1a267e33397c68390154cd33e9e2b43d72664ac5a17f726cdaa1104d07e0872f

Sharing

Copy URL

Twitter E-mail

General

Target

1a267e33397c68390154cd33e9e2b43d72664ac5a17f726cdaa1104d07e0872f
Size

3.5MB
Sample

221125-31bj9agb88
MD5

58ff414c8bfb2295031a3939285909a9
SHA1

d2c97b27eba31b308ad72abdd36c59619d618d33
SHA256

1a267e33397c68390154cd33e9e2b43d72664ac5a17f726cdaa1104d07e0872f
SHA512

80c939f54af1ea24a6c8fbb7bbf24705819b6539de1f5e19df1213533594b7063139104b164a2eea193fd10c78d0d02cff77231a97876ad7b0c8dd7541f2f909
SSDEEP

98304:rSRqyS8EgFgAJi+JI/gio4PvlKNAYvPDU8FPDU8RPDU8p:1y1lDMJfINrUKrUOrU6

Score

9^/10

Malware Config

Targets

- Target
  
  jycms/捷扬文章系统0.4.1/程序文件/lpk.dll
- Size
  
  217KB
- MD5
  
  aa28054265b1c2fb7748fb21ab5984a7
- SHA1
  
  2fd0396a49a7024ce53783995c4b288e7c596342
- SHA256
  
  004785903afd37cace27aae4ed28b2130c2691798b82132debb42659d223b615
- SHA512
  
  aaa000f7947a92e834b3175facfcefd1d9f53e3204f1b26f10c19c4c1b5ea720b6d6fc45d88a909ca0dbe425c39a6885496f8673e4ff1ebff6a709a351322e28
- SSDEEP
  
  6144:u24mCyHAWyPgWITYJ0Ax9N17xM2lxq27Wo/GEvdt:u24xvPgWGYj9X7xM2Lq27D/GEvdt
Score

9^/10
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1 behavioral2
- Target
  
  lpk.dll
- Size
  
  217KB
- MD5
  
  aa28054265b1c2fb7748fb21ab5984a7
- SHA1
  
  2fd0396a49a7024ce53783995c4b288e7c596342
- SHA256
  
  004785903afd37cace27aae4ed28b2130c2691798b82132debb42659d223b615
- SHA512
  
  aaa000f7947a92e834b3175facfcefd1d9f53e3204f1b26f10c19c4c1b5ea720b6d6fc45d88a909ca0dbe425c39a6885496f8673e4ff1ebff6a709a351322e28
- SSDEEP
  
  6144:u24mCyHAWyPgWITYJ0Ax9N17xM2lxq27Wo/GEvdt:u24xvPgWGYj9X7xM2Lq27D/GEvdt
Score

9^/10
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral3 behavioral4
- Target
  
  sxw/admin/Editor/Editor.asp
- Size
  
  2KB
- MD5
  
  f6d158ef2ff891390c80bbeb52d03e9e
- SHA1
  
  ac08b43cbfdf0048ccc9883faf065aee0668db70
- SHA256
  
  8a0c99e440e86d68375e1e1ca1bc9bce27fa88e82bfb06ef1a74b53cf05b3a55
- SHA512
  
  ca7f39d5fbb1e41dc9bf22753df0a96406ed7e2654a9822bc74dc26b0b2023a8d36f2ecf7f771ac097ac6083b655031f7e572d0bc57fe75a8ca1f2740c66c8da
Score

3^/10
behavioral5 behavioral6
- Target
  
  sxw/admin/Editor/Editor.js
- Size
  
  2KB
- MD5
  
  7d7a7a15e5059da83824fdd29e12047e
- SHA1
  
  58cd12eb7f289be83aa40ca9ddb7b8a9f762d2ee
- SHA256
  
  0bf5cd89f08974efaed28e0b30517cc37e16390d8cc5bd80753588f90e0bcfcc
- SHA512
  
  d521422dc0791b7da241dbc0345ef7c0d5a1590b7f841b0293d1888dede0989d661e883c9af575b7da1c62e5213638df3457b7eac170fa266c8b637d2e937157
Score

1^/10
behavioral7 behavioral8
- Target
  
  sxw/admin/Editor/Format_Editor.asp
- Size
  
  3KB
- MD5
  
  f7ecd4b9d73b27cbec3d6cb29f011f92
- SHA1
  
  fbafe18a81732350a5582ae66d42acc467a4da08
- SHA256
  
  880ddb136b78663965523e937cc7559b5d39f3cf208db23712d8e53def3f7d88
- SHA512
  
  455880bb85af7d1b87da335cd9ef7a7cd835f9b6f32a6409e01643f2b26056031754dbee6b62a5d818051cc20ad2392e11bfa0463f9c55cb89d87ad2531a112c
Score

