Overview

overview

9

Static

static

9

91vpn(3.5....pn.exe

windows7-x64

8

91vpn(3.5....pn.exe

windows10-2004-x64

8

91vpn(3.5....ce.dll

windows7-x64

1

91vpn(3.5....ce.dll

windows10-2004-x64

8

91vpn(3.5....xy.dll

windows7-x64

7

91vpn(3.5....xy.dll

windows10-2004-x64

7

91vpn(3.5....00.dll

windows7-x64

1

91vpn(3.5....00.dll

windows10-2004-x64

1

91vpn(3.5....00.dll

windows7-x64

3

91vpn(3.5....00.dll

windows10-2004-x64

3

91vpn(3.5....00.dll

windows7-x64

3

91vpn(3.5....00.dll

windows10-2004-x64

3

91vpn(3.5....er.exe

windows7-x64

8

91vpn(3.5....er.exe

windows10-2004-x64

8

91vpn(3.5....il.dll

windows7-x64

7

91vpn(3.5....il.dll

windows10-2004-x64

7

91vpn(3.5....CN.dll

windows7-x64

1

91vpn(3.5....CN.dll

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0d6e80341bbe729ec982295201a421955bbc818114dbeabb19f90a81f757e56d

  • Size

    3.4MB

  • Sample

    221127-hhrtasbc9v

  • MD5

    625837c60e3e4337a1132c904ce9c145

  • SHA1

    3b1b0fdbed811ff291d655f37f26629e2805e1b5

  • SHA256

    0d6e80341bbe729ec982295201a421955bbc818114dbeabb19f90a81f757e56d

  • SHA512

    a17d5898c68bf11b6a9fad74dddd9b06eb0ef16a2d130f53fd2e17659291b13e2411250910db0b928d5226c257f956bb4f1de890f0cdfb6e333019a2c71eef43

  • SSDEEP

    98304:A28E3M+7roYO9WKNyqi0RrEKkaK3b1Ng5sy:xWyrY95J/W5W

Score
9/10
upx

Malware Config

Targets

    • Target

      91vpn(3.5.4)/91vpn/91vpn.exe

    • Size

      307KB

    • MD5

      3896a09770a42da96db5fbf530903203

    • SHA1

      3004cce7e3ca6692dbfb61f40560734c492b6f9b

    • SHA256

      bf9001e1c780d0c0f650c4481a3750c30132b8d932c511215e07c631c6cdc658

    • SHA512

      9840a2075ea8619b34bbce12224b747fd5789e43796a43d5c82ecddb42a54912d7d4cebd6c3a595d09b23530d6cccd0287f12eb0637d15cb7135d228d6aa1a5a

    • SSDEEP

      6144:rzmKnGDcrNkB5HG9QYQM87p+CCZazquuq54t5XPg0gQAAitfGFOyCuXwL5ceeLec:3hnXeLHJYQNiZa2uuq54t5Xo0gQAAity

    Score
    8/10
    upx

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Loads dropped DLL

    behavioral1behavioral2

    • Target

      91vpn(3.5.4)/91vpn/appface.dll

    • Size

      277KB

    • MD5

      ca69f84b164dd69a96bef1b2761c7596

    • SHA1

      81f352575d8056a8516b9cbb4f73b8c0c6730c28

    • SHA256

      e6870e771feb8095b42f03349032cc08ca01948b6672ad307f7355232970e895

    • SHA512

      f9ffc2ae28cb596f4c010ed860275c2ee2bdf96ac34ee2dd3b20bcf1c636d1f760ece74946c10eb41a031b61882a7eceaeac8b70e6a1d8ca03b02ebcaa38f857

    • SSDEEP

      6144:FTa+ar8WYs/v9tS08ttqgGEp2zL6UQHNWgb5sZN4rZ2BYejlNTqFg91k:FaDxlx8hngH6UQH3CZNkI3O

    Score
    8/10
    upx

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral3behavioral4

    • Target

      91vpn(3.5.4)/91vpn/httpproxy.dll

    • Size

      105KB

    • MD5

      16848d947d10770269512554a0defb7d

    • SHA1

      5299bc40a1944a34537904983af7b61ada6227c3

    • SHA256

      41a8aca7eb8483243676f2473cd98de507d814fdd7db81653c0aee0a69cdaff9

    • SHA512

      5bde5b62b30365ce14f94d7546ffa015f4c07435211078c5e8767886b1438e361763c09d3e9e05193117e3c5e57bda048eda211b5e36132139ac690b5eafefb8

    • SSDEEP

      1536:e8/zU/fGxBhO05YAoEYH7Th4F9dxMbRSPkJsBTAALlkWtOnCEePRQyo:tzU/8hOOxce5+beBTAALJOnCEePCd

    Score
    7/10

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral5behavioral6

    • Target

      91vpn(3.5.4)/91vpn/mfc100.dll

    • Size

      4.1MB

    • MD5

      07bccdcc337d393d7db0b2f8fe200b3f

    • SHA1

      5a02b227cb0a22a8e7884cd138c3e8568d083d94

    • SHA256

      bf38dda13b938b49a4df72b6477342373ee6e151be12c25cb0c17662fcb4bcd4

    • SHA512

      e5637727a549cf7b88f13474097a71200f0dfa511ecd55c5a42e5f53e9f86ce8b7ce763448830fd073e232876f7537bad96f2ced8d3159558778460264d07639

