Overview

overview

7

Static

static

3

SETUP.bat

windows7-x64

7

SETUP.bat

windows10-2004-x64

6

UPGRADE.bat

windows7-x64

1

UPGRADE.bat

windows10-2004-x64

1

postgresql...nt.msi

windows7-x64

7

postgresql...nt.msi

windows10-2004-x64

7

postgresql-8.3.msi

windows7-x64

7

postgresql-8.3.msi

windows10-2004-x64

7

vcredist_x86.exe

windows7-x64

7

vcredist_x86.exe

windows10-2004-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    94f72fa2314552a95cac703e96f760d30f8443ea23d8cf0adaf35eba147c1f85.zip.zip

  • Size

    25.0MB

  • Sample

    231107-q6n2bafd8y

  • MD5

    c6d3ebe40b97a3a7c1c91b580b233c48

  • SHA1

    affc7136c633a7b864c7fcfe1f88bdf0e627d89f

  • SHA256

    5e8b94ddfbf41321f4192295a6054b04b2b42cc09f44f822ceb915b255a43122

  • SHA512

    e24839be20ed95987e0ebd7af64fc9f7fda6b8153b3411620298163d983ada70675b99e2e36a15f885d042ee460d8d1df24685366996bebd63007bc64ecd6033

  • SSDEEP

    393216:MkuLEXZnwD1IGxg1kBwvh2NCMKmTZbLB67HYYDeIRWwV0Tr5nSUjDhKNEwmOXsBB:Bo4nwgkBwAN67HYYT8Fvh/wmOU

Score
7/10
persistence

Malware Config

Targets

    • Target

      SETUP.bat

    • Size

      192B

    • MD5

      4200cecaf0d0d6838e48b87f78c90c19

    • SHA1

      9ac646870d4047e34d72ea244d003397bb4e54be

    • SHA256

      1c684469f8230b75ca0c8e6d1ed39bfdbe22d7259e7c992986f9f3897bf91c05

    • SHA512

      1f363479d82e6d9f1f8e068aff25043f8af44027a49c337f788ead27329e510c9e8bed755d5a7cb484be3fcfcfeb986481e82d68cc4689fd92f79c7df22169e0

    Score
    7/10
    persistence

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1behavioral2

    • Target

      UPGRADE.bat

    • Size

      1KB

    • MD5

      9fe4a6fa51ffdf3ba0be4ec0657de0a5

    • SHA1

      796c19e478dd35306a2c582a7627f0f5a54963b4

    • SHA256

      24885a55b9fba9779a4620a69064b1205787b3d93d3d29f1f2bcf904f4af7972

    • SHA512

      ab306f6c6d639570f3b02429f30e055fc6bd6e1d74dd8c8e614372ec98451e754751effb0e937785d8f00e538e47fe23fa3a26dd9ae14f4cf1d66807ba9d770e

    Score
    1/10
    behavioral3behavioral4

    • Target

      postgresql-8.3-int.msi

    • Size

      23.7MB

    • MD5

      6895639289dbb80a54aaf18bd2645a5d

    • SHA1

      c51787c36d18db59d8931ac87d24f5aba1aa5adf

    • SHA256

      e302da9f3e935abc408be595cd465a715c2e67aab5ce74db4703a85d28f7bf32

    • SHA512

      ac08b6944f2f13e0ca6002e4da355899ef3393e964479fe9812a0e013ae2325b0f3abd7b57e21f698f63a0c3ad0f80e9d0d34b77436beec477004391ec0b87a4

    • SSDEEP

      393216:KJ3blEW0Tglk+7PtfX0wrT5+N14qgufgZxL5hTYiqJg/R5e702Br+X4y7uptLxsG:i3uvgfPCwh1qgukxwi355ef42tLCG

    Score
    7/10

    • Loads dropped DLL

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral5behavioral6

    • Target

      postgresql-8.3.msi

    • Size

      157KB

    • MD5

      9bd95420958b9c6773f86cd061eec0e2

    • SHA1

      f2201c71555875f8368bed067f4bdccd115a02ea

    • SHA256

      5322707fb675f25ce085eaafce716cb2428d509416bd8bc5bdaf68f846442ea6

    • SHA512

      c9bde16c945870879e6537007669155116fda18a52737218261bec3d94c16b22bceed5d109647e454c9bdc67fa9f48a4fb99ffdbfea20db11ae9704b42c15deb

    • SSDEEP

      1536:o4LjxwVJrjCQJZbrOt+sa/lTREfOcqDp:bLSI6POtra/lTR

    Score
    7/10

    • Loads dropped DLL

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral7behavioral8

    • Target

      vcredist_x86.exe

    • Size

      2.6MB

    • MD5

      1f8e9fec647700b21d45e6cda97c39b7

    • SHA1

      037288ee51553f84498ae4873c357d367d1a3667

    • SHA256

      9c110c0426f4e75f4384a527f0abe2232fe71f2968eb91278b16b200537d3161

    • SHA512

      42f6ca3456951f3e85024444e513f424add6eda9f4807bf84c91dc8ccb623be6a8e83dc40a8b6a1bc2c6fd080f2c51b719ead1422e9d1c1079795ec70953a1ad

    • SSDEEP

      49152:IJFEcHcHfnIpvSUxuB4vkjfCSfil3ObWcrJhxSkm6Fo4Ea0g/I2Pz7citcU7tmLq:S2c8gfd87CQgu9xNpW4t/Ic7csd7t0q

    Score
    7/10
    persistence

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral10behavioral9

MITRE ATT&CK Enterprise v15

Tasks