General

  • Target

    BackUp2.zip

  • Size

    17.3MB

  • MD5

    fdb1ed892c1ebdeadb1b9256b768b052

  • SHA1

    c9d4476fc75bd7c5479aa6a1dedf3ac61ff7ddf0

  • SHA256

    027411e486175f86517d2f2da3d94d6f917035041d5317d211622f5b9ee73bdb

  • SHA512

    0b7bbe6700d0e0bf395f975cf8736e389d02659f6cb7b8ac506edca74a2da0ef6d19fc38c05bde6b3a6e48a408018893039b99ecbd1dc5f570858f4482698bec

  • SSDEEP

    393216:/mPxFM3ZLXV0R6tOs4uLRrVFyTLvKTbHIYImVoBkmFiOOEEJgetudU0:/mPvMH5BFNCfiridU0

Score
8/10

Malware Config

Signatures

  • Patched UPX-packed file 1 IoCs

    Sample is packed with UPX but required header fields are zeroed out to prevent unpacking with the default UPX tool.

Files

  • BackUp2.zip
    .zip
  • Lang/en.ttt
  • cdma.ps1
    .ps1
  • descript.ion
  • dev/php7.lib
  • ext/php_bz2.dll
    .dll windows x64

    00bd8ad32137692ef0571264ac0063bd


    Headers

    Imports

    Exports

    Sections

  • ext/php_com_dotnet.dll
    .dll windows x64

    e79e0ef874f913825e0fb99c23fb7939


    Headers

    Imports

    Exports

    Sections

  • ext/php_curl.dll
    .dll windows x64

    c4409e5a1d07362e9d0ad633144b3df7


    Headers

    Imports

    Exports

    Sections

  • ext/php_dba.dll
    .dll windows x64

    a0cd8c133df665ade56e73d7463b08f6


    Headers

    Imports

    Exports

    Sections

  • ext/php_enchant.dll
    .dll windows x64

    3ac76ed901d148a4dfefe891fba312ea


    Headers

    Imports

    Exports

    Sections

  • ext/php_exif.dll
    .dll windows x64

    31cc28f824ba71870d48da364f49a242


    Headers

    Imports

    Exports

    Sections

  • ext/php_fileinfo.dll
    .dll windows x64

    594224bba3ede9ef7edfb3b4833d49e0


    Headers

    Imports

    Exports

    Sections

  • ext/php_ftp.dll
    .dll windows x64

    74ebac8f300002d4c6b9d1cd5fad6a4c


    Headers

    Imports

    Exports

    Sections

  • ext/php_gd2.dll
    .dll windows x64

    4cdaadc730e85945c1c3f4c8944572e0


    Headers

    Imports

    Exports

    Sections

  • ext/php_gettext.dll
    .dll windows x64

    a57272c5ca77ed985e96d580a5436711


    Headers

    Imports

    Exports

    Sections

  • ext/php_gmp.dll
    .dll windows x64

    00861600abcc8f793076ab04895544a1


    Headers

    Imports

    Exports

    Sections

  • ext/php_imap.dll
    .dll windows x64

    aba4285fff9ca404ae63214de623cdab


    Headers

    Imports

    Exports

    Sections

  • ext/php_interbase.dll
    .dll windows x64

    0a7985658d153c37598d184429f123cf


    Headers

    Imports

    Exports

    Sections

  • ext/php_intl.dll
    .dll windows x64

    bd6949ca774f6af6dfc32c4083b5068c


    Headers

    Imports

    Exports

    Sections

  • ext/php_ioncube.dll
    .dll windows x64

    cead8e1ec90e026538613f5bf9e6d4a1


    Headers

    Imports

    Exports

    Sections

  • ext/php_ldap.dll
    .dll windows x64

    418d65160a3b15f08d060aba0a298107


    Headers

    Imports

    Exports

    Sections

  • ext/php_mbstring.dll
    .dll windows x64

    da403e745be4a87ded5d68b559e3795d


    Headers

    Imports

    Exports

    Sections

  • ext/php_mysqli.dll
    .dll windows x64

    39f9491964a9646d0fd57f0b4c1437fc


    Headers

    Imports

    Exports

    Sections

  • ext/php_oci8_12c.dll
    .dll windows x64

    14f21a7b52e465d648d76017047862c6


    Headers

    Imports

    Exports

    Sections

  • ext/php_odbc.dll
    .dll windows x64

    500a1be55f56c7adb0813fdd2e7eec87


    Headers

    Imports

    Exports

    Sections

  • ext/php_opcache.dll
    .dll windows x64

    d589f57ecae781d2ecf611ee61781d5c


    Headers

    Imports

    Exports

    Sections

