General
-
Target
HMCL-3.5.8.249.jar
-
Size
4.6MB
-
Sample
240722-wzj2nszhpe
-
MD5
d26a16de693a9fa841d2c64fb500f9c1
-
SHA1
6d6baf9f6b96526785659a5f940277e95d97252f
-
SHA256
0154c4f510f40ca2aeba63df6b998f40c59dc787e50dec9e39e6baccbf2b7ae7
-
SHA512
ad3e1ad02456e018b6c93ccab0759f4d978670c94e7e145d5449138efdc769ffab4e5820ca2fc257014fe344db05a6b66cc1f2a319ad95a8f40f651bca125997
-
SSDEEP
98304:ZL5ScSlFchZD9YIZMTAuOBiJMWz86ixcnQDlT5z/ni:ZwlShN9U0DcWWnQh9zK
Static task
static1
Malware Config
Targets
-
-
Target
HMCL-3.5.8.249.jar
-
Size
4.6MB
-
MD5
d26a16de693a9fa841d2c64fb500f9c1
-
SHA1
6d6baf9f6b96526785659a5f940277e95d97252f
-
SHA256
0154c4f510f40ca2aeba63df6b998f40c59dc787e50dec9e39e6baccbf2b7ae7
-
SHA512
ad3e1ad02456e018b6c93ccab0759f4d978670c94e7e145d5449138efdc769ffab4e5820ca2fc257014fe344db05a6b66cc1f2a319ad95a8f40f651bca125997
-
SSDEEP
98304:ZL5ScSlFchZD9YIZMTAuOBiJMWz86ixcnQDlT5z/ni:ZwlShN9U0DcWWnQh9zK
-
Drops file in Drivers directory
-
Manipulates Digital Signatures
Attackers can apply techniques such as modifying certain DLL exports to make their binary seem valid.
-
Drops desktop.ini file(s)
-
Legitimate hosting services abused for malware hosting/C2
-
Drops autorun.inf file
Malware can abuse Windows Autorun to spread further via attached volumes.
-
Drops file in System32 directory
-
Modifies termsrv.dll
Commonly used to allow simultaneous RDP sessions.
-