8d022a2eb23de6c1a15af83b3dbb51598e121e8488a1a4c1341e3296857c20c8
- SHA256 8d022a2eb23de6c1a15af83b3dbb51598e121e8488a1a4c1341e3296857c20c8
Behavioral task
behavioral1
Sample
x360ce/data/Reg.exe
Resource
win7-20240729-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
x360ce/data/Reg.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral3
Sample
x360ce/data/Reg.vbs
Resource
win7-20240708-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
x360ce/data/Reg.vbs
Resource
win10v2004-20240802-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral5
Sample
x360ce/x360ce.exe
Resource
win7-20240708-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral6
Sample
x360ce/x360ce.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
20 signatures
150 seconds
General
- Target 8d022a2eb23de6c1a15af83b3dbb51598e121e8488a1a4c1341e3296857c20c8
- Size 13.2MB
- Sample240901-gy8w3stdkl
- SHA256 8d022a2eb23de6c1a15af83b3dbb51598e121e8488a1a4c1341e3296857c20c8
- MD5 4d6d1b271a4c108fce94d992f37ebb50
- SHA1 61a8432a7a0b9362ffabaecfe3aef5e42d707830
- SHA512 0117b373e4d8a7f7d8096d65f47862f22e929018dec9b209de3ebdf9ead246b1d4d88d45638a98da52afa79ba1560a878fac259f1877537243c08285528c5d3f
- SSDEEP 393216:ZzCn+O7YjNcbB041Yfmn3wjmc1KbRtjh4/j5:9CnYjyBifljQRtG/l
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Detected Ploutus loader 1 IoCs
resource yara_rule static1/unpack001/x360ce/data/Reg.data family_ploutus - Ploutus family
File Explorer
-
8d022a2eb23de6c1a15af83b3dbb51598e121e8488a1a4c1341e3296857c20c8.zip 13.2MB
-
x360ce/data/Reg.data.exe 14.7MB
-
x360ce/data/Reg.dll.vbs 270KB
-
x360ce/x360ce.exe.exe 162KB
x360ce/data/Reg.data
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 74faf334cb0bdd3e9dfab8c323d4eb3b9b089bcaadc7dbd639d9aa93a4f6f829
- MD5 be80f3348b240bcee1aa96d33fe0e768
- SHA1 40ea5de9a7a15f6e0d891cd1ba4bca8519bb85ed
- SHA512 dfb3b191152981f21180e93597c7b1891da6f10b811db2c8db9f45bbecc9feb54bc032bdd648c7ad1134e9b09e5e2b9705d5e21294e1ae328a4390350745536a
- SSDEEP 196608:n+/7/fO/vBSVnf+viDyJBwhsCArf+viDyJBQhsCAaIF/f+viDyJBaF9hsCA6EJ0k:nX/vu0Bwhs8vu0BQhsvFOvu0BaF9hsR
- MD5 SHA1 SHA512 SSDEEP
-
Detected Ploutus loader
Digest
c3:56:43:57:63:22:9e:04:ce:38:45:79:02:4c:9b:30:e6:57:8c:79:e9:00:79:14:e5:82:aa:8a:b1:91:38:46
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Evaldas Jocys,O=Evaldas Jocys,POSTALCODE=W12 0LX,STREET=Wormholt Road+STREET=5 Cleverly Estate,L=London,C=US
Chains
Nov 15, 2020
CN=Evaldas Jocys,O=Evaldas Jocys,POSTALCODE=W12 0LX,STREET=Wormholt Road+STREET=5 Cleverly Estate,L=London,C=US
CN=GoGetSSL RSA Codesigning CA,O=GoGetSSL,L=Riga,C=LV
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
CN=Evaldas Jocys,O=Evaldas Jocys,POSTALCODE=W12 0LX,STREET=Wormholt Road+STREET=5 Cleverly Estate,L=London,C=US
CN=GoGetSSL RSA Codesigning CA,O=GoGetSSL,L=Riga,C=LV
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB
Subject
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Serial Number
39:72:44:3a:f9:22:b7:51:d7:d3:6c:10:dd:31:35:95
Issuer
CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Mar 12, 2019 - Dec 31, 2028
Subject
CN=GoGetSSL RSA Codesigning CA,O=GoGetSSL,L=Riga,C=LV
Serial Number
1a:6e:54:ff:9f:9c:e0:f8:ea:cb:e7:a0:ab:56:9d:32
Issuer
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Sep 6, 2018 - Sep 5, 2028
Subject
CN=Evaldas Jocys,O=Evaldas Jocys,POSTALCODE=W12 0LX,STREET=Wormholt Road+STREET=5 Cleverly Estate,L=London,C=US
Serial Number
6c:c7:a2:8d:3a:6f:d3:39:ec:e4:bf:53:58:03:b5:16
Issuer
CN=GoGetSSL RSA Codesigning CA,O=GoGetSSL,L=Riga,C=LV
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Aug 1, 2020 - Aug 1, 2023
Subject
