b1707825c0f2fde7bfdbb5f4a4cef4002a935b2c9edfa93f512127f430cfbdd0

Sharing

Copy URL Twitter E-mail

General

Target
PCRemoteReceiverSetup_7_5_16.exe
Size 63.3MB
Sample241024-dj5z4a1frd
SHA256 b1707825c0f2fde7bfdbb5f4a4cef4002a935b2c9edfa93f512127f430cfbdd0
MD5 ca3eb78b4bfcd2388bf49a980f1053b7
SHA1 81c60fff0a2f0bf8e8ffc4161b0ed00fd3353a9f
SHA512 5f02bd4cab05cd242f3605ab027c11d28b855bd9180ff52aa14963248e2778cacc36466dcca684c0c17c9bab874f12b3a3e2d3ca655570831101cfc5c1022e51
SSDEEP 1572864:DGr9D2YYvt8/7Z9lRA9lg5yJRotDthtYt/1vv+W5x/t6rRYyjvZXTpoZC86:DO9DoFE3lKYgJ1cW5+ruyjv1Nos86
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

Malware Config

Targets

- Target
  PCRemoteReceiverSetup_7_5_16.exe
- Size 63.3MB
- SHA256 b1707825c0f2fde7bfdbb5f4a4cef4002a935b2c9edfa93f512127f430cfbdd0
- MD5 ca3eb78b4bfcd2388bf49a980f1053b7
- SHA1 81c60fff0a2f0bf8e8ffc4161b0ed00fd3353a9f
- SHA512 5f02bd4cab05cd242f3605ab027c11d28b855bd9180ff52aa14963248e2778cacc36466dcca684c0c17c9bab874f12b3a3e2d3ca655570831101cfc5c1022e51
- SSDEEP 1572864:DGr9D2YYvt8/7Z9lRA9lg5yJRotDthtYt/1vv+W5x/t6rRYyjvZXTpoZC86:DO9DoFE3lKYgJ1cW5+ruyjv1Nos86
- MD5 SHA1 SHA512 SSDEEP
Score

8^/10

discovery evasion persistence privilege_escalation
- Drops file in Drivers directory
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Modifies Windows Firewall
  evasion
- Drops file in System32 directory
behavioral1
- Target
  $PLUGINSDIR/InstallOptions.dll
- Size 15KB
- SHA256 b34fb342f21d690aac024b6f48a597e78d15791ef480ac55159cd585d0f64af7
- MD5 0a9fb96a7579b685ec36b17fc354e6a3
- SHA1 355754104dd47d5fcf8918dee0dc2e2ee53390a6
- SHA512 67870206fa7f1e7df45c8c1bc2f51fb430f0a048a2bdb55a4a41525388ca3b50203784537f139169705a03db4bb13b591162a79a5d2df81a4d11fd849615c86b
- SSDEEP 384:EFC43tPegZ3eBaRwCPOYY7nNYXCg/Yosa:EMTgZ3eBTCmrnNAo
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral2
- Target
  $PLUGINSDIR/LangDLL.dll
- Size 5KB
- SHA256 09acfc5ee34a1dfa1af3a9d34f00c3b1327b56641feebd536e13752349c08ac8
- MD5 014a3be4a7c1ccb217916dbf4f222bd1
- SHA1 9b4c41eb0e84886beb5591d8357155e27f9c68ed
- SHA512 0f3d1bf548e29a136150b699665a3f22c6ea2821701737363fa2920b51c391d735f1eae92dea8af655e7d07304bd3d06e4aff3f5a82fa22bcf5d1690013eb922
- SSDEEP 48:S46+/iTKYKxbWsptIpBtWZ0iV8jAWiAJCvxft2O2B8mMofjLl:zsuPbOBtWZBV8jAWiAJCdv2CmfL
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral3
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 7a9ddee34562cd3703f1502b5c70e99cd5bba15de2b6845a3555033d7f6cb2a5
- MD5 564bb0373067e1785cba7e4c24aab4bf
- SHA1 7c9416a01d821b10b2eef97b80899d24014d6fc1
- SHA512 22c61a323cb9293d7ec5c7e7e60674d0e2f7b29d55be25eb3c128ea2cd7440a1400cee17c43896b996278007c0d247f331a9b8964e3a40a0eb1404a9596c4472
- SSDEEP 192:nenY0qWTlt70IAj/lQ0sEWc/wtYbBH2aDybC7y+XBDIwL:n8+Qlt70Fj/lQRY/9VjjfL
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral4
- Target
  MonectMediaCenter.exe
- Size 143KB
- SHA256 ef2b810a55b58c71ef3fb184b3949f4d108027b8f1f3a18f4a646b265547ff5b
- MD5 55b6cb3f16a0f837179c7c1c241e1c57
- SHA1 41ba6d07f19d4155afb815882d80c9ac74349a7e
- SHA512 6531b179b00e8879a7551819d54c6d448ca71fa29764f1b5a40037d1580f8ff8b1b363c09dfa4be8a809b34204fc21ffb269d2c4a6f45b831c2c1e0d637adfa9
- SSDEEP 1536:SZ60XWFeE3F4UvmE2T9BmUM16R6FJ+rw1Y1mLE3hYDQuSKiVpmrMz00tXWBgOxw/:GHXWFBFlcBBXHwD+ueMrUtmBgO2/w0
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral5
- Target
  MonectRuntimeCheck.exe
- Size 121KB
- SHA256 7a3846a11ebe48d769c2983931fad9c71a924b2f0d892a478aeff528e108883e
- MD5 855868707c8daba66438545fba07b490
- SHA1 cb28feed2dc91fbb47dd3da4527ac7fb00a04f25
- SHA512 df3cd7a00eb562412b204cbb8e06cb31917b665f01cb9f521a8ba66ede8440b208f705da17159048e34327ca00d0c1b926bd1a78c0543c272203cb749c55dca3
- SSDEEP 768:kLnW4UkQyOM9aV1+qXUpv9Sbh9SbPvNnr2u+vTS+ST6nkM:k7hUFyOyaV1+f9C4vNrxk/me
- MD5 SHA1 SHA512 SSDEEP
Score

8^/10

evasion persistence privilege_escalation
- Drops file in Drivers directory
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Modifies Windows Firewall
  evasion
- Drops file in System32 directory
behavioral6
- Target
  MonectServer.exe
- Size 158KB
- SHA256 68c45fb8ef63e88d843a902444c7abba285244b88711f75e0e5c5836535cb46f
- MD5 67d3e56a71739c8da1b63f67ff0b2d3e
- SHA1 00fd96b988ffe43ca6f82509de75ca8cdd7a7d2f
- SHA512 68e83c3203b6ed6f839f88820789e18e48ad9984ee5a259c25467eadeea8cadb1cd838a21eb21d2badec9944dfb55b7e12eaab804c0c4a1d85d1b6201b24701c
- SSDEEP 1536:glOA1XM6FlHn11JG+oDHFc2xlkC3xM/mi:glOApRH13G+0Hu2xqC3i/B
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral7
- Target
  MonectServerService.exe
- Size 2.5MB
- SHA256 8ee17b3085f769d34a7da47fb61d29f9c46326c0be1e52f29a87a3cdb0c11f54
- MD5 ff7e7658509e639ee022b9a079df1c52
- SHA1 052c6f08e11ab143d653f3db27390da0673ac1d2
- SHA512 f7d4ffc09c1e53bf5cc985d470ed488578c9935c2d9ba8176217ae76a929ffa0b634d5f2503c57e7b8a10ff4e42e34c5556cab79be825f45580e63a4b85b5cef
- SSDEEP 49152:cIVwASOCGtlqS/IU6i7tRywB8kldM65y0oZOusM1TjLOh5PhP3fo1rriPNnmBYZk:5Q+Xl5EhmA1/GnmBY5I
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral8
- Target
  PCRemoteReceiver.exe
- Size 7.2MB
- SHA256 22720868281ba4a699ebe9e34a94865bfb40207b386672d0afa4e4daba94bc0d
- MD5 1f131b830b107f7ff0e12be96cac1eb1
- SHA1 1abb094ccb683d7e5ab18c1fe3bc37ad777accba
- SHA512 c4df0294a1b25f96de69bf228f6b8612a9ab6f048110de441f83ef088296cb7106cc1dd125b32f4784395f99f579a4090c35a6db801d8ee442e57344858142eb
- SSDEEP 98304:n+iVLTjmGW8YRlXXe4nazbKBZ1P9BAvzycT6BKig+Z6elPq:nhzmGQRlXX5azWH1qKgig+Aepq
- MD5 SHA1 SHA512 SSDEEP
Score

