ebb59161759ac7e1a5c5b58f4eac53013778d1d39a5be4979c099a80c7f0bc55

Sharing

Copy URL Twitter E-mail

General

Target
archive.zip
Size 10.5MB
Sample240711-ppgp8syepa
SHA256 ebb59161759ac7e1a5c5b58f4eac53013778d1d39a5be4979c099a80c7f0bc55
MD5 d95bfd3890f77c0be2c92f0bdafae715
SHA1 e089ec04117065c49abb12cfb6f5e1dfdcf5f82f
SHA512 514e0d343a62f49adb735b320fb75096585734de1fa6d885aabe04c84211a73d2d2579b1d6e8ae1cef439746932fb2d65b6f7dcab492d84303d155a8f140e101
SSDEEP 196608:/ExyzfvR+eQV9I9UjqKYuO2T6B562Q2nHs2Oaq8Bz/L:sxofLgI5KY6WBdMxQL
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

evasion

Malware Config

Targets

- Target
  archive/Setup.exe
- Size 792.5MB
- SHA256 9c6d924afa3b84241a00762d243b156a2af26374154de67a89cda3e4ef37a2c8
- MD5 882c754fb952c8abb850dc3c11c7fde2
- SHA1 668d6cd355a11ca4af98275b89be3ed27af1a918
- SHA512 7f9fea9b477f3eba99db92cd076320b29db1e603797c4ade3f5bba1543cb7711f92a19b73c214ed92443218a805a4ed3ea4bf4d46eed1c43486801481b186b9b
- SSDEEP 98304:94zumTUVxOTJeP4tQt26kDyy14zv6rsps+eZPvHlZ7K:94M8JBta26kGyM3ni/lZ7
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

