Overview

overview

10

Static

static

8

MirServer/...er.exe

windows7-x64

1

MirServer/...er.exe

windows10-2004-x64

1

MirServer/...er.exe

windows7-x64

1

MirServer/...er.exe

windows10-2004-x64

1

MirServer/...er.exe

windows7-x64

7

MirServer/...er.exe

windows10-2004-x64

7

MirServer/...te.exe

windows7-x64

1

MirServer/...te.exe

windows10-2004-x64

1

MirServer/...rv.exe

windows7-x64

1

MirServer/...rv.exe

windows10-2004-x64

3

MirServer/...al.dll

windows7-x64

1

MirServer/...al.dll

windows10-2004-x64

1

MirServer/...er.exe

windows7-x64

MirServer/...er.exe

windows10-2004-x64

MirServer/...��.htm

windows7-x64

10

MirServer/...��.htm

windows10-2004-x64

10

MirServer/...te.exe

windows7-x64

1

MirServer/...te.exe

windows10-2004-x64

1

MirServer/...te.exe

windows7-x64

1

MirServer/...te.exe

windows10-2004-x64

1

MirServer/...��.url

windows7-x64

1

MirServer/...��.url

windows10-2004-x64

1

MirServer/...��.url

windows7-x64

1

MirServer/...��.url

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    bdfc91a4bd37d52d6c11bdfabf5cb8ef3ca113b246e8d0319d730e7822e8e237

  • Size

    25.2MB

  • Sample

    221125-ya74bade31

  • MD5

    1001740cc77cc2da78ff1a25a5cc3086

  • SHA1

    2957a22701a1db50fd2414dbae0737e437723634

  • SHA256

    bdfc91a4bd37d52d6c11bdfabf5cb8ef3ca113b246e8d0319d730e7822e8e237

  • SHA512

    413efafb1fa496e9c212f86cf7d6eaa72075a3f2014bd683256b79062455b499eb1b1616ecbc7b6a4c76af9df2b87194b5947388611a69e374a8114f6bda2cc0

  • SSDEEP

    786432:5AkIZakId/6Jc+0Xa/+n0rBV32a7QjDUNCBKluW6Uc7:G5J2+8a/GCH317NVluW/c7

Score
10/10
aspackv2phishing

Malware Config

Targets

    • Target

      MirServer/DBServer/DBServer.exe

    • Size

      372KB

    • MD5

      fcc308fed5295a02d017d13d063801f5

    • SHA1

      01f82b30ef0b64d1453cc11ef33bc0c154d499ca

    • SHA256

      38aef4afad39080ad177165faf7e50e841c353c95bbe3de8d85d53a825ac9520

    • SHA512

      71a448ffb800515361573a33c9e8cfd056d026fed48ad5d03d801adec78596d2dd35ed4978da288ad25968efbe0016daebe4581c9ad641bfbb173dcaacdb6b25

    • SSDEEP

      6144:9DRLy4mo9+Ozphe1L8HtwQ4RAQS/wz+gQ4di8kjonW6f5ZFXo8t4WGm+KEC:9DJy4rUcsL8HtwDiwoy1kgV5bXVNgM

    Score
    1/10
    behavioral1behavioral2

    • Target

      MirServer/GameCenter.exe

    • Size

      800KB

    • MD5

      4dad024babd2cabc68bf0eb99709c5a2

    • SHA1

      54a3a56486398dc2cab258dac66fe95ff6212274

    • SHA256

      fbcd0274006305012a888ddbda680bb25e04fd348497b7e5e7a3fd69db53df45

    • SHA512

      2c1c2558ffee960bf3859d67efb54e16804e7414dc49ead439d2f8cf4fd7fa6d057f60a43961cbaeeebe5829c6c67d0713fa1f6107fe1b012e9490b4ff16e7cf

