Overview

overview

7

Static

static

7

ca585886f3...0N.exe

windows7-x64

7

ca585886f3...0N.exe

windows10-2004-x64

7

$PLUGINSDI...ls.dll

windows7-x64

3

$PLUGINSDI...ls.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDIR/inetc.dll

windows7-x64

3

$PLUGINSDIR/inetc.dll

windows10-2004-x64

3

$PLUGINSDI...se.rtf

windows7-x64

4

$PLUGINSDI...se.rtf

windows10-2004-x64

1

$PLUGINSDI...gs.dll

windows7-x64

3

$PLUGINSDI...gs.dll

windows10-2004-x64

3

$PLUGINSDI...ON.dll

windows7-x64

7

$PLUGINSDI...ON.dll

windows10-2004-x64

7

$PLUGINSDI...it.dll

windows7-x64

7

$PLUGINSDI...it.dll

windows10-2004-x64

7

$PLUGINSDIR/nxs.dll

windows7-x64

3

$PLUGINSDIR/nxs.dll

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ca585886f32c6d710e577597a952c240N

  • Size

    215KB

  • Sample

    240908-pfevaaxgmb

  • MD5

    ca585886f32c6d710e577597a952c240

  • SHA1

    34429c22bfed0c04adc41140b491d40f07682ad9

  • SHA256

    7ea53d1705cb202531a2dbb02c1d9f070bf662b4ba028c340fd9cacaf06edf1e

  • SHA512

    5c41804d4272b95d5c54aebae417ea98d3c38ac549a72861cd5aef308de6e910a565f534642e5fb38bbed2a39ced8650d570246385d2fff9567b03ace554a4e3

  • SSDEEP

    3072:/X7DItrfaocyTgfsqQOlJHboKLvB44GIYtK1WB7IMO0DsRejz3UmCsFA7nQprG:/saocyLC77j3YtK4SVusRuU9XnX

Score
7/10
discoveryupx

Malware Config

Targets

    • Target

      ca585886f32c6d710e577597a952c240N

    • Size

      215KB

    • MD5

      ca585886f32c6d710e577597a952c240

    • SHA1

      34429c22bfed0c04adc41140b491d40f07682ad9

    • SHA256

      7ea53d1705cb202531a2dbb02c1d9f070bf662b4ba028c340fd9cacaf06edf1e

    • SHA512

      5c41804d4272b95d5c54aebae417ea98d3c38ac549a72861cd5aef308de6e910a565f534642e5fb38bbed2a39ced8650d570246385d2fff9567b03ace554a4e3

    • SSDEEP

      3072:/X7DItrfaocyTgfsqQOlJHboKLvB44GIYtK1WB7IMO0DsRejz3UmCsFA7nQprG:/saocyLC77j3YtK4SVusRuU9XnX

    Score
    7/10
    discoveryupx

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

    • Target

      $PLUGINSDIR/StdUtils.dll

    • Size

      18KB

    • MD5

      e03876429de52398e49cf9b308ec97e2

    • SHA1

      c540ca346d63666d40f7d64bec1fdc742ec9b7ae

    • SHA256

      515f58aaad94e1a3c00577e258f9592f5e6eea32e0343392f4611852acf0f906

    • SHA512

      c25ac014c77573af44d44f28ad547bd08f0c6f5b342d5d6269fcbd2dc92f8c2b859ea4091bec9c4e4ad8482b8951b03b526d4bfaddf8f802487d30348aaf627c

    • SSDEEP

      384:WflsDFSQa8fj9yOXCkzGBatLJGLnH0kBYmIv:ClsZSQa0xCxYmI

    Score
    3/10
    discovery
    behavioral3behavioral4

    • Target

      $PLUGINSDIR/System.dll

    • Size

      23KB

    • MD5

      125aebb055446fb52aa5956cf99e8a9a

    • SHA1

      6b58fd08a8ff2763219cc6b0dcdb875f9970f850

    • SHA256

      2e1b11ee20e5061ea86dc6b01e3efc659e887540afcab7317cdfd6a8eff87ec3

    • SHA512

      5f85e48bd3ae2fd2be0595b93cbf74674e0281210688dcc73691178b295a702e8d43898afb6e5d8b7e82de98b4ee28194c9838ddf8279cde85f7fe48d34dc8b7

    • SSDEEP

      384:7AQ5GjarYFU76ffyEIPb9p206QrHwIl8ToknCLJy4k9KyFkKCKWin/aY+:72XixPbPD6gQikUywWkKx/aY+

    Score
    3/10
    discovery
    behavioral5behavioral6

    • Target

      $PLUGINSDIR/inetc.dll

    • Size

      25KB

    • MD5

      29e2dcdfb57ee3ab5e2bbc2fc3c42f02

    • SHA1

      bd6cafcce5b70ee15311f9f53e9fd4aac819ccda

    • SHA256

      2b7a69e98ed4975fd4eade513cff17099c43b3eebe7e7641696d1d20e8e14b2f

    • SHA512

      f71c981b3b5308566b56156462d106ebf8e49a32e55b70891f9d70338941afd347cb4df374fe38b9b3d7309f63dd75a7c80ebe02bb8941d558cd638a6f8daf7a

