Overview

overview

10

Static

static

3

archive/Setup.exe

windows7-x64

10

archive/Setup.exe

windows10-2004-x64

10

archive/ap...ds.dll

windows7-x64

1

archive/ap...ds.dll

windows10-2004-x64

1

archive/ap...er.dll

windows7-x64

1

archive/ap...er.dll

windows10-2004-x64

1

archive/ap...if.dll

windows7-x64

1

archive/ap...if.dll

windows10-2004-x64

1

archive/ap...ns.dll

windows7-x64

1

archive/ap...ns.dll

windows10-2004-x64

1

archive/ap...co.dll

windows7-x64

1

archive/ap...co.dll

windows10-2004-x64

1

archive/ap...eg.dll

windows7-x64

1

archive/ap...eg.dll

windows10-2004-x64

1

archive/ap...er.dll

windows7-x64

1

archive/ap...er.dll

windows10-2004-x64

1

archive/ap...vg.dll

windows7-x64

1

archive/ap...vg.dll

windows10-2004-x64

1

archive/ap...ga.dll

windows7-x64

1

archive/ap...ga.dll

windows10-2004-x64

1

archive/ap...ff.dll

windows7-x64

1

archive/ap...ff.dll

windows10-2004-x64

1

archive/ap...mp.dll

windows7-x64

1

archive/ap...mp.dll

windows10-2004-x64

1

archive/ap...bp.dll

windows7-x64

1

archive/ap...bp.dll

windows10-2004-x64

1

archive/libGLESv2.dll

windows7-x64

3

archive/libGLESv2.dll

windows10-2004-x64

3

archive/qsvgicon.dll

windows7-x64

1

archive/qsvgicon.dll

windows10-2004-x64

1

archive/tr...es.dll

windows7-x64

1

archive/tr...es.dll

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ebb59161759ac7e1a5c5b58f4eac53013778d1d39a5be4979c099a80c7f0bc55

  • Size

    10.5MB

  • Sample

    240711-wrtwxazhpa

  • MD5

    d95bfd3890f77c0be2c92f0bdafae715

  • SHA1

    e089ec04117065c49abb12cfb6f5e1dfdcf5f82f

  • SHA256

    ebb59161759ac7e1a5c5b58f4eac53013778d1d39a5be4979c099a80c7f0bc55

  • SHA512

    514e0d343a62f49adb735b320fb75096585734de1fa6d885aabe04c84211a73d2d2579b1d6e8ae1cef439746932fb2d65b6f7dcab492d84303d155a8f140e101

  • SSDEEP

    196608:/ExyzfvR+eQV9I9UjqKYuO2T6B562Q2nHs2Oaq8Bz/L:sxofLgI5KY6WBdMxQL

Score
10/10
evasion

Malware Config

Targets

    • Target

      archive/Setup.exe

    • Size

      792.5MB

    • MD5

      882c754fb952c8abb850dc3c11c7fde2

    • SHA1

      668d6cd355a11ca4af98275b89be3ed27af1a918

    • SHA256

      9c6d924afa3b84241a00762d243b156a2af26374154de67a89cda3e4ef37a2c8

    • SHA512

      7f9fea9b477f3eba99db92cd076320b29db1e603797c4ade3f5bba1543cb7711f92a19b73c214ed92443218a805a4ed3ea4bf4d46eed1c43486801481b186b9b

    • SSDEEP

      98304:94zumTUVxOTJeP4tQt26kDyy14zv6rsps+eZPvHlZ7K:94M8JBta26kGyM3ni/lZ7

    Score
    10/10
    evasion

    • Modifies firewall policy service

      evasion

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Drops file in System32 directory

    behavioral1behavioral2

    • Target

      archive/appsremote/qdds.dll

    • Size

      45KB

    • MD5

      3fdb8d8407cccfaa0290036cc0107906

    • SHA1

      fc708ecac271a35a0781fed826c11500184c1ea4

    • SHA256

      3a71a119eeabce867b57636070adeb057443a6ec262be1360f344cb3905545db

    • SHA512

      79fdf0f6316069a4810a67c64a662803dede86d32223b6c07da4e970d45e0a75f6027183a63d361787514fb095ce980a640c7e840c11aba93abc8318cc92ee94