8^/10

evasion persistence privilege_escalation
- Drops file in Drivers directory
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Modifies Windows Firewall
  evasion
- Drops file in System32 directory
behavioral9
- Target
  Packages/vc_redist.x64.exe
- Size 14.3MB
- SHA256 b6c82087a2c443db859fdbeaae7f46244d06c3f2a7f71c35e50358066253de52
- MD5 f0248d477e74687c5619ae16498b13d4
- SHA1 9ed4b091148c9b53f66b3f2c69be7e60e74c486a
- SHA512 0c373b06ffe84f3e803831e90f22d7d73304e47a47839db614f63399ff1b7fcf33153bf3d23998877c96d2a75e316291a219fdd12358ca48928526284b802591
- SSDEEP 393216:q5lptVYmfr7yBG/4WoI+j6LTinXKSf0fzTDv8:q7pttD7yBG/uljIinXj0fQ
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10

discovery
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral10
- Target
  QRCodeEncoder.dll
- Size 40KB
- SHA256 9c9a8da4bb2b628b77de98c2b48f1c039649700db6bcadc0af97ec465dd28441
- MD5 cc39b3af69c02e64f3560b0c078141e7
- SHA1 4c2a4644a6908e766180054eb8d792f1c4a17b2e
- SHA512 59228ba046bfd12091ee4f3e43f3ed9a021b55e2f6e990bc063e90a1d92a9b62ae4d90b97060d4a3de5d1862bd84211522f4e9c6d433d28d672cadf3dea5c609
- SSDEEP 384:aoI6JUHDdlKSXrA5m/UHXrA5m/UFouYDe+gDlpLqQVWrlWa+w6MibZKfg+AObT7n:aoIHrDHFVsHSoaNr2u+vJzS+ST6nkW
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral11
- Target
  SDL2.dll
- Size 2.2MB
- SHA256 81c70b7bfa5690b0ff20c15caa499f615a82cf5b49d278da89265eb836036465
- MD5 5a2819c823a5af53420511a1ceb7a9aa
- SHA1 3b80b1228631abbb7f2745828a25cbce0d9dce09
- SHA512 da85ca5a8666eb5a2a4bc6b0c9e2f7b7811eb22fe1632a8604274f4fdd5b4303e8943b85cdacb4a3378261d1c0c2d754f4db372294a7146c26a9a546ba83b399
- SSDEEP 24576:HzJfKNu0feee3s8LjMwUiny7Irssh55Z0lZGO5cO7bSbtnG4+bDYnZVBsi9s8ZF7:H9fd8y5m5cv9F0Qc3OW/a45m5
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral12
- Target
  SDL2_image.dll
- Size 122KB
- SHA256 1e364af75fee0c83506fbdfd4d5b0e386c4e9c6a33ddbddac61ddb131e360194
- MD5 b8d249a5e394b4e6a954c557af1b80e6
- SHA1 b03bb9d09447114a018110bfb91d56ef8d5ec3bb
- SHA512 2f2e248c3963711f1a9f5d8baea5b8527d1df1748cd7e33bf898a380ae748f7a65629438711ff9a5343e64762ec0b5dc478cdf19fbf7111dac9d11a8427e0007
- SSDEEP 3072:6bsejIuO504fzsOM05Nmy7iGpJ7SvFisgf:6bmX0qQOhmyPs
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral13
- Target
  TouchInput.dll
- Size 26KB
- SHA256 ebdf396161b4c6ff20cdd54d08a334e3a98aba33663130a43f0f92fe7ee4801e
- MD5 5594270400bd6b2c68f706067efcd889
- SHA1 c344b768407e0ebbaa67c830f1b8bb96d0762e88
- SHA512 f4d64294c255a5c0c579172a1275b925964e5901f61acc06820b89c30a6d1d597c1ee473a6290d2d902aa31f1ae62491aa81cffe1423542d9fef47adcffb8ec2
- SSDEEP 384:emeTqSLPB4XT7MQv/uo6ki2Di+vywbS+ShjmM6IGBkS+E:emetLP6Wr2u+v5bS+ST6nk0
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral14
- Target
  avcodec-59.dll
- Size 67.3MB
- SHA256 5023347055e0dc62d02d6e1d557832d61834fda26da11f43ea7eb04f224ed92d
- MD5 5398be059d32fc99ae35a469bcd55255
- SHA1 dd4a6154a185e1fe24a4ce024179441ec8a44194
- SHA512 c0f6b782030c8bd4da9bde690192a826f4eb9bb027918bdb81b1a91195e22d2a1e2475767f250cc4e6cd23e5a21650030765ec769acb8399f330172200251f94
- SSDEEP 393216:rh5v+6bVVGcq20EPrEStqiJ0WOf5dd0EhRCe9lBZkvxMXHthsT6ltmPshdPPRX29:r7HK20+RJ8jd0EjCilb+MXc4Ph4dH3
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral15
- Target
  avformat-59.dll
- Size 14.8MB
- SHA256 2072e00d0c821eff03b22cfafdc164404ec7a15c2cee28520184efe6fd97bee6
- MD5 73719d8f1cc65ebce26a5e2959b92bc4
- SHA1 3b27af34a204c0feebe1ff217880ea90d6341584
- SHA512 2d19463188bd36cc7cfa1b18c3bb4e58642d14cab12cf8653730f93260a9c2e0e8101e768d30ca22ba26887d2abb11ea8f407203df50a4de754dc7f019b6c395
- SSDEEP 196608:+EizaE5RwATgZaqd+KPRkbTNV/3Ew/1g3wg7T:+RRlY+GRkbTT3HgXT
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral16
- Target
  avutil-57.dll
- Size 940KB
- SHA256 cb86f74c46b1771d9ce5aba2fd83796b60c0d2a3f1f9ba7ed9cc111f0b25b0a1
- MD5 fa3f45bb731c4de12e3f56662d488164
- SHA1 d1988df5b0c643ba9b7729b0312fdfb2d2d61077
- SHA512 1c209ab2589ef5f3eb43e954cc85349e81b9c28a01f1ae8646520c3aab57a8f9798b421b816235646853954b677a8fbf97e3048ed231a36d48a58faa086468a9
- SSDEEP 12288:KznPFPp7redNfXlwVtBQwRHoCwxQO+NF+nWypr1G7tvRommHiSG:gPFP9GNfl6BQwRHMyOnn71G7/m+
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral17
- Target
  channel.dll
- Size 3.5MB
- SHA256 ca286604d2e3d576e95c414df2e3d32fb2260da136b50f539fc76e1812cc0966
- MD5 a84a04ad46b430f2f784d7da2dc256e9
- SHA1 cc817715e7db73e5ba4d1462bc717c4af178b2a5
- SHA512 02a495ec649aae1eaa87094d4fdee74df880cedaed97668b514f9b194fc23f763a3ae70329f2985681e8f22a2a3e123c5e17e2d3c2eec680046aea4ef01ba97e
- SSDEEP 49152:pxg5rxLDjuuQ6JSStg/aELQnTuciLCXrKklWyHfdAMUf+ErbCRHhywvPW6:bkuG4LmrKpjbCP3h
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral18
- Target
  driver/ViGEm/x64/ViGEmBus.sys
- Size 67KB
- SHA256 1a1e57cb0dd7ca08d96bbb1b6ce667e3273702c13a7ecf86839b7642ef8255e0
