General

  • Target

    Update.exe

  • Size

    24.0MB

  • MD5

    105108872ba8d8b5df9a9eaccd659124

  • SHA1

    406c6f1ca3819b83cfad54d79fed529ba462ac3a

  • SHA256

    8b02429d36ee2c479e0d322589809daff155afdf815d24f6ebf699197b1c2121

  • SHA512

    afa6332cbb9fe23763fe70fe764350303870fabada15c0d96f088aca91ce82294d29ecb6f2b15cda3cec72c8f5e012210b91f9f5d7d32203e7e9e6c6aa315986

  • SSDEEP

    393216:uIHbuclTnUpIXaEwgDCU/c9vZpCCK8O+YycEqIg4dH9eowIScoJUnHShM38gzu81:uI7uaIpIqIm28rcEqt+toJU2MDzu84c

Score
7/10
upx

Malware Config

Signatures

  • ACProtect 1.3x - 1.4x DLL software 3 IoCs

    Detects file using ACProtect software.

  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Unsigned PE 25 IoCs

    Checks for missing Authenticode signature.

  • NSIS installer 6 IoCs

Files

  • Update.exe
    .exe windows:4 windows x86 arch:x86

    099c0646ea7282d232219f8807883be0


    Code Sign

    Headers

    Imports

    Sections

  • $PLUGINSDIR/ExecCmd.dll
    .dll windows:4 windows x86 arch:x86

    bf44c9fb48bb8c36b3e2527e7252350d


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/KillProc.dll
    .dll windows:4 windows x86 arch:x86


    Headers

    Exports

    Sections

  • out.upx
    .dll windows:4 windows x86 arch:x86


    Headers

    Sections

  • $PLUGINSDIR/SimpleSC.dll
    .dll windows:4 windows x86 arch:x86


    Headers

    Exports

    Sections

  • $PLUGINSDIR/System.dll
    .dll windows:4 windows x86 arch:x86

    2017f2acbdaa42ab3e4adeb8b4c37e7b


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/UserInfo.dll
    .dll windows:4 windows x86 arch:x86

    afa8e526425f3585465337467d0b5909


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/ip.dll
    .dll windows:1 windows x86 arch:x86


    Headers

    Exports

    Sections

  • $PLUGINSDIR/nsExec.dll
    .dll windows:4 windows x86 arch:x86

    d83f71e61ee459ee63ca3e829966a9dc


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/nsisxml.dll
    .dll windows:4 windows x86 arch:x86

    d9ee494a2a7b0d46616d9537ef3d8431


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/registry.dll
    .dll windows:4 windows x86 arch:x86

    421a02aae559045e04759aae146087eb


    Headers

    Imports

    Exports

    Sections

  • $SYSDIR/OpsRampEventLogs.dll
    .dll windows:6 windows x86 arch:x86


    Code Sign

    Headers

    Sections

  • Uninstall.exe
    .exe windows:4 windows x86 arch:x86

    099c0646ea7282d232219f8807883be0


    Code Sign

    Headers

    Imports

    Sections

  • $PLUGINSDIR/EventLog.dll
    .dll windows:4 windows x86 arch:x86

    b641db062d69aad5b1d64f77fc160e2b


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/ExecCmd.dll
    .dll windows:4 windows x86 arch:x86

    bf44c9fb48bb8c36b3e2527e7252350d


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/KillProc.dll
    .dll windows:4 windows x86 arch:x86


    Headers

    Exports

    Sections

  • out.upx
    .dll windows:4 windows x86 arch:x86


    Headers

    Sections

  • $PLUGINSDIR/SimpleSC.dll
    .dll windows:4 windows x86 arch:x86


    Headers

    Exports

    Sections

  • $PLUGINSDIR/System.dll
    .dll windows:4 windows x86 arch:x86

    2017f2acbdaa42ab3e4adeb8b4c37e7b


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/UserInfo.dll
    .dll windows:4 windows x86 arch:x86

    afa8e526425f3585465337467d0b5909


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/nsExec.dll
    .dll windows:4 windows x86 arch:x86

    d83f71e61ee459ee63ca3e829966a9dc


    Headers

    Imports

    Exports

    Sections

  • bin/Trayicon.exe
    .exe windows:5 windows x86 arch:x86

    e43b9f550ed3d0f4f9a9f09a58496c68


    Code Sign

    Headers

    Imports

    Sections

  • bin/agentsockipc.exe
    .exe windows:6 windows x64 arch:x64

    0018aa9541de88fcaa193a4707acf083


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • bin/opsramp-shield.exe
    .exe windows:6 windows x64 arch:x64

