b9d975b61efe303eb5bcb7bb6f0bce6d704b3dc1531aafafc83e8b1b7c939cb8

Sharing

Copy URL Twitter E-mail

General

Target
Squad.ICU 战术小队全能助手v1.1.1.exe
Size 368.7MB
Sample260426-teaamaes2l
SHA256 b9d975b61efe303eb5bcb7bb6f0bce6d704b3dc1531aafafc83e8b1b7c939cb8
MD5 d1c405ae5b3d5f434ae81f64a510b3c4
SHA1 6354e750f93f3d4e4bfe400f8de6a7ed77b2314c
SHA512 21d87ef0305b049f2962219d8469f80577f3c6d1edbb6500fd0e4a090d17fd9988b64f602cc3287e0d6f8e425be57390b46baae2fb3b51fece29b552e1459f19
SSDEEP 6291456:CvOOQrcU6vWZSKlElcMJxhFmttycFhVdQ1jmIWIX9ZRp8bey1pvlfMPmwhQFJgMU:kme6SKlElx3hFeoiQ2IXpWBp9f+KK
TLSH
T1CC09338B4ED81812DA1BABB95DB90B0EA77CEC35590E661DF308700F2CDB8643D64BD5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  Squad.ICU 战术小队全能助手v1.1.1.exe
- Size 368.7MB
- SHA256 b9d975b61efe303eb5bcb7bb6f0bce6d704b3dc1531aafafc83e8b1b7c939cb8
- MD5 d1c405ae5b3d5f434ae81f64a510b3c4
- SHA1 6354e750f93f3d4e4bfe400f8de6a7ed77b2314c
- SHA512 21d87ef0305b049f2962219d8469f80577f3c6d1edbb6500fd0e4a090d17fd9988b64f602cc3287e0d6f8e425be57390b46baae2fb3b51fece29b552e1459f19
- SSDEEP 6291456:CvOOQrcU6vWZSKlElcMJxhFmttycFhVdQ1jmIWIX9ZRp8bey1pvlfMPmwhQFJgMU:kme6SKlElx3hFeoiQ2IXpWBp9f+KK
- TLSH
  T1CC09338B4ED81812DA1BABB95DB90B0EA77CEC35590E661DF308700F2CDB8643D64BD5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery defense_evasion trojan
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  defense_evasion trojan
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
behavioral1 behavioral2
- Target
  $PLUGINSDIR/FindProcDLL.dll
- Size 7KB
- SHA256 cffec7f0bbcfca2873c510d93666e0ebe95e236433c3c415358dffc50a70e44e
- MD5 81a424cbfa89976b1c40da870d8ad4bb
- SHA1 a43f1b04eb8726552eb8934b0db2e76c46535e35
- SHA512 555d28e23fe7dc97400356ae6c1e13b1e1e18633a153fc7ddafe76a11ccae8d166a550dc0c61c03a9041f691ea74b2501c0f5ad20bb8390375ceb63128e1af5e
- SSDEEP 96:PNrt9XBrYR9YVi4fl+l0tMh6VLuiXX8VASx3aPmh7z7GOVINv3vTx3mtJsBKz:Pv9XBrYR+jtyuLucgs+INv3vN34JGs
- TLSH
  T105F1B7435B011472C1F8943CB8DB45375BEDB23062B36787E92BA9263E991D07C7D7A4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/InstallOptions.dll
- Size 15KB
- SHA256 2a2845b8bc368a71f0973f30851c25f3ea70172bc5569792ff9222d12aa0d67d
- MD5 68bb5139954c236860a25cde611dac33
- SHA1 269755dff956cb5fe31dae6fa357a43fcf68928d
- SHA512 93b5c263fcfa5ab8fcaff331ba5f22b39a2c3d3e01c820497660f88e150d80b663dcf925e5d867af1addae2b1a5732474c3533897a583b271597675c07e6309d
- SSDEEP 384:0CNorf/mefeZBKJjIM9L5qu/b6o554+gmCUW:5oKefeBksMV5j/bTP3
- TLSH
  T110621A52BAC110F2DED2A67036E77F371FB2B51094D5880B97B33E475922261BE35362
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/KillProcDLL.dll
- Size 14KB
- SHA256 0fe15b023e21b7054fabb3d47b6084d60f8e474d8f9ca3a0a25dcb2097d6f0b8
- MD5 586270250a1acce8126a0877fd5bb981
- SHA1 9f5645b37b3af04004697639855da5c99a41aca1
- SHA512 a1994b91337385ab153860a013912f9cacdf9c233395868bf8eedfbe6dd13841619a8048c1d8407ee4b77c466fd8f31fc5cac2c779a2ef58c3a2a02caeded055
- SSDEEP 192:/BZa4DYIcJ4nS1ejJThugw4LBs4TJjdjqJVQXS3p16ZGntrefncWCV:JZ8IcJ4nSkJlums4TJJjsVh3pwZs/
- TLSH
