Overview

overview

7

Static

static

7

16b1be1cdf...eN.exe

windows7-x64

7

16b1be1cdf...eN.exe

windows10-2004-x64

7

$PLUGINSDI...ls.dll

windows7-x64

3

$PLUGINSDI...ls.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDIR/inetc.dll

windows7-x64

3

$PLUGINSDIR/inetc.dll

windows10-2004-x64

3

$PLUGINSDI...se.rtf

windows7-x64

4

$PLUGINSDI...se.rtf

windows10-2004-x64

1

$PLUGINSDI...gs.dll

windows7-x64

3

$PLUGINSDI...gs.dll

windows10-2004-x64

3

$PLUGINSDI...ON.dll

windows7-x64

7

$PLUGINSDI...ON.dll

windows10-2004-x64

7

$PLUGINSDI...it.dll

windows7-x64

7

$PLUGINSDI...it.dll

windows10-2004-x64

7

Sharing

Copy URL Twitter E-mail

General

  • Target

    16b1be1cdf32bd5dd7cde26777c95c87f95f4d2d7c9a4f4e31b96b06e714673eN

  • Size

    247KB

  • Sample

    240921-ekhfvstgjh

  • MD5

    e808715c4fee816936736b4d7564bc80

  • SHA1

    6f0157274b01754f32123dacc88196aae678100f

  • SHA256

    16b1be1cdf32bd5dd7cde26777c95c87f95f4d2d7c9a4f4e31b96b06e714673e

  • SHA512

    9c5ee6ce797bb228dfef73112440c47a7cc59b1a0224adca9ac89246a480cdbd3d0ecacd479eb94b7a9b81a65be80aa14d6ade6b33bc27e107802178c5a763c0

  • SSDEEP

    6144:7AQnIaoYyFijuBWX4TvHlYdgD4ueAq/7fC8:lyFijUiwFYdgD4uev/7K8

Score
7/10
discoveryupx

Malware Config

Targets

    • Target

      16b1be1cdf32bd5dd7cde26777c95c87f95f4d2d7c9a4f4e31b96b06e714673eN

    • Size

      247KB

    • MD5

      e808715c4fee816936736b4d7564bc80

    • SHA1

      6f0157274b01754f32123dacc88196aae678100f

    • SHA256

      16b1be1cdf32bd5dd7cde26777c95c87f95f4d2d7c9a4f4e31b96b06e714673e

    • SHA512

      9c5ee6ce797bb228dfef73112440c47a7cc59b1a0224adca9ac89246a480cdbd3d0ecacd479eb94b7a9b81a65be80aa14d6ade6b33bc27e107802178c5a763c0

    • SSDEEP

      6144:7AQnIaoYyFijuBWX4TvHlYdgD4ueAq/7fC8:lyFijUiwFYdgD4uev/7K8

    Score
    7/10
    discoveryupx

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

    • Target

      $PLUGINSDIR/StdUtils.dll

    • Size

      21KB

    • MD5

      62cd3e9089314d24f0817c231dfa859f

    • SHA1

      907fc4cef9bf22b3814dcf1cd06fc2b3c3ec842e

    • SHA256

      93530c4c3cfa4a6c87671050a52eb673228a597e9052622e57bec02fec5328ce

    • SHA512

      ccbe4f18013fd1055ca575d15faec1773268404b5dd1af40de865b39bf18457ca8d9078d3d3932fffdcebb5e76a807adce39b1091bda897ca53d60c6798fd041

    • SSDEEP

      384:1DBI+2XKPdeyYTpLhDaSR61M01rP41WKSthVGBJwSAkBMyO:1K+2XsdeyMRhOSRAn1wWXKM

    Score
    3/10
    discovery
    behavioral3behavioral4

    • Target

      $PLUGINSDIR/System.dll

    • Size

      24KB

    • MD5

      e7143c9655d4d4a9efaa578748c6bc45

    • SHA1

      f8ac5c6ecf4847e1bbeafe021881a46e20f09e7c

    • SHA256

      5c25a47da05d6ec943baec00977aae4825fe06db370b765afc1a5d39670ccbe2

    • SHA512

      deadec14af2048188ae6c56cacec0fad9e9c86bbd352e664a999f2df8d0cef23575e6cc85bdfdc5105d69f5b0bdcca95a7b9f052f31676295ab6e3cae01cf8de

