Overview
overview
7Static
static
3ButterFly ...gh.exe
windows7-x64
1ButterFly ...gh.exe
windows10-2004-x64
1ButterFly ....1.exe
windows7-x64
7ButterFly ....1.exe
windows10-2004-x64
7ButterFly ...sp.dll
windows7-x64
3ButterFly ...sp.dll
windows10-2004-x64
3ButterFly ...pp.dll
windows7-x64
3ButterFly ...pp.dll
windows10-2004-x64
3ButterFly ...cp.dll
windows7-x64
1ButterFly ...cp.dll
windows10-2004-x64
1ButterFly ...li.exe
windows7-x64
5ButterFly ...li.exe
windows10-2004-x64
5ButterFly ...te.exe
windows7-x64
1ButterFly ...te.exe
windows10-2004-x64
1ButterFly ...EL.dll
windows7-x64
1ButterFly ...EL.dll
windows10-2004-x64
1Analysis
-
max time kernel
151s -
max time network
132s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
26/12/2023, 01:58
Static task
static1
Behavioral task
behavioral1
Sample
ButterFly BotByZeRo/Butterfly Wizard High.exe
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral2
Sample
ButterFly BotByZeRo/Butterfly Wizard High.exe
Resource
win10v2004-20231222-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
ButterFly BotByZeRo/QQdaili_2.1.exe
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral4
Sample
ButterFly BotByZeRo/QQdaili_2.1.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
ButterFly BotByZeRo/QQdaili_2.1/gamelsp.dll
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral6
Sample
ButterFly BotByZeRo/QQdaili_2.1/gamelsp.dll
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
ButterFly BotByZeRo/QQdaili_2.1/gameppp.dll
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral8
Sample
ButterFly BotByZeRo/QQdaili_2.1/gameppp.dll
Resource
win10v2004-20231222-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
ButterFly BotByZeRo/QQdaili_2.1/gametcp.dll
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral10
Sample
ButterFly BotByZeRo/QQdaili_2.1/gametcp.dll
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
ButterFly BotByZeRo/QQdaili_2.1/qqdaili.exe
Resource
win7-20231129-en
windows7-x64
Behavioral task
behavioral12
Sample
ButterFly BotByZeRo/QQdaili_2.1/qqdaili.exe
Resource
win10v2004-20231222-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
ButterFly BotByZeRo/QQdaili_2.1/update.exe
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral14
Sample
ButterFly BotByZeRo/QQdaili_2.1/update.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
ButterFly BotByZeRo/SkinH_EL.dll
Resource
win7-20231129-en
windows7-x64
Behavioral task
behavioral16
Sample
ButterFly BotByZeRo/SkinH_EL.dll
Resource
win10v2004-20231215-en
windows10-2004-x64
General
-
Target
ButterFly BotByZeRo/Butterfly Wizard High.exe
-
Size
1.3MB
-
MD5
1c06e24dc17612c64638ecc9439ff588
-
SHA1
b8c3cb71634fd420ebf8fd332973c3fbc9fde419
-
SHA256
cc4deffa08046a112e2c5561ffef6956fa32adf74e9a02815da6a180edefa8b1
-
SHA512
7ee58d916bf0198b64d702173081b06380dd165b4c78f6a8d348e9758c53813b2f670a0a7d9b8ffcb6ddd6a4ff29be845504ef7b3fe9b6fea10f898f6204121e
-
SSDEEP
24576:C/SS8OuGgzOKH8HTPWcXtwHW4l6AFA7JAJ:C6CgzCzpXuDUAFA7JAJ
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1704 Butterfly Wizard High.exe 1704 Butterfly Wizard High.exe 1704 Butterfly Wizard High.exe 1704 Butterfly Wizard High.exe 1704 Butterfly Wizard High.exe 1704 Butterfly Wizard High.exe 1704 Butterfly Wizard High.exe 1704 Butterfly Wizard High.exe 1704 Butterfly Wizard High.exe 1704 Butterfly Wizard High.exe 1704 Butterfly Wizard High.exe 1704 Butterfly Wizard High.exe 1704 Butterfly Wizard High.exe 1704 Butterfly Wizard High.exe 1704 Butterfly Wizard High.exe 1704 Butterfly Wizard High.exe 1704 Butterfly Wizard High.exe 1704 Butterfly Wizard High.exe 1704 Butterfly Wizard High.exe 1704 Butterfly Wizard High.exe 1704 Butterfly Wizard High.exe 1704 Butterfly Wizard High.exe 1704 Butterfly Wizard High.exe 1704 Butterfly Wizard High.exe 1704 Butterfly Wizard High.exe 1704 Butterfly Wizard High.exe 1704 Butterfly Wizard High.exe 1704 Butterfly Wizard High.exe 1704 Butterfly Wizard High.exe 1704 Butterfly Wizard High.exe 1704 Butterfly Wizard High.exe 1704 Butterfly Wizard High.exe 1704 Butterfly Wizard High.exe 1704 Butterfly Wizard High.exe 1704 Butterfly Wizard High.exe 1704 Butterfly Wizard High.exe 1704 Butterfly Wizard High.exe 1704 Butterfly Wizard High.exe 1704 Butterfly Wizard High.exe 1704 Butterfly Wizard High.exe 1704 Butterfly Wizard High.exe 1704 Butterfly Wizard High.exe 1704 Butterfly Wizard High.exe 1704 Butterfly Wizard High.exe 1704 Butterfly Wizard High.exe 1704 Butterfly Wizard High.exe 1704 Butterfly Wizard High.exe 1704 Butterfly Wizard High.exe 1704 Butterfly Wizard High.exe 1704 Butterfly Wizard High.exe 1704 Butterfly Wizard High.exe 1704 Butterfly Wizard High.exe 1704 Butterfly Wizard High.exe 1704 Butterfly Wizard High.exe 1704 Butterfly Wizard High.exe 1704 Butterfly Wizard High.exe 1704 Butterfly Wizard High.exe 1704 Butterfly Wizard High.exe 1704 Butterfly Wizard High.exe 1704 Butterfly Wizard High.exe 1704 Butterfly Wizard High.exe 1704 Butterfly Wizard High.exe 1704 Butterfly Wizard High.exe 1704 Butterfly Wizard High.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 1704 Butterfly Wizard High.exe 1704 Butterfly Wizard High.exe 1704 Butterfly Wizard High.exe