  • ext/php_openssl.dll
    .dll windows x64

    ee18c0adfad951a54708c5e01da3ac3f


    Headers

    Imports

    Exports

    Sections

  • ext/php_pdo_firebird.dll
    .dll windows x64

    837a94d46a7497134fdc12d59d7432a1


    Headers

    Imports

    Exports

    Sections

  • ext/php_pdo_mysql.dll
    .dll windows x64

    10815b06fa383524d9144cc1dfb2f7ca


    Headers

    Imports

    Exports

    Sections

  • ext/php_pdo_oci.dll
    .dll windows x64

    1b76c5fe13ab872b7b7858e629a7d04d


    Headers

    Imports

    Exports

    Sections

  • ext/php_pdo_odbc.dll
    .dll windows x64

    8d4775b6fdb3348962ca7f6d06fa3bd9


    Headers

    Imports

    Exports

    Sections

  • ext/php_pdo_pgsql.dll
    .dll windows x64

    2e0d090a15c3dfaebd3dd75853a1d49f


    Headers

    Imports

    Exports

    Sections

  • ext/php_pdo_sqlite.dll
    .dll windows x64

    c27a0a573d9e60e524463e1f78c09095


    Headers

    Imports

    Exports

    Sections

  • ext/php_pgsql.dll
    .dll windows x64

    cab701871fd53fedead58b0fbe7f7bfc


    Headers

    Imports

    Exports

    Sections

  • ext/php_phpdbg_webhelper.dll
    .dll windows x64

    4d72f1dd2b519d46d2079e432479f467


    Headers

    Imports

    Exports

    Sections

  • ext/php_shmop.dll
    .dll windows x64

    8da7b381238f58bfcbfae72281ba8a16


    Headers

    Imports

    Exports

    Sections

  • ext/php_snmp.dll
    .dll windows x64

    34a12ae73ba443704fdaab2517529d3f


    Headers

    Imports

    Exports

    Sections

  • ext/php_soap.dll
    .dll windows x64

    cdef720e507e0c161918a5b2d2e57298


    Headers

    Imports

    Exports

    Sections

  • ext/php_sockets.dll
    .dll windows x64

    f0fe7655a1f5bf76f183cf2cf273d480


    Headers

    Imports

    Exports

    Sections

  • ext/php_sodium.dll
    .dll windows x64

    f4dce9b477f8a60d311436b329c82480


    Headers

    Imports

    Exports

    Sections

  • ext/php_sqlite3.dll
    .dll windows x64

    abf15623a92762046ce7ef0325f1810b


    Headers

    Imports

    Exports

    Sections

  • ext/php_sysvshm.dll
    .dll windows x64

    0f12cf0ef01ceefd4815b07afc4650aa


    Headers

    Imports

    Exports

    Sections

  • ext/php_tidy.dll
    .dll windows x64

    b479076e8ca209e66e79c472ad717ea5


    Headers

    Imports

    Exports

    Sections

  • ext/php_xmlrpc.dll
    .dll windows x64

    2d68987e98afa3178cc32aee631d1235


    Headers

    Imports

    Exports

    Sections

  • ext/php_xsl.dll
    .dll windows x64

    0a29fe50bbdc6142f58c9d35d8e1a5ce


    Headers

    Imports

    Exports

    Sections

  • ext/php_zend_test.dll
    .dll windows x64

    f0e39b3b8c11c6859f96a5e092f9df3c


    Headers

    Imports

    Exports

    Sections

  • extras/ssl/openssl.cnf
  • glib-2.dll
    .dll windows x64

    a18ef03d1a23f5092f0e0eff0762e1bf


    Headers

    Imports

    Exports

    Sections

  • gmodule-2.dll
    .dll windows x64

    6645e6ea7ff4ce3e0542d8170ffe3fe4


    Headers

    Imports

    Exports

    Sections

  • icuin60.dll
    .dll windows x64

    5954113b8b3ab699fe6f946b5f05cdd9


    Headers

    Imports

    Exports

    Sections

  • icuio60.dll
    .dll windows x64

    74eda715e5c2ff8d367d2077ffd25aad


    Headers

    Imports

    Exports

    Sections

  • icutu60.dll
    .dll windows x64

    ddb4c0c430eefa453c59fb0137e57132


    Headers

    Imports

    Exports

    Sections

  • icuuc60.dll
    .dll windows x64

    69c3dc8530d4698aa7f1c54e5119631a


    Headers

    Imports

    Exports

    Sections

  • include.php
  • index.php
  • lib/enchant/libenchant_ispell.dll
    .dll windows x64

