Overview

overview

9

Static

static

9

�...ad.dll

windows7-x64

1

�...ad.dll

windows10-2004-x64

1

�...EL.dll

windows7-x64

8

�...EL.dll

windows10-2004-x64

8

�...er.dll

windows7-x64

1

�...er.dll

windows10-2004-x64

3

�...p1.dll

windows7-x64

1

�...p1.dll

windows10-2004-x64

3

�...PI.dll

windows7-x64

1

�...PI.dll

windows10-2004-x64

1

�...ew.dll

windows7-x64

1

�...ew.dll

windows10-2004-x64

1

�...nv.dll

windows7-x64

1

�...nv.dll

windows10-2004-x64

1

�...xt.dll

windows7-x64

1

�...xt.dll

windows10-2004-x64

1

�...t5.dll

windows7-x64

1

�...t5.dll

windows10-2004-x64

1

�...et.dll

windows7-x64

1

�...et.dll

windows10-2004-x64

1

�...ln.dll

windows7-x64

1

�...ln.dll

windows10-2004-x64

1

�...ec.dll

windows7-x64

1

�...ec.dll

windows10-2004-x64

1

�...��.htm

windows7-x64

1

�...��.htm

windows10-2004-x64

1

�...��.exe

windows7-x64

5

�...��.exe

windows10-2004-x64

5

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1c388a8bd8a2f14fb270c3bcd6ef475f7536f1dd6412f0e91746c054d15db58d

  • Size

    2.9MB

  • Sample

    221127-1ss38afe5s

  • MD5

    e42c407e5e9ba53ded9380c5849360ad

  • SHA1

    2215872bf271928f0ed62034bac4ab9b4a2d8eef

  • SHA256

    1c388a8bd8a2f14fb270c3bcd6ef475f7536f1dd6412f0e91746c054d15db58d

  • SHA512

    67334cd0b16dc4b91f67b2cd54ff92774d26ed4f04a5a6e90f8caeb2b44b53d2d7f8d45b43776d9a02ddf00ce89bb98e635448b3f3332b4f8d26cd18bc47326c

  • SSDEEP

    49152:GYWF02joXNLXtuUGTXj4k2GN6poZq33O7eQl9X1OFf/U8+XJm6etTtO5Q7:Gi2jcXTij4k2GN6+03ezl9XAFac6e5tF

Score
9/10
upx

Malware Config

Targets

    • Target

      Ծע/EThread.fne

    • Size

      60KB

    • MD5

      206396257b97bd275a90ce6c2c0c37fd

    • SHA1

      3cae4506a033cf7e97156d5261f2a247c6270f42

    • SHA256

      64eef86745d7ae0168fec357099e2e952ce74ee19576d06cc8c8c65f210cc22c

    • SHA512

      4c23e52b5b23b305c3172e01dd205e15fda8f20f8b60776ba59d080bf05bbbca456a0ed232f2e2a2bf01d32efb913063f89fb4928bc4d5d1c1eb4c4979803455

    • SSDEEP

      768:r3gWNW3gyVNWTmOPMJcyS6K7viaViB9V5yHQ6Fq4oCaJa2OJK:TXkSTmOP0Cbu2BboCaKJK

    Score
    1/10
    behavioral1behavioral2

    • Target

      Ծע/SkinH_EL.dll

    • Size

      86KB

    • MD5

      147127382e001f495d1842ee7a9e7912

    • SHA1

      92d1ed56032183c75d4b57d7ce30b1c4ae11dc9b

    • SHA256

      edf679c02ea2e170e67ab20dfc18558e2bfb4ee5d59eceeaea4b1ad1a626c3cc

    • SHA512

      97f5ae90a1bbacfe39b9e0f2954c24f9896cc9dca9d14364c438862996f3bbc04a4aa515742fccb3679d222c1302f5bb40c7eaddd6b5859d2d6ef79490243a4d

    • SSDEEP

      1536:s5Np2dgZgIehUUS3E1Ujmrvl179D53UWnGQRJZiXRmrCnKptnouy8K:s5Np2dlUX0+Cx17F8QRJZKmOK3outK

    Score
    8/10
    upx

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral3behavioral4

    • Target

      Ծע/UUWiseHelper.dll

    • Size

      146KB

    • MD5

      c09c3e121ce7ef05ead3681f216a4550

    • SHA1

      af676d70899982c4227bcc1f656e83095ea1f386

    • SHA256

      63e9a59a04299836cec0ff7caadabbb1bc1aa50cdc66e0b71bb2aa58a1e9ccfe

    • SHA512

      d65800f274c8fa47bf3d3d991083b3d6e37b4c5e4415bc2bc8efb29336a4066bc99dc6c10c2d26e966de37197cf5d31869e05fe5f0439a550e3d9ef39586596c

