pseudomanuscrypt

General

Target

4589f71870479cdddc1439394eb7c27da1c95d1f7a89016168f32f6791f541ab
Size

7.4MB
Sample

230306-dh1zrahh5y
MD5

2850ccb10aa6f6700d555ca67f89f1e0
SHA1

c55b593e654f822ed59d86bab7f8e081b331f132
SHA256

4589f71870479cdddc1439394eb7c27da1c95d1f7a89016168f32f6791f541ab
SHA512

8ee232798200eb6b25116ef75c3a07f61812ee3865b95272e92010ccc021d3fb261982a309c69a592cab5e397de945733133bb2cfd77faaa0be9acf3038df0c9
SSDEEP

196608:ak5uXAsEDJBbnU3ec/fEF9KtlsWQpAJyy8:ak5uQZfLU3P3Y9qlrJy

Score

10^/10

Malware Config

Targets

- Target
  
  4589f71870479cdddc1439394eb7c27da1c95d1f7a89016168f32f6791f541ab
- Size
  
  7.4MB
- MD5
  
  2850ccb10aa6f6700d555ca67f89f1e0
- SHA1
  
  c55b593e654f822ed59d86bab7f8e081b331f132
- SHA256
  
  4589f71870479cdddc1439394eb7c27da1c95d1f7a89016168f32f6791f541ab
- SHA512
  
  8ee232798200eb6b25116ef75c3a07f61812ee3865b95272e92010ccc021d3fb261982a309c69a592cab5e397de945733133bb2cfd77faaa0be9acf3038df0c9
- SSDEEP
  
  196608:ak5uXAsEDJBbnU3ec/fEF9KtlsWQpAJyy8:ak5uQZfLU3P3Y9qlrJy
Score

10^/10

pseudomanuscrypt xmrig evasion loader miner upx vmprotect spyware stealer
- Detects PseudoManuscrypt payload
  loader
- Modifies security service
  evasion
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- PseudoManuscrypt
  PseudoManuscrypt is a malware Lazarus’s Manuscrypt targeting government organizations and ICS.
  loader pseudomanuscrypt
- Suspicious use of NtCreateUserProcessOtherParentProcess
- xmrig
  XMRig is a high performance, open source, cross platform CPU/GPU miner.
  miner xmrig
- XMRig Miner payload
  miner
- Stops running service(s)
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Unexpected DNS network traffic destination
  Network traffic to other servers than the configured DNS servers was detected on the DNS port.
- VMProtect packed file
  Detects executables packed with VMProtect commercial packer.
  vmprotect
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1 behavioral2