    • SSDEEP

      12288:8ROc7qcvits8dACz7g2LtOm2WORNRGqJZg3M:8RTa1qi73gW1qJZ3

    Score
    1/10
    behavioral3behavioral4

    • Target

      MirServer/LogServer/LogDataServer.exe

    • Size

      986KB

    • MD5

      a9b98bb188a0f6ff38cb94d6657981fb

    • SHA1

      5609ee2bddbc219d0eddb5bd0d6eff395a204ec1

    • SHA256

      68a14f070c477b05e0804635c8db4904b217aa8842f171fbeb5151b1f76c08e7

    • SHA512

      3ed536d33e26ac62e74a066938fc8096882b8db8aff24f2519c54df7c61ccd33fbc1d92756d5562af01620d74cea7f9b148b99267c288e329c864e06dec7d70e

    • SSDEEP

      24576:/cc+DzVchKHemUmv3ZtAq7qEPnwX2nZAB1nStjvsfTTVYBjknmnVR3Tjy:/izPLNb7bESZAKjvYvSBrDTjy

    Score
    7/10

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    behavioral5behavioral6

    • Target

      MirServer/LoginGate/LoginGate.exe

    • Size

      221KB

    • MD5

      5f5284f3844770430c92718dab0a0b25

    • SHA1

      a6cead04edcbc399885ae3bd88d90a2bff515f63

    • SHA256

      9374cd488d82286c95278cc1189a94187fcc089082c182114910998180bb8eab

    • SHA512

      c52b7b59ca0d4f3a4d9037622fc93285612284f515b92024135909466a61297e35c54641fa716ab97cd5640464af8a617ef043bbb022883363e62e60391755c5

    • SSDEEP

      6144:P9g1WrkRES4Z3wJxDJqh0csc5Pt8LcNAJKE:PE5EnwzJqecrgcNK

    Score
    1/10
    behavioral7behavioral8

    • Target

      MirServer/LoginSrv/LoginSrv.exe

    • Size

      277KB

    • MD5

      06195fa5de6d51d39c40011c8ac981c6

    • SHA1

      236f3eaed9354cead365aae80aadb79ad8d8e8b7

    • SHA256

      5b5fddd1eef5b17b54a87ccb36f42bfa7ac0787711f34a116ab909dee45940a4

    • SHA512

      b215330cf8c83c6ce7040e4a5b45581562ef5d8570af1b91cfc77afeeb5e3918608c7d773186e057c0f4a9db61daeadfd04c4c06f70254550f1d7d80036b05b2

    • SSDEEP

      6144:3CnpCPZNM9ouEX6zWiUvt61g+C82SQoK8NKE:3CV9BEqzZUvtL+r2roK8N

    Score
    3/10
    behavioral10behavioral9

    • Target

      MirServer/Mir200/IPLocal.dll

    • Size

      167KB

    • MD5

      bbf62130e7a5966a2b7b89411ad335c8

    • SHA1

      9f6a0af9525cc6b6df479d3d511e06200571c1b5

    • SHA256

      da61a728a96293d8d99db31d3843a68c3788fca93f630219adfab0e0132dde44

    • SHA512

      52baf478f0dab1bb13e03b6ae47ea48b0cc329a35569cd78473e8c5eeefe0d6474b7ad720cbf90664fd140c9c76dcfdd92bcddee11c8b9c2488b5c114d7babf2

    • SSDEEP

      3072:vqu/oVRpW3b2OQLOhRy7kCmRHnhAQPukkGfeDN/z2HS79BKyJcC:v1o3Ab2VLOhAehhN9vexb2HS79gyK

    Score
    1/10
    behavioral11behavioral12

    • Target

      MirServer/Mir200/M2Server.exe

    • Size

      1.0MB

    • MD5

      ff85fcdaea09e3cb9be35023ad330c0a

    • SHA1

      cf791ad2f6bf1cb2daee6810b2f9663be7ced31b

    • SHA256

      c44e25d15fd0437d0442bfdcf5e6a74ce12561d77da1fc8a762584cd0f0c1677

    • SHA512

      986ab18ed1e48fadf94527b81a98514daaa6cbe63175c834888ce0c79802dc329d07fa379b492583d8b18f1e44515406ce672fddd3dfeea3d01153c090705da9

