77bb35807e4fa5ccde415bfaa04496fa64e69e0c8a08163a37f3ba77af5f97a2 | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
5ca9edd8b0661aaa4e7895232d35e805_JaffaCakes118
Size 17.1MB
Sample241019-pvbq6swdrf
SHA256 77bb35807e4fa5ccde415bfaa04496fa64e69e0c8a08163a37f3ba77af5f97a2
MD5 5ca9edd8b0661aaa4e7895232d35e805
SHA1 da3aed24ec0d48ce773507e6af1a9e33ea3ec613
SHA512 f09ef2d4d9619e545e1f1b8a59d51af774f3997fcd365d9375604debc0650d333aa03f5c9ffa4396fcce8e168cce29bdfbf722f8545ead2a60cd967e198befce
SSDEEP 393216:gPCFuY4qJM/1KQcA6e33XbBi5CaXI4IWfEs2OCEj814J1bryw:oCoY4f/1UABSIQMvBEhh7
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

aspackv2 bootkit discovery persistence upx

Malware Config

Targets

- Target
  mirserver/DBServer/DBServer.exe
- Size 382KB
- SHA256 3cce2cb4ff76b4ff4362699003fde1375e82a05932794ba09f0809f287128922
- MD5 d7a8eec0e18be329c93bd2095f0df1f7
- SHA1 f2b90bd2c0013ee4a518ad130bc481606dd9e3f1
- SHA512 8719727a47803c95df24095aa7cd9c8af19223d6d59490117cc589c62ead8663583a35535bc7e8ea92dca40feba7c95958be7cf539319ed827564ebe8291a871
- SSDEEP 6144:YFM/VTFE7hlI9yNgX8fIlEIS2qVUDA6rGafN8mscrEe0PyIEVqmQ5iJCJt6U3pRG:CMVe7hlM5lEZ6AhId0PtmGKe7p0q
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral1 behavioral2
- Target
  mirserver/GameCenter.exe
- Size 267KB
- SHA256 eb81deb3a6676cb16d3f3520989b2fff5bcdd5a73dc145e42d4113fc1056c2ba
- MD5 935ed40f01658ce10baef215912a3422
- SHA1 43042f9bd9586e3a0c41a6370c1cefbf198168fa
- SHA512 a42feee8dad0801b84e481deaf57a11b476cc6f7d785860726211161c17e1e4033ae3017d9c562a58ed5885ad583c4ffe346bc19e9408d99fa8a641c00f6fd9c
- SSDEEP 6144:YcERY7dT6CLL6jbX7f6OJbYLIQDeXZWifmjzo5:6mJeCLLEzjbYLzeJJfmzo
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  mirserver/Gm命令查看器.exe
- Size 67KB
- SHA256 d146b6aec8c551e4963be52231f34f72468ca4cf20662e5d9ae62518286ad7a4
- MD5 fc6b50667fd624f5db15fa38d981ff4d
- SHA1 260bf08ca4ae9753f1ea2a523c16538d570cf02c
- SHA512 c22ce0eb37363a0bd57b08140c6e2d9a3942fab7af1d81eac8f835937929e8b43ff26ff93c7feff7cdddf1c9aecc5de4877819cf3f51659ded2859a67df7893f
- SSDEEP 768:m/2G3MDtzd2nPxafVdaKRnk3ThxrysqfeX1vD:LQosWIKRa1x9jXl
- MD5 SHA1 SHA512 SSDEEP
Score