- MD5 129165f67ccbb25be6be8ae2f0c15dda
- SHA1 499865e046dc1d70edbf2a31ef06c03b6c6ea855
- SHA512 4666cf73ef77b0e7b86822fdc18743d41496c46686a91535ed7757dbdb8e0354489383aa4a27ab943e26360e8e1c8aed5600724034e0e6c38163faea24344ca2
- SSDEEP 1536:z+qh1jHbs7EZAusYDJg47/5tEYyD7B4G91eZ0dicytMaop:KqPjHb7zT7/5tEPnTeZ0dicytw
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral19
- Target
  driver/ViGEm/x64/WdfCoinstaller01009.dll
- Size 1.7MB
- SHA256 1a7627c11aecf24e8e0c9a519498e8456f0457bd89f0ffe649bd8fb53a194f89
- MD5 f279d3e406114192148dd976de222138
- SHA1 0567e9073c46c40e60e2ecd0a509579f029efd8e
- SHA512 e72d1011bd3c4208c3733228aac45a6ae00c3979ffb49130d4141293764db1b91551edf9340b5cc5c987b848e3ffc661b8084923c2032b175fcf55321f42dc25
- SSDEEP 24576:FU4MsColC6Je/ZgY7OOfcEpiRLH87SyVXGe38uKUj+NFVov1PJLfVKZ8F5mEeZWq:uFCsfZRZA6Xn388avVovfLd+Mo4iEq
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral20
- Target
  driver/legacy/ViGEm/x64/ViGEmBus.sys
- Size 67KB
- SHA256 02e5554bbd32f852aa8abd53ee915143af78cdc0ad2bec86df24831b85e287b7
- MD5 c852237eab4b5bebec7b3952371617be
- SHA1 5336ec8ebba005b6c257826bd10061e01a48ee1c
- SHA512 f002f8429dd592080b21e031c0ed753eb9bdc8653c7afa09bbfdc8f832c1a25b654810299f6ecc894bcb7871ce0e82f5abb05e92e1aad02db089547718eefc32
- SSDEEP 1536:H+qh1jHbs7EZAusYDJg47/5tEYyD7B4G91eZ0dicy+M+EL:eqPjHb7zT7/5tEPnTeZ0dicy++
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral21
- Target
  install.dll
- Size 26KB
- SHA256 10acbcf011f06a42d9f2577abdd5d455d6770ec7dfefd0da2832e1f36231819e
- MD5 b343876cb4c4574e675ef636074dac2f
- SHA1 af43f04949b1405bb5015de99603ff5f7a40d09a
- SHA512 886998baf7e063b4eb5793760f44b68c7ab04df8fb167d79ab3293582ed26e6b8d89790dc330aa92c782b22a879d42feb0010d6c6166eae97a13d7b8304a9358
- SSDEEP 384:a0o5eUmw4k4b39kbslT7MQv/uo6ki2Di+vpM/S+ShjmM6IGBkSm:HUm9ky39koIr2u+vW/S+ST6nkf
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral22
- Target
  libjpeg-9.dll
- Size 238KB
- SHA256 3a224af540c96574800f5e9acf64b2cdfb9060e727919ec14fbd187a9b5bfe69
- MD5 c540308d4a8e6289c40753fdd3e1c960
- SHA1 1b84170212ca51970f794c967465ca7e84000d0e
- SHA512 1dadc6b92de9af998f83faf216d2ab6483b2dea7cdea3387ac846e924adbf624f36f8093daf5cee6010fea7f3556a5e2fcac494dbc87b5a55ce564c9cd76f92b
- SSDEEP 6144:I7wNZIYb0maLgCaqrWqg7EdP8J1dJHoFaeghCbBL:I7we7gCaqrWqg7EdP8jpY
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral23
