Overview

overview

3

Static

static

3

BINDInstall.exe

windows7-x64

1

BINDInstall.exe

windows10-2004-x64

1

arpaname.exe

windows7-x64

arpaname.exe

windows10-2004-x64

bindevt.dll

windows7-x64

1

bindevt.dll

windows10-2004-x64

1

ddns-confgen.exe

windows7-x64

ddns-confgen.exe

windows10-2004-x64

dig.exe

windows7-x64

dig.exe

windows10-2004-x64

dnssec-dsfromkey.exe

windows7-x64

dnssec-dsfromkey.exe

windows10-2004-x64

dnssec-key...el.exe

windows7-x64

dnssec-key...el.exe

windows10-2004-x64

dnssec-keygen.exe

windows7-x64

dnssec-keygen.exe

windows10-2004-x64

dnssec-revoke.exe

windows7-x64

dnssec-revoke.exe

windows10-2004-x64

dnssec-settime.exe

windows7-x64

dnssec-settime.exe

windows10-2004-x64

dnssec-signzone.exe

windows7-x64

dnssec-signzone.exe

windows10-2004-x64

genrandom.exe

windows7-x64

genrandom.exe

windows10-2004-x64

host.exe

windows7-x64

host.exe

windows10-2004-x64

isc-hmac-fixup.exe

windows7-x64

isc-hmac-fixup.exe

windows10-2004-x64

libbind9.dll

windows7-x64

1

libbind9.dll

windows10-2004-x64

1

libdns.dll

windows7-x64

1

libdns.dll

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    355431fb82916137ec22ddd7288cf6014d496fe44df5f774051346c0e57eb1c7.zip.zip

  • Size

    13.0MB

  • Sample

    231107-qzy8pseh4x

  • MD5

    75ed09cbc4b43cccb222a9d342eb8a6e

  • SHA1

    431fc71cbb2f1f5efb837abd717635f8455b09a7

  • SHA256

    929437f507f93afe723a8cde00a677b3baf841fde99281cb1274a3355b202312

  • SHA512

    ce0c377c352aff51e7468e1e4066c1b3bd4c30f856bdb53e28e337668e5fa6108cab582556d3d19a93dde4f4a0980f39270dfae198f3628e338113e7f98aaf70

  • SSDEEP

    393216:OF3D3sWe9lwY6/kWQbXk5XncFQpSexfY2B:STggbkWQDK3cgxwU

Score
3/10

Malware Config

Targets

    • Target

      BINDInstall.exe

    • Size

      2.1MB

    • MD5

      8f72b7a5fe2ccc9cbf2782ef47690d40

    • SHA1

      e5adad407bce0c709bad26d827f013a00b858e3d

    • SHA256

      e89d3365614731cb5747d6e5bc63b79cd76fdb62742a191885c74a6a2ccee992

    • SHA512

      338112df3b6a6db6b22ab605ccefd2347d65d67b30a56718a201277c65478ebdb68306bd7db3ef1357be2ade0bbd39cbd834c0000aa7a963428db5ac89a31336

    • SSDEEP

      24576:iPrY4zNJTGIib8PeEmT4seLU5pSNX5AmoQnRekxtITfb:iDTnGj8WqLNpzRC

    Score
    1/10
    behavioral1behavioral2

    • Target

      arpaname.exe

    • Size

      40KB

    • MD5

      fa9d26218520c51339591576769bfdef

    • SHA1

      823b15d92ab6b97897e4258d61a4e6ab268f8fad

    • SHA256

      cfb7c8c39bd204004592822dc11952c347cbb87175ca8ef14a197e2976657dd3

    • SHA512

      6725ee0dbbb95043035d938ef2d2083277369cb0a7bc6dafbd911ef1f7c146fed7b68849edd541ee27234802d7c30af2739ec0528e4cf9ce24b8744a475a279d