  T15852F79EF117F6F6D4CB46B045E2FF3B443E29028836A8B4DF50EA207D1789E6529047
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 245597797e73ddac0b2408a6736e883461c5030dfcaf2f2a6c08ba04b6989c34
- MD5 5e422c6ab294bb8cff15996622c8ccce
- SHA1 b63a4c61d8843f56058d9706167fa9b26e422f42
- SHA512 edae552c2af7a64fa7c1fe2b43c9f15585c0cffd4c652977333525a2dafaca70b9aaee589d69cb2efd358482e14f4ea95f444fd338b58c418d404b585168b1c5
- SSDEEP 192:f8TiS2p6uXjL1ZRcFsMaRqllbYIlcXvh0NqesZ6r6OMc5eWL:KiHXjpPcFsMvlls/SBZr6Ob5NL
- TLSH
  T154425C426BB25AF1FA25073625B67F170B3CAE5803D44A9B8FE79444E8B01E710367D3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  Accessibility.dll
- Size 20KB
- SHA256 e8fdeeca670d064ab1f9e991be1d31b4963d9841d73481615ab2908163e25f5c
- MD5 5328c6f09b075393c49360daa4599622
- SHA1 af73d736273c851712dfb8c73807c04656093be8
- SHA512 9180ee92dabc260a5d1c9532a404f466f59c8cb1b678b89b8971d655fec36af7e3b71aa68168bcedbcb392c9d9e0d918235d7b32123403fd80e0a91101979f6a
- SSDEEP 384:3Bmy0h6gSGR1OcHiSW2+/W9c/hljHRN71o7R9zI6dI:kSyOcHCEcDjC9z9a
- TLSH
  T149925D93FA58E162DC775A70A9A8EA063F38E3861911CE27089CF7491E43380DF51779
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  AngleSharp.Css.dll
- Size 446KB
- SHA256 fa059eeb35eda2b318043e79cd99acebf81d74bc2d86d600e6aa1207813a49c8
- MD5 03015db5bf6a144758a7250ca8a08849
- SHA1 358e915373816c7e2a15e75f3dcd8f236b6519d3
- SHA512 1ba6cdb1f561c221f411cc5c662819727a97c72e6753ee6d3be671647e18a28c642ffc1443ee3170bea5a9736f0803c02d983f92138b0b02c6e46684ecbc1c09
- SSDEEP 12288:g+FENWG0jdPfm3jVcS0jFpIHPqJnZdIQ67Ak8qSKeUPr1Npc0YA0vPdWxZ6jPVnp:8NVFygEWz/462ZLz
- TLSH
  T1CCA45C1423E41630E6CE57F5F4B06D085FBDE62765A3AFAE6C4899EA2C837471D007B2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  AngleSharp.dll
- Size 935KB
- SHA256 470f705ecd73021f6ed6a065a9b696ac86f480eafc08c4fd106f7444152bc280
- MD5 d71ebe3fcc5b6db7a56c2e9d95ea5b82
- SHA1 7d0cdfbc7e14bc8b3667fe5ed241cfb585732304
- SHA512 85f44b122a6b1ff5ca9be3c6233d05ce30c7ef2fefd044eb9810d81aa12e1cbac01acdc4e27d3cb3bd7a5fa5429a40dbd9d4471328caa16de2512e095c074e16
- SSDEEP 6144:O+b7XqTWH0gCzjhHsOy6/MZ/T7kbaMm7QHMZS3GdTxKkaV0JScuWceIjpSYOPRwF:Oe2WnGjNsOy6A7YJOq6pPtkrifAT
- TLSH
  T1FC156D4077FA4133D8EE0B3DE0F5A64889F5E4731686E79F1B1894B93C9739A8C1A193
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  CDY.WebView2Helper.dll
- Size 8KB
- SHA256 0705f1a77581f821487929784784ec7ef8949fab953a3e132e247ba037aa7e34
- MD5 29eebd8ed4bd7b3c1871e03462c9deb5
- SHA1 97d3dd5a5929af766d60812ca7ae52ea1ff19193
- SHA512 bba0dea15758e0700ae5820c70f69e7753ac509bb0a20721955aee441cdd0f869cced26f4069213c8a642bab45977ec39a497aa06cb41083ac6ca8865a043d06
- SSDEEP 192:cH7bk4axP74spKmQWf8hmXHu3yeJEhQXmToUFnWu1wMY:cWx0NmQWkhAHu3yeJKQ2To5u1FY
- TLSH
  T155F1E82597D98336EC974BF9C8F3638107B4E2267882EB7F0E45D20A2C436565171FB2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  Castle.Core.dll
- Size 379KB
- SHA256 7bc5dcd9bc87a516bfb98bd24b3d51e594d051de520d608b12f9daa73c85431b
- MD5 30131746addf12e650326b862760bbc0
- SHA1 f8de51c60c18f36a0572767d7c4eaffaadacece7
