁电讯管线设施表.xls
- Size
  
  28KB
- MD5
  
  e912d8d82da8fd7d7de95fa3bf6750a9
- SHA1
  
  3069c207fc0d8a296170545eb039bc265983d94e
- SHA256
  
  fd6f21bc84406e6a6b4072b3a3bc68b4b06d8c7bfbc9d703668d73e3342bb0ea
- SHA512
  
  d2e2afe7ac253103819cf665747b5383eff28f02a184f86ad91bd73579cbfad93bbe21d67082799ad1648549309e32472796c2a69ce9367c11ca947773e314bf
- SSDEEP
  
  768:veeeqCeX/Hm37DyNSacjWyh4BiFjR29kl6Nc7yRzs1H75wkZUiEfClsPI4ukoRWt:veeeqCeX/Hm37DyNSacjWyh4BiFgkl6F
Score

1^/10
behavioral21 behavioral22
- Target
  
  邱山、渠道、三株设计图纸（修编版）/三珠中桥/用地拆迁图表/BRT013--用地坐标表.xls
- Size
  
  34KB
- MD5
  
  23534a61f085894d8068a0531542e716
- SHA1
  
  0f3cf0bf5b68ce6cc2983eaaa30ee43cd6ea4f21
- SHA256
  
  e4ff7ccbfb5de47460b387019bd12bc22b5c1f8287e32c740e4f45d990dc7351
- SHA512
  
  c7d82ce305c32838a6800d330db392c9a8734a1dd0c7f5d165ef58f8ed0f054afba2bb4bcee3bc5ad8d7e0aaa367aca126938f5da618f4b81f31cf25a1f87316
- SSDEEP
  
  768:XNeeeeqemxF37DySNiWhB4yajNR2kOEl6Nc7yRzs1H75wkZUiEfClsQ6NqTBun52:9eeeeqemxF37DySNiWhB4yajbOEl6Ncr
Score

1^/10
behavioral23 behavioral24
- Target
  
  邱山、渠道、三株设计图纸（修编版）/三珠中桥/用地拆迁图表/三珠中桥13--06表03-3.18.xls
- Size
  
  61KB
- MD5
  
  1f1a0032ad29270b17c3b27493638eb2
- SHA1
  
  61231ca43aac765c207cebf614e9070e5f4dfd8b
- SHA256
  
  4b340e2aa8300feaf84eef669e9c2249c787e1ccba368458357c33c249e134d6
- SHA512
  
  947692eb7601998e56579fca7809a11ed056419df2608194ae472f3f10579ae75928bd130bf6c9b12c1d6abfad0a769ae728f0da91634462dce233620dfefc30
- SSDEEP
  
  1536:jeeeqLmCKj737DyNSacjWyh4BiFP3Ygl6Nc7yRzs1H75wkZUiEfClsQ6NqTBun5R:QFl6Nc7yRzs1H75wkZUgsQ6NqTBun5oM
Score

1^/10
behavioral25 behavioral26
- Target
  
  邱山、渠道、三株设计图纸（修编版）/三珠中桥/用地拆迁图表/公路临时用地表.xls
- Size
  
  28KB
- MD5
  
  6557789e8f74fd3a7065f20e6cdd5125
- SHA1
  
  f5e2653f639fbab6c5369f087d73483724fc59ad
- SHA256
  
  b99d7c3f6cd91d74e12c79a09a9c1cb7b83e223326775d196746876fb6ad90ac
- SHA512
  
  00e3dfa867ee834e41c918e03cc4bc0774dc5499e8e05c61bbedd00f2b9d04a268e21632f0586c10a694feb5f3cbb71fb51c416bbdd14fb45972749e36b49fad
- SSDEEP
  
  768:AeeeqCLzfi37DyNSacjWyh44BiFjR2qLbl6Nc7yRzs1H75wkZUiEfClsPI4ukoRV:AeeeqCLzfi37DyNSacjWyh44BiFRLbl7
Score

1^/10
behavioral27 behavioral28
- Target
  
  邱山、渠道、三株设计图纸（修编版）/三珠中桥/路线路基路面/2 安全设施主要工程数量表.xls
- Size
  
  30KB
- MD5
  
  082f3574c2ba90de0fed8cd4df60abf4
- SHA1
  
  0d883bcfd592830371db87d796128283386b86ea
- SHA256
  
  f6c173805053206bc693872e8644e55755bf6ae3561a23803db4fabdc9493390
- SHA512
  
  4fce36400489805d65b9c99dcdccc08e9d5806cd78c6c3fe41a9234759244d189af43bc92a396eb3308a090dcf45e1cf41e0c7643a4416605d005f173c5eb083
- SSDEEP
  
  768:EFFFSB4Q9Ekg9VLprFL4KmOf/AvLsMFfnuKR2l/Z95dlgF3Y:EFFFSB4Q9Ekg9VLprFL4KmOf/AvLsMFM
Score

1^/10
behavioral29 behavioral30
- Target
  
  邱山、渠道、三株设计图纸（修编版）/三珠中桥/路线路基路面/5 路侧护栏设置表.xls
- Size
  
  50KB
- MD5
  
  60324636888b8347403ee7cab2522ebf
- SHA1
  
  eea5a5a8c269b3dafe79f84d7b98865bbb58bd69
- SHA256
  
  f47c8d58227e2b4a1e4f70a70132a000e6842a3ea8f47a469e30540f6dbc59a3
- SHA512
  
  7ab24e89b704fe0cf503482d70619fe70466b3c271f45b861f64527d2244e39274f5ddb0e68f4fb7f9cedc74a616f22486c0b920e0e28e96c3b8acbc34df94da
- SSDEEP
  
  1536:aHHHHDC6LHyHbHPrB6Ic0NtydB2WHNlU7Hoqs1Z95Zioz:acoz
Score

7^/10
- Unexpected DNS network traffic destination
  Network traffic to other servers than the configured DNS servers was detected on the DNS port.
behavioral31 behavioral32

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

Sharing

General

Malware Config

Targets

Unexpected DNS network traffic destination

MITRE ATT&CK Matrix ATT&CK v6

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32