    e99eb73c2c8b2ec1f955da2ff5203262


    Headers

    Imports

    Exports

    Sections

  • lib/enchant/libenchant_myspell.dll
    .dll windows x64

    1915215b749fd445c57a9e7708757570


    Headers

    Imports

    Exports

    Sections

  • libcrypto-1_1-x64.dll
    .dll windows x64

    f53812aba577fc4542e3180f32603d8b


    Headers

    Imports

    Exports

    Sections

  • libenchant.dll
    .dll windows x64

    65bb24c9557bd4189897605b71539118


    Headers

    Imports

    Exports

    Sections

  • libpq.dll
    .dll windows x64

    d562c6a9faf14cdac6ec0c60d4b9150c


    Headers

    Imports

    Exports

    Sections

  • libsasl.dll
    .dll windows x64

    901edaacb08f31471f4773e404f58271


    Headers

    Imports

    Exports

    Sections

  • libsodium.dll
    .dll windows x64

    38236461eace5db7409e0d03dd9a01d5


    Headers

    Imports

    Exports

    Sections

  • libssh2.dll
    .dll windows x64

    ff2ba23229f19a4cb810b450b17f627f


    Headers

    Imports

    Exports

    Sections

  • libssl-1_1-x64.dll
    .dll windows x64

    01107f9bf2f14d81c28a253c73ac1800


    Headers

    Imports

    Exports

    Sections

  • news.txt
  • nghttp2.dll
    .dll windows x64

    6bc8717070c5968adb87244135e4fe45


    Headers

    Imports

    Exports

    Sections

  • phar.phar.bat
  • pharcommand.phar
    .js
  • php.exe
    .exe windows x64

    5e821d6d40a8405ab17924b0b85a85c3


    Headers

    Imports

    Exports

    Sections

  • php.gif
    .gif
  • php.ini
  • php7.dll
    .dll windows x64

    1622c5db319d027d1bb301fb181bb7ec


    Headers

    Imports

    Exports

    Sections

  • php7embed.lib
  • php7phpdbg.dll
    .dll windows x64

    fb1d80c53f9d25b655bd7b1e516af819


    Headers

    Imports

    Exports

    Sections

  • rhc.exe
    .exe windows x86

    0b9ca80ff295945b3cf5762a07ef3d50


    Headers

    Imports

    Sections

  • run.bat
  • sasl2/saslANONYMOUS.dll
    .dll windows x64

    de0f5a04d994999d63903a23673faf91


    Headers

    Imports

    Sections

  • sasl2/saslCRAMMD5.dll
    .dll windows x64

    19b6978191f01d11cffa663fa0d23e46


    Headers

    Imports

    Sections

  • sasl2/saslDIGESTMD5.dll
    .dll windows x64

    0b59422a44fe9d9b6ccca3908f86cf08


    Headers

    Imports

    Sections

  • sasl2/saslLOGIN.dll
    .dll windows x64

    4f30de07413c025357c8f507a443c3c4


    Headers

    Imports

    Sections

  • sasl2/saslNTLM.dll
    .dll windows x64

    6e6c292271dd2e029c09ac9b8433807d


    Headers

    Imports

    Sections

  • sasl2/saslOTP.dll
    .dll windows x64

    41f219f1b60c049feb8b78ec53b964c1


    Headers

    Imports

    Sections

  • sasl2/saslPLAIN.dll
    .dll windows x64

    4f30de07413c025357c8f507a443c3c4


    Headers

    Imports

    Sections

  • sasl2/saslSASLDB.dll
    .dll windows x64

    8c73c7bb5dec92c1857cdcb73b908eaa


    Headers

    Imports

    Exports

    Sections

  • sasl2/saslSCRAM.dll
    .dll windows x64

    2a1cf650a8083d70489f8c8d2509e5e4


    Headers

    Imports

    Sections

  • sasl2/saslSQLITE.dll
    .dll windows x64

    82cd517d5a63cf8819dc5c24acc24772


    Headers

    Imports

    Sections

  • tag
  • time.ps1
  • vcruntime140.dll
    .dll windows x64

    44c3854843f7a3fccdf8ddbbea66f302


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • version.php
  • wplugin1.exe
    .exe windows x64

    72a686573013f451cbb1b320bf4aa609


    Code Sign

    Headers

    Imports

    Sections

  • wplugin2.exe
    .exe windows x86

    15847eb10d7d06dcd5980e8a9b786fd6


    Headers

    Imports

    Sections