evasion
- Modifies firewall policy service
  evasion
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in System32 directory
behavioral1 behavioral2
- Target
  archive/appsremote/qdds.dll
- Size 45KB
- SHA256 3a71a119eeabce867b57636070adeb057443a6ec262be1360f344cb3905545db
- MD5 3fdb8d8407cccfaa0290036cc0107906
- SHA1 fc708ecac271a35a0781fed826c11500184c1ea4
- SHA512 79fdf0f6316069a4810a67c64a662803dede86d32223b6c07da4e970d45e0a75f6027183a63d361787514fb095ce980a640c7e840c11aba93abc8318cc92ee94
- SSDEEP 768:62cu2Izzl95wF36BhInlpnEIK3GeB7r3qgLgacVOqNRyU:40zl9u36BinbnEIK2eB7r6gUacV/R
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral3 behavioral4
- Target
  archive/appsremote/qgenericbearer.dll
- Size 45KB
- SHA256 086d6ba24f34a269856c4e0159a860657590d05aabb2530247e685543b34c52f
- MD5 dba35d31c2b6797c8a4d38ae27d68e6e
- SHA1 37948e71dc758964e0aa19aee063b50ef87a7290
- SHA512 282e7613fe445785fa5ed345415bc008637b7d1d7988cc6da715b024311a1c29425f5edb26a1d90f301af408b60244dd81e1459eef2aab10b07d1ac352770b4b
- SSDEEP 768:B+B5mIpDC6s1Hf30HdG806zHgaEsyJa5gYnDGMHgtpQu8KOqfyc:UB5mTfEHdh0GHga9nDGigvQu8K/J
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral5 behavioral6
- Target
  archive/appsremote/qgif.dll
- Size 32KB
- SHA256 d5459a707922dd2bf50114cc6718965173ee5b0f67deb05e933556150cfdd9d1
- MD5 c108d79d7c85786f33f85041445f519f
- SHA1 2c30d1afc274315c6d50ee19a47fff74a8937ea1
- SHA512 6bb5316cd8cd193a8bc2b9fbe258a4b9233508f4aaaa079d930a8c574dc9c9786863ae0a181061fcb2a84b7a43e5b98c5a264cad8aae5e0890a2a58c114a0d9c
- SSDEEP 768:6EIE7zOufzpO8hY7OvWlMwQLFUchQtOqzy3:sEfOu1OCoOvWlRQRUch+/y
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral7 behavioral8
- Target
  archive/appsremote/qicns.dll
- Size 38KB
- SHA256 e665f3519309bae42e0e62f459ecc511701ddddf94599ebfd213d0a71775c462
- MD5 52c6978203ca20beead6e8872e80d39f
- SHA1 f223b7ba12657cd68da60ab14f7ab4a2803fc6e7
- SHA512 88b64203d6f3daed11da153bc2f02196296203dc913836c98595c09f7772c40830284366db964fcb6886b78b0ebb8f78517cdc7b6d0ad7922861597eaf474b85
- SSDEEP 768:CIz31g+6jT06+WEFnZqGVPJWJzvincpC9qcF6xsb0yJsYUOq/yRk:VJg+6jT06+WEFRxJWJzvscIrF6abvJsx
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral10 behavioral9
- Target
  archive/appsremote/qico.dll
- Size 32KB
- SHA256 9d942215a80a25e10ee1a2bb3d7c76003642d3a2d704c38c822e6a2ca82227bf
- MD5 eddf7fb99f2fcaea6fe4fd34b8fd5d39
- SHA1 85bbc7a2e1aaafd043e6c69972125202be21c043
- SHA512 0b835d4521421d305cf34d16b521f0c49b37812ef54a20b4ab69998b032cca59581b35c01e885ec4a77eac0b4e1d23228d9c76186a04a346a83f74a7198c343b
- SSDEEP 768:/F7ME5fbPFzbvG+pnu8dZ8E28M2UQ1gLWmFOq+yQH:/eYbPFG4nuKmE/HUAg6mF/m
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral11 behavioral12
- Target
  archive/appsremote/qjpeg.dll
- Size 245KB
- SHA256 45c1f50c922ac1d9d4108e37f49981fd94f997667e23085cb2ea226d406c5602
- MD5 3232706a63e7cdf217b8ed674179706c
- SHA1 12ac2af70893147ca220d8e4689e33e87f41688d
- SHA512 db787e96a2ad4d67338f254996cf14c441de54fc112065fba230da97593de6b1fb4ef0459dcd7f4aea8fb3648fa959c05978ca40813036bf8a26860befa38407
- SSDEEP 6144:doozp27baTENcrXotvHuOyaPB9Jhjf18JSCHsoWhpfWJA6Xnb1jF:1zp2Deou5aPB9Jhj9A/M4
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral13 behavioral14
- Target
  archive/appsremote/qnativewifibearer.dll
- Size 46KB
- SHA256 c209d080a62f5e67ddc01a3ae6b4f9b103faf4104c93b7dbb5ffa8d548bf0cd5
- MD5 a8bca50f7966f578b127d1e24fc2430f
- SHA1 cfa1e5d684d938fdb9a97ff874cd2166a10ca0c8
- SHA512 86b1e4eec873b5951408f1793b5a35725fb53e2282e194b409705f476d8bea9750dcee74bd51ae5d3acb3d47846a8b7210b1493f7d9ac012140df5e6a57d8c69
- SSDEEP 768:AoK5SNALlqMB1hF4hGm6/q4wgaHbAUjHgLa3TO1ZOqgCyEw:mSIlq6cl6SDgacU7ge3TOn/I
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral15 behavioral16
- Target
  archive/appsremote/qsvg.dll
- Size 26KB
- SHA256 6bae9af6a7790fbdee87b7efa53d31d8aff0ab49bdaaefd3fb87a8cc7d4e8a90
- MD5 2831b334b8edf842ce273b3dd0ace1f8
- SHA1 e586bf0172c67e3e42876b9cd6e7f349c09c3435
- SHA512 68dca40e3de5053511fc1772b7a4834538b612724ec2de7fb2e182ba18b9281b5f1ccf47bd58d691024f5bcddfc086e58570ad590dd447f6b0185a91a1ac2422