    • SSDEEP

      24576:uGK/8riFreNz++4qSlkfeOeOgev+Vb10UkIJw7uK:urGiFi4zlk2Ovyb10EJw7uK

    Score
    1/10
    behavioral13behavioral14

    • Target

      MirServer/Readme-说明.htm

    • Size

      2KB

    • MD5

      70f8e0a8f3cc2fb89704dc6ab1be4481

    • SHA1

      8e29ae18eb8876b6cdfcd43d90fb8b703bd44608

    • SHA256

      22f1a011a15cc161aa95e928b1821ff55de4a588b527c42e780a376a8c9bc224

    • SHA512

      dd393fe80aaa014fea51e9cd15b18c95484b1646aa109d84a0a886cc8ee9ae5de74463a5c6236e02cb2888264a0bba7a05a5583266c266fa9bd232346186f8b6

    Score
    10/10
    phishing
    behavioral15behavioral16

    • Target

      MirServer/RunGate/RunGate.exe

    • Size

      271KB

    • MD5

      dbc6ad29d7cc06f500363cb6f930bdec

    • SHA1

      7e1d7813b05b271101cd100fd88af42ad2032228

    • SHA256

      38d137a262db84fdf7a74e9e35a06e7f9f20d70369b8c7d153782dc72e966555

    • SHA512

      a9d21cb706c591c2859714ccc142e1c9a131271f19ca5862328f160193fd395b3c37df9c7dc20fc4c4831fd10bb796b5af3dceac5e658ae49b8eb061ddd64bf7

    • SSDEEP

      6144:czM59IhBbUUkCtuVyYnV4oKPuvl5kD3QVbjDMGKE:czG9IhBbaCtO12oCuvl523QVLMG

    Score
    1/10
    behavioral17behavioral18

    • Target

      MirServer/SelGate/SelGate.exe

    • Size

      214KB

    • MD5

      794f111746a7399b9239f471f257b37b

    • SHA1

      119572fa578e5b98bebc1d32effba356b828c687

    • SHA256

      8063c0aa6ca6a4a72f3d9f9024dad72c8e2353e555eef1d3cec73c96ad9f3ba0

    • SHA512

      60b4c011c12d3f97009cf7a11d213408de3a87bbc912e14b975d22bd90e3fa6bb25c801523e172a2fdd83d8566b403f918fc077c8bb19ebf97a383212e7096f6

    • SSDEEP

      6144:j/ectNJCqelWAL18AM1FXEKmKnE2JxqtIZEWIcbNKEi:j/3wdQRlM2Jxqia5UN0

    Score
    1/10
    behavioral19behavioral20

    • Target

      MirServer/好服务端下载站.url

    • Size

      234B

    • MD5

      a5a23c0803fa7add8e4ebd8d00433afe

    • SHA1

      9cde22f81a1f74a41d8b23f5a4bcd63c5e0fd2b9

    • SHA256

      194a3331d2052e6357fc75c0884a391cc3bc2c31b362a0109f6718d0d5517951

    • SHA512

      b81a611640ebef0558cb0883879562962d727b87d7278d9a2cc3678268391aefc39193f827ce80b8da998b095a5fe0072b0e517fcfc368ff797b366d3e3a2141

    Score
    1/10
    behavioral21behavioral22

    • Target

      MirServer/完美科技信誉一条龙.url

    • Size

      140B

    • MD5

      669008132ff45078ac87976814dea4e4

    • SHA1

      e7c71d6c4c16fa37963c039302569aa48b4fddd0

    • SHA256

      1be0a3129cb38631421006a8024a0093822ea497002b9232c4461a1c2941e25f

    • SHA512

      954e3e4697c5500f10b1a96ff823909ccf02cde4927cb68989a9f28d9f7377916934bbdb920aae1e7b503b376e9fb0775e63cc5d7c72e35d81ca76c829d85918

    Score
    1/10
    behavioral23behavioral24

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks