x360ce.zip
- SHA256 908babf5e35f2c31922744e1bf78990f9c1edbc5f7c1ce950812e920e60da1e9
Behavioral task
behavioral1
Sample
x360ce.exe
Resource
win7-20231130-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
x360ce.exe
Resource
win10v2004-20231127-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target x360ce.zip
- Size 12.8MB
- Sample231203-xtltraed6z
- SHA256 908babf5e35f2c31922744e1bf78990f9c1edbc5f7c1ce950812e920e60da1e9
- MD5 425b3e1e66c3ce08449f229c716beedf
- SHA1 0aaaa0795d232e41443ad1b298de82f55f75d704
- SHA512 81942032a261ae5e446829b36d0142f009840b00b645ab82445a4ee1c6e7a50449f425ed8a35d994411672f159f58e1d69eac625c90e4602fa1f8d64b0015199
- SSDEEP 393216:npWZYcR4z9GHzAklmHqaps9I4RO1PT/+nRr10:pWZqzszUHi9APTWnt10
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Detected Ploutus loader 1 IoCs
resource yara_rule static1/unpack001/x360ce.exe family_ploutus - Ploutus family
File Explorer
-
x360ce.zip.zip 12.8MB
-
x360ce.exe.exe 14.7MB
x360ce.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 74faf334cb0bdd3e9dfab8c323d4eb3b9b089bcaadc7dbd639d9aa93a4f6f829
- MD5 be80f3348b240bcee1aa96d33fe0e768
- SHA1 40ea5de9a7a15f6e0d891cd1ba4bca8519bb85ed
- SHA512 dfb3b191152981f21180e93597c7b1891da6f10b811db2c8db9f45bbecc9feb54bc032bdd648c7ad1134e9b09e5e2b9705d5e21294e1ae328a4390350745536a
- SSDEEP 196608:n+/7/fO/vBSVnf+viDyJBwhsCArf+viDyJBQhsCAaIF/f+viDyJBaF9hsCA6EJ0k:nX/vu0Bwhs8vu0BQhsvFOvu0BaF9hsR
- MD5 SHA1 SHA512 SSDEEP
-
Detected Ploutus loader
Digest
c3:56:43:57:63:22:9e:04:ce:38:45:79:02:4c:9b:30:e6:57:8c:79:e9:00:79:14:e5:82:aa:8a:b1:91:38:46
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Evaldas Jocys,O=Evaldas Jocys,POSTALCODE=W12 0LX,STREET=Wormholt Road+STREET=5 Cleverly Estate,L=London,C=US
Chains
Nov 15, 2020
CN=Evaldas Jocys,O=Evaldas Jocys,POSTALCODE=W12 0LX,STREET=Wormholt Road+STREET=5 Cleverly Estate,L=London,C=US
CN=GoGetSSL RSA Codesigning CA,O=GoGetSSL,L=Riga,C=LV
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
CN=Evaldas Jocys,O=Evaldas Jocys,POSTALCODE=W12 0LX,STREET=Wormholt Road+STREET=5 Cleverly Estate,L=London,C=US
CN=GoGetSSL RSA Codesigning CA,O=GoGetSSL,L=Riga,C=LV
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB
Subject
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Serial Number
39:72:44:3a:f9:22:b7:51:d7:d3:6c:10:dd:31:35:95
Issuer
CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Mar 12, 2019 - Dec 31, 2028
Subject
CN=GoGetSSL RSA Codesigning CA,O=GoGetSSL,L=Riga,C=LV
Serial Number
1a:6e:54:ff:9f:9c:e0:f8:ea:cb:e7:a0:ab:56:9d:32
Issuer
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Sep 6, 2018 - Sep 5, 2028
Subject
CN=Evaldas Jocys,O=Evaldas Jocys,POSTALCODE=W12 0LX,STREET=Wormholt Road+STREET=5 Cleverly Estate,L=London,C=US
Serial Number
6c:c7:a2:8d:3a:6f:d3:39:ec:e4:bf:53:58:03:b5:16
Issuer
CN=GoGetSSL RSA Codesigning CA,O=GoGetSSL,L=Riga,C=LV
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Aug 1, 2020 - Aug 1, 2023
Subject
CN=Sectigo RSA Time Stamping Signer #2,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6b
Issuer
CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 23, 2020 - Jan 22, 2032
Subject
CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Issuer
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
May 2, 2019 - Jan 18, 2038
Minor OS version
0
Major OS version
4
Entry point
15307522
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
14.6MB
Virtual Size
14.6MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
146KB
Virtual Size
145KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