3^/10
behavioral10 behavioral9
- Target
  
  sxw/admin/Editor/include/about.htm
- Size
  
  1KB
- MD5
  
  1df3741f7e8f2f27cfb86fd10bd48cb7
- SHA1
  
  b07c4feb18b0d315a11ac2778e2e6ee7e0829ac2
- SHA256
  
  a4350f07dd66503f0e8b8fab36cacf69b42e77cd70ee3c454012bd9c0eedf9dd
- SHA512
  
  c94e695b8eee888337106d53d251988ebe536392e06c94c624310d20edd1c642f58d4246f1b2dc2dd9bcdf26d1546bc545883efcb129709befb4d593ef485d53
Score

1^/10
behavioral11 behavioral12
- Target
  
  sxw/admin/Editor/include/~$lcolor.htm
- Size
  
  162B
- MD5
  
  4dd5ace35b656c62711e850638906ea5
- SHA1
  
  e42ff6ac975eccd184322b222a5d43fe0e38dd4d
- SHA256
  
  1cc2f7add0cd6a5141c10219d1c2d20a9b28b62ca0ece7f88fb1516e7e473b70
- SHA512
  
  912eed3e600038321e5294f46f921ab2aaff2a3b8aefd46f3f38663330b096c213919c95b2221f0a0134a3296a411f14f656f57f5604ba73695423449f5a1662
Score

1^/10
behavioral13 behavioral14
- Target
  
  sxw/admin/admin_bg.asp
- Size
  
  9KB
- MD5
  
  cf525337b759958ad29729539678e8f6
- SHA1
  
  fb104c5375f6db02c9cbe79a203b33113a9ff3d0
- SHA256
  
  3c1242124e5a603d528b606cd3f1e84e0b4631629af3c2d236c2fa94caec32a2
- SHA512
  
  36beab921b861d6f6fadb0a63a2e6029c7d2acf3a1df82aa7b497856ffe1c567e4029bfb2b9fb499f73fa10e413a2c4d940bfce6ad1b7be963c3eb47b08dccd4
- SSDEEP
  
  192:zpJ6p6UTgfuU6Jx6J6zD5TufsJo22uMUgW6F5JSFSlSuSdTyjS/i6ThXn5JSFSls:zpJ6p6UTPU6L6J6zD8fsH2f9QfTh3e
Score

1^/10
behavioral15 behavioral16
- Target
  
  sxw/admin/admin_config.asp
- Size
  
  18KB
- MD5
  
  ae61e473eb21bdb26dc9adeb30be7d52
- SHA1
  
  bb55aab207c2b01a5875bc5a97d16f41fa2cf42c
- SHA256
  
  480fd78e90b91b9156f7a68ffd89482aab9a811daa843845743bde8f97957a46
- SHA512
  
  402756c01a9af483840f2d9a594da9e0c9526e83c9e0e021d198981dab53b9e0c819a0d647064a22d83090f28b56a4a4bc4be843618b4b9482f96ef5feb138da
- SSDEEP
  
  192:z1foZT0aGOHEPlytWp4CZ8sQ+Nac02QTOolgxHE6bcvvG7lou5a6XTG8PRHrcZtr:z1EbHEPl75Z8hc02QTOolgxk6uqR5xZG
Score

1^/10
behavioral17 behavioral18
- Target
  
  sxw/admin/admin_config.xml.asp
- Size
  
  12KB
- MD5
  
  7cbab70ff18c3de06e6527114379c110
- SHA1
  
  3a0df3b672548e609b3181f925140f9851e60dab
- SHA256
  
  a0f13c2b81ea7cac58926b5d5bff83dbf2494b7fcc1bb234f286915592adcd19
- SHA512
  
  8647cce1950706da0923dc25fbb6f5d2f3f84984945699622cb8c9577ccf6361af593f2e3cbb159bbcbaae831266aaa8a81494c2d3d962d401e3bc21fae6eba6
- SSDEEP
  
  192:4q9Po90+w0BUIHbJbYOeokNqRkdtEtngD0wku8MrpZZAfNANFS:4q910HtbYx/NqRhlgD0wkuLrpZifSI
Score

1^/10
behavioral19 behavioral20
- Target
  
  sxw/admin/admin_data.asp
- Size
  
  7KB
- MD5
  
  11fcf67fe381dce5cb2cd49c1e5510c6
- SHA1
  
  04982e4b967a2812306265a4e9412151fa27a407
- SHA256
  
  2a1774a3e6b992874e4026eba5b99a9c409bdd330536f0e9d187f49f536dc08f
- SHA512
  
  6f92aaebbb74a3bb79e293eb104959d7d85c43831800f40709bf2c13636f9ae1f8267176c0a25bcb062ebf5cb849b9279706b8159e4bfb653060e6611205ccbf
- SSDEEP
  
