General

  • Target

    902c0748e8911632a43a2e04d40b79c5

  • Size

    9.1MB

  • Sample

    240204-z35z4adabj

  • MD5

    902c0748e8911632a43a2e04d40b79c5

  • SHA1

    52c6149f9c6be70e0abdd48d82e890a49d96765d

  • SHA256

    3a41ebcd198dde9831095a035abb241bff819739976a7e481fa9b384ec73439f

  • SHA512

    1e613a1cdc166593f3fa8f97c9027669be28401a4c0acb41dbccba1d1ba186157af8f703eb44535971d8e3d092746b00a447e2e2e5314929b3147fa26269b0ae

  • SSDEEP

    196608:UOvErjzQNFtqB3T7YpBtGo84ChWcn7txAdYcNM75JGf6q5QLBkb7ty55:UKE/U/u3TsUR4CFn7txAdla7lKQq855

Malware Config

Targets

    • Target

      zhugeqm.exe

    • Size

      9.2MB

    • MD5

      85032a9876284e13f8f748026ce93654

    • SHA1

      bdff1fed5522a107a5a2c7a40e1a8e72ae6c0c3d

    • SHA256

      711296508c03f942d3f238ae0b0edd4c0c10520343d63abae6590022684ee71c

    • SHA512

      cd0f9fbaae8ddbb874b8ecc9adadba91be27fbb05f11886e47ba5057110a8bf15b19a903aafe73dfbb71cc17018c75db6755998448e8259b9a1dcf348876129e

    • SSDEEP

      196608:J5s3DVso/7ZT7AqDubJ0hVq/zG30SVuVnM:J5sTVso/7ZT5DFhlEaOnM

    • Modifies firewall policy service

    • Drops file in Drivers directory

    • Manipulates Digital Signatures

      Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to obtain their binary as valid.

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Installs/modifies Browser Helper Object

      BHOs are DLL modules which act as plugins for Internet Explorer.

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

MITRE ATT&CK Enterprise v15

Tasks