ploutus | miflash_unlock_en_7[.]6[.]727[.]43_repacked[.]7z

General

Target
miflash_unlock_en_7.6.727.43_repacked.7z
Size 57.3MB
Sample240308-p57llafe56
SHA256 14a551c56654fffdc58209b0f09643e72c2f3e1e73e19fbba1c94c9fa2eb0c7d
MD5 fa0257ec31018ead1672a7ec6828761f
SHA1 7fbea6303c3768ee227eadfb2b327e704028cc9e
SHA512 c4a6c7c81430c1a50d7caefff4781e827958c9b2c64bd184a078ccd720c78c4037875155a838d9fbc896c0aeb90f3d20a01d6f72719e164d10a40faf159079d9
SSDEEP 1572864:kSW6Q+XlIsuFkS86gYmdk4Sz6Sa1Rpb1rZANAyI3v4i5bcy0xI:zIPk2gYZ6j1RpbguyI3v4itcy0m
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

ploutus

Malware Config

Signatures

Detected Ploutus loader 1 IoCs

resource	yara_rule
static1/unpack001/miflash_unlock_en_7.6.727.43_repacked.exe	family_ploutus

Ploutus family
ploutus

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/miflash_unlock_en_7.6.727.43_repacked.exe

File Explorer

miflash_unlock_en_7.6.727.43_repacked.7z

.7z 57.3MB
miflash_unlock_en_7.6.727.43_repacked.exe

.exe 185.7MB

miflash_unlock_en_7.6.727.43_repacked.7z

SHA256 14a551c56654fffdc58209b0f09643e72c2f3e1e73e19fbba1c94c9fa2eb0c7d
MD5 fa0257ec31018ead1672a7ec6828761f
SHA1 7fbea6303c3768ee227eadfb2b327e704028cc9e
SHA512 c4a6c7c81430c1a50d7caefff4781e827958c9b2c64bd184a078ccd720c78c4037875155a838d9fbc896c0aeb90f3d20a01d6f72719e164d10a40faf159079d9
SSDEEP 1572864:kSW6Q+XlIsuFkS86gYmdk4Sz6Sa1Rpb1rZANAyI3v4i5bcy0xI:zIPk2gYZ6j1RpbguyI3v4itcy0m
MD5 SHA1 SHA512 SSDEEP

miflash_unlock_en_7.6.727.43_repacked.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 3a7b84dd1d2c7bae7c6e595e0985f8a4ad375ef829ee78583dea512cac4c155a
MD5 34e2ba519f2f505a0b60b0637cb0bc68
SHA1 6d0769ded7f775de2ca44d0561b6adaffb09a146
SHA512 c486952d00fa88d6e85625314480f0210d27bacd7417353a2ee526023fd33c149fb17e581f3181bd2dbcaa35138df77d2b9b8c1fd143ae653b64e692311877fc
SSDEEP 1572864:EtEIGOn9l9/VCdGBOSX4GkGoZXwrSdtvy4EYj5tEAw/R+Un+gsanf3u9iQkx0jwZ:Et7FGP/l5HolSqXX3nlM+
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Detected Ploutus loader
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

278110

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Users\SerGreen\Source\Repos\Appacker\Unpacker\obj\Release\Unpacker.pdb

miflash_unlock_en_7.6.727.43_repacked.7z

miflash_unlock_en_7.6.727.43_repacked.exe

mscoree

dotnet

Sharing

General

Malware Config

Signatures

File Explorer

miflash_unlock_en_7.6.727.43_repacked.7z

miflash_unlock_en_7.6.727.43_repacked.exe

mscoree

dotnet