Extracted

• • Target

    绩效考核整改意见/其他信息/.__MACOS__/.__MACOS__/._MACOS_/Uxtheme.dll

  • Size

    4.3MB

  • MD5

    579403a0a0407119b01dafb2f9cf0229

  • SHA1

    884a0b4246e8a83bf2f17bdf3dd5ca20979eeffc

  • SHA256

    e8f6d96d0fba3b08651c8e2cfd160401d287901a44ab06770e02946a1b490dca

  • SHA512

    78955598bec3017322087dbdbeeb5c8d3503dc21b294e36aca00f821b67b1e761e9afefb66f3ce9be70a3e404ea48e8e5285642d22afe71b1fe173bc855fc6a4

  • SSDEEP

    98304:laAFQE1zBmdoSsaqTbXMqqijkFNjX1GOSzU8:laeQ4zsdiaioNLwz

  Score

  9^/10

  bootkitevasionpersistencetrojan

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks whether UAC is enabled

    evasiontrojan

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2

• • Target

    绩效考核整改意见/其他信息/.__MACOS__/.__MACOS__/._MACOS_/ds.exe

  • Size

    6.6MB

  • MD5

    512f4350aee7eb50adf509008a3ad3ce

  • SHA1

    b9eb9c56289e835739447925a0c085a9849a8f53

  • SHA256

    64f7a36c01e79cd4b041e8a8607dff06d5b606d36e3dff9cfb5fffa22d14d34c

  • SHA512

    9f8fc1871545abb446e76990c02ea648f3a588e1245f9140e86199a834b49d7410907925d471a4cb255f01176dc56d9099920db8f645938c32c66810cc14f649

  • SSDEEP

    49152:hfvxdjdBT6fQ88jYf89GdJufo0HNoWzSMWPQYH09RU39h6b/tQxFezMZoRZXtSHj:bb4zEsqaMWEr8gQLACJir2wFXk/mol

  Score

  10^/10

  cobaltstrike100000backdoorbootkitevasionpersistencetrojan

  • Cobaltstrike

    Detected malicious payload which is part of Cobaltstrike.

    trojanbackdoorcobaltstrike

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks whether UAC is enabled

    evasiontrojan

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral3behavioral4

• • Target

    绩效考核整改意见/其他信息/其他信息.docx

  • Size

    44KB

  • MD5

    2f82623f9523c0d167862cad0eff6806

  • SHA1

    5d77804b87735e66d7d1e263c31c4ef010f16153

  • SHA256

    9c2c8a8588fe6db09c09337e78437cb056cd557db1bcf5240112cbfb7b600efb

  • SHA512

    7fe8285e52355f2e53650dc4176f62299b8185ed7188850e0a566ddef7e77e1e88511bdcf6f478c938acef3d61d8b269e218970134e1ffc5581f8c7be750c330

  • SSDEEP

    384:OtF1XO9GxgL7ol+WSvYWCiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiLiiiiiriM:QOOgL7E4r

  Score

  1^/10
  behavioral5behavioral6

• • Target

    绩效考核整改意见/绩效考核整改意见.docx.lnk

  • Size

    809B

  • MD5

    2cec819246244026af2dd3fdcee0b02d

  • SHA1

    0ae1cce41ecd481a97450de5628c1bba0785b94e

  • SHA256

    550c62c18cc9ec6dbd12d1d81e0c5b15b9b3c46d93da23ed518af1e237389364

  • SHA512

    4614d0a99680f414f87ad0a9625b4f901ab961f203d5782b8753389a82f4886a2de73ca45007ee7ad970dd203c1c1ccdf09219963f58ae8558a6f31bee2ca7c0

  Score

  10^/10

  cobaltstrike100000backdoorbootkitevasionpersistencetrojan

  • Cobaltstrike

    Detected malicious payload which is part of Cobaltstrike.

    trojanbackdoorcobaltstrike

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral7behavioral8