Resubmissions

03-09-2024 21:32

240903-1dvy9syeqh 3

03-09-2024 21:15

240903-z35pbsxcnm 3

03-09-2024 21:00

240903-ztqttaxalq 3

03-09-2024 20:53

240903-zps4dawhll 3

General

  • Target

    Cisco AnyConnect Secure Mobility Client.zip

  • Size

    11.6MB

  • MD5

    a046e07111f7ecae523c8acd0e6a0ffa

  • SHA1

    10c35ca94d6a834dc81a60c953abc11bdfaa4bb1

  • SHA256

    31e347b556164f5e2d068ed6be0101b8ee12a248be2ced71a6744db817d787b0

  • SHA512

    a84baed41cf5d7a4dbb599728164b7cf28cd7d92212513f3e821dfeb617b93030f545264adfe9ed1cfdd09220f5518031a368369ad035a3698bc7e7030719a76

  • SSDEEP

    196608:mIgy+3IWzFPMN0d7GcXraogl7b9qvnE4le2eVVX/dgE5HK+ATELEvGlxp9TYc5N6:m1y+77GmratsvJej/dgISAYv+ppr51+X

Score
3/10

Malware Config

Signatures

  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • Cisco AnyConnect Secure Mobility Client.zip
    .zip
  • Cisco AnyConnect Secure Mobility Client/Install/Component/acsock64.json
  • Cisco AnyConnect Secure Mobility Client/Install/Dependency/vpn_manifest.json
  • Cisco AnyConnect Secure Mobility Client/InstallHelper.exe
    .exe windows:6 windows x86 arch:x86

    bd32d108c92ae0ab7a6d6e8ec4b2b5de


    Code Sign

    Headers

    Imports

    Sections

  • Cisco AnyConnect Secure Mobility Client/InstallHelper64.exe
    .exe windows:6 windows x64 arch:x64

    1a40abfbe723aa502b8f7bccd9856721


    Code Sign

    Headers

    Imports

    Sections

  • Cisco AnyConnect Secure Mobility Client/OpenSource.html
    .html
  • Cisco AnyConnect Secure Mobility Client/Plugins/acdownloader.dll
    .dll windows:6 windows x86 arch:x86

    6495a4282f2ae677fbaefb7a47bad11d


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Cisco AnyConnect Secure Mobility Client/Plugins/acfeedback.dll
    .dll windows:6 windows x86 arch:x86

    d231fdf1190915798ef144618bb637eb


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Cisco AnyConnect Secure Mobility Client/Plugins/actoast.dll
    .dll windows:6 windows x86 arch:x86

    06ba87b099ad99d09c981e524b44da25


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Cisco AnyConnect Secure Mobility Client/Plugins/acwebhelper.dll
    .dll windows:6 windows x86 arch:x86

    7b11d6721f8d078bf56e302919a51328


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Cisco AnyConnect Secure Mobility Client/Plugins/vpnapishim.dll
    .dll windows:6 windows x86 arch:x86

    c39db8bd7bc2724e1d412a92d73d8a54


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Cisco AnyConnect Secure Mobility Client/Plugins/vpnipsec.dll
    .dll windows:6 windows x86 arch:x86

    ec70c5f244cbc88050703999fe30ee84


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Cisco AnyConnect Secure Mobility Client/ProxyCon.exe
    .exe windows:6 windows x86 arch:x86

    6dc4a5476a4e339032372bcb39e8cb88


    Code Sign

    Headers

    Imports

    Sections

  • Cisco AnyConnect Secure Mobility Client/Uninstall.exe
    .exe windows:6 windows x86 arch:x86

    846815fed5a9132a0eec45f029d87e61


    Code Sign

    Headers

    Imports

    Sections

  • Cisco AnyConnect Secure Mobility Client/UpdateComponentManifest.json
  • Cisco AnyConnect Secure Mobility Client/VACon64.exe
    .exe windows:6 windows x64 arch:x64

    4ca3ab0ebe679a8a823e3020e4ca2eee


    Code Sign

    Headers

    Imports

    Sections

  • Cisco AnyConnect Secure Mobility Client/ac_sock_fltr_api.dll
    .dll windows:6 windows x86 arch:x86

    3716cb8591c4b4f2b8d8260134764144


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Cisco AnyConnect Secure Mobility Client/acciscocrypto.dll
    .dll windows:6 windows x86 arch:x86

    eee82b3969a7f43b35fdeb575b738356


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Cisco AnyConnect Secure Mobility Client/acciscossl.dll
    .dll windows:6 windows x86 arch:x86

    f04c440af1ff5815877b44668a025d03


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Cisco AnyConnect Secure Mobility Client/accurl.dll
    .dll windows:6 windows x86 arch:x86

