Overview

overview

7

Static

static

7

96c4b7f0b5...2b.exe

windows7-x64

3

96c4b7f0b5...2b.exe

windows10-2004-x64

3

$PLUGINSDI...er.dll

windows7-x64

3

$PLUGINSDI...er.dll

windows10-2004-x64

3

$PLUGINSDI...ns.dll

windows7-x64

3

$PLUGINSDI...ns.dll

windows10-2004-x64

3

$PLUGINSDI...LL.dll

windows7-x64

3

$PLUGINSDI...LL.dll

windows10-2004-x64

3

$PLUGINSDI...dl.dll

windows7-x64

3

$PLUGINSDI...dl.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDIR/XML.dll

windows7-x64

3

$PLUGINSDIR/XML.dll

windows10-2004-x64

3

$PLUGINSDI...er.dll

windows7-x64

3

$PLUGINSDI...er.dll

windows10-2004-x64

3

$TEMP/kcheck.dll

windows7-x64

7

$TEMP/kcheck.dll

windows10-2004-x64

7

kcheck2.dll

windows7-x64

1

kcheck2.dll

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    96c4b7f0b5f386e7157dee8d6873812b

  • Size

    469KB

  • Sample

    240212-kwgatsba96

  • MD5

    96c4b7f0b5f386e7157dee8d6873812b

  • SHA1

    fcf257d5e3ba8c9fa17d3c346d4f8a9c54cfcf59

  • SHA256

    3fe1f468e3ba9b4adb193fc391cbecede89148cf711c1481644f82d9d36afc56

  • SHA512

    f10854f2c4e7531c61f813c9547d3f8e74d30753ff2a073ceb787eaf8a1e8c256473f79d19aa779749d17e10141f4d683287060cc9279dc9ccb305ccd04366e1

  • SSDEEP

    12288:RPMbo1G5rrJNUjj28Xv+5gbnk/pRmspB6AXL9FqsDm:R0bo4rDUj9+SbkhRPogL9FPDm

Score
7/10
upx

Malware Config

Targets

    • Target

      96c4b7f0b5f386e7157dee8d6873812b

    • Size

      469KB

    • MD5

      96c4b7f0b5f386e7157dee8d6873812b

    • SHA1

      fcf257d5e3ba8c9fa17d3c346d4f8a9c54cfcf59

    • SHA256

      3fe1f468e3ba9b4adb193fc391cbecede89148cf711c1481644f82d9d36afc56

    • SHA512

      f10854f2c4e7531c61f813c9547d3f8e74d30753ff2a073ceb787eaf8a1e8c256473f79d19aa779749d17e10141f4d683287060cc9279dc9ccb305ccd04366e1

    • SSDEEP

      12288:RPMbo1G5rrJNUjj28Xv+5gbnk/pRmspB6AXL9FqsDm:R0bo4rDUj9+SbkhRPogL9FPDm

    Score
    3/10
    behavioral1behavioral2

    • Target

      $PLUGINSDIR/Dialer.dll

    • Size

      3KB

    • MD5

      4e6686aece13707435cce60dcb2ab572

    • SHA1

      9bc7bcffa81e19ad315cab0f261e2394b99aa8f4

    • SHA256

      b8bdabefe8360a157f287bf2b672d8d9a0453224a6b377348aa6a98438fccaf2

    • SHA512

      a1936a86e1fd28a0d44e3e2bab4e41d3ebc6322155d47cd64df9d4ec1b3a093872f74f9848d39c6062242ea4f5af69b32e99f06fd892279b2a1a3cc6c1586e3e

    Score
    3/10
    behavioral3behavioral4

    • Target

      $PLUGINSDIR/InstallOptions.dll

    • Size

      14KB

    • MD5

      0dc0cc7a6d9db685bf05a7e5f3ea4781

    • SHA1

      5d8b6268eeec9d8d904bc9d988a4b588b392213f

    • SHA256

      8e287326f1cdd5ef2dcd7a72537c68cbe4299ceb1f820707c5820f3aa6d8206c

    • SHA512

      814dd17ebb434f4a3356f716c783ab7f569f9ee34ce5274fa50392526925f044798f8006198ac7afe3d1c2ca83a2ca8c472ca53fec5f12bbfbbe0707abacd6b0

    • SSDEEP

      192:n6d+dHXLHQOPiY53uiUdigyU+WsPdc/A1A+2jPK72dwF7dBEnbok:n6UdHXcIiY535zBt2jP+BEnbo

    Score
    3/10
    behavioral5behavioral6

    • Target

      $PLUGINSDIR/KillProcDLL.dll

    • Size

      32KB

    • MD5

      83142eac84475f4ca889c73f10d9c179

    • SHA1

      dbe43c0de8ef881466bd74861b2e5b17598b5ce8

    • SHA256

      ae2f1658656e554f37e6eac896475a3862841a18ffc6fad2754e2d3525770729

    • SHA512

      1c66eab21f0c9e0b99ecc3844516a6978f52e0c7f489405a427532ecbe78947c37dac5b4c8b722cc8bc1edfb74ba4824519d56099e587e754e5c668701e83bd1

    • SSDEEP

      384:3rYz6grZodORNWATt4TBmlk5ooyzFh7BukAUdJoUtSOSR:3QggDWATWNCFh7BNddJoxO+

    Score
    3/10
    behavioral7behavioral8

    • Target

      $PLUGINSDIR/NSISdl.dll

    • Size

      14KB

    • MD5

      254f13dfd61c5b7d2119eb2550491e1d

    • SHA1

      5083f6804ee3475f3698ab9e68611b0128e22fd6

    • SHA256

      fd0e8be2135f3d326b65520383a3468c3983fa32c9c93594d986b16709d80f28

    • SHA512

      fcef8ac5bd0ee6e316dbbc128a223ba18c8bf85a8d253e0c0877af6a4f686a20b08d34e5a426e2be5045962b391b8073769253a4d9b18616febc8133ccf654f7

    • SSDEEP

      192:t5ZTobBDJ68r67wmsvJI5ad9cXzFOVu+mZ/P3p+57CvpVqDxVp01Dwn2GRYgsfA:fBo/680dCI5adOjFOg9//p27uNw2bo

    Score
    3/10
    behavioral10behavioral9

    • Target

      $PLUGINSDIR/System.dll

    • Size

      11KB

    • MD5

      00a0194c20ee912257df53bfe258ee4a

    • SHA1

      d7b4e319bc5119024690dc8230b9cc919b1b86b2

    • SHA256

      dc4da2ccadb11099076926b02764b2b44ad8f97cd32337421a4cc21a3f5448f3

    • SHA512

      3b38a2c17996c3b77ebf7b858a6c37415615e756792132878d8eddbd13cb06710b7da0e8b58104768f8e475fc93e8b44b3b1ab6f70ddf52edee111aaf5ef5667

    • SSDEEP

      192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw

    Score
    3/10
    behavioral11behavioral12

    • Target

      $PLUGINSDIR/XML.dll

    • Size

      118KB

    • MD5

      42df1fbaa87567adf2b4050805a1a545

    • SHA1

      b892a6efbb39b7144248e0c0d79e53da474a9373

    • SHA256

      e900fcb9d598643eb0ee3e4005da925e73e70dbaa010edc4473e99ea0638b845

    • SHA512

      4537d408e2f54d07b018907c787da6c7340f909a1789416de33d090055eda8918f338d8571bc3b438dd89e5e03e0ded70c86702666f12adb98523a91cbb1de1d

    • SSDEEP

      1536:U2A8OSGjylgkara+70LICin9zgtg2LxowhtJu6MqSNicNEtIfF42q2KC:OzjLkarn7O+n9z2L6whFtGF42bK

    Score
    3/10
    behavioral13behavioral14

    • Target

      $PLUGINSDIR/linker.dll

    • Size

      6KB

    • MD5

      8450b29ee8d592c208ba1aaf6ee50267

    • SHA1

      75096da057bc85cef63bb0eec168652ea75cf618

    • SHA256

      53aa57e582dc56421c1191a0a9efac9c36960b903b7d825f3b9682605ec2b612

    • SHA512

      d23a3057053a1f36f5eb212ae0b09b9b0b41e50b8a6a20bbc46c12c51199ad0bca741bcce17534488158e8f2b9470dbdac2aa059688b7588a05778c40d461039

    • SSDEEP

      48:q/XgJspkvsIWyuS3fyVLkmqbIWXGuDNcGo+FLtLFSfrPIk2vIhll:4gJsFIWjS3qVomqIixo+9tLFUr4vMl

    Score
    3/10
    behavioral15behavioral16

    • Target

      $TEMP/kcheck.dll

    • Size

      3KB

    • MD5

      d7abd1fa2c2bf8d37b38851d498bf4bf

    • SHA1

      4701dfb6ccab99988278540c4326c09ea7a2551a

    • SHA256

      e11a73b3bc733d4ccb6fc334a1e205e5a8b5183bf376f0b268f900b3165d5613

    • SHA512

      1e654cabdb8f850da70f6c98eb017c649cbb14a4a69f5848dd2753dcfb78b256c45cb6fefad3be13fe00dcf51fcb1b526b5226d4a6d31e8fbaa29b24398cd15f

    Score
    7/10
    upx

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral17behavioral18

    • Target

      kcheck2.dll

    • Size

      30KB

    • MD5

      3b1ffbe4744eefcaa7285eb4e700dca2

    • SHA1

      6319e6863a3c980d94818daa1040f93e3e1be8d8

    • SHA256

      fcff934d640972756710d86d55df19449dc90c58563e053d5b42ab4ac8dd30f0

    • SHA512

      6d034b95f1324a51ccf5ad8145ebf79857c5d4a953e7ccfcf98fe7fc0adb11a1747205c14779df4051988dd0168a8bdf864eb511f6e3a349831af25fffdb0129

    • SSDEEP

      192:ZuBd9yGkN2j9RhAEvryowJL/KxO4SLvYihx3aQe0HG0:G97Yi9R6yrYJLiOLLvYiDm0m0

    Score
    1/10
    behavioral19behavioral20

MITRE ATT&CK Enterprise v15

Tasks