- SHA512 52073bbc835fc30dd6ede5cbe0932f24f08c5d6cb5ef10a2112cf33389ca6d08d82a3a117ae3b164b2b394b59fd8b93c33f947528732e77e40659070e6cd5b34
- SSDEEP 6144:f6EqbCCKFkNet9r3VWAhRvvUGhP+aWyjJi1salna+qRBmnLO7tTSAfcnF:fMCCKFkNetqAhRx+FyjM1saNa+qRBmnt
- TLSH
  T132845A6223EC833AE9AF077AB4B124268BF6F407647BD35E5A45E5FA1C53740A901373
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  D3DCompiler_47_cor3.dll
- Size 4.7MB
- SHA256 a05d04a270f68c8c6d6ea2d23bebf8cd1d5453b26b5442fa54965f90f1c62082
- MD5 a7349236212b0e5cec2978f2cfa49a1a
- SHA1 5abb08949162fd1985b89ffad40aaf5fc769017e
- SHA512 c7ff4f9146fefedc199360aa04236294349c881b3865ebc58c5646ad6b3f83fca309de1173f5ebf823a14ba65e5ada77b46f20286d1ea62c37e17adbc9a82d02
- SSDEEP 49152:FCZnRO4XyM53Rkq4ypQqdoRpmruVNYvkaRwvpiD0N+YEzI4og/RfzHLeHTRhFRNS:EG2QCwmHXnog/pzHAo/A2L
- TLSH
  T19A367C5673EA40B9C1ABD178CE479213EBB1781403345BEB4190C669AF73BE16A3E734
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21
- Target
  DirectWriteForwarder.dll
- Size 490KB
- SHA256 ba087aef5460adf1f2da4995884821cd86ea82c9e1f2a25c98eee5a9f6ee0e35
- MD5 a7e293a4cc6b8e8feba33888ff79534e
- SHA1 7d2f838bfdea1d81aafa79bf7db92f7bdff9c77e
- SHA512 4189b743c4f48ad9cb63ebe779a9cc374882f327468c4d751f246d70cda35a0904ce920d3d22ef758f7d036df4f833e2288ce00ed75f8f6a1745856e6acfb096
- SSDEEP 12288:mlxRNCHstpwoII46tdR08qCh0JoK/3HaM9Fm:qxRNCHstqrI5uoeD9Fm
- TLSH
  T1ABB49E14B7842B97E81DC6BF8353CA92D63099F15302E7C7C68186A61E2FBC1D77B192
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral22 behavioral23
- Target
  DnsClient.dll
- Size 153KB
- SHA256 fcf2d07f01bb34f6e8ea61da6d281d1979b5d3c1485bcc5b2b350ec8c59cc2f0
- MD5 43f52efde366a4cb409ce99730418a6c
- SHA1 cc593f284f915a39fa2502e2e9f9072231f8b8df
- SHA512 d47e42c3dd74f35335572634bbf9c96d9c4235cd4a8ca787b7706d4516fa530c3f3bd1b42de7cc7d39b057dad3c04f729655185c7933e3924318f82ac9d921ea
- SSDEEP 3072:Ls2iAtNRzcWlRXX7vvBC0/Tg2/zmFscJ0YQGahmt3t:LjRH7XBFz/SFscEhO
- TLSH
  T137E3492563EC072AE6AF1BB9F4306014C7F2F90A757AE78E5E0974FE2512F42A510763
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral24 behavioral25
- Target
  HandyControl.dll
- Size 1.4MB
- SHA256 4b20a42f06220ebc024e8d23ec73a76e9666cbe08d53d09b90fde5ac51be55c0
- MD5 f03ca9247640752df8af6cb7cf3f521f
- SHA1 d0e795727fadcc4ac268b1cb1b0df2c08c16521f
- SHA512 429351c598225578c83d51710b9018ca07853936503a913fc0a2e654393886ec2d1d9ada4376726237a6e951827d586a1b10b17cda314b05e4bd88460c390cc1
- SSDEEP 24576:prNvtYuCK51pbnKlYkWg9B/lbBqThLRvAq3RiQ2Ny:dBt7V1pbkbBGv
- TLSH
  T192656C803368AD79C43E077AD67259CC673CDC529BE1FB9B11A67CAE4CF0B42294116B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral26 behavioral27
- Target
  MainHost/index.html
- Size 1KB
- SHA256 6fec7ff3fc02cbd435087c3635a6d9bb170bf1ca76087a64e0eb1e6edb34d8fd
- MD5 e53556a71986a18415fd3159b5792f13
- SHA1 84cf322a538a0cb7be1e1f0d79e9059cad4dd639
- SHA512 e29db94452ec5d78ef674abcd7c360f2034a50f8d0687d1707af41f84c775e94df2d3121947ca6c06cc4aa8b62a6250e179f2be71a5c2ce9274c04dd8977165e
- TLSH
  T1FB110686CC25D5DC43D01E8A6975F31EAC49B949CF62DCD076FA90BD0AE4F884D53858
- MD5 SHA1 SHA512 TLSH
Score