  192:znXw7i0m0/0T0q7tsvFyRybRB0ir0dqcBCWxNQt0a0dI/k1OZ//0T:znXw7+tKPRBEFBCWxNRL
Score

1^/10
behavioral21 behavioral22
- Target
  
  sxw/admin/admin_dj.asp
- Size
  
  17KB
- MD5
  
  f62f1cae3305abbe9e5cdcc6440ff02f
- SHA1
  
  e636632ccd7a2d9aedcf31f799e3b19a685433e8
- SHA256
  
  cb351b5c2ac38830961b0e71ccc1c3e212718e328e921a30580042d981bdb170
- SHA512
  
  80cb024a84531d843089eccb6bb95aeff327479f45f6544a07b401db8a8ebdc17d078cbbd686b50986514e709c891a8b767aa86302e38f280ab4ba28d505c8f9
- SSDEEP
  
  384:zWQCzaTu6uiTGDXTS/T7dRrFRR8vlQmTE5j:SQCzai6uiTGDO///BR4Qmgd
Score

1^/10
behavioral23 behavioral24
- Target
  
  sxw/admin/admin_email.asp
- Size
  
  6KB
- MD5
  
  e94991da6a9fe621d83f0ce0dc07f7c1
- SHA1
  
  408f1eb1086a72e5afb351112283e072d823503a
- SHA256
  
  aa2ef599dade5a43c2799d51d293fbe00edf71c1f8619b2734beaf5bc703eb15
- SHA512
  
  a2ba87f43eb6cb1d31dc63b6bb0cf09a2ad0bf97c94036868f218b4d640467853f622e2221f683cc8e2dffa3f48ce8c64d7781f1aba7f863a9185a22258332a3
- SSDEEP
  
  96:zhmOn5OP2bNNR7CBAPr+lfOjBu12yCK6hKSQyRS3pH7NVhKJ2TH5RbIIYC:zkiZzP+RVLHBGJHDC
Score

1^/10
behavioral25 behavioral26
- Target
  
  sxw/admin/admin_form.asp
- Size
  
  3KB
- MD5
  
  37f71809d02c70a30f597b56f0877244
- SHA1
  
  70315d9ca3f8a3ad84dff8317c32dcb4a69bf1dd
- SHA256
  
  213e83465696a24c11650231b7cba78c2ec0c8ed9d1bb81ebe4e952a9cd894cc
- SHA512
  
  8f24336a07bbe3292c2083426b939e73a2cec311d128baa0c6e01d0f7bdae815525ed5b0f0457b3a18d8d7102f89b36424dd34f21efdb09cf0c86fcd40de41d4
Score

1^/10
behavioral27 behavioral28
- Target
  
  sxw/admin/admin_html.asp
- Size
  
  4KB
- MD5
  
  78f2ec78035a1394552eb499c0fe7e1b
- SHA1
  
  76c89b40c829880788b3897669b344868edf2cc7
- SHA256
  
  c8dd0885134ecc16a97e2d1e35beecf8c3df768b44dbb1b547db891d2f3e2cb7
- SHA512
  
  7a2b755ef688892764179688b5960740e2a38049a18fb9e1f4ef61e893af4ae56a724c9beaa5b325ac7474b5311f35ab1340568b71415232996b70cf6ba4eaa3
- SSDEEP
  
  96:zxvRe3DjPhaP23rfYDiMnVRarT/hKe3NweNfXOEYuEXgOPp:zaDMP23rfYDRnVWTAMIbp
Score

1^/10
behavioral29 behavioral30
- Target
  
  sxw/admin/admin_ly.asp
- Size
  
  9KB
- MD5
  
  35080bb3711d3786ae0bdb51c69ff06b
- SHA1
  
  e69ad0f83024927ed1f6703907b8e6881a4c9336
- SHA256
  
  74bc242a759c9f7bb0135221f804446e047701024843f7ee4d77dfb8a9fd5579
- SHA512
  
  3a0efff018689ef8998d939a26fb4ee619d36c7d00b3407475658f12a41563c804f2644b825d623f0ab477357d92bffcdf69047da7cf087d08a3e874da50de86
- SSDEEP
  
  96:zyLV8jPWXPhK4whyhZ/EjTYaSJVrp0h5aLq+58y2+Vb/ApxHAgjMhcWPrDRgNDCM:zXqAFh5pugJ6kYvJtzwUawa8RmMNkmlo
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

ACProtect 1.3x - 1.4x DLL software

Executes dropped EXE

Loads dropped DLL

Drops file in System32 directory

Suspicious use of SetThreadContext

ACProtect 1.3x - 1.4x DLL software

Executes dropped EXE

Loads dropped DLL

Drops file in System32 directory

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32