    8ec681ec652bfaf9462ec36894a28b30


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Cisco AnyConnect Secure Mobility Client/acextwebhelper.exe
    .exe windows:6 windows x86 arch:x86

    cd54756e451e357ba3b9d90b908ecd2c


    Code Sign

    Headers

    Imports

    Sections

  • Cisco AnyConnect Secure Mobility Client/acruntime.dll
    .dll windows:6 windows x86 arch:x86

    5be29dc0f56f83514b66e8765f8c49de


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Cisco AnyConnect Secure Mobility Client/acsock64.cat
  • Cisco AnyConnect Secure Mobility Client/acsock64.inf
  • Cisco AnyConnect Secure Mobility Client/acsock64.sys
    .sys windows:10 windows x64 arch:x64

    b9536af201b2a97e724fe2582dadbabf


    Code Sign

    Headers

    Imports

    Sections

  • Cisco AnyConnect Secure Mobility Client/acwebhelper.exe
    .exe windows:6 windows x86 arch:x86

    f358d41d6fbb7febcaf8d7c31eb163d4


    Code Sign

    Headers

    Imports

    Sections

  • Cisco AnyConnect Secure Mobility Client/boost_chrono.dll
    .dll windows:6 windows x86 arch:x86

    01bb944c7e964ffa874aca94c2c45a83


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Cisco AnyConnect Secure Mobility Client/boost_date_time.dll
    .dll windows:6 windows x86 arch:x86

    9560962c757318a085c63d24a14aa8cc


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Cisco AnyConnect Secure Mobility Client/boost_filesystem.dll
    .dll windows:6 windows x86 arch:x86

    b258f5c983e0e7e4cb304dadc8444fb5


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Cisco AnyConnect Secure Mobility Client/boost_signals.dll
    .dll windows:6 windows x86 arch:x86

    1fe684a26dff82d5c6d8224960e29ee7


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Cisco AnyConnect Secure Mobility Client/boost_system.dll
    .dll windows:6 windows x86 arch:x86

    84228cd283275012e7dd62c246e3f100


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Cisco AnyConnect Secure Mobility Client/boost_thread.dll
    .dll windows:6 windows x86 arch:x86

    8f227d8a8dd71270e92ce65b1460037e


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Cisco AnyConnect Secure Mobility Client/cfom.dll
    .dll windows:6 windows x86 arch:x86

    1b9ce5b17635183ef787b84a8324b2c3


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Cisco AnyConnect Secure Mobility Client/concrt140.dll
    .dll windows:6 windows x86 arch:x86

    a7f0e297dae66d5b73188a236ad0ae0f


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Cisco AnyConnect Secure Mobility Client/manifesttool.exe
    .exe windows:6 windows x86 arch:x86

    1cf26a59941a5a8e1004d8df69acbb7e


    Code Sign

    Headers

    Imports

    Sections

  • Cisco AnyConnect Secure Mobility Client/msvcp140.dll
    .dll windows:6 windows x86 arch:x86

    6dbd7763e94344402d4206b7bab40e1f


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Cisco AnyConnect Secure Mobility Client/msvcp140_1.dll
    .dll windows:6 windows x86 arch:x86

    badc88dcecb53267a454e1969fb4ce2e


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Cisco AnyConnect Secure Mobility Client/msvcp140_2.dll
    .dll windows:6 windows x86 arch:x86