    • SSDEEP

      98304:BZP0PvxMJfTcXPSo0akd+BPSLC4IEy+XNy136jCfsqLhDIJJGN8mFLOAkGkzdnEe:BZP2iIE80qLrHFLOyomFHKnPAG

    Score
    1/10
    behavioral7behavioral8

    • Target

      91vpn(3.5.4)/91vpn/msvcp100.dll

    • Size

      411KB

    • MD5

      03e9314004f504a14a61c3d364b62f66

    • SHA1

      0aa3caac24fdf9d9d4c618e2bbf0a063036cd55d

    • SHA256

      a3ba6421991241bea9c8334b62c3088f8f131ab906c3cc52113945d05016a35f

    • SHA512

      2fcff4439d2759d93c57d49b24f28ae89b7698e284e76ac65fe2b50bdefc23a8cc3c83891d671de4e4c0f036cef810856de79ac2b028aa89a895bf35abff8c8d

    • SSDEEP

      12288:iHEqYsrMWIqz473PTiPoH/aGhUgiW6QR7t5qv3Ooc8UHkC2eKq87:iH9YsIWIW4rPTiPofaDv3Ooc8UHkC2e8

    Score
    3/10
    behavioral10behavioral9

    • Target

      91vpn(3.5.4)/91vpn/msvcr100.dll

    • Size

      752KB

    • MD5

      67ec459e42d3081dd8fd34356f7cafc1

    • SHA1

      1738050616169d5b17b5adac3ff0370b8c642734

    • SHA256

      1221a09484964a6f38af5e34ee292b9afefccb3dc6e55435fd3aaf7c235d9067

    • SHA512

      9ed1c106df217e0b4e4fbd1f4275486ceba1d8a225d6c7e47b854b0b5e6158135b81be926f51db0ad5c624f9bd1d09282332cf064680dc9f7d287073b9686d33

    • SSDEEP

      12288:fQmCy3NeRjkpQmj3oaMtQqjoygfXq3kon9IlbgaOxQdVJJ6j5EBKX8hR5:ImCy3VQs9MtLjTgfa3kon9FaOdEz5

    Score
    3/10
    behavioral11behavioral12

    • Target

      91vpn(3.5.4)/91vpn/updater.exe

    • Size

      75KB

    • MD5

      1bf4e650ace71c93b6b768db6538fd5a

    • SHA1

      9b4d3ccb7dc6db7167b00a9720b60f23c6237d7f

    • SHA256

      3609ea382a9ea5fde45e9c7281a81e3706534a2a4db6bce068c03c07f9dee0b5

    • SHA512

      c24882e9e131ab609f4f92d8824c444922d86c0b8cb5b71617bb4646c2abe59bf4030dff910dc0f38b7e7e559a37311512a762c08d47b77e4fc04643ef3e83d9

    • SSDEEP

      768:Pf6DuCdfJSyQ8wXPGjH+9LE+31lwPfJHp4fgKIj6n9+6gOrGdzRleMM2DQvcZL+U:36qwS2y9LE+3DAHp4AVOS9eT2Dbqa

    Score
    8/10
    upx

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral13behavioral14

    • Target

      91vpn(3.5.4)/91vpn/vpnutil.dll

    • Size

      750KB

    • MD5

      2a85f60ed95582d66ebedeec374ea64e

    • SHA1

      ad1b515b0b72e6d51563e89f40b23e62630c39de

    • SHA256

      163399e825d23c9c019a9bd03a58328d365a5fc9f80af1e516ca7412de2c49e6

    • SHA512

      cb2766a0bcd7f6979831f004e84b15df18ba33ad11d6ce20b6432845074e8249de72c906cd4900576831c21d09940b9e30b701db839b0aba299ff364d9e8b458

    • SSDEEP

      12288:3ysfcCzYEjeYL89XikxFkPBs+OeO+OeNhBBhhBBdlrYj5cEwmco0LgUdj:lzYERL89XikxFkPnYj5zwmd0LgUdj

    Score
    7/10

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral15behavioral16

    • Target

      91vpn(3.5.4)/91vpn/zh-CN.dll

    • Size

      96KB

    • MD5

      38b5032035c89460e2a2b65373131a63

    • SHA1

      c463ed6295637980bfb1d397ac8ba556d53cbebc

    • SHA256

      96db6715ef3dd940c2759dbe74c15c9e0be4b94f2a9661e33bdc9b6794f1ae06

    • SHA512

      f855b813553164500405f86977f3bf68d928cd263d12306c97e28190cc5ed73c11807a01cd94e94a4c097018e865c9c108c625393ef281ad0fbd5e97665bf6c7

    • SSDEEP

      3072:7HWhnZ5ceeV4Q6rwJMLUiXMlQZHIOzztDev:aL5ceeLeUMIiXMEzzc

    Score
    1/10
    behavioral17behavioral18

MITRE ATT&CK Matrix

Tasks