    • SSDEEP

      384:C5WsaAWdbuqBOziF9FmP7NVPr6vxwUbMSVRRs6oP:C5WsrChBOzK94hVPGmUz1WP

    Score
    1/10
    behavioral3behavioral4

    • Target

      bindevt.dll

    • Size

      448KB

    • MD5

      8477542c8013bd0697660609a5845dd3

    • SHA1

      800644dfe46fb92ec73f5456857b388c3b118022

    • SHA256

      0ee30b5532df951d5c18c3e780d534d795dd9166794b04c18da4056145e8cb05

    • SHA512

      ec1c653fc5e7bf4a1db0c46711917f121b08cf022e960a3e0de6ba9c1e66f5e1d715ace574d2e18838f11cfe5dfc3ad032ccf969d2cd5243efeed724f8c5bb35

    • SSDEEP

      6144:2Lyto9KMLecTR/bsUpbm97VQ8873FKBkDORsnb6ZYtZpdHiVXj:2LKo9PLecFTsU9m9E73FSRsnb6mHIj

    Score
    1/10
    behavioral5behavioral6

    • Target

      ddns-confgen.exe

    • Size

      48KB

    • MD5

      d33735b5113de2e8b1e88939ec1cf2ae

    • SHA1

      c0e53c5f5b34e6784a096681f84ef4444ef8023e

    • SHA256

      fb1aa05c74b2287192cbfd5405220c2a4c74bd93aae828f2801ef0cfe8b4546d

    • SHA512

      fb1fdc0e290b08d06f58bc25dfff0586853298a6215e194c4c5762c59197cca433f6d20828edce43c049474a1f49cf43b2f4b6b5367af1f04372cc992c625f3e

    • SSDEEP

      768:BqWLQRA7NGlvtBzh+LGmjO1lAHmUr/P4ywP:BqplVP6O1uHmUr/s

    Score
    1/10
    behavioral7behavioral8

    • Target

      dig.exe

    • Size

      148KB

    • MD5

      0b412f4fc8f575b0060ea040872a3130

    • SHA1

      043472407988544e0ff745b86e5065c1e2f00939

    • SHA256

      aaa83a5365faa61c0aa3850c4cc08dd4dc84029c50d9c6d69421409cd508373b

    • SHA512

      934dd80dc0953ba3e93e721135fa500ade2a7075e45db3243473e7814d5305240611c332ac296205f156ea28d6d69aaadd261f4c7e45f223c332c96f6412707d

    • SSDEEP

      3072:hPevywAZXkx2yO8IUJwlQNuyq1G+R6Pxj2pZmUj:J8I6+QNuywlaj2X

    Score
    1/10
    behavioral10behavioral9

    • Target

      dnssec-dsfromkey.exe

    • Size

      92KB

    • MD5

      60a8bdc42a8025681cd23f4acd127d88

    • SHA1

      c05a568cbf94f0033a415cc03fe61e3e642e4f11

    • SHA256

      8a58344b7394e6fbe55f12acc1438249f24ba4ad3627d7ea130a6c683d5a50e3

    • SHA512

      751a1974cb56e78f800e98caa061967168cbbaa2b542c69cbb1ac4b6aed9e6adf1dcc54eecc6957c4e5639691e36e619a675dbeba7d5563724791a25fa41b5d1

    • SSDEEP

      1536:usZKajoVdxGU8qM6SAYluVkydNF8M8ZEzOZvh7a1E8PXk8mUXz1h1nG:Ya0VLGU8qlYluVkydN7NzOZvVae8/k8/

    Score
    1/10
    behavioral11behavioral12

    • Target

      dnssec-keyfromlabel.exe

    • Size

      92KB

    • MD5

      8054b99daaff13694002c11598eb7dc4

    • SHA1

      57fb3b2525b515cf29c5ada0396ec464288bf1f4

    • SHA256

      95265f9a0808e70ba065da82580966a7384ea7fc24d54c6573fb8dd517cc1904

    • SHA512

      8a35fb6d84f19fb11cad72d846ad02db246e7ebb6940971c8bd978e0774c362960cbb5b99f4f520dd6d58dc66c2a2d9bb7c5799a4bb96cc8dcbb551a4a4ab2a0

    • SSDEEP

      1536:Q7prvo9VyT+ItBzPOkIWcvH2OZBc+2k7mUD9:fAHzPOkIWo2OZ++2k7mUD

    Score
    1/10
    behavioral13behavioral14

    • Target

      dnssec-keygen.exe

    • Size

      104KB

    • MD5

      051e25ff295d7b9c0eaba624d5aa293f

    • SHA1

      0d601960edb0482292abc77b4bd28f9280a2441a

    • SHA256

      6d04e3df9a17118bafd91a0cf3875409f117fe822971c5ad696cbff5c0027131

    • SHA512

      687f876ea399730e66cfc3fdb7b352f092bdbbf7a3e1aea781a4eca9b4112e73e064bb07548ad149ad115fa897f8cf197cdbf44ada73e08cf6d22585b3573082

    • SSDEEP

      3072:1ZSEhGZePd6OZULQAJZ3KWgsXb4kbmUY:1E1ZePcOZHK

    Score
    1/10
    behavioral15behavioral16

    • Target

      dnssec-revoke.exe

    • Size

      84KB

    • MD5

      92987de16a4a63cc4ebae4bfba54d86e

    • SHA1

      fbc6282a57900c27aeb0065ef42c7fede065b542

    • SHA256

      5bc078b82f5d2f4351a37d8caf96c844b7c7dec3dde478396151a5c6525808d7

    • SHA512

      a31efdbee4c6f55919f232c0054229fc05dae54e8d5d2194abfa934dd9e65cc28f6f0603f5b855952ca7abf22078268c6db61699c795ef6c0d8b3a331f4d8770

    • SSDEEP

      1536:C360EKjmf+G6K6SfwffGmOZjnMMtfk7mUsyY:0602+Gn6SfwWmOZjnMGk7mUsy

    Score
    1/10
    behavioral17behavioral18

    • Target

      dnssec-settime.exe

    • Size

      92KB

    • MD5

      ea24d4a0d658d358aadd00b60e99c83a

    • SHA1

      cd9dec0f990f312d6285d589634063e657fdfebc

    • SHA256

      c138e98a2deef044551446e8b3689a0728b6cb55b9e6552f6d550105319ede58

    • SHA512

      92d06439a912b36d275de6c679bb4935470dd874832dad34f8ed2e1ff5e1dbbb425d57ad88b250d9108e2115f227bff3ffd83e6f8e876e876c55618a69431ff8

    • SSDEEP

      1536:5pQ3YejhRvpX8T4Rzpe3OZ/7i2KGk7mU4K:fQTHZ8T4RI3OZ/7ZKGk7mU4

    Score
    1/10
    behavioral19behavioral20

    • Target

      dnssec-signzone.exe

    • Size

      156KB

    • MD5

      f0fc0e6a583a9e429a834e480bbbff40

    • SHA1

      4b5ee360c7e6541f6e96c9aa54080d448bed7cdd

    • SHA256

      ba5b33968f46217f5a7bc0065199c508823fc10a91e85646d945c2d5242d6ae0

    • SHA512

      9f5e3cec7cd562660a372bc3caa8088f9a64d4ef9919134437ad7945cb15ae1702a35c7c5f7fa4c782cb6f5f9e51834a2f5100ebe2cefd8163ef2d48df9c4200

    • SSDEEP

      3072:6mlbkcnh61TCHBaTT8zP8UnXOZtDeblCKil+hQxkMGUn:6/Wh60H438zP80XOZtCx6

    Score
    1/10
    behavioral21behavioral22

    • Target

      genrandom.exe

    • Size

      40KB

    • MD5

      6db7f6028c6bb88a303fa78ad33f6452

    • SHA1

      364434072105dfb35b4d59ec57c41dd5550f8c08

    • SHA256

      0c8ecb5b7b9159d658920f09f41939d7ffa631532336a8f04b0e3c397f0cb833

    • SHA512

      603fb06e2b74f1fc557921045f175763127f975441a3fc0bc81130088ca11d0d52dc786cd89c9c4faa07a77c27ec2c989f522f0764d50cd2e24e4eee827b7cee

