ploutus | 0106757fac9d10a8e2a22dce5337f404bfa1c44d3cc0c53af3c7539888bc4025[.]zip[.]7z

Resubmissions

20/09/2023, 15:20

230920-sq1raaba9410

19/09/2023, 05:46

230919-ggksxsfb3x3

07/09/2023, 16:32

230907-t12xrsbg383

Sharing

Copy URL Twitter E-mail

General

Target
0106757fac9d10a8e2a22dce5337f404bfa1c44d3cc0c53af3c7539888bc4025.zip.7z
Size 32KB
Sample230920-sq1raaba94
SHA256 08f5eb636439ef668b599b595456651ae259fd1f1760bddba8192cf74b394ce0
MD5 cce1f1c49d19d95ca04e0fd801d9aa9a
SHA1 8048d3e9ca0c56430eb29d11116c952f354caae1
SHA512 fdf82a8a1618da79c5bf5a67955b573c0258bcf685ad0f8d85463e9358c39621510ca2fe8a9d5f848c055ad9bb7ab11b7e55eb8f88ee0aae414eed7431a3f8b7
SSDEEP 768:YWMAg9Y8zA0Bw5ybp8hSz/AXj0YZ8IOGQbu3EuU:zBgVzA0W5I8GoXj0YZ/fU
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

ploutus

Malware Config

Signatures

Detected Ploutus loader 1 IoCs

resource	yara_rule
static1/unpack002/0106757fac9d10a8e2a22dce5337f404bfa1c44d3cc0c53af3c7539888bc4025	family_ploutus

Ploutus family
ploutus

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack002/0106757fac9d10a8e2a22dce5337f404bfa1c44d3cc0c53af3c7539888bc4025

File Explorer

0106757fac9d10a8e2a22dce5337f404bfa1c44d3cc0c53af3c7539888bc4025.zip.7z

.7z 32KB
0106757fac9d10a8e2a22dce5337f404bfa1c44d3cc0c53af3c7539888bc4025.zip

.zip 33KB
0106757fac9d10a8e2a22dce5337f404bfa1c44d3cc0c53af3c7539888bc4025

.exe 37KB

0106757fac9d10a8e2a22dce5337f404bfa1c44d3cc0c53af3c7539888bc4025.zip.7z

SHA256 08f5eb636439ef668b599b595456651ae259fd1f1760bddba8192cf74b394ce0
MD5 cce1f1c49d19d95ca04e0fd801d9aa9a
SHA1 8048d3e9ca0c56430eb29d11116c952f354caae1
SHA512 fdf82a8a1618da79c5bf5a67955b573c0258bcf685ad0f8d85463e9358c39621510ca2fe8a9d5f848c055ad9bb7ab11b7e55eb8f88ee0aae414eed7431a3f8b7
SSDEEP 768:YWMAg9Y8zA0Bw5ybp8hSz/AXj0YZ8IOGQbu3EuU:zBgVzA0W5I8GoXj0YZ/fU
MD5 SHA1 SHA512 SSDEEP

Password

infected

0106757fac9d10a8e2a22dce5337f404bfa1c44d3cc0c53af3c7539888bc4025

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 0106757fac9d10a8e2a22dce5337f404bfa1c44d3cc0c53af3c7539888bc4025
MD5 488acf3e6ba215edef77fd900e6eb33b
SHA1 8c52518f3e0208b8e1ba6174a988e2378d69fae0
SHA512 a3b9cdbc5745f11e0ac1a4b722974c7ae9641d92eb8a2dace588de8f66f7fc56387526d0fd6bb04d682c840bdb3c067f69551ac3a84563fb165f3e3cebab039c
SSDEEP 768:icRUUxy0Lp3Ol0dcE+MgXnVKbjh9Gz64GolJMf6fYm:icJp3OwcEjqVKTGhGoliaYm
MD5 SHA1 SHA512 SSDEEP

windows x86

Detected Ploutus loader
Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

43486

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths