860ab461cf4a1228ed2bd4bbe7c23ac806bd0998581a5a3d2d5a096a2b71c3fd

Sharing

Copy URL Twitter E-mail

General

Target
b15cf4f2515278f3f0766a16a6dadb49
Size 2.6MB
Sample240304-ggf5qscc75
SHA256 860ab461cf4a1228ed2bd4bbe7c23ac806bd0998581a5a3d2d5a096a2b71c3fd
MD5 b15cf4f2515278f3f0766a16a6dadb49
SHA1 df5dad2260ed788a3437365f0908423ed3d4dff3
SHA512 37494e8f32bfd03f82b5a94d6d2eec2a15176857acb166f47864fada67712cd3d9fed3e0a6daea5c5dfa0246c5a46975249b25136663b09f6ae382adc1327048
SSDEEP 49152:ykykjPKZshvx4Fy9qXGgQyECB6NI3WUePNgMTlKijg/GkfsoQw:7ys4NCCBrep3jgmoP
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Targets

- Target
  Vw3Setup.exe
- Size 2.6MB
- SHA256 257901ed4baf9b723706c064c0d8c3c074989b712ca3f53aa17207febaf4e01a
- MD5 000f9cf40f83d513f311939a9f023ad4
- SHA1 2b9891f3edc08dbea9ccc140703c6b6c1986fef4
- SHA512 68fb4dfea7e54520c1fddc90055ac8746a5ba8ec47c85bf10b7d0ea1b20a2e6f351438d483eb867fe1972ea1d979edf8ff2a1d2c3a11221032e5d8b46656f626
- SSDEEP 49152:ud8y7aY6fOLhUoK28M6wazV+RQBJSiglyuRBV5PqDy9l3Zm0L+A7TkKdUO:w5aY6yvD1GpOyurPIynPxTkKdd
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10
- Loads dropped DLL
behavioral1 behavioral2
- Target
  $PLUGINSDIR/InstallOptions.dll
- Size 12KB
- SHA256 a505e6c537a5ce0166227dda9f7671605395592ac9f1a3764e8a01b713939db1
- MD5 07f3b3445f66e1089567796bf3c8be78
- SHA1 851eb574c1067b23a654f8aa47b17ef599b24d1c
- SHA512 8c56308fff3a947b26fd0d98dbdd96c406ddf967f5d7abee8cba082b6c46a4e575094bb0bb981551ac5160bb5089cf6fb125dd17a659c427e28c07402adab1c3
- SSDEEP 192:pzi5iBjGHp29db9Dd+w6VPESclh3I8dYvwqu7hwbbHF1QuCb:pO5kjGHSDdgjo6pvwqu72bbMum
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral3 behavioral4
- Target
  $PLUGINSDIR/LangDLL.dll
- Size 5KB
- SHA256 799f91bdd59f2133bf195c5b4ca685ee91666d981a6bcd8a6c45b7c8ecc96eef
- MD5 2c3c8976d729d28478a789217a882291
- SHA1 10c18b23fac957419547ef0f8ec3bc1b10e91e79
- SHA512 749c650974f94cc5009124d3fa3d9bb1ee5824a3fa0a76b81733e08379678a2a1b7c54b77d1709fb6de24c81c68c03c0ec3e9ec5ccad0d30d9237300794f1213
- SSDEEP 48:aefTYzqi+/XC1aQbkMIwovgxbLuwOWd8s/d79C6O4MWNEYJvRZJ0dfh80:22XC1XkH/ohLZDSs/d799O4MQE0R4
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral5 behavioral6
- Target
  SDK/vsidasp.asp
- Size 16KB
- SHA256 9de64ac19108b723ecccdb48fd2ad87e0befe1a936ad3de551c788020da82d14
- MD5 a54b2c7e5a1e7b722f60a7e48acdcb8c
- SHA1 99caaa71fd6e49f9f84076cc0a2661de08807e56
- SHA512 4202a563e2b96cea3aa989b42b9ff9500d451c7167ccca222865046291e0ea503b831dff84e10dfda51778a663a6cbc23acff3c2bd7b96630dc37b30e8786eb8
- SSDEEP 384:Hkp8MG6g8aT+zqciWGaCZU29ydyuGRJ63XP+p63N:Ep8ML3iiCZU29yguGRJ63f+p63N
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral7 behavioral8
- Target
  VirtualWall.dll
- Size 310KB
- SHA256 dad8f06df5c8417d1c43fe645d0425ce2369c61a50ed56b63c0fc472cdb8bbfd
- MD5 74b11daf83e0e41821e3907afe228737
- SHA1 38847d90b9117d9527fc65b878c49888b7b16eed
- SHA512 e4d1870e4b9a1bc1051379015fa53a3b5a8a7a0286d513b0d6b53dd16193f7f83aa55cea218ce0d1a65dbc66f8b28e3684d03aed6097792877db2dec230f12e8
- SSDEEP 6144:5z7pa09Ih48wScQMFUMK4wBgFb1TLdLb7IOerqmo+Vlw2Y:5np39IO1QFMvwmb1TLJbJeemXVm
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral10 behavioral9
- Target
  VwCfgNew.exe
- Size 488KB
- SHA256 f7185e0e081b40c48fe14ca8aef34e0c9e23230e24c25657823b523f1fd1d8f2
- MD5 af00b56e5579b83f46551cd10017e993
- SHA1 b6e322098c2717b06dd3c85c20945478c0c06606
- SHA512 c6a0c59c3349c807a7d4a3eebe06fd1a308d061b94f8c9c8230924f9a970702cd55a5528a503e54e93d30aed581f0aed26c64a97000751ef7f0aa0002b69c504
- SSDEEP 12288:7Ub7qZg/fu1MMMt3FMvwmb1TLVZv1tl0S:nx1MMMt3FWwmb1/Pv1tT
- MD5 SHA1 SHA512 SSDEEP
Score

6^/10

persistence
- Adds Run key to start application
  persistence
behavioral11 behavioral12
- Target
  VwClient/VwClient.dll
- Size 10KB
- SHA256 7604076faea99079091022b920ad2318839cc1883b08894f015245f851fece9b
- MD5 54bf8e984142b7f2e35d9bea7b6aec44
- SHA1 e905e201d8df2e9fe542c959fef7ada1167b5a4f
- SHA512 3147fbe999fb7a6a2acdc7ab38ea2d1a946a821a1122332d03b22171fb431c962b229a8208bcd8d6bd58812d7fda00e6a3518300e6abae138e7e5fea8aeeecfc
- SSDEEP 96:6sviUrNI4AijDGP54pkLqgqnuC4vuRsMh2P+BovBAeNCR7IWBAzMp1Cb3rUn0b3N:6C7SsuvXqnuz+7hRBA8RMfzYu7Z7N9J
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10

upx
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral13 behavioral14
- Target
  VwClient/VwClientCfg.exe
- Size 290KB
- SHA256 170dbaa708bd8a6eba1f2e10d0abd009ee51fe724a4ee1b67cbb308f4a9a48f3
- MD5 36cd0791cee9ae02b250692b6f6c2a6b
- SHA1 6a8c2a42dc0022443d632c180b87624936e5598e
- SHA512 1c0899a78c43082ea54c7e0746d1a3485f4ff0eaf373fc5d54c3dd8600f66bf3f5daa0b367d80b30c779203dfe5a3d27969090a95afcf007da7aece01423fdd9
- SSDEEP 6144:1ytcx91UQN9sMFUMK4wBgFb1TLdq+UaTf69:3vWQPsFMvwmb1TL9Uf9
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral15 behavioral16
- Target
  VwHelpZhcn.chm
- Size 1.1MB
- SHA256 ffe8f2b9249d572e6f48da2361a4945a5fa1a1e07029fb5ead5832bec98f4096
- MD5 b6dd3309abec82c9d3afb6346821e7b7
- SHA1 3e0ff9d561e405752836aab2b5d0a9120e5140de
- SHA512 4107395ed9e0bf93b12e9081a7bb97e3314d8dd7ed47bec902abd579e84d136de7a0afcf1ca7eedcef79de3793c8ce1aca1fb2d4ce20183247eb86f35fb32440
- SSDEEP 24576:AxipDMeiP1i4hBezIVyiQp6YMugB8Ym6TqAQGxVZ7PY1+UJ:2i2eiP5rdQMpBauVZ7Q1+O
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral17 behavioral18
- Target
  VwUpdate.exe
- Size 281KB
- SHA256 039ff8a955508a1f88ab2fd7338ad83ecf4637197bd56036a9e40ba1a811d10f
- MD5 047ee79579b597cff61358156451ac46
- SHA1 897e21dcc088d594f9cd86c5b2e36c3d6e8cd950
- SHA512 06a39802a32e2bd1958594f40e8916f6ca1f6f3e3457c406d3dd4d0e50069f0547fbbc8a0bc4aaee2583d7a015f54f894ab604aed9a8ab3ee7d5168991b96c70
- SSDEEP 6144:pDJxQI/74MFUMK4wBgFb1TLdHh8QDeOCYOSr:pluI8FMvwmb1TLAQqO/O6
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral19 behavioral20
- Target
  uninst.exe
- Size 38KB
- SHA256 e4443df1d3255cd1eb3fad89de5943341931f842498d327701dbefa7b00fa7c2
- MD5 77d5904fb7d1c5a687b585b199f33828
- SHA1 ae0ab177741d3900026b92ccf7abc211e9fd2e43
- SHA512 579aa711970be9cd4116fb15cac3e9863d2fbfdccc35ca4711a28576ad3ab793daeea2b7d96e352ae6d98407a0354daf59c714f5faba341c6c4c3800e959ea33
- SSDEEP 768:0w0D3T2XQW0dcyngqR8lWFYCPMfjABHD2tAJb5PAAIYHLLE8JyJRngCY9aLyMW:0w0DsT0zikYCPMUxDRbw8JBx0o
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
behavioral21 behavioral22
- Target
  $PLUGINSDIR/LangDLL.dll
- Size 5KB
- SHA256 799f91bdd59f2133bf195c5b4ca685ee91666d981a6bcd8a6c45b7c8ecc96eef
- MD5 2c3c8976d729d28478a789217a882291
- SHA1 10c18b23fac957419547ef0f8ec3bc1b10e91e79
- SHA512 749c650974f94cc5009124d3fa3d9bb1ee5824a3fa0a76b81733e08379678a2a1b7c54b77d1709fb6de24c81c68c03c0ec3e9ec5ccad0d30d9237300794f1213
- SSDEEP 48:aefTYzqi+/XC1aQbkMIwovgxbLuwOWd8s/d79C6O4MWNEYJvRZJ0dfh80:22XC1XkH/ohLZDSs/d799O4MQE0R4
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral23 behavioral24
- Target
  新云软件.url
- Size 133B
- SHA256 df65af1fc1e09f6effbde7e0ef1cb64d6caeef1f62b0e6467821efa032533678
- MD5 4f0017b3b346bd0626f0c3b915e6e734
- SHA1 823bf3ff9e16cd636c9dc0dc690d6a586fcbfe92
- SHA512 0f5eb5024cf6a0323f7998d419995a707c48de917a5899a185369e6acfeb17c09ffa03f7d110adc87b8de20b7d4bf30d50c72479bfb18614d2e21cbe169dc5a6
- MD5 SHA1 SHA512
Score

1^/10
behavioral25 behavioral26

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Loads dropped DLL

Adds Run key to start application

UPX packed file

Deletes itself

Executes dropped EXE

Loads dropped DLL

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26