- Target
  libpng16-16.dll
- Size 206KB
- SHA256 e688b4a4d18f4b6ccc99c6ca4980f51218cb825610775192d9b60b2f05eff2d5
- MD5 3a26cd3f92436747d2285dcef1fae67f
- SHA1 e3d1403be06beb32fc8dc7e8a58c31e18b586a70
- SHA512 73d651f063246723807d837811ead30e3faca8cb0581603f264c28fea1b2bdb6d874a73c1288c7770e95463786d6945b065d4ca1cf553e08220aea4e78a6f37f
- SSDEEP 3072:VatMOImapxER0/vnm2mjq61IJJT1fX0yuWUQstxZw2TnzFEY5IQ:VatMOImapaR03nmnYJV1cjtnwunw
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral24
- Target
  libtiff-5.dll
- Size 422KB
- SHA256 ebfe97ac5ef26b94945af3db5ffd110a4b8e92dc02559bf81ccb33f0d5ebce95
- MD5 7d40a697ca6f21a8f09468b9fce565ad
- SHA1 dc3b7f7fc0d9056af370e06f1451a65e77ff07f7
- SHA512 5a195e3123f7f17d92b7eca46b9afa1ea600623ad6929ac29197447bb4d474a068fd5f61fca6731a60514125d3b0b2cafe1ff6be3a0161251a366355b660d61a
- SSDEEP 6144:d8x4RKXHtEOtiYFJEn9RX9kgr+6Dr1Xu1ih/QpGJylW:qx4RK3tvKRH3Dt4ih9Ji
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral25
- Target
  libwebp-7.dll
- Size 437KB
- SHA256 9a53563b6058f70f2725029b7dd2fe96f869c20e8090031cd303e994dfe07b50
- MD5 2c5aca898ff88eb2c9028bbeefebbd1e
- SHA1 7a0048674ef614bebe6cc83b1228d670372076c9
- SHA512 46fe8b151e3a13ab506c4fc8a9f3f0f47b21f64f37097a4f1f573b547443ed23e7b2f489807c1623fbc41015f7da11665d88690d8cd0ddd61aa53789586c5a13
- SSDEEP 6144:t2lROjMXfhVy+tEZzshykv2SxgQceWni1UC2JCsJ5zIGWexIaZOovMPVt9ACB/1O:JMtVykiiiCsJdpxIaZOokPVtW
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral26
- Target
  mfwrap.dll
- Size 38KB
- SHA256 539a6ff095f8a52d8fa1162b1971a0ed31c15d769d24bf2abe8f7bcb2380c05f
- MD5 70d2b9c7cbc7134b037325c51fa3fb66
- SHA1 9fe89420baeebb6404bca991e37bc3a3a6eea4a7
- SHA512 a1d07e2715dd0e808afeb4fb21d5d060b6dc9cb4b0d08226ef18ab7d0cbe16ea65f1e20059dd2e8f05fdc6c81a2af6b52b4b865e4ab448ffbaeabc32ba301747
- SSDEEP 768:oTgyUqNOEaTUXGn8ZR0ZaFy7Vjgdr2u+v9KS+ST6nkH:oTgyTgn2R0Za07Rg5xn/mJ
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral27
- Target
  officehook.dll
- Size 38KB
- SHA256 aa65e91e8189dd104933a3c8cec167d6287b976d5a89f5fa5dad3a733a672ddc
- MD5 94e97ffad1db29218b928d32917bcd5d
- SHA1 12b0c7fc550897516ce7255256ca5537d4204e0d
- SHA512 8b0261796b76a87460f487a09a18760eb357c5356ee520c6948ceee18b91798fb34ea2a454792a4d075cdc2e07314c419cb4c0d649cac978c73f45c2b7064c9b
- SSDEEP 768:vz4X1CfOjfhC1xwESHtG06Nr2u+vlS+ST6nkG:GEeEBMtGjJxe/mw
- MD5 SHA1 SHA512 SSDEEP
Score