7^/10

discovery
- Loads dropped DLL
behavioral28 behavioral29
- Target
  MainHost/js/16.ce572686.js
- Size 556KB
- SHA256 49f3e338e2151ae71f23fd47f51beffbc7f7fd4391cb6c6aa3b502ab85a8ecc0
- MD5 8c6d089d8d8a02300f8daf456087f8d2
- SHA1 6e6f2774c60d99498481fdd22850f13e6dcbc5ea
- SHA512 ca20b273cfc654e26acf350e90c6518573596445030494ff886e4d01fb3d89388e699b143a991af193a13e44fff7d11ec9ec6cf01a72d275daf81cf56d755635
- SSDEEP 12288:Utnp6zId/mi/bhYbg2xmKRcD662gFxnoo3tK7U7ZNm:un0zOyBx52D662gFxooZu
- TLSH
  T1A2C4531063C9788022577F76771FB1E6EA194FFD7098084BD404BC58AAB9916FEE7A30
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral30 behavioral31
- Target
  MainHost/js/170.6348d86d.js
- Size 443KB
- SHA256 b648d3ea072e6e51e319149051432876375b735d3da7d115270f8580622faf7c
- MD5 bd65498bd42f324eb1116e78449b5466
- SHA1 40f43b4b3a580f8af8b54756e5c8e9832bfeceaf
- SHA512 135da612368fb9cd572126b7dbe2086f093704578a7837acec0c51400b30aaf2b3fa24c0195fe1e9c330d0add5503fc057c07f0258d830cbce20e5e01a67e549
- SSDEEP 12288:JvjalflJAuqN3ZDubeTLi/bwdbgbK+UM6j0engrF0wXZwnXHJrNH2s6QDsVp5KnK:Bjaljp+9HJxTg5KnjP+
- TLSH
  T1ACA41F5CDBC12CB012076F77A71FB7D1EA569AA839470C8BD014BC74EEA5A0AE9D1730
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Executes dropped EXE

Loads dropped DLL

Checks installed software on the system

Checks whether UAC is enabled

Network Share Discovery

Loads dropped DLL

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32