���N08#;@p��1�'>>gC����n�dTϿ.3֬&����H�$w*�OW����;�j�}����=i>�;A b��s���]F��K�xn�ӓ�2L�pl ��C���)=�qv^�s�=jԡ/��WA�ݑ fh~p1�Z/*���_���;D45��� �v����!��2\.ZC���AkZ��q���.B ����}��fV���uQo������g��xjo�MFi8E����!8&��n�d$J�D%`� �v�gΓ� S �s��O�UO�7�������F)L�B��+r(��Aw�J(�K�px�����`dZd_� �,^)��Ł�9K�= ��H�ɑ'�h~ �ɮ٩�JB���c��;h2>�Y �� �h�9-q #zj�e7��~���;�� W Wp�ɗ�ۄ�[�ō���1 ]!�Ԧ���K1����Pk�UU�FUrn�k����{n�������r�e;K�br� ��;8�hD�2�����{����Ӊ���Z ��C�.t��dỼ1Г_"� '�����Sv��g�)�V/�Xr�}�< gN���W-3o���Ц�tc������ 9OJv�): �#���9�Û��Q�xL;�V �g��6W���f.sD�a��z{����YS�����kA- ��]"O�� ���?CP{m6�l{��E35�3���3Ρ}�D7uv�����L%�RU�!h2� �Ü���^��">�Ԯ� �mn��7���!�e`�����Q1f*��&%K��_���Q �> ���\u�����2��E�NfZÕ��O�J����z�q�O,/�#� cp�QJ�I���#\�[6y�\4}n%�&(DZ����� �.�Ĺ����}5 *4��>�Þ 1���5DTLD2O<�@{���$�ݯ�rv� �+���.�ei&��Vִ�Tn� �e��K栁���e� �uXU崣wJ�c�'(<�H�� �����5Y%i��o����n w�^f �4E��E�[>�YE�v5��e�`�V"�*%��z���a�;SE�g�VL�z!"�9�Ki�2h��H_ ��9 �zn�v�g ��V�C�<JC}��h�-[5�쳋j#����o���^��=�n��"=w̋{�Ayˌ��(Y4{�V��M���Cа.wR��9#E�@�����RC��q�Ȕw�)i��� �! �~�m@]��RQn�h����� gl<M��`��ݬEL�� ���Lm��c¹6� �c���>�<��ek�;��ޑ�/��D-�]+�hNH��۶݅8c�y���x$< I R1� �9�� ����ߵ�0���wS| 4�tO 6�u;��{>�.tj[�d)�-���^��=)�0�O�Z:a U�D욳|&�(��sT\+��/R]�<ը��N���0�j� Q��͏���A��ӯ�9�z]Ov ɉC�D�m�����&�{R �d��)�Եhy ���9�$g�]ЗH��mfaH�o�ɰ�ٖa������� ��^�#�8�5bڛ!�@o��~���!�i6�����[<F�'0��ˈB����7�e<� �:3�~�Ͷi��m�4��+׀ ��Xy7-ô.e�U��\h����2�22���:�~�R�x��6����j� v����@`�� �Nz���!Q�* ��� a��m���c��]�� ��=pb�a�m�&�3���Aoݓ^8A��, _�kd�k�ʆ��>��{ fٳ���x��rI��W1tŋ�� a�ӄ���@��Ũ��3��i z`���_�i��B;/�ŵ��F�.٧PY���mJ��lJ������>O�Q�� |h�*I}d�UpG� �W<�*'�چφv��ɷ�F ;�"0t��1����~�&�Q�#��S�� �����W!�9 ���7��28 �l*�� .Cd_ ��32뎋'� �q��ol�P�+��۸��_�0>���Pa�V�io������aWi� ̼��{r����j��,I^�Ӫra�ì��_@�S���}qNȹU�/��c���{P�I�1uN���p�� :������6vn�}+���HF���� ,���w�3��Ԉ�˚z���&^�������}(56 V��l@�`�z%�6��u��T�xJQ[t���8��J� ����6��[ �����m� VPd�7�7�����aJP��5����g���C�qT� $>�i`�����V��$$gL�+<N߃�ҋr�Ϡ��aK�_���4ܕ9��E���<���Em��(�Ӂ� v</v��)k�&T�rs�H �b�v=]����h���Ȍ) B�>V�VN\���C� ��lF]��tl��MHi�ˉ-%����$mO�� V��P��O�FC��"��Y�;+��z{�q���HI����4���Gbs�M����>+9����O�dn��R�a���g|d��C�FҿE�)+��HKS6�Y�o���;�j��"�oi��h�����X �Cx�m>�)�� ��X?������dWKSvc���kVf�ڱ���\2`M�4^Kc� j�ZϩᑹD_̼&�'�_�94.O :�1)$u��ƺ��e��� ���U�b-]�§���n������S"��w4ß�iv��ZBr��,5�|�R� ]II(2 �h�~��Ct�=��l���P��E�� ���}t�@�!h��fRf���s����"z�3� =���;L%/���h���< u����'.