General

  • Target

    up.zip

  • Size

    29.1MB

  • MD5

    8e55ac85297f10a09b3445311e21ee69

  • SHA1

    337faa8462151bf3671d59dac6882320e60e4c0a

  • SHA256

    7ac82c97b884b5ff5ae1699d793d7c0101d2484b597cbae9b7516a2bde8091c5

  • SHA512

    0cc153d18f9cabffffea481e697757306b6ea0c3be4a5f53f1d21a277f58fcd4c135ae6b7a6732952422641e6b6e942d3b1e51112efa30c0a15d2e08ae6065a6

  • SSDEEP

    786432:vBcQV0RGzCr2i+3vUO11Od4W9I6DsENIen86Won4bD:yI0RGzCrF+3vNOCyI6scn8634v

Malware Config

Signatures

  • Detect PureCrypter injector 6 IoCs
  • Detected MagicRAT payload 1 IoCs
  • Detected SessionManager backdoor 1 IoCs
  • Magicrat family
  • Purecrypter family
  • Sessionmanager family
  • Unsigned PE 16 IoCs

    Checks for missing Authenticode signature.

Files

  • up.zip
    .zip
  • Cloakedbgfjfjjaea5_browsingIso.iso
    .iso
  • Information.lnk
    .lnk
  • _
  • agenda.exe
    .exe windows x64

    ae76f6354c75c58b47b250b7fb349fb3


    Code Sign

    Headers

    Imports

    Sections

  • vcruntime140.dll
    .dll windows x64


    Headers

    Exports

    Sections

  • vctool140.dll
    .dll windows x64

    6af15efcf8b02fb0f30aba51e0286183


    Headers

    Imports

    Exports

    Sections

  • Guloaderbgghjjdjcc1_browsingIso.iso
    .iso
  • Iisbgfhaciadc2_browsingDll.dll
    .dll windows x64

    37791ed07fb74bfe504edfe9d52f4e3a


    Headers

    Imports

    Exports

    Sections

  • Iranbggaiajfbi13_browsingExe.exe
    .exe windows x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • Knotweedbgfjcfhafh13_browsingDll.dll
    .dll windows x64

    fb53c25042d49980f86f221ccb7bb886


    Headers

    Imports

    Exports

    Sections

  • Magicratbggdhgejff1_browsingExe.exe
    .exe windows x64

    207a191ca5a5ececab300a9baa69d115


    Headers

    Imports

    Exports

    Sections

  • Newcopperstealer10_browsingExe.exe
    .exe windows x86

    8c6cf8123d4782167f2c0c00c889a02a


    Code Sign

    Headers

    Imports

    Sections

  • Newlogforshell18_browsingExe.exe
    .exe windows x64

    4f2b9ad89041fedc43298c09c8e7b948


    Headers

    Imports

    Sections

  • Purecrypter12_browsingExe.exe
    .dll windows x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Purecrypter16_browsingExe.exe
    .dll windows x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Purecrypter28_browsingExe.exe
    .dll windows x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Purecrypter3_browsing7Exe.exe
    .iso
  • Purecrypter3_browsing7Exe_2.exe
    .dll windows x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Purecrypter45_browsingExe.exe
    .dll windows x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Purecrypter50_browsingExe.exe
    .dll windows x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Ratelbgfhajhjcd11_browsingIso.iso
    .iso
  • Ratelbgfhajhjcd13_browsingIso.iso
    .iso
  • Redeembgfighcgda1_browsingExe.exe
    .exe windows x86

    f5ef0d41a45190c75da2aad4b1525290


    Headers

    Imports

    Sections

  • Xfourk15_browsingExe.exe
    .dll windows x64

    23ae38e1cd9e878e8381818cafabbf61


    Headers

    Imports

    Exports

    Sections

  • Xfourk19_browsingExe.exe
    .dll windows x64

    2b85eda5e2ca4805e05003741ab3fe72


    Headers

    Imports

    Exports

    Sections

  • Xfourk35_browsingExe.exe
    .dll .ps1 windows x64