    • SSDEEP

      768:62cu2Izzl95wF36BhInlpnEIK3GeB7r3qgLgacVOqNRyU:40zl9u36BinbnEIK2eB7r6gUacV/R

    Score
    1/10
    behavioral3behavioral4

    • Target

      archive/appsremote/qgenericbearer.dll

    • Size

      45KB

    • MD5

      dba35d31c2b6797c8a4d38ae27d68e6e

    • SHA1

      37948e71dc758964e0aa19aee063b50ef87a7290

    • SHA256

      086d6ba24f34a269856c4e0159a860657590d05aabb2530247e685543b34c52f

    • SHA512

      282e7613fe445785fa5ed345415bc008637b7d1d7988cc6da715b024311a1c29425f5edb26a1d90f301af408b60244dd81e1459eef2aab10b07d1ac352770b4b

    • SSDEEP

      768:B+B5mIpDC6s1Hf30HdG806zHgaEsyJa5gYnDGMHgtpQu8KOqfyc:UB5mTfEHdh0GHga9nDGigvQu8K/J

    Score
    1/10
    behavioral5behavioral6

    • Target

      archive/appsremote/qgif.dll

    • Size

      32KB

    • MD5

      c108d79d7c85786f33f85041445f519f

    • SHA1

      2c30d1afc274315c6d50ee19a47fff74a8937ea1

    • SHA256

      d5459a707922dd2bf50114cc6718965173ee5b0f67deb05e933556150cfdd9d1

    • SHA512

      6bb5316cd8cd193a8bc2b9fbe258a4b9233508f4aaaa079d930a8c574dc9c9786863ae0a181061fcb2a84b7a43e5b98c5a264cad8aae5e0890a2a58c114a0d9c

    • SSDEEP

      768:6EIE7zOufzpO8hY7OvWlMwQLFUchQtOqzy3:sEfOu1OCoOvWlRQRUch+/y

    Score
    1/10
    behavioral7behavioral8

    • Target

      archive/appsremote/qicns.dll

    • Size

      38KB

    • MD5

      52c6978203ca20beead6e8872e80d39f

    • SHA1

      f223b7ba12657cd68da60ab14f7ab4a2803fc6e7

    • SHA256

      e665f3519309bae42e0e62f459ecc511701ddddf94599ebfd213d0a71775c462

    • SHA512

      88b64203d6f3daed11da153bc2f02196296203dc913836c98595c09f7772c40830284366db964fcb6886b78b0ebb8f78517cdc7b6d0ad7922861597eaf474b85

    • SSDEEP

      768:CIz31g+6jT06+WEFnZqGVPJWJzvincpC9qcF6xsb0yJsYUOq/yRk:VJg+6jT06+WEFRxJWJzvscIrF6abvJsx

    Score
    1/10
    behavioral10behavioral9

    • Target

      archive/appsremote/qico.dll

    • Size

      32KB

    • MD5

      eddf7fb99f2fcaea6fe4fd34b8fd5d39

    • SHA1

      85bbc7a2e1aaafd043e6c69972125202be21c043

    • SHA256

      9d942215a80a25e10ee1a2bb3d7c76003642d3a2d704c38c822e6a2ca82227bf

    • SHA512

      0b835d4521421d305cf34d16b521f0c49b37812ef54a20b4ab69998b032cca59581b35c01e885ec4a77eac0b4e1d23228d9c76186a04a346a83f74a7198c343b

    • SSDEEP

      768:/F7ME5fbPFzbvG+pnu8dZ8E28M2UQ1gLWmFOq+yQH:/eYbPFG4nuKmE/HUAg6mF/m

    Score
    1/10
    behavioral11behavioral12

    • Target

      archive/appsremote/qjpeg.dll

    • Size

      245KB

    • MD5

      3232706a63e7cdf217b8ed674179706c

    • SHA1

      12ac2af70893147ca220d8e4689e33e87f41688d

    • SHA256

      45c1f50c922ac1d9d4108e37f49981fd94f997667e23085cb2ea226d406c5602

    • SHA512

      db787e96a2ad4d67338f254996cf14c441de54fc112065fba230da97593de6b1fb4ef0459dcd7f4aea8fb3648fa959c05978ca40813036bf8a26860befa38407