5^/10

discovery upx
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral5 behavioral6
- Target
  mirserver/LogServer/LogDataServer.exe
- Size 421KB
- SHA256 1926d958983a59b78c0a212b68e6fedcc24e8b920a41141fec5787f96fe023c3
- MD5 e8fae6abd9cfc6f32821f5c7366ea64f
- SHA1 e18ba551f9ed5a258e6bb8efca394f3aff1cb246
- SHA512 acf7ef1cf96c7a33fc1afb7943b842fed7bf9c7108f43af904fb60e3f485efecb94ca0f7cadd7010c3d513d97c494a618842dbdb29e6d9abc0881ff8e1b91098
- SSDEEP 6144:Ndu1qC4u63IVhYKjrDx/YD9RT8ZFpG3Lk5BoXWTzNbTuqdYm2OwFnl:q1h4b3IVaqxivwFw7k5ltubNFl
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  mirserver/LoginGate/LoginGate.exe
- Size 212KB
- SHA256 30aaa1a59c1b295e26fcff124e5b8474458d6c972de4f36982105ca37f63a0d0
- MD5 700f370afb01ec1e2d5be6d92ca30dcf
- SHA1 2366dada79cf49b1802962d387107637099ff3f9
- SHA512 e61c8a08089d25b4ff2bf46e4c0c6df0c1992d7158cf5bc9212adb096daec0f6edc2669d5a5678be86b6e42581b03521a64d9347ef5fb54066220ccddcfb7ad9
- SSDEEP 3072:G7v5I31Wr7Rm2pfna1vES43tkM3wQPyfrdHDOilQAM0csASL5Nqg3JnIZ:G9g1WrkRES4Z3wJxDJqh0cs3UIN
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  mirserver/LoginGate/更多版本下载Www.Uc955.Com.html
- Size 371B
- SHA256 11664ed54c8667da47b0e914a4630b8f003b7c583245aee9e1dacb0e4d42cecd
- MD5 d726adaaf77a5393dd5a4e76daed3df6
- SHA1 6a591c992a00b4b77950c47fb22a52dcdf9efd0f
- SHA512 befa984ae9b8d743f37dff638472afb9a3acc54d518cca3cbfdb162dedf2bf537f469cf3073d56105582a35426ac3aba8e0797e883802e6a4b946bba132eed11
- MD5 SHA1 SHA512
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  mirserver/LoginSrv/LoginSrv.exe
- Size 246KB
- SHA256 92c6dfa26a49ba334778a928b6f0a39b46d123a87a47e6f713d82b9d14f139f8
- MD5 7f5de1ca3a879695e175b4e4261eb5f4
- SHA1 90f89b980c62e8de88fd4a880ede6117981b8139
- SHA512 febdebc98eb9c0d08a6c59fb7fce48e47dbb8a348203f2ead5f27d19deaf1e1bd337adce68a127bfb5bf322847b70351c65e82669ee4bc3fdf6211faf9154485
- SSDEEP 6144:3CnpCPZNM9ouEX6zWiUvt61g+C88XQ5SGA+:3CV9BEqzZUvtL+rX5S3
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral13 behavioral14
- Target
  mirserver/Mir200/Envir/Market_prices/更多版本下载Www.Uc955.Com.html
- Size 371B
- SHA256 11664ed54c8667da47b0e914a4630b8f003b7c583245aee9e1dacb0e4d42cecd
- MD5 d726adaaf77a5393dd5a4e76daed3df6
- SHA1 6a591c992a00b4b77950c47fb22a52dcdf9efd0f
- SHA512 befa984ae9b8d743f37dff638472afb9a3acc54d518cca3cbfdb162dedf2bf537f469cf3073d56105582a35426ac3aba8e0797e883802e6a4b946bba132eed11
- MD5 SHA1 SHA512
Score

3^/10

discovery
behavioral15 behavioral16
- Target
  mirserver/Mir200/Envir/QuestDiary/16sky.com/牛牛/MSCOMCTL.OCX
- Size 1.0MB
- SHA256 18a83d7a420a17fcb6f56eb3ba5362c975d32e5ded7553c6fd407f07bdb7b006
- MD5 f7bbb7d79adb9e3adc13f3b3c33d3d4d
- SHA1 cacb4b31d22419e6a9ddbffcf61ae42da0d5fb8a
- SHA512 4870ddbdf283d7f7f64d3f4bf556600a78804f6a94fc2ca7eb778e85d70b6d2d017aa35cbddf773b6a1b6d9a2813cd67fe54ede7859050a254a3e3c05616ae0e
- SSDEEP 24576:mnt4M/pL1wAEIqSBanK6CC33VTj+1R8xRFLqqmbD1kWIAqPA:mPL15EIqS1e6q3FmKbt4
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral17 behavioral18
- Target
  mirserver/Mir200/Envir/QuestDiary/16sky.com/牛牛/斗牛V101009.exe
- Size 1012KB
- SHA256 46b0253d4ef11b4961e28aef32f28274257d1849b2b42e75eb9bdb116aa72cfe
- MD5 d42c33bd4fdad5ee85b2f551c9257d49
- SHA1 2cd68b7b763d512b585b260a6e10ee533c046aa9
- SHA512 6287dac26e9caa2366cf804a529dc7f2e6e946e3f46c26720f8e5287782a9b938e089531d7514cd76c32568fefd9e116684085c52f10beef402c3a66d17de7a5
- SSDEEP 24576:/Gdb+hTvpktapRhGrd9ntzItUfGXCM8UkCnIo5BTxgH:Eb+3mEqDntzIwM85povTxg
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10

bootkit discovery persistence
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
behavioral19 behavioral20
- Target
  mirserver/Mir200/Envir/QuestDiary/更多版本下载Www.Uc955.Com.html
- Size 371B
- SHA256 11664ed54c8667da47b0e914a4630b8f003b7c583245aee9e1dacb0e4d42cecd
- MD5 d726adaaf77a5393dd5a4e76daed3df6
- SHA1 6a591c992a00b4b77950c47fb22a52dcdf9efd0f
- SHA512 befa984ae9b8d743f37dff638472afb9a3acc54d518cca3cbfdb162dedf2bf537f469cf3073d56105582a35426ac3aba8e0797e883802e6a4b946bba132eed11
- MD5 SHA1 SHA512
Score