    • SSDEEP

      384:DkSuHRskrQsU5Ho04zu75yenQbywA4dPxwUbggiGeK6dP:Dkj2Z5HofzG55nwA4dGUhUNP

    Score
    1/10
    behavioral23behavioral24

    • Target

      host.exe

    • Size

      124KB

    • MD5

      c6331a7ded6bdd15edc79cf1f1540d1c

    • SHA1

      1de0e63050d2332d4d7b822d1f9e16545190284f

    • SHA256

      1e0e3c05e8988c8f6b990a6c38a0199f994f2e6bee0fe3200e0198157566181c

    • SHA512

      3b65a0db577d82665705bd99665609f3510aa0e9068fac16a356c1d29f1449c5fe524199611615f9a38d080ad308e268a27db10f1e5da4cdb76f6df96aba634f

    • SSDEEP

      3072:hRKNKMNsdLy+JIZEv+bE2PxjG2iGUuFD:0KImLy+JYymjGZQD

    Score
    1/10
    behavioral25behavioral26

    • Target

      isc-hmac-fixup.exe

    • Size

      40KB

    • MD5

      f5fa362b9c4de748b7e27992450ce3d2

    • SHA1

      fb7e97de04bee491531af4d3e412cab62bfa8bc1

    • SHA256

      0f18086a0cc587b719b3c9d00e70d5c46e614b932784da68b33c33d9bbc5ec79

    • SHA512

      b6e431cac084ba50777215f29bda4338b0c570b0848901035c6fcbf85ae3c7832e70d2e8378a4292c989fd2fd07af1164aaa4e2fd11ddf4c5432f70d5e1c5838

    • SSDEEP

      384:aCZQ/KHVjJzr8AHfWjBulJ6vxwUbTruzR5s6oP:aC0kVjJzfu4EmUjurWP

    Score
    1/10
    behavioral27behavioral28

    • Target

      libbind9.dll

    • Size

      96KB

    • MD5

      867969070db62df83e509c567e5f4c65

    • SHA1

      2b157b998120cadda648acfe20af033b6d276fc8

    • SHA256

      c810ccc47291dfaad4dd323f445b34ee344d13dc0009e9ce2e28da3b72ac2181

    • SHA512

      b64a28902b66384acf1e124ea041374e3a5b05a0d640a23e35f2c728e2394ca0b8178bf2384a43e5d215f732960e95a9f91e470deff38efd593d15fe140687dd

    • SSDEEP

      1536:v3aEfdZKL6/yQyCCka6lJ3HRl6SgmUIJjPr:v3aEfdZc6Zyr6H3HRl0mUIJb

    Score
    1/10
    behavioral29behavioral30

    • Target

      libdns.dll

    • Size

      2.5MB

    • MD5

      95914ef8c6b4e0d3324817539c8a533b

    • SHA1

      1461d90a235e7cffc45e0aa775b64a44fa506fb8

    • SHA256

      840842f7dbcae82912d43d7c13072b26c0f83fb203c7151aaffa62e97dd01d4d

    • SHA512

      c14fcc4ac7871c85a1338b75f2be6865cbb8374d401e04c6c9611df72b3140e5d43d7bdc1689ee4fc6a59b969d9d3284538369b5504331e77e3b452ae43d634e

    • SSDEEP

      49152:G/XpR3qa3uK8cy3o7ohfzfsP2tqkSGmrNy:hYAzfsP2tqkSrNy

    Score
    1/10
    behavioral31behavioral32

MITRE ATT&CK Matrix

Tasks