    • SSDEEP

      6144:doozp27baTENcrXotvHuOyaPB9Jhjf18JSCHsoWhpfWJA6Xnb1jF:1zp2Deou5aPB9Jhj9A/M4

    Score
    1/10
    behavioral13behavioral14

    • Target

      archive/appsremote/qnativewifibearer.dll

    • Size

      46KB

    • MD5

      a8bca50f7966f578b127d1e24fc2430f

    • SHA1

      cfa1e5d684d938fdb9a97ff874cd2166a10ca0c8

    • SHA256

      c209d080a62f5e67ddc01a3ae6b4f9b103faf4104c93b7dbb5ffa8d548bf0cd5

    • SHA512

      86b1e4eec873b5951408f1793b5a35725fb53e2282e194b409705f476d8bea9750dcee74bd51ae5d3acb3d47846a8b7210b1493f7d9ac012140df5e6a57d8c69

    • SSDEEP

      768:AoK5SNALlqMB1hF4hGm6/q4wgaHbAUjHgLa3TO1ZOqgCyEw:mSIlq6cl6SDgacU7ge3TOn/I

    Score
    1/10
    behavioral15behavioral16

    • Target

      archive/appsremote/qsvg.dll

    • Size

      26KB

    • MD5

      2831b334b8edf842ce273b3dd0ace1f8

    • SHA1

      e586bf0172c67e3e42876b9cd6e7f349c09c3435

    • SHA256

      6bae9af6a7790fbdee87b7efa53d31d8aff0ab49bdaaefd3fb87a8cc7d4e8a90

    • SHA512

      68dca40e3de5053511fc1772b7a4834538b612724ec2de7fb2e182ba18b9281b5f1ccf47bd58d691024f5bcddfc086e58570ad590dd447f6b0185a91a1ac2422

    • SSDEEP

      384:Q5JEkajiasWEN7MADKzFk8RPf4BYSJGI9kgLjW/zXE58nupWwOk0GfZRm5g+zCxh:Q5JEkbWEOAODfsZJGHgLszUFTOqYyT

    Score
    1/10
    behavioral17behavioral18

    • Target

      archive/appsremote/qtga.dll

    • Size

      25KB

    • MD5

      d0604a5f13b32a08d5fa5bd887f869a6

    • SHA1

      976338eb697507ac857a6434ef1086f34bc9db24

    • SHA256

      2b6444d2a8146a066109ca19618ceee98444127a5b422c14635ab837887e55bf

    • SHA512

      c42edbaf6506dc1ca3aae3f052a07c7d2c4841f5b83003186cda185193f7cd2035cfe07e04a28356d254ab54666b5d60be4763e3e204273ecd0d7f2cd84bfc90

    • SSDEEP

      384:fFMPiwwZFypMrcrQVdPy82S8fQ4rI95QLjPx6/kOk0GfZQ5g+zCxw:CKwwZFypFrQVdPy4zQSQL7x68OqQyG

    Score
    1/10
    behavioral19behavioral20

    • Target

      archive/appsremote/qtiff.dll

    • Size

      314KB

    • MD5

      756d047a93d72771578286e621585ed2

    • SHA1

      313add1e91a21648f766aaa643350bec18ec5b5d

    • SHA256

      f9ebf4c98c1e0179cd76a1985386928fdb9e6f459e2238ed5530d160df4f0923

    • SHA512

      67fa91f266f0030ca0695f1c7964ee4d1c1447413420d0379eca62d54cc9d6cd0706df62da0043259b563e95a9c3a5c7ef0e0baacb36cafed5c9fcb1a3954aca

    • SSDEEP

      6144:kRfirNO3cCAolH6NdXv1+74AvPY6am60rvTW:kRsEgolH89+R2

    Score
    1/10
    behavioral21behavioral22

    • Target

      archive/appsremote/qwbmp.dll

    • Size

      25KB

    • MD5

      131a58669be7b3850c46d8e841da5d4e

    • SHA1

      1c08ae3c9d1850da88edc671928aa8d7e2a78098

    • SHA256

      043f3acf1dc4f4780721df106046c597262d7344c4b4894e0be55858b9fad00e

    • SHA512

      4f62b0c5ba0be6fb85fa15e500c348c2a32266e9b487357ea8ed1c1be05d7eabc46c9a1eeb9c5339291f4dd636b7291447a84d4ad5efbc403e5e7966b3863ade

