General

  • Target

    9e364ccf2384a19973de23c0b730e50a84a250f915e09253e77740baa69eb9bb

  • Size

    10.9MB

  • MD5

    9f01ccb1587ba4b9009d6ce0d333e143

  • SHA1

    19c95a4a08dcbdfdfa70af09b14ee5dff05d3788

  • SHA256

    9e364ccf2384a19973de23c0b730e50a84a250f915e09253e77740baa69eb9bb

  • SHA512

    7ddb1ce1c23060d1a72f75e06fa85b579ed179f72d05e5915b8924b38149ea4e4737490dd1e6305a651298aa0cc058f12750fa8591e8217f71caa51d8be11308

  • SSDEEP

    196608:vYPJdcE4G1fCTcT0RTmpwYk5vdQ2ypCVyn1qoKQoumCbi9if6VdJh1AqKups1oD:UAG1f4cwdmFfnUoKQoxYSVdNAqKui1M

Score
10/10

Malware Config

Signatures

  • Mimikatz family
  • mimikatz is an open source tool to dump credentials on Windows 2 IoCs
  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Unsigned PE 10 IoCs

    Checks for missing Authenticode signature.

Files

  • 9e364ccf2384a19973de23c0b730e50a84a250f915e09253e77740baa69eb9bb
    .zip
  • Bin1799/Cache/Install.dat
    .exe windows:4 windows x86 arch:x86

    de6942886ea1706308de6a5dc748b51c


    Headers

    Imports

    Sections

  • Bin1799/Client.exe
    .exe windows:4 windows x86 arch:x86

    301ef8e58bfdf1286e62c3d4852447ce


    Headers

    Imports

    Sections

  • Bin1799/Client.ini
  • Bin1799/Plugins/Baidu.html
    .html .js polyglot
  • Bin1799/Plugins/BaiduE.html
    .html
  • Bin1799/Plugins/Gaode.html
    .html .js polyglot
  • Bin1799/Plugins/GaodeE.html
    .html
  • Bin1799/Plugins/GetPswd32.exe
    .exe windows:5 windows x86 arch:x86

    91c58525e2b08a41627faf84ecb6c4cc


    Code Sign

    Headers

    Imports

    Sections

  • Bin1799/Plugins/GetPswd64.exe
    .exe windows:5 windows x64 arch:x64

    66ee036df5fc1004d9ed5e9a94a1086a


    Code Sign

    Headers

    Imports

    Sections

  • Bin1799/Plugins/IPUpdate.exe
    .exe windows:4 windows x86 arch:x86

    77f2a6b3e475e55480b0129029e9b348


    Headers

    Imports

    Exports

    Sections

  • Bin1799/Plugins/PcLock.exe
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • out.upx
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • Bin1799/Plugins/ShellCode.bat
  • Bin1799/Plugins/ShellCode.exe
    .exe windows:4 windows x86 arch:x86

    f231c1c2b41c960e929c721b24e45228


    Headers

    Imports

    Sections

  • Bin1799/Plugins/bPluginVideo.dll
  • Bin1799/Plugins/mstscax.dll
    .dll regsvr32 windows:5 windows x86 arch:x86

    f4f9ea2971d7855283ab7cbcf0ce7925


    Headers

    Imports

    Exports

    Sections

  • Bin1799/Plugins/qqwry.dat
  • Bin1799/Plugins/termsrv_t.dll
    .dll windows:5 windows x86 arch:x86

    38242edcd70d38c5abcf4713d30126aa


    Headers

    Imports

    Exports

    Sections

  • Bin1799/SkinH.dll
    .dll windows:4 windows x86 arch:x86


    Headers

    Exports

    Sections

  • out.upx
    .dll windows:4 windows x86 arch:x86


    Headers

    Sections

  • Bin1799/Skins/SkinH.she
  • Bin1799/Skins/homestead.she
  • Bin1799/Skins/itunes.she
  • Bin1799/Skins/niceblack.she
  • Bin1799/Skins/pixos.she
  • Bin1799/Skins/qqplayer.she
  • Bin1799/Skins/royale.she
  • Bin1799/Skins/xmp.she