    • SSDEEP

      384:ViY1+aFplLBSgN9afuzwZAEecpuB3NVeMUPOSya4fa0Ac9khYLMkIX0+GGxky8oO:ViY1+a3e1mwJKVSPO5a4fsO

    Score
    3/10
    discovery
    behavioral7behavioral8

    • Target

      $PLUGINSDIR/license.rtf

    • Size

      1KB

    • MD5

      194758433a4f4a9adbe0f47189c0ff57

    • SHA1

      ed979930542bb3b9ee0a5fabf7574ea11f078405

    • SHA256

      e17f9c0044f7255773ad4055eb9b838c1ab9092ec4784f87d62c1323d858f819

    • SHA512

      9659420a64bf49696d5fb7ce4f30ca48ae22d58e4bd522d27c144f9fc2f5d1af64661b924ec05e4ff92e74d1730506346bc0887fc1736fffc03d199c98a4a21f

    Score
    4/10
    discovery
    behavioral10behavioral9

    • Target

      $PLUGINSDIR/nsDialogs.dll

    • Size

      11KB

    • MD5

      790d227d847f7571c8d58a79057a469e

    • SHA1

      75c347b1441383c61166b615dfd6e7e65b04629f

    • SHA256

      37e99ab9db0045870e31db147438cf0c69b6fcdec4f3737a9743c447cbc0c3c0

    • SHA512

      5821605bfb3e57ddfcc1a74829968814aae92b13cb713ef3628913d9112d493117e8aa9cc437770facdcd2d4bd1e53a271d491e6b4d3e4cff53bd027f4b07f4c

    • SSDEEP

      192:WyeiCdfR0gDj2dtr03OOM9X89jqcZNckLYKFaYWOdIyHWsK:adpjHY0tM9X892nkLJvWOdTHWs

    Score
    3/10
    discovery
    behavioral11behavioral12

    • Target

      $PLUGINSDIR/nsJSON.dll

    • Size

      7KB

    • MD5

      b9cd1b0fd3af89892348e5cc3108dce7

    • SHA1

      f7bc59bf631303facfc970c0da67a73568e1dca6

    • SHA256

      49b173504eb9cd07e42a3c4deb84c2cd3f3b49c7fb0858aee43ddfc64660e384

    • SHA512

      fdcbdd21b831a92ca686aab5b240f073a89a08588e42439564747cad9160d79cfa8e3c103b6b4f2917684c1a591880203b4303418b85bc040f9f00b6658b0c90

    • SSDEEP

      96:Zw8NZ0x0OOdzJt0TwYKj7W/NYDNd9fQ6blfW+KrWC69r7ncnrD6Qdm:6e/7vAmrHblfW3iCmDcru

    Score
    7/10
    discoveryupx

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral13behavioral14

    • Target

      $PLUGINSDIR/nsRichEdit.dll

    • Size

      5KB

    • MD5

      02f1858b3131ffc3fc5e3a5391d3a489

    • SHA1

      454a6d749cf55ff990bd9f57941aca9d1f1674f6

    • SHA256

      f00bd6d3e7c7b8e8ad18b7dc6275fb80cc720fb164200a6506f50f6e66998b12

    • SHA512

      8147fa8014a5065f4fed7de1fbb9c2ee2c1b94d63596f7bbcf6821ecd41a73d25ebdfa1e71ca74d7598cba063042b6dfcaf050a23d0c855a7b6fbc94147ab41b

    • SSDEEP

      96:Z3CA+/dN6g2Aznq+1kaNar7ta6mKAJN0u4KOhB7lkZ3hBjB8wZ:Z3G/D26EaNar7QKzLdZkZX

    Score
    7/10
    discoveryupx

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral15behavioral16

    • Target

      $PLUGINSDIR/nxs.dll

    • Size

      5KB

    • MD5

      7259499597d08655801ecebcfd5f82d9

    • SHA1

      2772b9b7ce9945eb896238ddea1558c48ce055c8

    • SHA256

      09f7c4372e34fedb2c98c1f2cd73275a8ce5f2ce02581789d374513f1ff2fa34

    • SHA512

      8e3c945a5d66d20ca388ed0aaf98548a4da46cd9480d2041c1215414072c3a21a42c8b5606165793457dc7ed5cf729d878c74608f2346d5eee627186ce2fd7d5

    • SSDEEP

      96:C+hGtm1jGTl0NtrqTZPfcPfLxHkWLbYG:C+hjGJ+IVfUfLxEWL

    Score
    3/10
    discovery
    behavioral17behavioral18

MITRE ATT&CK Enterprise v15

Tasks