ploutus | fdd43450dd4fbb4401851aa82f46b392e2e6d721a456db2eedafe566de6d7c7f | Triage

Submit
Reports

Overview

overview

Static

static

1

fdd43450dd...7f.msi

windows7-x64

fdd43450dd...7f.msi

windows10-2004-x64

6

Sharing

General

Target

fdd43450dd4fbb4401851aa82f46b392e2e6d721a456db2eedafe566de6d7c7f
Size

119.6MB
Sample

240206-ma9rcseaa9
MD5

762693a76e48c511441139a32e1b0afe
SHA1

3d8bac6a67b71d52f4a2bf547e7140297fa61dc9
SHA256

fdd43450dd4fbb4401851aa82f46b392e2e6d721a456db2eedafe566de6d7c7f
SHA512

48d4a6c039392534f021d45e6fdca287270599ef985555add06a8b3e12cd6279d9a01b33355e87bf794561741dca585302ef70fa5ebca0a9cdfbf2bb76ada4a4
SSDEEP

3145728:n57bFe0N9sOVo+N+/k++ODv87wtE1ODuaoIZ4DwiuJou:n15yOVoiyk9Qv8MtIQuaL4Dwz

Score

10^/10

ploutus atm backdoor persistence

Static task

static1

Behavioral task

behavioral1

Sample

fdd43450dd4fbb4401851aa82f46b392e2e6d721a456db2eedafe566de6d7c7f.msi

Resource

win7-20231215-en

ploutus atm backdoor persistence

windows7-x64

16 signatures

150 seconds

Behavioral task

behavioral2

Sample

fdd43450dd4fbb4401851aa82f46b392e2e6d721a456db2eedafe566de6d7c7f.msi

Resource

win10v2004-20231222-en

windows10-2004-x64

5 signatures

150 seconds

Malware Config

Targets

- Target
  
  fdd43450dd4fbb4401851aa82f46b392e2e6d721a456db2eedafe566de6d7c7f
- Size
  
  119.6MB
- MD5
  
  762693a76e48c511441139a32e1b0afe
- SHA1
  
  3d8bac6a67b71d52f4a2bf547e7140297fa61dc9
- SHA256
  
  fdd43450dd4fbb4401851aa82f46b392e2e6d721a456db2eedafe566de6d7c7f
- SHA512
  
  48d4a6c039392534f021d45e6fdca287270599ef985555add06a8b3e12cd6279d9a01b33355e87bf794561741dca585302ef70fa5ebca0a9cdfbf2bb76ada4a4
- SSDEEP
  
  3145728:n57bFe0N9sOVo+N+/k++ODv87wtE1ODuaoIZ4DwiuJou:n15yOVoiyk9Qv8MtIQuaL4Dwz
Score

10^/10

ploutus atm backdoor persistence
- Detected Ploutus loader
- Ploutus
  Ploutus is an ATM malware written in C#.
  backdoor atm ploutus
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

ploutusatmbackdoorpersistence

behavioral2

© 2018-2024

Terms | Privacy