    0018aa9541de88fcaa193a4707acf083


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • bin/patchmanagement.exe
    .exe windows:5 windows x86 arch:x86

    cf1e83995e585fcbbfffd32bf1fa620f


    Code Sign

    Headers

    Imports

    Sections

  • bin/remote-exec.exe
    .exe windows:6 windows x64 arch:x64

    0018aa9541de88fcaa193a4707acf083


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • bin/scriptRunAsUser.exe
    .exe windows:6 windows x86 arch:x86

    224f978a021a45a5f9651f91b3392b95


    Code Sign

    Headers

    Imports

    Sections

  • bin/updater.exe
    .exe windows:6 windows x64 arch:x64

    0018aa9541de88fcaa193a4707acf083


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • bin/xCmd.exe
    .exe windows:4 windows x86 arch:x86

    9d7ae3a456dc8c657076d2c40d517d28


    Code Sign

    Headers

    Imports

    Sections

  • conf/App_Deployment.ini
  • conf/Config_av.ini
  • conf/app.d/creds.yaml.sample
  • conf/app/discovery/auto-detection.yaml
    .ps1
  • conf/app/monitoring/ad/monitoring.yaml
  • conf/app/monitoring/cpu/monitoring.yaml
  • conf/app/monitoring/disk/monitoring.yaml
  • conf/app/monitoring/exchange/2003/monitoring.yaml
  • conf/app/monitoring/exchange/2007/clientaccess/monitoring.yaml
  • conf/app/monitoring/exchange/2007/edgetransport/monitoring.yaml
  • conf/app/monitoring/exchange/2007/mailbox/monitoring.yaml
  • conf/app/monitoring/exchange/2007/monitoring.yaml
  • conf/app/monitoring/exchange/2007/unifiedmessaging/monitoring.yaml
  • conf/app/monitoring/exchange/2010/clientaccess/monitoring.yaml
  • conf/app/monitoring/exchange/2010/edgetransport/monitoring.yaml
  • conf/app/monitoring/exchange/2010/mailbox/monitoring.yaml
  • conf/app/monitoring/exchange/2010/monitoring.yaml
  • conf/app/monitoring/exchange/2010/unifiedmessaging/monitoring.yaml
  • conf/app/monitoring/exchange/2013/clientaccess/monitoring.yaml
  • conf/app/monitoring/exchange/2013/edgetransport/monitoring.yaml
  • conf/app/monitoring/exchange/2013/mailbox/monitoring.yaml
  • conf/app/monitoring/exchange/2016/edgetransport/monitoring.yaml
  • conf/app/monitoring/exchange/2016/mailbox/monitoring.yaml
  • conf/app/monitoring/exchange/monitoring.yaml
  • conf/app/monitoring/iis/monitoring.yaml
  • conf/app/monitoring/memory/monitoring.yaml
  • conf/app/monitoring/mssql/2000/monitoring.yaml
  • conf/app/monitoring/mssql/2005/monitoring.yaml
  • conf/app/monitoring/mssql/2008/monitoring.yaml
  • conf/app/monitoring/mssql/2012/monitoring.yaml
  • conf/app/monitoring/mssql/2014/monitoring.yaml
  • conf/app/monitoring/mssql/2016/monitoring.yaml
  • conf/app/monitoring/mssql/2017/monitoring.yaml
  • conf/app/monitoring/mssql/2019/monitoring.yaml
  • conf/app/monitoring/mssql/monitoring.yaml
  • conf/app/monitoring/network/monitoring.yaml
  • conf/app/monitoring/uptime/monitoring.yaml
  • conf/configuration.properties
  • conf/hb.properties
  • conf/hb.properties.tmp
  • conf/log.d/log-config.yaml.sample
  • conf/log/log-config.yaml.default
  • data/dbtool.exe
    .exe windows:6 windows x64 arch:x64

    0018aa9541de88fcaa193a4707acf083


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • data/dbtool3.exe
    .exe windows:6 windows x64 arch:x64

    4b98ae23e00779bd26811059b103d2b8


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • data/scriptversion.txt
  • opsramp-agent.exe
    .exe windows:6 windows x64 arch:x64