3^/10

discovery
behavioral21 behavioral22
- Target
  mirserver/Mir200/Envir/更多版本下载Www.Uc955.Com.html
- Size 371B
- SHA256 11664ed54c8667da47b0e914a4630b8f003b7c583245aee9e1dacb0e4d42cecd
- MD5 d726adaaf77a5393dd5a4e76daed3df6
- SHA1 6a591c992a00b4b77950c47fb22a52dcdf9efd0f
- SHA512 befa984ae9b8d743f37dff638472afb9a3acc54d518cca3cbfdb162dedf2bf537f469cf3073d56105582a35426ac3aba8e0797e883802e6a4b946bba132eed11
- MD5 SHA1 SHA512
Score

3^/10

discovery
behavioral23 behavioral24
- Target
  mirserver/Mir200/IPLocal.dll
- Size 167KB
- SHA256 da61a728a96293d8d99db31d3843a68c3788fca93f630219adfab0e0132dde44
- MD5 bbf62130e7a5966a2b7b89411ad335c8
- SHA1 9f6a0af9525cc6b6df479d3d511e06200571c1b5
- SHA512 52baf478f0dab1bb13e03b6ae47ea48b0cc329a35569cd78473e8c5eeefe0d6474b7ad720cbf90664fd140c9c76dcfdd92bcddee11c8b9c2488b5c114d7babf2
- SSDEEP 3072:vqu/oVRpW3b2OQLOhRy7kCmRHnhAQPukkGfeDN/z2HS79BKyJcC:v1o3Ab2VLOhAehhN9vexb2HS79gyK
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral25 behavioral26
- Target
  mirserver/Mir200/M2Server.exe
- Size 1.1MB
- SHA256 eedec2679961ea4ec1ef35c3e666f2b476135a1e6a7569778fa972bf79cfbc17
- MD5 a8975a2b638082e995e6f1556856f4c9
- SHA1 acf4d679af45fb33320d87ad366b6acd444e2e61
- SHA512 166869ede17a541352006917613f04e6a99b6584032682aa2604d43d69858e9825351e44df8f385cc08ddab338b122c1add08d24c236dee7d95d1a5e1ede0c5e
- SSDEEP 24576:bkKXzQni7id+1AOLFf60z84x+AhU6t1GNw2+MqPkjr:YKDQi7xjLFf60AcMskjr
- MD5 SHA1 SHA512 SSDEEP
Score

6^/10

bootkit discovery persistence
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral27 behavioral28
- Target
  mirserver/Mir200/Notice/更多版本下载Www.Uc955.Com.html
- Size 371B
- SHA256 11664ed54c8667da47b0e914a4630b8f003b7c583245aee9e1dacb0e4d42cecd
- MD5 d726adaaf77a5393dd5a4e76daed3df6
- SHA1 6a591c992a00b4b77950c47fb22a52dcdf9efd0f
- SHA512 befa984ae9b8d743f37dff638472afb9a3acc54d518cca3cbfdb162dedf2bf537f469cf3073d56105582a35426ac3aba8e0797e883802e6a4b946bba132eed11
- MD5 SHA1 SHA512
Score

3^/10

discovery
behavioral29 behavioral30
- Target
  mirserver/Mir200/更多版本下载Www.Uc955.Com.html
- Size 371B
- SHA256 11664ed54c8667da47b0e914a4630b8f003b7c583245aee9e1dacb0e4d42cecd
- MD5 d726adaaf77a5393dd5a4e76daed3df6
- SHA1 6a591c992a00b4b77950c47fb22a52dcdf9efd0f
- SHA512 befa984ae9b8d743f37dff638472afb9a3acc54d518cca3cbfdb162dedf2bf537f469cf3073d56105582a35426ac3aba8e0797e883802e6a4b946bba132eed11
- MD5 SHA1 SHA512
Score

3^/10

discovery
behavioral31 behavioral32

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

Bootkit

Privilege Escalation

Defense Evasion

Modify Registry

Pre-OS Boot

Bootkit

Credential Access

Discovery

Browser Information Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

bootkitdiscoverypersistence

behavioral20

bootkitdiscoverypersistence

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

bootkitdiscoverypersistence

behavioral28

bootkitdiscoverypersistence

behavioral29

behavioral30

behavioral31

behavioral32