General

  • Target

    b7d91f0e15cf0258fc857699171b6627337d511ecca9ab22adf668e0918eec50

  • Size

    454KB

  • Sample

    240410-q4epvsda6w

  • MD5

    cc0fbde95e79b041fbff79a5509937e7

  • SHA1

    a6bc16d3a0ab230b33e59b13055d40ff8f35c664

  • SHA256

    b7d91f0e15cf0258fc857699171b6627337d511ecca9ab22adf668e0918eec50

  • SHA512

    9aa13dabb341904f21c20112c2884c80ac126c7fbbf52fcd5be3712a57abce326b93c6155f8f99a54c11dd2acda7c860acb1a939e721b8608d345ca347cbb77f

  • SSDEEP

    12288:KsANVftO7Wf+f5mItKUAqPOgmagToLMsD1Hx3316niBK:KswT7UOgmJ4Lp1lDE

Score
10/10

Malware Config

Targets

    • Target

      Bitdefender/USOPrivate.exe

    • Size

      760KB

    • MD5

      10866465a9b0c56af2cd093b80cdbc9f

    • SHA1

      fc77be3e68a79b597ffed1b307d1b447787e7995

    • SHA256

      9831526e475a4ed0d149bec15f69193a48249c3cda1ddb2f2140292afd862cfa

    • SHA512

      975c0c3abe71d29a1391bc9a258df9560466f40764ff6dd8b06db5234d45a6c12f27c77bd26409fda051de598cdc0087afd847e46818553c5ed3eff53cfe2091

    • SSDEEP

      6144:c3PgKtEhPIPe16jzM66rBghPlNoVh5j9mmNpMHGIygduNrnoh/WOHI0jVjSjztx/:eIA4PIPoQMFgDNg/jMmLohW70Rj+ztp

    Score
    10/10
    • Detects PlugX payload

    • PlugX

      PlugX is a RAT (Remote Access Trojan) that has been around since 2008.

    • Unexpected DNS network traffic destination

      Network traffic to other servers than the configured DNS servers was detected on the DNS port.

    • Deletes itself

    • Target

      Bitdefender/log.dll

    • Size

      71KB

    • MD5

      03797703f999e8e5029edbee30446ed2

    • SHA1

      272c7b26c3dabfbbdb9150f2e041e228f9692efb

    • SHA256

      eb9ffe12dff87a143ea188fc6c16f2b3f44e43c2ae20506c4a69c23c3c74e6c2

    • SHA512

      b4622a56e0576bb736e74ee5d1f20574a81cd9c55eac9ae64f4f4d3bd61baefaa3128b902c17b019280357687121e6ddd95de7a24f5bdfff0f4c213fbf70d1a7

    • SSDEEP

      1536:ooyQOT0ER2voLkTPi3rUFNc9Pj/FuMMeXXjyV3he/:oozOT0ER2kkTq3YFN+jztXzyq/

    Score
    1/10

MITRE ATT&CK Matrix

Tasks