Overview

overview

9

Static

static

8

YYsydgnfzq...�].exe

windows7-x64

9

YYsydgnfzq...�].exe

windows10-2004-x64

9

YYsydgnfzq...cn.url

windows7-x64

1

YYsydgnfzq...cn.url

windows10-2004-x64

1

YYsydgnfzq...��.url

windows7-x64

1

YYsydgnfzq...��.url

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    3535bd6637b428d1b0c83929c62afcdaa506549a50d730eb12009f5dd20e561e

  • Size

    1.2MB

  • Sample

    221125-19el6abb26

  • MD5

    3fc413a0fb49ab294b1a796ed213c4ef

  • SHA1

    5ad708da65eca7329843445a36e719ddd8f563e8

  • SHA256

    3535bd6637b428d1b0c83929c62afcdaa506549a50d730eb12009f5dd20e561e

  • SHA512

    c852a764646e87c60a7893af66b4f7c87555f5d1703131d45af0dce96946a95de91fb47afebc159afd6fd047e2d69cd362ed1b3faa0e2208c048a1ad4ec2bc3d

  • SSDEEP

    24576:ThQHuZNmcDXIPFw6rSCMzMM+gONSv3ackYJVO+Q5/3kOTAIbNXObz6eAJu:dQObBD4PFTvM5+ZQvKck6w+k/UOTlNE7

Score
9/10
persistenceupx

Malware Config

Targets

    • Target

      YYsydgnfzq/yy随缘多功能辅助器[独家原创].exe

    • Size

      1.3MB

    • MD5

      43bfa86cad337e7395246282b9efb999

    • SHA1

      8d0c4c5bd952ad1454c849cd8cb474ef1ab98304

    • SHA256

      86518bc888b624e3f00198ce3acbb0e7cda8b60f5fb8e85a5200489b4a535553

    • SHA512

      a9a60639a9090853e09b8a695e4201db4bd635a3df348e6533c94d0957fa7fde7c07a5acc0b3641ae00ab4c8ee30c45daf893c743b247a9c4282454f3abbb8fb

    • SSDEEP

      24576:S+HygdP0DbDfEHLpIWyJrca2igv01tc4osxj5g/nRFzJ7ZHoEI:SeyxfSLE6aDgqt5xj5SRFzv

    Score
    9/10
    upxpersistence

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

    • Target

      YYsydgnfzq/河源下载站-cngr.cn.url

    • Size

      110B

    • MD5

      87d5540eb47b60f225cc6d5e9ec5d3b5

    • SHA1

      bb87c8cd2721eed95ed96cfed3c23a71dd636743

    • SHA256

      7503e8e9530726e8934149fb2afc1a9638d8a4727cc05c6bed1c1b1539dc43fa

    • SHA512

      ed81acc65c042f99ed20b511a755606e13619ddbd7e05125ecbcf5342ac9239329184d8b1b45d47ee4fc0ef4c62e06b2bd806b73f0f5c852173798e76d23a951

    Score
    1/10
    behavioral3behavioral4

    • Target

      YYsydgnfzq/淘宝热卖.url

    • Size

      384B

    • MD5

      959444600790e569e917523917654610

    • SHA1

      bf62acd4e2059dcdf7dbe9b1c343a436212ff784

    • SHA256

      3f5d98f266fa246282bbda9fbe2872e1a6c28452a14bb3b2fa80b8498ceb9f93

    • SHA512

      982c307aaa05bac10e079e4bc59aec4adc64f5c48a70dd67d57379e7e4e36af63e77450d55a1c895dc9dc26601cc1e9f11353378d2151f6486f480cdf6f0a9b7

    Score
    1/10
    behavioral5behavioral6

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

2
T1112

Credential Access

Discovery

System Information Discovery

3
T1082

Query Registry

2
T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks