Overview

overview

10

Static

static

8

lianxuextb...��.url

windows7-x64

1

lianxuextb...��.url

windows10-2004-x64

1

lianxuextb...a1.exe

windows7-x64

10

lianxuextb...a1.exe

windows10-2004-x64

10

lianxuextb...��.exe

windows7-x64

8

lianxuextb...��.exe

windows10-2004-x64

8

lianxuextb...��.url

windows7-x64

1

lianxuextb...��.url

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    69babee20fca03eccf70e8344ff9480d7b1924dd9af275cbb259bcd77646cc09

  • Size

    3.7MB

  • Sample

    221125-3zkrjagb64

  • MD5

    fe4677fde367205f2a0aa0fe0bbf2e47

  • SHA1

    a4b1f6d5ecbf72d24170dfbf79cad9c891d72e96

  • SHA256

    69babee20fca03eccf70e8344ff9480d7b1924dd9af275cbb259bcd77646cc09

  • SHA512

    9824b182f154a599eae3740a9e038f63eea92f6830cad0111629d29c27c3d6cc219e18f5cce62604d76d2ebd67a71c2ceee75f0f2cd2ee9ea517286ddc24ef0f

  • SSDEEP

    98304:hGzb2fmuDP3ncy3cYHFVoouevuNA8T6xozVant5:hGzbPurcCEA82p

Score
10/10
modiloadertrojanupxvmprotect

Malware Config

Targets

    • Target

      lianxuextbsq_33lc.com/3837网址导航.url

    • Size

      321B

    • MD5

      d8ab0069918a1c63f650fa60bf3c0b76

    • SHA1

      e9b5eac5f170c1e48444644fefa3244053ccba94

    • SHA256

      fbe65a28f5f1b8f11dd2c77d1816da0f0e6763a506c7c08a8ef6ea5e518250b2

    • SHA512

      f92a675a798b998cb5be693061d8eea62d6521d89b390edae47e4de53e05e50694a89e905426928542a44b091d94295e689873cb2bfc0f93c21309cc54a2c8e8

    Score
    1/10
    behavioral1behavioral2

    • Target

      lianxuextbsq_33lc.com/lx_speed 1.5 beta1.exe

    • Size

      2.2MB

    • MD5

      d5fdd0a32bc734cc4abb7c39921c0051

    • SHA1

      cca76e39f9c9e7a9dbb4544b275669e297edc522

    • SHA256

      b3e4ec4f0233a46af22a024643deae26f6b1455b45dba5f5a3d6d59019a4b172

    • SHA512

      e354883e69d7d538a7c37042d1b1ebf7499b987dba4d0464da492f9f9963c646689b394c069abfeaabc2ced9818511dd51e5685e29adace962c969b43f03a7cf

    • SSDEEP

      49152:HeZ6epYyulT8r+d/PJOwKkfbPqm9QpDHfjuWULBtmQqvzUHe:HeseyvPJh9f2m9Q9HftULTmvvzUHe

    Score
    10/10
    modiloadertrojanupxvmprotect

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • ModiLoader Second Stage

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

      vmprotect

    • Loads dropped DLL

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral3behavioral4

    • Target

      lianxuextbsq_33lc.com/破解补丁.exe

    • Size

      1.6MB

    • MD5

      e5c0784a64ca52c3e2c932b932d439e0

    • SHA1

      388ec842a606750f44def7b259d5bde604b34bfd

    • SHA256

      adcade3ecfd221bfbb5cb440a4bdaa58a9b00882c63bbe37192c37143bb69094

    • SHA512

      6f4f31669ef36aec896d62bcda06ad2a10b57593cd0c4dbfd62fc959df71e425c5354e6f43058b94a445c2e39f5d621a6528a42eefc5f4a8cced3e0802e5e93a

    • SSDEEP

      49152:kdr+P+HQihOWHXEN5sFHeJzHgvL86rdHRz:EwihfHUw1eJrgT8Y

    Score
    8/10
    upxvmprotect

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

      vmprotect
    behavioral5behavioral6

    • Target

      lianxuextbsq_33lc.com/绿茶软件园.url

    • Size

      316B

    • MD5

      f8204334d8834e2b93660a909245ade5

    • SHA1

      6162163d5458ef88c4e39bcb4136af4c3ae0e6f1

    • SHA256

      0fc1c2110d4f4cc2c05fc7053c48eff3f49ac395723e67f13fca0f7b15851d13

    • SHA512

      d400dd04ea4294514e6269bed656ca751b4807f38502ff3204be287abd1a4799ca23ecc6cb0940b3fb6c49f001e7f1f9278be50c1faa41049e4250b248147f5a

    Score
    1/10
    behavioral7behavioral8

MITRE ATT&CK Enterprise v6

Tasks