    • SSDEEP

      3072:wQLAnZ8mWGDInSLqDZPkIusTUoEFGfQT7W5jD:3LAZ8XzS+DZPZEFGfr

    Score
    3/10
    behavioral5behavioral6

    • Target

      Ծע/dp1.fne

    • Size

      128KB

    • MD5

      07201b1fd5f8925dd49a4556ac3b5bab

    • SHA1

      a76afbb44376912f823f2b461507c28d2585a96c

    • SHA256

      abebbb0981d3d51eb63abcfa68be98da0cae4e6e3b143dd431fc845d1457dbd2

    • SHA512

      0cf673ce1b6cad38f0211231e876f00f6a8397a5f3e71680046f4a216bbe0f47f4541e5f5b49364310e41a04cce14703459725c3d9f052f9da13624e73753e12

    • SSDEEP

      1536:tiDSn+hfeTpCwAncpZ6Z8HTiQjl1sYiKG3oe/:UDTReTgwAcp9lqKG3o

    Score
    3/10
    behavioral7behavioral8

    • Target

      Ծע/eAPI.fne

    • Size

      320KB

    • MD5

      8a8dfdd6ef9f17e5caba3d2fd9995805

    • SHA1

      8eb39efd8e1cd127ec0a32ae6118704c87367e97

    • SHA256

      6ec377e848c7254cc22b1a8e5eb1599bc31805b1fcfda1a2cc5999f6b28ea839

    • SHA512

      3998832d2732d82e3559395029cd8bbde70d090def133e96b401d409bae2c2477fac229a12a04e795e4ea0ee0de11688ff6dea65c3372b0f90e43cb170291946

    • SSDEEP

      3072:rU0swaxu1SrlTvpSuKsZZA+CaHgepAPAdh+SmTsc05nJhonAfVMQDjwQ+9JsOyOK:rUHwakEr9p+AbCQpAIdh6mVMewQ+LIa

    Score
    1/10
    behavioral10behavioral9

    • Target

      Ծע/ethreadnew.fne

    • Size

      48KB

    • MD5

      b63c5fe0ecc37dc8875e6f5a005eaf0b

    • SHA1

      1611a5105b3f0d86ee633e1deb1beb85d451e4ca

    • SHA256

      4c48c0c3941b1851e69773170dafa56099a8d8c1d55164d465dc50867a62a258

    • SHA512

      7bba7504fde51bc2e34b7676bd313d2e9486f1f1f5b48b4ad7fb4a84109d7dd1f6938b1b107cb7f058287c44254cb0c52291f4de81caa1ef378d8f9433a5d4e4

    • SSDEEP

      768:adPnk2MB8FjWl9uTSyVmKRGK6TmPsLX3fwURhFvljyX9:adZMB8FjYuTrVtq7XPnRPl

    Score
    1/10
    behavioral11behavioral12

    • Target

      Ծע/iconv.fne

    • Size

      928KB

    • MD5

      f6a2a92194fc69858ffa9aa1557454da

    • SHA1

      47dbb9abb4d83e2d21c6107c11244f8daae0cc5d

    • SHA256

      1b28d05c306b575319c6fb9b08276b2204a7b569d9e540879ce67c8d17640990

    • SHA512

      0bfecdc1bc39fdbb3820d88c93361af072f794a64b5394a745ce09b400badf4936dc633b4e5643bd18dc451344f91943febf1467988e9f5293e685757cd8fad0

    • SSDEEP

      24576:Ouqf2FfWl8KuqGavkg3NyNIbbbIoIBAUZLY:OV+s8KuqGaX0ToIBAUZLY

    Score
    1/10
    behavioral13behavioral14

    • Target

      Ծע/iext.fnr

    • Size

      216KB

    • MD5

      3f1b2b497172b65f7bb15453d0d93de0

    • SHA1

      e24556e47ced0b6ae6b89a5e280b83e15ed42e8a

    • SHA256

      4f9ad22aa55455f56619e76a01afeb337e1f28f61c7dde5869eb2a6d8776581e

    • SHA512

      8837e6108ffde548674487c5ebba3e3dbee8bfafa5727470d3ebaeec039baefc6dc3d756a199f4fb334754985288f0a5577b32eb41fbd69295fc9681354cd3f2

    • SSDEEP

      3072:Mn8on8DDXsrbOfcrhoqJJeSld1oLLPCa/p9Z/oUHhRO6fVo:Ogcmqmud1oVldRp

    Score
    1/10
    behavioral15behavioral16

    • Target

      Ծע/iext5.fne

    • Size

      324KB

    • MD5

      9d06808df2f2c7b12f13e29ad5758e1e

    • SHA1

      ac4d3b358bfe6f03ec93a3b0aa84349ff1854ce5

    • SHA256

      78fb1c83193f6cd29e7e630abb2612b8b2f5698509095e9cbac5c1ee43859bc8

    • SHA512

      5ea4eb7cdc62d24ba6e37fe3a3d431f326f4502557d73672520d4ba2d85e73f27d925d3a9f5cf824e86101f378b2716b47b9f6c5cb457594d1e689387bdb7dec

