Overview

overview

10

Static

static

10

PCPS.exe

windows11-21h2-x64

10

Resubmissions

11-07-2024 20:08

240711-ywph4avapg 10

11-07-2024 20:05

240711-yt1hksthre 10

11-07-2024 20:04

240711-ytal6athpc 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    PCPS.exe

  • Size

    2.8MB

  • Sample

    240711-ywph4avapg

  • MD5

    483da837d70e72105520ea82033c49ff

  • SHA1

    4339212b959c1ead23bb5cc31dcf12736ee3e1d4

  • SHA256

    d9f553bfe5254e734f2c687a69d9a61f082b87c74fc03af1a51dff715a6d7e9d

  • SHA512

    1501cef6c13fd7285749b27ff1f1cb7bcbd4e75543eb3b3d78da649c3603028731b361a24d724d68dc41737e550ac826baf829806a69d7a90366e1768a58d23f

  • SSDEEP

    49152:B3+xTCM1oVeG0kGj/esU462SJJm0tjRU+hT9Lgr84zMG8qK7kyjF3U4RRGef++fd:BLGefGh

Score
10/10
ploutusatmbackdoordiscovery

Malware Config

Targets

    • Target

      PCPS.exe

    • Size

      2.8MB

    • MD5

      483da837d70e72105520ea82033c49ff

    • SHA1

      4339212b959c1ead23bb5cc31dcf12736ee3e1d4

    • SHA256

      d9f553bfe5254e734f2c687a69d9a61f082b87c74fc03af1a51dff715a6d7e9d

    • SHA512

      1501cef6c13fd7285749b27ff1f1cb7bcbd4e75543eb3b3d78da649c3603028731b361a24d724d68dc41737e550ac826baf829806a69d7a90366e1768a58d23f

    • SSDEEP

      49152:B3+xTCM1oVeG0kGj/esU462SJJm0tjRU+hT9Lgr84zMG8qK7kyjF3U4RRGef++fd:BLGefGh

    Score
    10/10
    ploutusatmbackdoordiscovery

    • Detected Ploutus loader

    • Ploutus

      Ploutus is an ATM malware written in C#.

      backdooratmploutus

    • Drops file in Drivers directory

    • Executes dropped EXE

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Drops file in System32 directory

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks