Overview
overview
7Static
static
7Privoxy.exe
windows7-x64
7Privoxy.exe
windows10-2004-x64
7x64/NTT.exe
windows7-x64
1x64/NTT.exe
windows10-2004-x64
1x64/NetchCore.dll
windows7-x64
1x64/NetchCore.dll
windows10-2004-x64
1x64/ShadowsocksR.exe
windows7-x64
1x64/ShadowsocksR.exe
windows10-2004-x64
1x64/Win-10.sys
windows7-x64
1x64/Win-10.sys
windows10-2004-x64
1x64/Win-7.sys
windows7-x64
1x64/Win-7.sys
windows10-2004-x64
1x64/Win-8.sys
windows7-x64
1x64/Win-8.sys
windows10-2004-x64
1x64/ck-client.exe
windows7-x64
x64/ck-client.exe
windows10-2004-x64
x64/dns2tcp.exe
windows7-x64
1x64/dns2tcp.exe
windows10-2004-x64
1x64/nfapi.dll
windows7-x64
1x64/nfapi.dll
windows10-2004-x64
1x64/nfapinet.dll
windows7-x64
7x64/nfapinet.dll
windows10-2004-x64
7x64/sysproxy.dll
windows7-x64
1x64/sysproxy.dll
windows10-2004-x64
1x64/tap-dr...ll.bat
windows7-x64
5x64/tap-dr...ll.bat
windows10-2004-x64
5x64/tap-dr...01.sys
windows7-x64
1x64/tap-dr...01.sys
windows10-2004-x64
1x64/tap-dr...ll.exe
windows7-x64
1x64/tap-dr...ll.exe
windows10-2004-x64
1x64/tun2socks.exe
windows7-x64
1x64/tun2socks.exe
windows10-2004-x64
1Analysis
-
max time kernel
150s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
11/10/2023, 12:18
Behavioral task
behavioral1
Sample
Privoxy.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
Privoxy.exe
Resource
win10v2004-20230915-en
Behavioral task
behavioral3
Sample
x64/NTT.exe
Resource
win7-20230831-en
Behavioral task
behavioral4
Sample
x64/NTT.exe
Resource
win10v2004-20230915-en
Behavioral task
behavioral5
Sample
x64/NetchCore.dll
Resource
win7-20230831-en
Behavioral task
behavioral6
Sample
x64/NetchCore.dll
Resource
win10v2004-20230915-en
Behavioral task
behavioral7
Sample
x64/ShadowsocksR.exe
Resource
win7-20230831-en
Behavioral task
behavioral8
Sample
x64/ShadowsocksR.exe
Resource
win10v2004-20230915-en
Behavioral task
behavioral9
Sample
x64/Win-10.sys
Resource
win7-20230831-en
Behavioral task
behavioral10
Sample
x64/Win-10.sys
Resource
win10v2004-20230915-en
Behavioral task
behavioral11
Sample
x64/Win-7.sys
Resource
win7-20230831-en
Behavioral task
behavioral12
Sample
x64/Win-7.sys
Resource
win10v2004-20230915-en
Behavioral task
behavioral13
Sample
x64/Win-8.sys
Resource
win7-20230831-en
Behavioral task
behavioral14
Sample
x64/Win-8.sys
Resource
win10v2004-20230915-en
Behavioral task
behavioral15
Sample
x64/ck-client.exe
Resource
win7-20230831-en
Behavioral task
behavioral16
Sample
x64/ck-client.exe
Resource
win10v2004-20230915-en
Behavioral task
behavioral17
Sample
x64/dns2tcp.exe
Resource
win7-20230831-en
Behavioral task
behavioral18
Sample
x64/dns2tcp.exe
Resource
win10v2004-20230915-en
Behavioral task
behavioral19
Sample
x64/nfapi.dll
Resource
win7-20230831-en
Behavioral task
behavioral20
Sample
x64/nfapi.dll
Resource
win10v2004-20230915-en
Behavioral task
behavioral21
Sample
x64/nfapinet.dll
Resource
win7-20230831-en
Behavioral task
behavioral22
Sample
x64/nfapinet.dll
Resource
win10v2004-20230915-en
Behavioral task
behavioral23
Sample
x64/sysproxy.dll
Resource
win7-20230831-en
Behavioral task
behavioral24
Sample
x64/sysproxy.dll
Resource
win10v2004-20230915-en
Behavioral task
behavioral25
Sample
x64/tap-driver/install.bat
Resource
win7-20230831-en
Behavioral task
behavioral26
Sample
x64/tap-driver/install.bat
Resource
win10v2004-20230915-en
Behavioral task
behavioral27
Sample
x64/tap-driver/tap0901.sys
Resource
win7-20230831-en
Behavioral task
behavioral28
Sample
x64/tap-driver/tap0901.sys
Resource
win10v2004-20230915-en
Behavioral task
behavioral29
Sample
x64/tap-driver/tapinstall.exe
Resource
win7-20230831-en
Behavioral task
behavioral30
Sample
x64/tap-driver/tapinstall.exe
Resource
win10v2004-20230915-en
Behavioral task
behavioral31
Sample
x64/tun2socks.exe
Resource
win7-20230831-en
Behavioral task
behavioral32
Sample
x64/tun2socks.exe
Resource
win10v2004-20230915-en
General
-
Target
Privoxy.exe
-
Size
169KB
-
MD5
3f760435abdf9b9c6e607fdc6cccbdbb
-
SHA1
6b5e88e4f141c29f312b54161e52053c287884e0
-
SHA256
0372d33b8c9aeb6ae74d72fc91ff003215c25a05558c4beab8bf9e05b415079b
-
SHA512
0b08bc160aee003bcc238a569f71e4703314eb33e8827676645bbc3de1ca1483b08927ac772f66bf340e35fa504644c18af85a00f60e21cc355727770b0e9789
-
SSDEEP
3072:H5gB6K+TnzatlpkKmPht+XEdwW1Iy+s5NE4wJLlh4VOiJcLTJMOo:H46hTWf30dw8l+sDEdJLlh4bcLT2
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/4136-0-0x00000000007E0000-0x000000000085C000-memory.dmp upx behavioral2/memory/4136-1-0x00000000007E0000-0x000000000085C000-memory.dmp upx