Overview
overview
7Static
static
7Actions/LogViewer.py
windows7-x64
3Actions/LogViewer.py
windows10-2004-x64
3Actions/Pr...ter.py
windows7-x64
3Actions/Pr...ter.py
windows10-2004-x64
3Actions/Re...wer.py
windows7-x64
3Actions/Re...wer.py
windows10-2004-x64
3Actions/__...38.pyc
windows7-x64
3Actions/__...38.pyc
windows10-2004-x64
3Actions/__...38.pyc
windows7-x64
3Actions/__...38.pyc
windows10-2004-x64
3Actions/__...38.pyc
windows7-x64
3Actions/__...38.pyc
windows10-2004-x64
3Actions/__...38.pyc
windows7-x64
3Actions/__...38.pyc
windows10-2004-x64
3Actions/__...38.pyc
windows7-x64
3Actions/__...38.pyc
windows10-2004-x64
3Actions/preload.py
windows7-x64
3Actions/preload.py
windows10-2004-x64
3CLib/__pyc...38.pyc
windows7-x64
3CLib/__pyc...38.pyc
windows10-2004-x64
3CLib/__pyc...38.pyc
windows7-x64
3CLib/__pyc...38.pyc
windows10-2004-x64
3CLib/__pyc...38.pyc
windows7-x64
3CLib/__pyc...38.pyc
windows10-2004-x64
3CLib/__pyc...38.pyc
windows7-x64
3CLib/__pyc...38.pyc
windows10-2004-x64
3CLib/__pyc...38.pyc
windows7-x64
3CLib/__pyc...38.pyc
windows10-2004-x64
3CLib/__pyc...38.pyc
windows7-x64
3CLib/__pyc...38.pyc
windows10-2004-x64
3CLib/__pyc...38.pyc
windows7-x64
3CLib/__pyc...38.pyc
windows10-2004-x64
3Behavioral task
behavioral1
Sample
Actions/LogViewer.py
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
Actions/LogViewer.py
Resource
win10v2004-20231127-en
Behavioral task
behavioral3
Sample
Actions/ProgressUpdater.py
Resource
win7-20231023-en
Behavioral task
behavioral4
Sample
Actions/ProgressUpdater.py
Resource
win10v2004-20231127-en
Behavioral task
behavioral5
Sample
Actions/ReportViewer.py
Resource
win7-20231020-en
Behavioral task
behavioral6
Sample
Actions/ReportViewer.py
Resource
win10v2004-20231127-en
Behavioral task
behavioral7
Sample
Actions/__pycache__/LogViewer.cpython-38.pyc
Resource
win7-20231023-en
Behavioral task
behavioral8
Sample
Actions/__pycache__/LogViewer.cpython-38.pyc
Resource
win10v2004-20231127-en
Behavioral task
behavioral9
Sample
Actions/__pycache__/ProgressUpdater.cpython-38.pyc
Resource
win7-20231023-en
Behavioral task
behavioral10
Sample
Actions/__pycache__/ProgressUpdater.cpython-38.pyc
Resource
win10v2004-20231127-en
Behavioral task
behavioral11
Sample
Actions/__pycache__/ReportViewer.cpython-38.pyc
Resource
win7-20231020-en
Behavioral task
behavioral12
Sample
Actions/__pycache__/ReportViewer.cpython-38.pyc
Resource
win10v2004-20231127-en
Behavioral task
behavioral13
Sample
Actions/__pycache__/__init__.cpython-38.pyc
Resource
win7-20231020-en
Behavioral task
behavioral14
Sample
Actions/__pycache__/__init__.cpython-38.pyc
Resource
win10v2004-20231127-en
Behavioral task
behavioral15
Sample
Actions/__pycache__/preload.cpython-38.pyc
Resource
win7-20231023-en
Behavioral task
behavioral16
Sample
Actions/__pycache__/preload.cpython-38.pyc
Resource
win10v2004-20231127-en
Behavioral task
behavioral17
Sample
Actions/preload.py
Resource
win7-20231020-en
Behavioral task
behavioral18
Sample
Actions/preload.py
Resource
