d54f16157c3064a21d3e0eb943bed16c68b3d7fd336032e7395ed1502f0e9b56

Sharing

Copy URL Twitter E-mail

General

Target
4a5ddaa2c35d55e052d354bf0b17c07e
Size 3.2MB
Sample240108-eespmsbfd3
SHA256 d54f16157c3064a21d3e0eb943bed16c68b3d7fd336032e7395ed1502f0e9b56
MD5 4a5ddaa2c35d55e052d354bf0b17c07e
SHA1 49306d01502ec9113c0e4f62fbef37dcc11b7f99
SHA512 eee48cb17b58162cbb5f3320572221f933b75c3069f599a2fa5d875e765b53ef531593c71fbc534d0d4c2778632a234fde08f6f20ff3b4abf1875fdaf3abe88b
SSDEEP 49152:lrhhFu2GHFVKrWp4JO4BRS+U+akqVlzcELNwro9hgMDvZqF2s3KUe3O8:thhvGn/OJznDovLNwrowmc8GKhr
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

evasion

Malware Config

Targets

- Target
  百度营销王9.0/ChnCharInfo.dll
- Size 381KB
- SHA256 56c61d14fa39e167205125f3d77c0640cd2e991bfcdfc1050b0647c2d4b0d7dd
- MD5 b8bb34a6ecf0e61c750dd158f87fda14
- SHA1 a0246b347f07470c089672eb5e329b140156853b
- SHA512 d4fb2d82450a597418b3cfdca012939ff7204e2f1596c4dec2c7f462edaeb6882069fd594de643faf1bb118cd604a7ce84351f3c829998dccc9a8d15a01ed634
- SSDEEP 6144:aC8p4HNX4MGBJpV/o0ULr9Acp2AO57r6y8ZI9C7s7glZuDkl5NdCgP:aCq4t4BJvo0Kr9JFO57r6RZHI7mygP
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral1 behavioral2
- Target
  百度营销王9.0/DevComponents.DotNetBar2.dll
- Size 2.4MB
- SHA256 8122ac66237d02f22684737f44b959a295330bb0540e8d920ea1f30e70870052
- MD5 f44f0ed1eb08040c47b160ff57027e87
- SHA1 5e68e633223a2c918c79bd115c4eacc8e8cc70b7
- SHA512 6300bb83e0a3f9d1ed2f11f2cea222d75c093fe4873cfa64117f874fde1024de9b23a1c86c1047c29ce1d81dac4c266855fae1f166255c965dae4ba287136bc7
- SSDEEP 24576:2VNjZ9wl3IhV4lr3nr+ttYytsYne2sVMavxO1jQbNTJkNxfGgoG/RDp+y:2VNjZWie3wg+Z1jQbMNxfUEj
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral3 behavioral4
- Target
  百度营销王9.0/E路采集王.exe
- Size 172KB
- SHA256 54f75b7e43147f4743f0872834068239e9a9162725a27abe2b7f27a91f7331c2
- MD5 68acd38cf506c2169162b419684fac2d
- SHA1 679a31e5216ac5a77b9a1f0a7e3ead499d70d773
- SHA512 c3962bc3f9554bb60750d24ad636ef00b55f783c9e3ca321dc34fddbf02a43c38774b7da486551c750b7bdfc22075c102d6df9efb0be4f57c9f7bd73b4360682
- SSDEEP 3072:kJX+XN6fIpMBJdGh6Wci677M9LfF8mQDiKm9jy6Gtld9q9n1B3LHA:McN6fvw9fa8Vjy6iIvbg
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral5 behavioral6
- Target
  百度营销王9.0/Interop.MSXML2.dll
- Size 84KB
- SHA256 e6fe625e83568ce1b4e355eb2b07e28f89aec042db35fed6b91ce4e4d8b1fbc2
- MD5 5056857b59dde3735adc3f9464f994e5
- SHA1 ca108b10cc6ac441b91092de53346a8fb20a5fbd
- SHA512 75f05cc35378c21ef17abf8125161dc089fb9d846153eb14792e254cdeae804ef46e091852db0c64963b57e96b279e596454be061ec8edff5dd825d211a474c6
- SSDEEP 1536:6cqs/QtIEOwMoBUXvS7NqQKC8h3SaiSZaSA8:6cqMybUXvS7IQSlSa7HA8
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral7 behavioral8
- Target
  百度营销王9.0/Interop.SHDocVw.dll
- Size 128KB
- SHA256 a6e1f70d3d3ab78c121d17f4d13b7aa0b4aa405822039daae9ab5a80996fbf28
- MD5 182f052d92115aa5a04ae460c7a9e386
- SHA1 58d23fae166ab14b669ab76df64b53625d722ecd
- SHA512 9029587b7d7427307c7c581fed6dd5849d8eb6e7af9565e3dd20b5048e60659a501bc93285188c679c3158377b7f28a7ade88820c3c261ddad4b2a3ba03a9b78
- SSDEEP 3072:ONknBTRIuXP+EYJO/01arQhkze+psvCNATWR0X6VI7OZc/S9QjmBknKFYLmXwqUG:ONknBTRIuXP+EYJO/01arQhkze+psvCa
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral10 behavioral9
- Target
  百度营销王9.0/IrisSkin2.dll
- Size 528KB
- SHA256 49740ab7dbdadfa7554734d7ca59bd26d50d8486b16d3e44b68a0755dca22222
- MD5 47a971ed9601f1a3c00c8200dfd6dc79
- SHA1 0aa9bc5331bd29032ab04ef530c893baaddf2a57
- SHA512 8b0a8ad0eca5f0354dd7bb64b49f2c764070ad33de603603c195d6d0ec555df0464f2f15871d3dd29e89c4eb81de2e39448ee4660bf2590f2f20a27bfc5361fa
- SSDEEP 6144:HkZrzTZiuamzuW51XYIPsZM9ffjgZvyj5cuwIgDAm2kcTP2Z2fZjKRzdyJrJO6d9:pmzCIkI7YqzGzsvex6fBF
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral11 behavioral12
- Target
  百度营销王9.0/bdyxw.dll
- Size 612KB
- SHA256 287d9d1eda063f5ae88b4406f8e9d4253765973db8bf0492bdefca06ac348268
- MD5 47219494f11a6b58606b5395f8fe278a
- SHA1 6f2a8ed9ec2549c27db9a1f9650f7b432612c879
- SHA512 cfffe082c3246ad4395b376672fe6515d7b27ef409fe99494673fba40a11381ebe7035648ea3f788037b88c12dba87e4c106b74ce2ae9ca15dbfa9fbf220803a
- SSDEEP 12288:TlWVI+xREiLuaBLbni3oSkDJtFnvlDDOs4z410m9FPRk:xY2iL7BDF/Fn0s4P
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10