    • SSDEEP

      384:EjuFHgNpQsSBO9+N5qoNvRjEJMmG+cGSjOBhpVPY8cCBfbwdxc4:ZOkooN6JMmGU6OBhbajxp

    Score
    3/10
    discovery
    behavioral5behavioral6

    • Target

      $PLUGINSDIR/inetc.dll

    • Size

      25KB

    • MD5

      29e2dcdfb57ee3ab5e2bbc2fc3c42f02

    • SHA1

      bd6cafcce5b70ee15311f9f53e9fd4aac819ccda

    • SHA256

      2b7a69e98ed4975fd4eade513cff17099c43b3eebe7e7641696d1d20e8e14b2f

    • SHA512

      f71c981b3b5308566b56156462d106ebf8e49a32e55b70891f9d70338941afd347cb4df374fe38b9b3d7309f63dd75a7c80ebe02bb8941d558cd638a6f8daf7a

    • SSDEEP

      384:ViY1+aFplLBSgN9afuzwZAEecpuB3NVeMUPOSya4fa0Ac9khYLMkIX0+GGxky8oO:ViY1+a3e1mwJKVSPO5a4fsO

    Score
    3/10
    discovery
    behavioral7behavioral8

    • Target

      $PLUGINSDIR/license.rtf

    • Size

      1KB

    • MD5

      71e4310177f5c62b4d8169138ca4d1d7

    • SHA1

      9769a5e96e25684d508405ff25aff484cd98591e

    • SHA256

      f56b071c73aeea8fc1823839736a480278c5f31e07403d06333c5ec3a0886d28

    • SHA512

      569211cc75afdc3534223e2f9a92a1c01fbcfc60483eb8f67a22eaa871e173bff72bc29bd2c8ecabebdea01e363452c3facd586586805d8208767bc5bbba2e13

    Score
    4/10
    discovery
    behavioral10behavioral9

    • Target

      $PLUGINSDIR/nsDialogs.dll

    • Size

      11KB

    • MD5

      66cfc94903c8cfa492fdab42bde2026d

    • SHA1

      d07194419d914eae5dc54a480ebddb0a8cb32f25

    • SHA256

      82e21860521feea4d15ff7f30538b9d0ed1860747c98549ec85217178a6db632

    • SHA512

      ecbc2c9361bef9332fe8e1675d11884c344b26f437eee9db3ec0b5999bf20e16b1d863c192e2091375a870cf8f4674deec16875ba56757b88cc859288305eeb7

    • SSDEEP

      192:mMmfEKSweFA9/H5aE3KRmQv295JrbQMH2klPdIobEEdTFdHg:OfEBwe+VH5avmQv29XrUMHVlPFEEdjHg

    Score
    3/10
    discovery
    behavioral11behavioral12

    • Target

      $PLUGINSDIR/nsJSON.dll

    • Size

      7KB

    • MD5

      b9cd1b0fd3af89892348e5cc3108dce7

    • SHA1

      f7bc59bf631303facfc970c0da67a73568e1dca6

    • SHA256

      49b173504eb9cd07e42a3c4deb84c2cd3f3b49c7fb0858aee43ddfc64660e384

    • SHA512

      fdcbdd21b831a92ca686aab5b240f073a89a08588e42439564747cad9160d79cfa8e3c103b6b4f2917684c1a591880203b4303418b85bc040f9f00b6658b0c90

    • SSDEEP

      96:Zw8NZ0x0OOdzJt0TwYKj7W/NYDNd9fQ6blfW+KrWC69r7ncnrD6Qdm:6e/7vAmrHblfW3iCmDcru

    Score
    7/10
    discoveryupx

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral13behavioral14

    • Target

      $PLUGINSDIR/nsRichEdit.dll

    • Size

      5KB

    • MD5

      02f1858b3131ffc3fc5e3a5391d3a489

    • SHA1

      454a6d749cf55ff990bd9f57941aca9d1f1674f6

    • SHA256

      f00bd6d3e7c7b8e8ad18b7dc6275fb80cc720fb164200a6506f50f6e66998b12

    • SHA512

      8147fa8014a5065f4fed7de1fbb9c2ee2c1b94d63596f7bbcf6821ecd41a73d25ebdfa1e71ca74d7598cba063042b6dfcaf050a23d0c855a7b6fbc94147ab41b

    • SSDEEP

      96:Z3CA+/dN6g2Aznq+1kaNar7ta6mKAJN0u4KOhB7lkZ3hBjB8wZ:Z3G/D26EaNar7QKzLdZkZX

    Score
    7/10
    discoveryupx

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral15behavioral16

MITRE ATT&CK Enterprise v15

Tasks