�d5dc�������8a��Iu_�� q�������hP<��S|�������%�J��\��a�M��`+�C_��|�D�[ތy5~Z�D�� nK�],�'�D\8g5it_��rfh ����=C4�ASzW��y�}��=�J*�p�Y�$�]l J �b���$[���Dl|����zm%>�X�C���ܝ�v � �d9�EDظ ��[Fc��xU\����`��+ � ��؈��"4t�� e����{q�����O�����ݥ���D�%}�o���8A� ��ӎeR�Vu+<��z5����z�T���u�=?̭l�v�ʼ{�ZF;*W�Q��� �K�!�Ț� ��q}�٢0ڥ�v��tf�i�1���Z���y�^�ʸ��#�8��}���8ܟ�^�wJJt�P
General
-
Target
摩纳哥.7z
-
Size
19.9MB
-
MD5
8d798197150cf22c2d63ff1181ca0535
-
SHA1
49bd04d964cfae91cc4021323dae9d51e8c33964
-
SHA256
00afff69b8f52c22df1875d98d75730cde0ea314c6e5b120636ed47deb12d014
-
SHA512
f84049e0266662e8aeac3a0d829e0461f9465d0450d2f5a0e111477a78aa05706d51457bb4f4d37591aac07e8e6145a05d6346210391ab4e01e211dea0904e33
-
SSDEEP
393216:O/Yz0z3hU/4T4e47EdNCVKko+kA27u2f2hLyBiFHNzF7V:Lz63hUWtjd4VCAHOENzFJ
Score
10/10
Malware Config
Signatures
-
Mimikatz family
-
mimikatz is an open source tool to dump credentials on Windows 2 IoCs
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
Files
-
摩纳哥.7z
-
摩纳哥/Cache/Install.dat
de6942886ea1706308de6a5dc748b51c
Headers
Imports
Sections
-
摩纳哥/Client.exe
ffc6c11cb2c57a8a3a8fdcded7aa9c4a
Headers
Imports
Exports
Sections
-
摩纳哥/Client.ini
-
摩纳哥/Plugins/Baidu.html
-
摩纳哥/Plugins/BaiduE.html
-
摩纳哥/Plugins/Gaode.html
-
摩纳哥/Plugins/GaodeE.html
-
摩纳哥/Plugins/GetPswd32.exe
91c58525e2b08a41627faf84ecb6c4cc
Code Sign
Headers
Imports
Sections
-
摩纳哥/Plugins/GetPswd64.exe
66ee036df5fc1004d9ed5e9a94a1086a
Code Sign
Headers
Imports
Sections
-
摩纳哥/Plugins/IPUpdate.exe
77f2a6b3e475e55480b0129029e9b348
Headers
Imports
Exports
Sections
-
摩纳哥/Plugins/PcLock.exe
Headers
Sections
-
摩纳哥/Plugins/ShellCode.bat
-
摩纳哥/Plugins/ShellCode.exe
09ca14b770874b1f2a5bf00d50fdc36b
Headers
Imports
Sections
-
摩纳哥/Plugins/SkinH.dll
9913b440c3d28720bd3a56580eb5dafb
Headers
Imports
Sections
-
摩纳哥/Plugins/bPluginVideo.dll
-
摩纳哥/Plugins/mstscax.dll
f4f9ea2971d7855283ab7cbcf0ce7925
Headers
Imports
Exports
Sections
-
摩纳哥/Plugins/qqwry.dat
-
摩纳哥/Plugins/termsrv_t.dll
38242edcd70d38c5abcf4713d30126aa
Headers
Imports
Exports
Sections
-
摩纳哥/SkinH.dll
Headers
Exports
Sections
-
摩纳哥/Skins/SkinH.she
-
摩纳哥/Skins/homestead.she
-
摩纳哥/Skins/itunes.she
-
摩纳哥/Skins/niceblack.she
-
摩纳哥/Skins/pixos.she
-
摩纳哥/Skins/qqplayer.she
-
摩纳哥/Skins/royale.she
-
摩纳哥/Skins/xmp.she
-
摩纳哥/rasadhlp.dll
Headers
Exports
Sections