evasion
- Identifies Wine through registry keys
  Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
  evasion
behavioral13 behavioral14
- Target
  百度营销王9.0/bdyxw64.dll
- Size 439KB
- SHA256 fcfa201bef70ee6a6075df469166e31627b5c45b03f9570c23d56d410e35310b
- MD5 fb671b70aeec46224ac4dfaf6465db7e
- SHA1 9915a33d71e52270af91b6751564af1437cdaf18
- SHA512 ed4948fed2e8b61ab3eca2be14a950f40e1ac912aeae6f034e8a18b47eb59993decabdacf1ad9d36bb286b2a3c564e8cd51a063a512895de010c4b8ab31c62f0
- SSDEEP 6144:7hi37SC//ZTEN2cT8NOyvqA0DlID8zkDDmETZOD7EzJcCmSTK79:g/BEN2DQ+HoaDmET64zuRt
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral15 behavioral16
- Target
  百度营销王9.0/edithtm/index.html
- Size 1KB
- SHA256 9921f5bd2770a3b0ccf52a3090293ae5ae84eaa7d9882fbed1d4b2a80c8d68bd
- MD5 abe74dd0b84a7e1c38dde4367ce9716c
- SHA1 b87d72984b802879f0426fdf4fa3974c97126b78
- SHA512 1661a53f2b046bd791d5f956ca467b099ecdc8072fe18ca323b759c8b88ac516c96a53d22a32f354b9abbd1cf1202f308bf931d5f9898362162d0ac89118a8ef
- MD5 SHA1 SHA512
Score

