Overview

overview

7

Static

static

7

G/HPSafeBo....0.exe

windows7-x64

G/HPSafeBo....0.exe

windows10-2004-x64

G/HPSafeBo....0.exe

windows7-x64

G/HPSafeBo....0.exe

windows10-2004-x64

G/ProgramD...ok.dll

windows7-x64

1

G/ProgramD...ok.dll

windows10-2004-x64

1

G/ProgramD...64.dll

windows7-x64

1

G/ProgramD...64.dll

windows10-2004-x64

1

G/ProgramD...er.exe

windows7-x64

7

G/ProgramD...er.exe

windows10-2004-x64

7

G/ProgramD...64.exe

windows7-x64

1

G/ProgramD...64.exe

windows10-2004-x64

1

G/ProgramData/Key.dll

windows7-x64

1

G/ProgramData/Key.dll

windows10-2004-x64

1

G/TOOLS.exe

windows7-x64

7

G/TOOLS.exe

windows10-2004-x64

7

Sharing

Copy URL Twitter E-mail

General

  • Target

    6bb8615edefc92f9175e9de57cfe78c33744a2cff12ff325c0a3d79e0104e35c

  • Size

    5.5MB

  • Sample

    240723-jtpzhsvhlc

  • MD5

    4af8ec07d4a948eeeba8f7d94988dcc1

  • SHA1

    e554da37a4f5b4df477d92da20972d3896eee0ce

  • SHA256

    6bb8615edefc92f9175e9de57cfe78c33744a2cff12ff325c0a3d79e0104e35c

  • SHA512

    ab3dac0eefe843c15515bc63c125c855d51fc57a045772f982120c8098dfed1319b8710e6c80b0f40c3774b421cce182e8ae04368837b67b624ef6be6dacb65b

  • SSDEEP

    98304:RVMDFKzoFRfHFgJLQGx8BzoB9mEAhzsVGiS6eHe0aKLssbQI2jAibEsFDr+2:R6Kw/FgJz8xOtAhgV+HTxLseQn0sFDF

Score
7/10
upx

Malware Config

Targets

    • Target

      G/HPSafeBox/Important Folder/Co_1.{d3e34b21-9d75-101a-8c3d-00aa001a1652}/__/NLLastF/files/basic-V2.0.exe

    • Size

      120KB

    • MD5

      b5d271cd96b688f497b313ce341fcc73

    • SHA1

      e7c2bc9cc05d188d9ea0c78ab9955c90f878a691

    • SHA256

      689574b82fc92818a58b62e51097f99c0d351e2e38a9ef78db87f115ae381e48

    • SHA512

      f3438e74cff496376ec18d3d83ac1c35015b0799bdcca5d90dee05d4a61d35e02ba73e865c6f3d0de3c7edcded5fb1049daa3aece2dbf11e9534648c12e441b8

    • SSDEEP

      3072:mEtZ4iofXDf00bQJA39qp91jYb2zhIgEf5u8qTaSrNh:mqZpgb00bd30tHEfE8qT/rNh

    Score
    1/10
    behavioral1behavioral2

    • Target

      G/HPSafeBox/Important Folder/Co_1.{d3e34b21-9d75-101a-8c3d-00aa001a1652}/__/NLLastF/files/depth-V2.0.exe

    • Size

      120KB

    • MD5

      1a7c12eb71a61913a7ef93067f93fef4

    • SHA1

      d6b4d87d1b79ac29f0af182ffb8a875d961c39db

    • SHA256

      e4dac8b886de9feb840e5d517851a0ef7bd6b30c2e95a0eec2c8df409635d21d

    • SHA512

      fc37bc521ac99731c2edce0973c6167e230920aaab78078ae3ef34771269b78db53da42549545188852f1918161eefab6dd462fc82e995a4296a7dda97b8f984

    • SSDEEP

      3072:1MIN8q7XVWjzLGlckmaqn8MnaXUoFe+ttljcCBx72:SIN82oScnaqn8MnaXNtgs72

    Score
    1/10
    behavioral3behavioral4

    • Target

      G/ProgramData/DHook.dll

    • Size

      368KB

    • MD5

      718554ecabc6d4179101f68dafc4d23f

    • SHA1

      3170ef43660253b058734edb5f40b5d312ffdab5

    • SHA256

      c3a86ff8406291a54780be367ab7dc539066d35dba00d0b6b650925ed2fb12fd

    • SHA512

      43a4cca692127f93811d508289065e992faa37ba7da5680893d749720daaa173eb81433b6c72fa90f4d6b84813f327dcbaaa927fb68fb1634272e45d5d4b5aed