win10v2004-20231127-en
Behavioral task
behavioral19
Sample
CLib/__pycache__/Activeusers.cpython-38.pyc
Resource
win7-20231025-en
Behavioral task
behavioral20
Sample
CLib/__pycache__/Activeusers.cpython-38.pyc
Resource
win10v2004-20231127-en
Behavioral task
behavioral21
Sample
CLib/__pycache__/CDS.cpython-38.pyc
Resource
win7-20231023-en
Behavioral task
behavioral22
Sample
CLib/__pycache__/CDS.cpython-38.pyc
Resource
win10v2004-20231127-en
Behavioral task
behavioral23
Sample
CLib/__pycache__/CustomerCount.cpython-38.pyc
Resource
win7-20231023-en
Behavioral task
behavioral24
Sample
CLib/__pycache__/CustomerCount.cpython-38.pyc
Resource
win10v2004-20231127-en
Behavioral task
behavioral25
Sample
CLib/__pycache__/Testlog.cpython-38.pyc
Resource
win7-20231020-en
Behavioral task
behavioral26
Sample
CLib/__pycache__/Testlog.cpython-38.pyc
Resource
win10v2004-20231127-en
Behavioral task
behavioral27
Sample
CLib/__pycache__/UBILogin.cpython-38.pyc
Resource
win7-20231023-en
Behavioral task
behavioral28
Sample
CLib/__pycache__/UBILogin.cpython-38.pyc
Resource
win10v2004-20231127-en
Behavioral task
behavioral29
Sample
CLib/__pycache__/__init__.cpython-38.pyc
Resource
win7-20231025-en
Behavioral task
behavioral30
Sample
CLib/__pycache__/__init__.cpython-38.pyc
Resource
win10v2004-20231127-en
Behavioral task
behavioral31
Sample
CLib/__pycache__/config.cpython-38.pyc
Resource
win7-20231023-en
Behavioral task
behavioral32
Sample
CLib/__pycache__/config.cpython-38.pyc
Resource
win10v2004-20231127-en
General
-
Target
a0c74578e8b730d900778299109e0d338d282dfcfb8f0bd84edf35bcd4417875
-
Size
1.3MB
-
MD5
c16c42ef9c5c7c0963dfe950c2b36051
-
SHA1
13cd60a0155a2bd13fcd2872480e04ede8f111a1
-
SHA256
a0c74578e8b730d900778299109e0d338d282dfcfb8f0bd84edf35bcd4417875
-
SHA512
5eecd6156e1a7b6d149d7ad6d0d2ed5b05e6f8f5d4cec6bd76139e645ecb10cfc90e25c477563dc148a026b35e784f5a85b21828b3382090a1abde9335869434
-
SSDEEP
24576:Wj0xhf5V1bwsf1//LiUbgPI+lFpXuusMDxTKKtyoUAbSwHRkA7Ab:00Lb1Tfp/LiUm/YusOTyVwHmUa
Malware Config
Signatures
-
resource yara_rule static1/unpack001/bin/upload.exe upx -
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule static1/unpack004/out.upx autoit_exe -
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/bin/upload.exe unpack004/out.upx
Files
-
a0c74578e8b730d900778299109e0d338d282dfcfb8f0bd84edf35bcd4417875.zip
-
.pylintrc
-
Actions/.gitignore
-
Actions/LogViewer.py
-
Actions/ProgressUpdater.py
-
Actions/ReportViewer.py
-
Actions/__pycache__/LogViewer.cpython-38.pyc
-
Actions/__pycache__/ProgressUpdater.cpython-38.pyc
-
Actions/__pycache__/ReportViewer.cpython-38.pyc
-
Actions/__pycache__/__init__.cpython-38.pyc
-
Actions/__pycache__/preload.cpython-38.pyc
-
Actions/preload.py
-
CLib/__pycache__/Activeusers.cpython-38.pyc
-
CLib/__pycache__/CDS.cpython-38.pyc
-
CLib/__pycache__/CustomerCount.cpython-38.pyc
-
CLib/__pycache__/Testlog.cpython-38.pyc
-
CLib/__pycache__/UBILogin.cpython-38.pyc
-
CLib/__pycache__/__init__.cpython-38.pyc
-
CLib/__pycache__/config.cpython-38.pyc