    • SSDEEP

      384:FQIH6vdFY1KdOkKCghKCyKE99jSz4rI9kb00+QQOk0GfZG5g+zCx9g:FQIH6vxdzpgs2zQHb0XQQOqGyrg

    Score
    1/10
    behavioral23behavioral24

    • Target

      archive/appsremote/qwebp.dll

    • Size

      325KB

    • MD5

      f859ecc883476fe2c649cefbbd7e6f94

    • SHA1

      9900468c306061409e9aa1953d7d6a0d05505de8

    • SHA256

      b057c49c23c6ebe92e377b573723d9b349a6ede50cfd3b86573b565bf4a2ae0b

    • SHA512

      67af11fb9c81a7e91be747b2d74e81e8fe653ef82f049b652c7892c4ec4cafeba76b54a976616cbf1cd6b83f0abe060e82e46bf37f3ed841d595c4318d6fd73b

    • SSDEEP

      6144:9weI6fmBFAShI2q3S/fSEdZtE4k/7a0Ku0rhfaTalQbKb9PjArMxcCUZvbo:99mB6ShI2ViuZtErz10AAQhi

    Score
    1/10
    behavioral25behavioral26

    • Target

      archive/libGLESv2.dll

    • Size

      4.4MB

    • MD5

      e307e977ebb1df8ba0957a412425ed23

    • SHA1

      e024a7a81e7f485058fec40fd0a745f0d7aecb1e

    • SHA256

      af4f66e79e0cc1e4254f023cfb7f0140561c7d4e38d9bcf6184e8e69b32540db

    • SHA512

      ab5f5beb80915385aea4b62337178c6dfa964edfb7e20c22d364c99cd323fa50df9e2c640d7850765e5a683a07034d6be8f61f47f06a8d1ee1f594da804e6def

    • SSDEEP

      49152:PnBb2OR3KPf/Et3msx8M+TsZ2idR/O0zql9Kgtg6QMsWFxtqhk/bivfhjgrQuIEt:h5qc/622iLAv1NQcoa/bY3g

    Score
    3/10
    behavioral27behavioral28

    • Target

      archive/qsvgicon.dll

    • Size

      37KB

    • MD5

      90bb882a4b5e3427f328259530aa1b3b

    • SHA1

      a4059f0c105f4e2abe84efc4a48fa676171f37c5

    • SHA256

      b2b420aa1805d8b5dc15ccb74dd664d10bd6ba422743f5043a557a701c8a1778

    • SHA512

      a486280bba42d6c2d8b5ca0a0191b6b29067e1c120f85dbff709a4a42c61d925804915f93f815f56c9ca06ea9f8b89de0e692776524d28d81e29ef1c75501db8

    • SSDEEP

      768:ps7Ss9mMa0qnobGobEng53IdR4rXDd/+Hb0RPNRuBNJOqUVyvC:s95aoZEgGdu7Dd/YbOPybJ/XC

    Score
    1/10
    behavioral29behavioral30

    • Target

      archive/translations/Common7/IDE/CommonExtensions/Microsoft/NuGet/cs/Microsoft.Build.NuGetSdkResolver.resources.dll

    • Size

      12KB

    • MD5

      75e41cb25c2773fb3ccf479e1bd0f701

    • SHA1

      0956e2c87dfd938181244d2ef5c3ccfff2967879

    • SHA256

      e378da6b569bc4c3c8f8a5c2912954c7750e4f640b3b0b4141b75073dc37384c

    • SHA512

      6738dc4be8b382db6516f8ffcea868407e6a3cfe7bda1da0287445dced3b4700fd43bafeaed45b6ccf8599358dc74dc28078a85883d2ee7a0957b8f17a9664db

    • SSDEEP

      192:utotSyzWPXCWULwu0Sc2HnhWgN7aQW4hrHDIzLMmDWqnajKsdTfQ:utotBzWPX0D/HRN77XEQmDWlGsdU

    Score
    1/10
    behavioral31behavioral32

MITRE ATT&CK Enterprise v15

Tasks