1^/10
behavioral17 behavioral18
- Target
  百度营销王9.0/edithtm/kindeditor.js
- Size 99KB
- SHA256 22e4fb0664ad847a74d32821c256a8fbdac12eac994a9d5db900e78f33fbfa07
- MD5 427b3ae3c99f99ed947eabcdab1792c0
- SHA1 16d6edc0a578c0485eb5f70025433abb0069f394
- SHA512 3b906dd77af9ba2c2a9f2a0e3c269bed36c61e9b527150c229f8d9ad81ebab1193f33314747857b988606843f5afc3c0f64a912e47fa31b6acf5d470e3ede470
- SSDEEP 1536:Xd80vLsQv1fi1w5fQiwEiu35LSkP9FJ1b4/NYH2Bez:XBVLBNFiNnA
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral19 behavioral20
- Target
  百度营销王9.0/edithtm/plugins/flash.html
- Size 1KB
- SHA256 3341518351a806032bb362c8cd0cf8453fab62b7c7d93141ae24a508179b1358
- MD5 83ab29cf4df5516e1a25864670986226
- SHA1 a7024d907a2d5f14b48a7885c2f6fa41376f6573
- SHA512 ea81ac07632ed52c7b27134173768e3d492648b7bc992a26b5d240a01db8450d1f4b1ce999258ef71530a843e5adca88260870a6d2251c9dadea350a57257251
- MD5 SHA1 SHA512
Score

1^/10
behavioral21 behavioral22
- Target
  百度营销王9.0/edithtm/plugins/image.html
- Size 2KB
- SHA256 83b85221392e3ba7fe6db7152dfbc13d42b934ef8c93490da4674c58a423040a
- MD5 52c6dc32cb38d4fe97ed148e8f0f9c28
- SHA1 1e40d58e30ab95d2fd992aba041b3eb0eb788954
- SHA512 b3d4d7121d519d56335b8db0cd8f990ccf8ec661a7f36d191fa9d57c47a79f2a577af2a0cafcdb7896238d2f52329684549fc3a33881ca0c38b91cbe3fea03f5
- MD5 SHA1 SHA512
Score

1^/10
behavioral23 behavioral24
- Target
  百度营销王9.0/edithtm/plugins/link.html
- Size 1KB
- SHA256 4a8478c92e8f862fd3dadd11b1dfc611746d7b93da2c7a42c7aa41d4e33190a3
- MD5 0701348e336f3a896b972fc937322cae
- SHA1 163a2813b8e2fe08f5504162024eb8400b53550f
- SHA512 78f19389f9e0e7773010723262e4469f815392f149d4f07619387f2b4b97829fa2207d463ae665237d57d5f4c08bd5838a1d428bbbd7d567b2b1f0887f4d9bbe
- MD5 SHA1 SHA512
Score

1^/10
behavioral25 behavioral26
- Target
  百度营销王9.0/edithtm/plugins/media.html
- Size 1KB
- SHA256 12be76c980713a51d5375baf25e5f8876294dda1e8722035fe7d071e676f1e37
- MD5 aecedfb98e24df94664b077d43ed70c3
- SHA1 579877beaec34c69d2490ffac9e14d9bd34cb0ee
- SHA512 a30c8c0cc896a876d528ecb5f4302e3cb9f80f9cdfac3bfb80e589a946a32c1fa9ef470b234d2adf5b6911fa114663c6c949caf0f219a35e8712da0d71a78207
- MD5 SHA1 SHA512
Score

1^/10
behavioral27 behavioral28
- Target
  百度营销王9.0/edithtm/plugins/plainpaste.html
- Size 773B
- SHA256 b9fdfb1686668b4e8ed9179d0455f72d8e53a1389dd996ce24d3d976b109f598
- MD5 d69c76f3ba8734795415ccde66f7fb5f
- SHA1 f0a2f54043738dae7a64b8b75b44de9cd26c764f
- SHA512 876dd79b4e566b65697d054d873eff545fab5344e2c0c39bef2b11deb9e19a05f2f45da3d338b585eb4e01b65fcefa328c2e6a7731b893945c03961354d1f5d0
- MD5 SHA1 SHA512
Score

1^/10
behavioral29 behavioral30
- Target
  百度营销王9.0/edithtm/plugins/remote_image.html
- Size 1KB
- SHA256 d6351898e62c55185743b2081ddb72a01d906a586f4b52c36144c65c606fd529
- MD5 ab867121c1745afde232c16c27cfef11
- SHA1 ac013a9caf4f0a520adef6dde8246d34d6f89f90
- SHA512 1dac18265018fd7c36092cc425d388a307aaa2f3c475aee349d9c4d8fd3fdd85443865d90beee26f2783e1a6f9136290f04986f2ca4fa29062b62a8382c10e48
- MD5 SHA1 SHA512
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Identifies Wine through registry keys

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32