-
CLib/__pycache__/customer2021.cpython-38.pyc
-
CLib/__pycache__/deposit.cpython-38.pyc
-
CLib/__pycache__/log.cpython-38.pyc
-
CLib/__pycache__/masrt.cpython-38.pyc
-
CLib/__pycache__/masrtsearch.cpython-38.pyc
-
CLib/__pycache__/masrtsearchnew.cpython-38.pyc
-
CLib/__pycache__/preload.cpython-38.pyc
-
CLib/__pycache__/yfdailyloan.cpython-38.pyc
-
CLib/__pycache__/zhh_jaj_financing_to_public.cpython-38.pyc
-
CLib/__pycache__/zhjEntELoan.cpython-38.pyc
-
CLib/masrtsearchnew.py
-
CLib/utility/SQLServer.py
-
CLib/utility/UBILogin.py.py .js
-
CLib/utility/__pycache__/UBILogin.cpython-38.pyc.js
-
CLib/utility/__pycache__/__init__.cpython-38.pyc
-
CLib/utility/__pycache__/config.cpython-38.pyc
-
CLib/utility/__pycache__/log.cpython-38.pyc
-
CLib/utility/__pycache__/log_test.cpython-38.pyc
-
CLib/utility/__pycache__/organization.cpython-38.pyc
-
CLib/utility/config.py
-
CLib/utility/log.py
-
CLib/utility/log_test.py
-
CLib/utility/notesmail.py
-
CLib/utility/organization.py
-
CLib/utility/test.py
-
Config/config.ini
-
Config/params.ini
-
Data/Result/Result.zip.zip
-
受益人截图上传进度.xlsx.xlsx office2007
-
Data/Result/_blank.zip.zip
-
Service/.gitignore
-
Service/AMLData.py
-
Service/Window.py
-
Service/__pycache__/AMLData.cpython-38.pyc
-
Service/__pycache__/Window.cpython-38.pyc
-
Service/__pycache__/__init__.cpython-38.pyc
-
bin/upload.exe.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 552KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 338KB - Virtual size: 340KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 27KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
out.upx.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 563KB - Virtual size: 562KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 178KB - Virtual size: 177KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 24KB - Virtual size: 39KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 36KB - Virtual size: 35KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 40KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
main.py
-
ui/.gitignore
-
ui/__pycache__/__init__.cpython-38.pyc
-
ui/html/css/form.css
-
ui/html/css/robot.css
-
ui/html/css/robot.less
-
ui/html/form.html.html
-
ui/html/images/btn-bg.png.png
-
ui/html/images/close.png.png
-
ui/html/images/error.png.png
-
ui/html/images/exit-a.png.png
-
ui/html/images/exit-b.png.png
-
ui/html/images/exit-btn.png.png
-
ui/html/images/icon-form.png.png
-
ui/html/images/min-a.png.png
-
ui/html/images/min-b.png.png
-
ui/html/images/rb-1.png.png
-
ui/html/images/rb-2.png.png
-
ui/html/images/rb-3.png.png
-
ui/html/images/rb-4.png.png
-
ui/html/js/commiter.js.js
-
ui/html/js/jquery.min.js.js
-
ui/html/js/qwebchannel.js.js
-
ui/html/js/robot.js.js
-
ui/html/js/updater.js.js
-
ui/html/robot.html.html
-
ui/logic/.gitignore
-
ui/logic/__pycache__/__init__.cpython-38.pyc
-
ui/logic/__pycache__/webwindow.cpython-38.pyc
-
ui/logic/__pycache__/window.cpython-38.pyc
-
ui/logic/webwindow.py
-
ui/logic/window.py