Overview
overview
3Static
static
1AxInterop....ib.dll
windows7-x64
1AxInterop....ib.dll
windows10-2004-x64
1Interop.MSTSCLib.dll
windows7-x64
1Interop.MSTSCLib.dll
windows10-2004-x64
1KeePassRDP.plgx
windows7-x64
3KeePassRDP.plgx
windows10-2004-x64
3QuickConne...in.dll
windows7-x64
1QuickConne...in.dll
windows10-2004-x64
1RDPPlugin.dll
windows7-x64
1RDPPlugin.dll
windows10-2004-x64
1Static task
static1
Behavioral task
behavioral1
Sample
AxInterop.MSTSCLib.dll
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
AxInterop.MSTSCLib.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral3
Sample
Interop.MSTSCLib.dll
Resource
win7-20230220-en
Behavioral task
behavioral4
Sample
Interop.MSTSCLib.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral5
Sample
KeePassRDP.plgx
Resource
win7-20230220-en
Behavioral task
behavioral6
Sample
KeePassRDP.plgx
Resource
win10v2004-20230221-en
Behavioral task
behavioral7
Sample
QuickConnectPlugin.dll
Resource
win7-20230220-en
Behavioral task
behavioral8
Sample
QuickConnectPlugin.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral9
Sample
RDPPlugin.dll
Resource
win7-20230220-en
Behavioral task
behavioral10
Sample
RDPPlugin.dll
Resource
win10v2004-20230220-en
General
-
Target
Plugins.zip
-
Size
14.6MB
-
MD5
ab34694686082610a4edb48413672e44
-
SHA1
e9b0ada7130e9694235e8b7b2b28c421465efba1
-
SHA256
b6d085ac02e1b6b9d6d2b68c1532ebb5431ec55ab2fbf05d6233a26284a7a6eb
-
SHA512
a718aa7eeb692308efaa53145562076edd0450f90476194e48431409426cd97f8d5e7267b5341ddd9160c06fa8be1471aea1751c4413a3321a56af7f99212ad7
-
SSDEEP
393216:WIbuEb0pCf4dmzcB63g1+LEZSPINWjsxKnwlN7Yx2H0tyDg5OvOOyv+7LX0digN4:RFb0pCf4dmzcB63g1+LEZSPINWjsxKn+
Malware Config
Signatures
Files
-
Plugins.zip.zip
-
AxInterop.MSTSCLib.dll.dll windows x86
dae02f32a21e03ce65412f6e56942daa
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorDllMain
Sections
.text Size: 291KB - Virtual size: 291KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 720B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
CertKeyProviderPlugin.plgx
-
GoogleSyncPlugin.plgx
-
Interop.MSTSCLib.dll.dll windows x86
dae02f32a21e03ce65412f6e56942daa
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorDllMain
Sections
.text Size: 517KB - Virtual size: 516KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 896B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
KPSyncForDrive-4.1.0.plgx
-
KeeOneDriveSync.plgx
-
KeePassBrowserImporter.plgx
-
KeePassFaviconDownloader.plgx
-
KeePassMasterSlaveSync.plgx
-
KeePassQRCodeView.plgx
-
KeePassRDP.plgx
-
KeePassWinHelloPlugin.plgx
-
KeepassTrueCryptMount.plgx
-
KeepassVeraCryptMount.plgx
-
QuickConnectPlugin.dll.dll windows x86
dae02f32a21e03ce65412f6e56942daa
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
mscoree
_CorDllMain
Sections
.text Size: 542KB - Virtual size: 542KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
QuickConnectPlugin.pdb
-
QuickConnectPlugin.plgx
-
RDPPlugin.dll.dll windows x86
dae02f32a21e03ce65412f6e56942daa
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorDllMain
Sections
.text Size: 13KB - Virtual size: 12KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 944B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
dbBackup.plgx
-
dbReorder.plgx