CN=Sectigo RSA Time Stamping Signer #2,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6b
Issuer
CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 23, 2020 - Jan 22, 2032
Subject
CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Issuer
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
May 2, 2019 - Jan 18, 2038
Minor OS version
0
Major OS version
4
Entry point
15307522
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
x360ce.pdb
mscoree
_CorExeMain
Name
.text
Size
14.6MB
Virtual Size
14.6MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
146KB
Virtual Size
145KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
x360ce/data/Reg.dll
- SHA256 94ac046fbe73a603bffed9c3360c66eb87c58025d99e5090ed330e00dbf1d07b
- MD5 babe69e99dded0a2f1362e596b31c718
- SHA1 5f2cf112eb24a14e701c4adb2a50aab81afda083
- SHA512 9a3c61b498b05c4a2039aeefb2969436acd3d0245e56fbf728f2eb80f1f9dfcb4012c483678747e8afe99b794e394dfd02347bf8d2f197516c487a53aa204765
- SSDEEP 6144:wTXqI/36A2JEq6AiAlP17338hHxR38GK5d0eKZTuJYYX+360f0eD:wTriA2JuAi6PRmHxF8GmtKhuJP+3CeD
- MD5 SHA1 SHA512 SSDEEP
x360ce/x360ce.exe
- SHA256 ed6c4a4dabead55eff566e48c9d67865a18fdf90871119b9011f9db523a67d8f
- MD5 d50289d1ba4b88774309b4ca8ee10ea4
- SHA1 b88976f789650c10922c665386ab929c5bf45728
- SHA512 9d682961c698328e545a6fca2b50d6acd33389aca4d8e4b8ee2f24bea7598117b763c8b287e62804e0e4660042d9573150c969dbd651414e62ad32568e877c2f
- SSDEEP 3072:3brZEFa/cwLLd85Ml1hL8nIwbAC1LwcEQkQkLY9nvu1Tno6vG2hwCxXdbqYun6L:3bx/caLd854qn9ECFwcEQWCUTnooG27B
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
db:e4:1e:84:81:0e:bd:bb:6a:c2:4c:5b:46:b4:f4:8c:ee:b2:66:13:64:70:79:02:fb:75:45:cf:42:a7:5a:1b
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
SERIALNUMBER=1078191-6,CN=Advantium Consulting Inc.,O=Advantium Consulting Inc.,L=Oakville,ST=Ontario,C=CA,1.3.6.1.4.1.311.60.2.1.3=#13024341,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Chains
Sep 1, 2024
Subject
CN=SSL.com EV Code Signing Intermediate CA RSA R3,O=SSL Corp,L=Houston,ST=Texas,C=US
Serial Number
42:4b:6a:53:ce:c7:66:14:1c:2a:63:b1:a5:1c:41:04
Issuer
CN=SSL.com EV Root Certification Authority RSA R2,O=SSL Corporation,L=Houston,ST=Texas,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Mar 26, 2019 - Mar 22, 2034
Subject
SERIALNUMBER=1078191-6,CN=Advantium Consulting Inc.,O=Advantium Consulting Inc.,L=Oakville,ST=Ontario,C=CA,1.3.6.1.4.1.311.60.2.1.3=#13024341,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Serial Number
2e:4f:4b:a2:5c:15:e3:bb:08:87:e8:b9:d1:ee:2b:ff
Issuer
CN=SSL.com EV Code Signing Intermediate CA RSA R3,O=SSL Corp,L=Houston,ST=Texas,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 4, 2024 - Apr 4, 2025
Subject
CN=SSL.com Timestamping Unit 2024 E1,O=SSL Corp,L=Houston,ST=Texas,C=US
Serial Number
5a:5a:ac:e8:1a:35:6e:b4:62:86:8d:57:7d:e0:3d:c7
Issuer
CN=SSL.com Timestamping Issuing RSA CA R1,O=SSL Corp,L=Houston,ST=Texas,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Feb 19, 2024 - Feb 16, 2034
Subject
CN=SSL.com Timestamping Issuing RSA CA R1,O=SSL Corp,L=Houston,ST=Texas,C=US
Serial Number
6d:52:18:70:87:e8:23:4d:85:60:00:d0:80:8f:93:56
Issuer
CN=SSL.com Root Certification Authority RSA,O=SSL Corporation,L=Houston,ST=Texas,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Nov 13, 2019 - Nov 12, 2034
Minor OS version
0
Major OS version
4
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\Administrator\source\repos\Sentinel\Sentinel\Sentinel\obj\x64\Release\x360ce.pdb
Name
.text
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
148KB
Virtual Size
148KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