Extracted

• • Target
    Call Notes/Call Notes .exe
  • Size 1.5MB
  • SHA256 fcf4efa82d477c924d42cc6b71aa672ab2381ca256769925ae34dabe2e77e025
  • MD5 c04c947efdfdd9ce24617903b6746a83
  • SHA1 43d646eda4166261eb1433c7599bf5cc9129a4f1
  • SHA512 5d2f4d4caaff0d04c64ccfe094be9ed683d8e408668d0dba3c9c59c5557258657d889078d4cc1fd106d53a3779fd59b8b7c18160a6a73803f20836d678454542
  • SSDEEP 49152:tXnulPRNaHAPM1ICw3qHZDlrqdWRyZNtoXwU7sk+TBV99yhW4iHp8p0:5uHNagPGICw3qHZhrW1ZPoXakyV99yhu
  • TLSH
    T13A758E3276A1947AC23B3630855A93F9F3B69D308E35024B36905E3E2F355D2592E72F
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  earth_pretamustang_pandaaptbackdoordiscoverytoneshellpersistence

  • Detects TONESHELL Backdoor payload

    backdooraptmustang_pandaearth_preta

  • TONESHELL

    TONESHELL is a Windows backdoor used by Earth Preta aka MUSTANG PANDA APT group.

    backdoortoneshell

  • Toneshell family

    toneshell

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2
• • Target
    Call Notes/SolidPDFCreator.dll
  • Size 125KB
  • SHA256 564a03763879aaed4da8a8c1d6067f4112d8e13bb46c2f80e0fcb9ffdd40384c
  • MD5 b0a08242dd5681333663dff29f92b5e6
  • SHA1 cbbe39fd59a2325cf6a7b0ed45d49d37b629c46d
  • SHA512 b857ad42f8cbd57dce2f6116234bb9f13c07966e64ce9352b020a9e0976fd22b956d7056f0f0eb1b0b47a87951993445659b11a39e1bc5f5ecd86e405662317d
  • SSDEEP 3072:m3oMvuKp8c/x4eH6P7nwvkU6GysNPV1myl4:mrLpRmeaP7wpHmG4
  • TLSH
    T131C38C82B6D0C032D7AE283C4921C66D4F3E7930DFA5899BA7C501298FB41D29E35F67
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  discovery
  behavioral3behavioral4