General

  • Target

    0e37b8a6711a3118daa1ce2e2f22c09b3f3c6179155b98215a1d96a81c767889.exe

  • Size

    199KB

  • Sample

    240824-ebe95stbrr

  • MD5

    1876442db107de88ad1dd01cb6c764a3

  • SHA1

    232163c4c6e6455d22c57453166269dbf3140692

  • SHA256

    0e37b8a6711a3118daa1ce2e2f22c09b3f3c6179155b98215a1d96a81c767889

  • SHA512

    d8d7e12ffa90bf7b55250a0548bbc0586b132461b1e4b213e3a44cb8942c8f503c165614fc3c6ad7c1955fd216b3bdeede827ec70a98d589f88b7ded53a45432

  • SSDEEP

    3072:zqODUQEEqx+IlkVz1QOFTas5+U1o3I3WAc51zHT29HTBXNUpY4aqf:z5DUQEEqxnEz1lOA+UrcLHTQFXN

Malware Config

Targets

    • Target

      0e37b8a6711a3118daa1ce2e2f22c09b3f3c6179155b98215a1d96a81c767889.exe

    • Size

      199KB

    • MD5

      1876442db107de88ad1dd01cb6c764a3

    • SHA1

      232163c4c6e6455d22c57453166269dbf3140692

    • SHA256

      0e37b8a6711a3118daa1ce2e2f22c09b3f3c6179155b98215a1d96a81c767889

    • SHA512

      d8d7e12ffa90bf7b55250a0548bbc0586b132461b1e4b213e3a44cb8942c8f503c165614fc3c6ad7c1955fd216b3bdeede827ec70a98d589f88b7ded53a45432

    • SSDEEP

      3072:zqODUQEEqx+IlkVz1QOFTas5+U1o3I3WAc51zHT29HTBXNUpY4aqf:z5DUQEEqxnEz1lOA+UrcLHTQFXN

    • Ploutus

      Ploutus is an ATM malware written in C#.

    • Grants admin privileges

      Uses net.exe to modify the user's privileges.

MITRE ATT&CK Matrix ATT&CK v13

Persistence

Account Manipulation

1
T1098

Discovery

Permission Groups Discovery

1
T1069

Local Groups

1
T1069.001

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Tasks