    • SSDEEP

      6144:oF3eyPv8sYviSKZFuULsJ0jgBy0nw80E1nPnzn+nunOFnnTngn+n+8f8888YJ27x:kP0DKZiy011nPnzn+nunOFnnTngn+n+o

    Score
    1/10
    behavioral17behavioral18

    • Target

      Ծע/internet.fne

    • Size

      188KB

    • MD5

      7b129c5916896c845752f93b9635fc4c

    • SHA1

      e3fc632af5e1f36e8022e651f64eb8f8381c73c3

    • SHA256

      adc45970f4a0eafd2f372302f64836802380c253096a99ca964677a70a7128f8

    • SHA512

      c72dd4043e7cdc0ccefe26ce8a6d05701b4c610f88ab827e6731296da76b8cbe5b63c0970954ec7616369172b8b8f9cb546545271be3e86c18c54d0b9cad8f95

    • SSDEEP

      3072:mpTEys+TR7yRoHzXjlhvtcxVIThpEbbAKNXoqlSY9M02MF8:mpTEt+ycLHlCIThpEX9+XM

    Score
    1/10
    behavioral19behavioral20

    • Target

      Ծע/krnln.fnr

    • Size

      1.0MB

    • MD5

      44e2ca67c060fbe3dc0d030149f5a478

    • SHA1

      5df61eb626bc3849893701942114609c1086d496

    • SHA256

      6ced19283dbbb95f264448f380592f4e98ba8228efca2f68821ab3ae61029d93

    • SHA512

      1a348c7585d78dd68c1d0e059ea1d7cea57c1aeff734f834f75025719b9fdd0e9bb16aebe75e15502a1b83106387eaa9493b8990999e0a68b62c1afdbc8cf45e

    • SSDEEP

      12288:rb0+sqCE6yy4bmhSd+1YCHYFZzktq0TNSARuOrRUVbNGvNXXYA/2b:AjE6+bhiHYF5kZI6uOrRUjYNXXYA/

    Score
    1/10
    behavioral21behavioral22

    • Target

      Ծע/spec.fne

    • Size

      88KB

    • MD5

      51d7be0ca4431fec32d0ba0978cb2cae

    • SHA1

      1aa65ca721bd881b615b16602f6bc7cc4c7d74d8

    • SHA256

      1e4d44d3a865a766517057c199eda71e005e56c13fce2c4137b66d185a416986

    • SHA512

      5cf2214bc60dde261f44aa339ba1943f5c9b70337a11d064185224b3dcfc705e55386c95de280b6d05c4b60a318abbfa3d5728724c28dfc009d57c3bbfd76ef5

    • SSDEEP

      1536:DcrPILJRJT/DpWc6hVoabwhfoeW7JsVRj0:QrMW1ojfolax0

    Score
    1/10
    behavioral23behavioral24

    • Target

      Ծע/˵.htm

    • Size

      4KB

    • MD5

      361a4d7a2df9912e4da63a0dafc5bdc7

    • SHA1

      c21b6c3f3c386dc5af10b1f6143ef33ad5ff5d49

    • SHA256

      83178bbd34a353abd0eebfd7cbd64251fb28c1ca754f6e04c0319440c9661c91

    • SHA512

      ee1675ca9f771f68d40afd52ade168ec7a66c42b641766c6bf0418d4ede68328778a44c2af7dfdfd2a0363df2eb3b2d478b8c610276838bd52f89693b9a5f495

    • SSDEEP

      96:SIg2t4UIQ0kUsVa/LrKcPuLfVcuXjAEj1mAKhzmxetkjeCmNnHwKEs4+k:SIg2trIQ0kUsVdkuLfVcuXjAE5IIeuiI

    Score
    1/10
    behavioral25behavioral26

    • Target

      Ծע/Ծע.exe

    • Size

      1.0MB

    • MD5

      5f412e1b19f61d35b8336cdc36b14afb

    • SHA1

      b8344251375eb99a418da4f66fa0f5eff043d9e8

    • SHA256

      480049fe1260a294b4bf2b543000225f450916445ae262c1cb8c757eae1fb97e

    • SHA512

      59747fe74a295a2f29fa77ff7717fe9b11d0c11a124726d902c72bf4041509db2ff0c881e8d1ff1af8f7e9704acf5d978f7736ebcee84b971178261c955955b4

    • SSDEEP

      24576:4ZLoBawNdGtpxn8qUkujNPJXlIdifmF7ktgUQ6:zjNstplUkulJ0iK7Tb6

    Score
    5/10

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral27behavioral28

MITRE ATT&CK Enterprise v6

Tasks