6^/10
- Drops desktop.ini file(s)
behavioral28
- Target
  rtcompress.dll
- Size 2.2MB
- SHA256 d7f74e4bf3a1d8504a117325ad77aa873d8744710da48cf2fe2ac3fc040fd65e
- MD5 a5eda8021244c048b06d7d0e9cecd484
- SHA1 238f617d178231ab4d78f029603f05d55c265584
- SHA512 0f3e4e4806a2d9979f26d109aea31cb2f5767a775a7ef1586a527e635c2e026cdd1de00bf22feb5b45682b88beb81c4451cb81f8633c4579fd9a3d8f1e5541bc
- SSDEEP 49152:BQuzrXZPHU5S8IzdMw1Ll+9q8JeuCNqzd/Ud3UTuRCb6b5HKQgM8PbhHW:BppK6bspW
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral29
- Target
  swresample-4.dll
- Size 423KB
- SHA256 339114e12aaf6c5c4d5f17605eac4665ec570ff5de189adada800c177b238932
- MD5 d4ba67aba67be2d58a0f4f0742cc6272
- SHA1 71629abdcd513dc3e6704fb55f71b28f09d23dac
- SHA512 f6a14f86636c078aadb9543e4660ad827f71a6bda3067a0490d4ab68d09197f05106e7d52e02fe989bca44f130ce265c1fde7c4dbec27b9dbc0e6180e92b7b6b
- SSDEEP 6144:IJ9IQm83mfhnpf7QTsiXMFfdN4wJg48nhyUXtLGsRBek:IHIQFufUTWIt48r
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral30
- Target
  swscale-6.dll
- Size 589KB
- SHA256 b2c3ee9cdc0e5292040bcd3336390e77ae8b467d65faa80f7e68625a619b32de
- MD5 ce2c506023961712261ebf67296864de
- SHA1 eaa7eac0ef9e7770876324f2934a2317f1519b7d
- SHA512 5dafe6784faeb6cad509ebbca44e51b2b971369fafecacffc8915d4980bd303f57201183669c7c4972ad8d0a3ebe32ebccaf4544fd66ed1c21893992ce1d5d24
- SSDEEP 12288:YSEgesaQ+8S2OS73oRUG43hbUoEALkv5tlbDhsUmSa9wCCn9lF5QSzY:YQOS73oRUGchbQALkv5zFsUmSa9wCCnK
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral31
- Target
  zlib1.dll
- Size 106KB
- SHA256 b1f58a17f3bfd55523e7bef685acf5b32d1c2a6f25abdcd442681266fd26ab08
- MD5 5eac41b641e813f2a887c25e7c87a02e
- SHA1 ec3f6cf88711ef8cfb3cc439cb75471a2bb9e1b5
- SHA512 cad34a495f1d67c4d79ed88c5c52cf9f2d724a1748ee92518b8ece4e8f2fe1d443dfe93fb9dba8959c0e44c7973af41eb1471507ab8a5b1200a25d75287d5de5
- SSDEEP 3072:wLmjK8n5MYk+NqZSB23eRenGvTBfs9Yy0J:wLl8n5MYCjFnaTBwYy0
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral32

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Drops file in Drivers directory

Looks up external IP address via web service

Modifies Windows Firewall

Drops file in System32 directory

Drops file in Drivers directory

Looks up external IP address via web service

Modifies Windows Firewall

Drops file in System32 directory

Drops file in Drivers directory

Looks up external IP address via web service

Modifies Windows Firewall

Drops file in System32 directory

Executes dropped EXE

Loads dropped DLL

Checks installed software on the system

Drops desktop.ini file(s)

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32