    • SSDEEP

      6144:VcuqMYFqtZAcWiPQAiL9JEcIoyfAv44Jk0p/i4+:VcrMYFqnATr9yfAw4JXv+

    Score
    1/10
    behavioral5behavioral6

    • Target

      G/ProgramData/DHook_64.dll

    • Size

      586KB

    • MD5

      6ed59a5f8d540fb4aff51ef8f3135508

    • SHA1

      85bab37322c1bff9b06acbd19d2d5a25523b69e0

    • SHA256

      fa08fe6b5f6b302743c644b627fd20df1e7dc517a077f6ba3b4939f53de74ec1

    • SHA512

      d64f0a394fa6ebdd0cb3146ed428e651ad292963f55912e745414269586e7196eadd7e1eeb1b3adee0b390dd9a48ebda88c2809eb44f6d7cfe0fcbec58863ba3

    • SSDEEP

      6144:hMRN38tAw7ZCY8hpgC80dMS6qimG5sJ/eYBMauc33kwg:e3GYDhpZ8896qHG5sRUIg

    Score
    1/10
    behavioral7behavioral8

    • Target

      G/ProgramData/DllLoader.exe

    • Size

      379KB

    • MD5

      c96fde128d054f9c3ff5757994b020cd

    • SHA1

      aa6f0b3522902a695ae53cecaaa81580a9b530d3

    • SHA256

      eff98419aaa485b2a5b7753cfa76cdefa3b5e06cf36e8a1a05bc932f70fed549

    • SHA512

      9180bee035a833d0ca3d3a6c053c44d4bd159c723eaa1cf5c62c3fab9b4a26f5369894de9f12f719b5b165f3d3ce59bebf032f3b6b8358826ae20f35f6b064cf

    • SSDEEP

      6144:XKjxMZGWKUnbdORiVJ3wOlgFIF4pLOo2CV0BFWh8Bc+dMDU7xLiXouTuSQLfLmLc:hJKUbccVJ39lgo4pLOoIqh8BcxDD761j

    Score
    7/10
    upx

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral10behavioral9

    • Target

      G/ProgramData/DllLoader_64.exe

    • Size

      1.9MB

    • MD5

      b51b7db4baeb91ec48e186378e164893

    • SHA1

      f25d07308baedad8475948187f5da1af8aa2ab9e

    • SHA256

      8742760a8d3078f9878ee01126363cb9026916a3e2f286586c99058f6c028bf8

    • SHA512

      041c0797b4084d4ece9c2b5a4f27af648ac67ec0f3091653d886b27d0d78f5dc174a8ff91d0bbe743ff494e94ac14222f2094a5daa5e1aeddf18d1bbb871de8c

    • SSDEEP

      24576:Oz5aCAG2pca3oBDB9S+flBT/8gvtuq5ePz:aaJdpcaYBDPS+cgvtuqI

    Score
    1/10
    behavioral11behavioral12

    • Target

      G/ProgramData/Key.dll

    • Size

      94KB

    • MD5

      d1a574cd082e8f9f64eae8de70057bf3

    • SHA1

      451531ce7a69f309efaa75ca598843064425fe9a

    • SHA256

      647aa2ac98ccc612be0f87bc5a3917e578d4c7be15c438054580f66c3f059d00

    • SHA512

      943f698995541ec5454020b5f11dc7122bdd46c371586062cacc37db4e2203d6ce6a563c3153c41cdc87b0d55723db06f15cf7d5751e319ff35e731827acf21e

    • SSDEEP

      1536:djqjoQ3Qa9bYHcZ8b+6goplj+b9pCd2ZC7wY6KKMf91FWqTFg1I9/Z8P:goROMq8a6fplj+b9pCd2ZC7wY6lMl1Fa

    Score
    1/10
    behavioral13behavioral14

    • Target

      G/TOOLS.exe

    • Size

      4.2MB

    • MD5

      422186ab5cb788779aeff280a3d4586f

    • SHA1

      2060283661a2b8b18e73815d4aa306c02fe8d6dc

    • SHA256

      29e9721eea55b03b3fb5141d3dc1ad0d8a8936b1ec8cd3a6dc3bad4f4d3361d7

    • SHA512

      3990b6c6cf47c02d3de8f9780aa3f89e178cc9e84927415efe6c40e7920a456234fa44c8d80ffa3fcdf3968c6064062784fb49001c3b033876854e725072aa23

    • SSDEEP

      98304:zX9CIQNdQhyUwmGfAOIshaObsH9qLOY8NS:xfQNyhuflXha4sH9wOYUS

    Score
    7/10

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    behavioral15behavioral16

MITRE ATT&CK Enterprise v15

Tasks