plusdrop | 98200cfa32ed0e3794fcb7f703d9f043b9c38c4db0aa8c7e5536aef51c5b65fa

General

Target
98200cfa32ed0e3794fcb7f703d9f043b9c38c4db0aa8c7e5536aef51c5b65fa.zip
Size 7.7MB
Sample260429-nktcssaz7t
SHA256 98200cfa32ed0e3794fcb7f703d9f043b9c38c4db0aa8c7e5536aef51c5b65fa
MD5 5a3e63028a81cd58801444924f5f789b
SHA1 e8aff39395532f7394e6f5addb8db7026951240a
SHA512 19412036bcee7a01d58cf1e55db5ebf6c9091084680870a65a335de096d91ae76c38844d9e87206d8c78b6b4935b27d6bfd5213f1df76270eaac250f8142986c
SSDEEP 196608:hiVurjfxpgofPYHL6dEA+7Cu2ghXeQcx+RO4/1T3nNnmUwmBYV0P:/p7Xy6ad7Bvc0ROATLA0P
TLSH
T1E78633DA25DACDF64A4847AD83238EA32736DB10872350685FE117E55FAEE5E4F0C831
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  V9se0A/37RXs3.exe
- Size 135KB
- SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
- MD5 9ec587911e501b73b7cf09f05d0ae17d
- SHA1 5b62403cc9a668c6e5c70ace177fd54fcc4c5936
- SHA512 d05468a472373815c46ccb46ec743408365d24982d10d8a23ee0036c28cf3dacd05d74304ef2d4b7118f91ff3f631f676b2e86ddee92a02cf988b0d3c6247847
- SSDEEP 3072:MmhXb5pgtiaRENEErO9Uj4OqhhUvB4BNgQaJ:MmjgtiayGErsUKh3To
- TLSH
  T1D0D38C2776A474F9E1778635C8511A1AE772B8760770CB9F03A442A62F237D19E3EF20
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

apt41 apt backdoor defense_evasion discovery execution plusdrop persistence trojan
- Detects Plusdrop Payload
  backdoor apt apt41
- Family: Plusdrop, toughprogress
  Plusdrop is a backdoor used by APT41 in Toughprogress campaign that abuses Google Calendar events as its C2.
  backdoor plusdrop
- Windows security bypass
  defense_evasion trojan
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops file in System32 directory
behavioral1 behavioral2
- Target
  V9se0A/UxEnhance64.dll
- Size 3.1MB
- SHA256 8193ce8996b0c4b1a22591a28e58386661d3436c19bfc0cc7ceb754c5f742245
- MD5 61040878bf337a67235fe82a8400c392
- SHA1 31b7a09e4abfa902e54ba28485c501d3afabf8bd
- SHA512 68710be08b2050223d773f2459bf2ca374b8df1199832755cb0a3f2022585ea96c68069afc5ecbd06b2c93040a40965f0223ce5f85cd22e85223f51a56b96f5d
- SSDEEP 49152:k8xUfn0rHSPj8d2uTVwtOYy1Ce3MXWY8Wt6I0VjqB/3q2ieE4TedO3EMB/iwdZ5a:cfKS8d2P+3MWEk1Vej6dMEMkOZ5acbCB
- TLSH
  T162E522A572C638F7C066C7B5D42278AE317D3B41EF638D4FB3C86A019E121285B3A756
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4