    93349915df9759fa7a16a326552ba61b


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Cisco AnyConnect Secure Mobility Client/res/GUI.ico
  • Cisco AnyConnect Secure Mobility Client/res/about.png
    .png
  • Cisco AnyConnect Secure Mobility Client/res/about_hover.png
    .png
  • Cisco AnyConnect Secure Mobility Client/res/app_logo.png
    .png
  • Cisco AnyConnect Secure Mobility Client/res/attention.ico
  • Cisco AnyConnect Secure Mobility Client/res/cisco_blue.png
    .png
  • Cisco AnyConnect Secure Mobility Client/res/cisco_indigo.png
    .png
  • Cisco AnyConnect Secure Mobility Client/res/collapse.ico
  • Cisco AnyConnect Secure Mobility Client/res/company_logo.png
    .png
  • Cisco AnyConnect Secure Mobility Client/res/company_logo_alt.png
    .png
  • Cisco AnyConnect Secure Mobility Client/res/cues_bg.jpg
    .jpg
  • Cisco AnyConnect Secure Mobility Client/res/error.ico
  • Cisco AnyConnect Secure Mobility Client/res/expand.ico
  • Cisco AnyConnect Secure Mobility Client/res/gradient.png
    .png
  • Cisco AnyConnect Secure Mobility Client/res/mftogglebtn-down-solid.png
    .png
  • Cisco AnyConnect Secure Mobility Client/res/mftogglebtn-down.png
    .png
  • Cisco AnyConnect Secure Mobility Client/res/mftogglebtn.png
    .png
  • Cisco AnyConnect Secure Mobility Client/res/neutral.ico
  • Cisco AnyConnect Secure Mobility Client/res/noncompliant.ico
  • Cisco AnyConnect Secure Mobility Client/res/status_ico_attention.png
    .png
  • Cisco AnyConnect Secure Mobility Client/res/status_ico_error.png
    .png
  • Cisco AnyConnect Secure Mobility Client/res/status_ico_good.png
    .png
  • Cisco AnyConnect Secure Mobility Client/res/status_ico_neutral.png
    .png
  • Cisco AnyConnect Secure Mobility Client/res/status_ico_noncompliant.png
    .png
  • Cisco AnyConnect Secure Mobility Client/res/status_ico_transition.png
    .png
  • Cisco AnyConnect Secure Mobility Client/res/status_ico_trusted.png
    .png
  • Cisco AnyConnect Secure Mobility Client/res/toast_nam.png
    .png
  • Cisco AnyConnect Secure Mobility Client/res/toast_vpn.png
    .png
  • Cisco AnyConnect Secure Mobility Client/res/toolbar.png
    .png
  • Cisco AnyConnect Secure Mobility Client/res/toolbar_about.png
    .png
  • Cisco AnyConnect Secure Mobility Client/res/toolbar_about_hover.png
    .png
  • Cisco AnyConnect Secure Mobility Client/res/toolbar_help.png
    .png
  • Cisco AnyConnect Secure Mobility Client/res/toolbar_help_hover.png
    .png
  • Cisco AnyConnect Secure Mobility Client/res/toolbar_prefs.png
    .png
  • Cisco AnyConnect Secure Mobility Client/res/toolbar_prefs_hover.png
    .png
  • Cisco AnyConnect Secure Mobility Client/res/transition_1.ico
  • Cisco AnyConnect Secure Mobility Client/res/transition_2.ico
  • Cisco AnyConnect Secure Mobility Client/res/transition_3.ico
  • Cisco AnyConnect Secure Mobility Client/res/vpn_connected.ico
  • Cisco AnyConnect Secure Mobility Client/res/vpn_logo.png
    .png
  • Cisco AnyConnect Secure Mobility Client/res/webbrowser.ico
  • Cisco AnyConnect Secure Mobility Client/vccorlib140.dll
    .dll windows:6 windows x86 arch:x86

    7bbb5ae4c5aa5ae8ccf84c3a96ba2cd3


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Cisco AnyConnect Secure Mobility Client/vcruntime140.dll
    .dll windows:6 windows x86 arch:x86

    6a84b7445ccacd5d29ac27de2745f356


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Cisco AnyConnect Secure Mobility Client/vpnagent.exe
    .exe windows:6 windows x86 arch:x86

    2aab5f78ca061ba9f0502805c323729c


    Code Sign

    Headers

    Imports

    Sections

  • Cisco AnyConnect Secure Mobility Client/vpnagentutilities.dll
    .dll windows:6 windows x86 arch:x86

    2a2b26a9c20c576ed1b9897bd9386d2b


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Cisco AnyConnect Secure Mobility Client/vpnapi.dll
    .dll regsvr32 windows:6 windows x86 arch:x86

    4eb996c236cbc6d8deb8ec20c35bdcb3


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Cisco AnyConnect Secure Mobility Client/vpncli.exe
    .exe windows:6 windows x86 arch:x86

    030bdfb2778c207beb937460f5ca4e61


    Code Sign

    Headers

    Imports

    Sections

  • Cisco AnyConnect Secure Mobility Client/vpncommon.dll
    .dll windows:6 windows x86 arch:x86

    27d9ae5c96714857111232f51ee6c864


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Cisco AnyConnect Secure Mobility Client/vpncommoncrypt.dll
    .dll windows:6 windows x86 arch:x86

    ea0d30d223018970f03f7df246c588ac


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Cisco AnyConnect Secure Mobility Client/vpndownloader.exe
    .exe windows:6 windows x86 arch:x86

    9968d423bb5593888c557ace75c82cf2


    Code Sign

    Headers

    Imports

    Sections

  • Cisco AnyConnect Secure Mobility Client/vpnmgmttun.exe
    .exe windows:6 windows x86 arch:x86

    563c7acd51095b281631428beb154493


    Code Sign

    Headers

    Imports

    Sections

  • Cisco AnyConnect Secure Mobility Client/vpnui.exe
    .exe windows:6 windows x86 arch:x86

    9a6f56b16253396b806cba2d405b18dc


    Code Sign

    Headers

    Imports

    Sections

  • Cisco AnyConnect Secure Mobility Client/vpnva-6.cat
  • Cisco AnyConnect Secure Mobility Client/vpnva-6.inf
  • Cisco AnyConnect Secure Mobility Client/vpnva64-6.sys
    .sys windows:10 windows x64 arch:x64

    e625f4d87c016c3934d6c8ed10bf6d9e


    Headers

    Imports

    Sections

  • Cisco AnyConnect Secure Mobility Client/zlib1.dll
    .dll windows:6 windows x86 arch:x86

    6f467e87095aad085bec213e5814d39e


    Code Sign

    Headers

    Imports

    Exports

    Sections