    5cb1a6f82fb862ba1e3a5c952c3175a3


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • plugins/Exchange2010.ps1
    .ps1
  • plugins/IISVersion8_Report.ps1
    .ps1
  • plugins/MSSQLServerReport.ps1
    .ps1
  • plugins/SCOMServiceModule.exe
    .exe windows:4 windows x86 arch:x86

    099c0646ea7282d232219f8807883be0


    Code Sign

    Headers

    Imports

    Sections

  • $PLUGINSDIR/ExecCmd.dll
    .dll windows:4 windows x86 arch:x86

    bf44c9fb48bb8c36b3e2527e7252350d


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/KillProc.dll
    .dll windows:4 windows x86 arch:x86


    Headers

    Exports

    Sections

  • out.upx
    .dll windows:4 windows x86 arch:x86


    Headers

    Sections

  • $PLUGINSDIR/UserInfo.dll
    .dll windows:4 windows x86 arch:x86

    afa8e526425f3585465337467d0b5909


    Headers

    Imports

    Exports

    Sections

  • db/sqlite3.exe
    .exe windows:4 windows x86 arch:x86

    2bbca035033fd6fb7dcb95d7c1c13cf0


    Headers

    Imports

    Sections

  • plugins/Microsoft.EnterpriseManagement.OperationsManager.Common.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • plugins/Microsoft.EnterpriseManagement.OperationsManager.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • plugins/SCOMPlugin.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Code Sign

    Headers

    Imports

    Sections

  • plugins/SCOMPlugin.exe.config
  • plugins/System.Data.SQLite.DLL
    .dll windows:5 windows x64 arch:x64

    60335f52d235cb30e3740e28254fe652


    Headers

    Imports

    Exports

    Sections

  • plugins/log4net.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • uninstall.exe.nsis
  • plugins/agentstatusinformation_windows.ps1
    .ps1
  • plugins/auto-monitor/ad-wmi.json
  • plugins/auto-monitor/exchange-2003-wmi.json
  • plugins/auto-monitor/exchange-2007-clientaccess-wmi.json
  • plugins/auto-monitor/exchange-2007-edge-hub-transport-wmi.json
  • plugins/auto-monitor/exchange-2007-mailbox-wmi.json
  • plugins/auto-monitor/exchange-2007-unifiedmessaging-wmi.json
  • plugins/auto-monitor/exchange-2007-wmi.json
  • plugins/auto-monitor/exchange-2010-clientaccess-wmi.json
  • plugins/auto-monitor/exchange-2010-edge-hub-transport-wmi.json
  • plugins/auto-monitor/exchange-2010-mailbox-wmi.json
  • plugins/auto-monitor/exchange-2010-unifiedmessaging-wmi.json
  • plugins/auto-monitor/exchange-2010-wmi.json
  • plugins/auto-monitor/exchange-2013-clientaccess-wmi.json
  • plugins/auto-monitor/exchange-2013-edge-hub-transport-wmi.json
  • plugins/auto-monitor/exchange-2013-mailbox-wmi.json
  • plugins/auto-monitor/exchange-2016-edge-hub-transport-wmi.json
  • plugins/auto-monitor/exchange-2016-mailbox-wmi.json
  • plugins/auto-monitor/exchange-wmi.json
  • plugins/auto-monitor/iis.ps1
    .ps1
  • plugins/auto-monitor/mssql-wmi.json
  • plugins/auto-monitor/mssql2000.ps1
    .ps1
  • plugins/auto-monitor/mssql2005.ps1
    .ps1
  • plugins/auto-monitor/mssql2008.ps1
    .ps1
  • plugins/auto-monitor/mssql2012.ps1
    .ps1
  • plugins/auto-monitor/mssql2014.ps1
    .ps1
  • plugins/auto-monitor/mssql2016.ps1
    .ps1
  • plugins/auto-monitor/mssql2017.ps1
    .ps1
  • plugins/auto-monitor/mssql2019.ps1
    .ps1
  • plugins/ntlmhash.ps1
    .ps1
  • utils/RBASystemStatus.ps1
    .ps1
  • utils/connectivity-debugger.exe
    .exe windows:6 windows x64 arch:x64

    f0ea7b7844bbc5bfa9bb32efdcea957c


    Code Sign

    Headers

    Imports

    Sections

  • utils/system-diag.exe
    .exe windows:6 windows x64 arch:x64

    0018aa9541de88fcaa193a4707acf083


    Code Sign

    Headers

    Imports

    Exports

    Sections