- SSDEEP 384:Q5JEkajiasWEN7MADKzFk8RPf4BYSJGI9kgLjW/zXE58nupWwOk0GfZRm5g+zCxh:Q5JEkbWEOAODfsZJGHgLszUFTOqYyT
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral17 behavioral18
- Target
  archive/appsremote/qtga.dll
- Size 25KB
- SHA256 2b6444d2a8146a066109ca19618ceee98444127a5b422c14635ab837887e55bf
- MD5 d0604a5f13b32a08d5fa5bd887f869a6
- SHA1 976338eb697507ac857a6434ef1086f34bc9db24
- SHA512 c42edbaf6506dc1ca3aae3f052a07c7d2c4841f5b83003186cda185193f7cd2035cfe07e04a28356d254ab54666b5d60be4763e3e204273ecd0d7f2cd84bfc90
- SSDEEP 384:fFMPiwwZFypMrcrQVdPy82S8fQ4rI95QLjPx6/kOk0GfZQ5g+zCxw:CKwwZFypFrQVdPy4zQSQL7x68OqQyG
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral19 behavioral20
- Target
  archive/appsremote/qtiff.dll
- Size 314KB
- SHA256 f9ebf4c98c1e0179cd76a1985386928fdb9e6f459e2238ed5530d160df4f0923
- MD5 756d047a93d72771578286e621585ed2
- SHA1 313add1e91a21648f766aaa643350bec18ec5b5d
- SHA512 67fa91f266f0030ca0695f1c7964ee4d1c1447413420d0379eca62d54cc9d6cd0706df62da0043259b563e95a9c3a5c7ef0e0baacb36cafed5c9fcb1a3954aca
- SSDEEP 6144:kRfirNO3cCAolH6NdXv1+74AvPY6am60rvTW:kRsEgolH89+R2
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral21 behavioral22
- Target
  archive/appsremote/qwbmp.dll
- Size 25KB
- SHA256 043f3acf1dc4f4780721df106046c597262d7344c4b4894e0be55858b9fad00e
- MD5 131a58669be7b3850c46d8e841da5d4e
- SHA1 1c08ae3c9d1850da88edc671928aa8d7e2a78098
- SHA512 4f62b0c5ba0be6fb85fa15e500c348c2a32266e9b487357ea8ed1c1be05d7eabc46c9a1eeb9c5339291f4dd636b7291447a84d4ad5efbc403e5e7966b3863ade
- SSDEEP 384:FQIH6vdFY1KdOkKCghKCyKE99jSz4rI9kb00+QQOk0GfZG5g+zCx9g:FQIH6vxdzpgs2zQHb0XQQOqGyrg
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral23 behavioral24
- Target
  archive/appsremote/qwebp.dll
- Size 325KB
- SHA256 b057c49c23c6ebe92e377b573723d9b349a6ede50cfd3b86573b565bf4a2ae0b
- MD5 f859ecc883476fe2c649cefbbd7e6f94
- SHA1 9900468c306061409e9aa1953d7d6a0d05505de8
- SHA512 67af11fb9c81a7e91be747b2d74e81e8fe653ef82f049b652c7892c4ec4cafeba76b54a976616cbf1cd6b83f0abe060e82e46bf37f3ed841d595c4318d6fd73b
- SSDEEP 6144:9weI6fmBFAShI2q3S/fSEdZtE4k/7a0Ku0rhfaTalQbKb9PjArMxcCUZvbo:99mB6ShI2ViuZtErz10AAQhi
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral25 behavioral26
- Target
  archive/libGLESv2.dll
- Size 4.4MB
- SHA256 af4f66e79e0cc1e4254f023cfb7f0140561c7d4e38d9bcf6184e8e69b32540db
- MD5 e307e977ebb1df8ba0957a412425ed23
- SHA1 e024a7a81e7f485058fec40fd0a745f0d7aecb1e
- SHA512 ab5f5beb80915385aea4b62337178c6dfa964edfb7e20c22d364c99cd323fa50df9e2c640d7850765e5a683a07034d6be8f61f47f06a8d1ee1f594da804e6def
- SSDEEP 49152:PnBb2OR3KPf/Et3msx8M+TsZ2idR/O0zql9Kgtg6QMsWFxtqhk/bivfhjgrQuIEt:h5qc/622iLAv1NQcoa/bY3g
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral27 behavioral28
- Target
  archive/qsvgicon.dll
- Size 37KB
- SHA256 b2b420aa1805d8b5dc15ccb74dd664d10bd6ba422743f5043a557a701c8a1778
- MD5 90bb882a4b5e3427f328259530aa1b3b
- SHA1 a4059f0c105f4e2abe84efc4a48fa676171f37c5
- SHA512 a486280bba42d6c2d8b5ca0a0191b6b29067e1c120f85dbff709a4a42c61d925804915f93f815f56c9ca06ea9f8b89de0e692776524d28d81e29ef1c75501db8
- SSDEEP 768:ps7Ss9mMa0qnobGobEng53IdR4rXDd/+Hb0RPNRuBNJOqUVyvC:s95aoZEgGdu7Dd/YbOPybJ/XC
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral29 behavioral30
- Target
  archive/translations/Common7/IDE/CommonExtensions/Microsoft/NuGet/cs/Microsoft.Build.NuGetSdkResolver.resources.dll
- Size 12KB
- SHA256 e378da6b569bc4c3c8f8a5c2912954c7750e4f640b3b0b4141b75073dc37384c
- MD5 75e41cb25c2773fb3ccf479e1bd0f701
- SHA1 0956e2c87dfd938181244d2ef5c3ccfff2967879
- SHA512 6738dc4be8b382db6516f8ffcea868407e6a3cfe7bda1da0287445dced3b4700fd43bafeaed45b6ccf8599358dc74dc28078a85883d2ee7a0957b8f17a9664db
- SSDEEP 192:utotSyzWPXCWULwu0Sc2HnhWgN7aQW4hrHDIzLMmDWqnajKsdTfQ:utotBzWPX0D/HRN77XEQmDWlGsdU
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Modifies firewall policy service

Looks up external IP address via web service

Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32