ploutus | jackpotting[.]zip

General

Target
jackpotting.zip
Size 34KB
Sample240106-sd8w5acbe8
SHA256 fa740e4e8c47b04507fc0176eb9f47ef024ab28e95f5aeed8f49b24522cddfa2
MD5 01bb500d8cf00d6fb2e68f0b1d88132f
SHA1 964e614658c7cd99674d6da7c39157bfe2e4c5f7
SHA512 06953176fe2ccddc7e4c202efe2f751881ebc4f646075b9e94da5876e84610f8f0b0f8a5d999be2ae5c91f361cfb79a0b5db8a31a08e802da6f616639bc4f1a3
SSDEEP 768:gQQGhUbecPPRG+bl1xgTW8JK0X7sAB2zEIclCXKK10Rvtzzw:5gpb1mi8tLBB2zEEt0ZU
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

ploutus

Malware Config

Signatures

Detected Ploutus loader 1 IoCs

resource	yara_rule
static1/unpack001/AgilisConfigurationUtilityN - Copy.exe	family_ploutus

Ploutus family
ploutus

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/AgilisConfigurationUtilityN - Copy.exe

File Explorer

jackpotting.zip

.zip 34KB
AgilisConfigurationUtilityN - Copy.exe

.exe 91KB

jackpotting.zip

SHA256 fa740e4e8c47b04507fc0176eb9f47ef024ab28e95f5aeed8f49b24522cddfa2
MD5 01bb500d8cf00d6fb2e68f0b1d88132f
SHA1 964e614658c7cd99674d6da7c39157bfe2e4c5f7
SHA512 06953176fe2ccddc7e4c202efe2f751881ebc4f646075b9e94da5876e84610f8f0b0f8a5d999be2ae5c91f361cfb79a0b5db8a31a08e802da6f616639bc4f1a3
SSDEEP 768:gQQGhUbecPPRG+bl1xgTW8JK0X7sAB2zEIclCXKK10Rvtzzw:5gpb1mi8tLBB2zEEt0ZU
MD5 SHA1 SHA512 SSDEEP

Password

infected

AgilisConfigurationUtilityN - Copy.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 146abbb4c7291130b1618ae8c99148eeaf3d64b4a583734ae3246e9a0102e8ac
MD5 b0e393a8a49bb79373acd0531b9b9156
SHA1 ab2e062b1d7b50e61ab03a7771099e2c7d5efdb9
SHA512 7ace25c49c4a16a79ff8263cda56099700161b2af9d5a1f3a21ca260bf448747b62b1a016d96ba96102f03693f925614a6aefa8f676499a14204f9eeac5004df
SSDEEP 1536:jUxjLlkHphKAg3HRdFWarr7ZDnXMKtgaUtNGl2y84TPnBGUqEk/WauqfNIstSHV:jUxjLlkHpQfdFRDnCNS2wB0DXfRSHV
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Detected Ploutus loader
Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

0

Major OS version

4

Entry point

97118

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

jackpotting.zip

AgilisConfigurationUtilityN - Copy.exe

mscoree

dotnet

Sharing

General

Malware Config

Signatures

File Explorer

jackpotting.zip

AgilisConfigurationUtilityN - Copy.exe

mscoree

dotnet