418c0d9b9075cb862bf20c3bda95dec0417678a75a25ffd545eeffe4bc6b9551

Sharing

Copy URL Twitter E-mail

General

Target
360epp1346196724[360.bjits.net-8080]-ws.exe
Size 21.6MB
Sample260525-pf2daaax91
SHA256 418c0d9b9075cb862bf20c3bda95dec0417678a75a25ffd545eeffe4bc6b9551
MD5 0a7bd9ba003b78b693f9d75d1823306e
SHA1 6b17943eec5f6ebb4c2970b98f247d10bdefeed2
SHA512 6b546aa2ff36481e51fa268d5a5f712f0bd739fe329b1d2b0c00300ca2916fcb573c5b19b79a9ce2992eb71ce689981c2dd3489047d0a2f3a2d633e4e430fe44
SSDEEP 393216:RU8QRutlYkR7fwrowYHcASNedmdAAffydfMBMm03IOLILxalR6v/ju:Rqm7f6owYHcK0dPaNMZ07w8R6vK
TLSH
T1933733536B3CCFE2C9C1BE3CFE169A700F665E72CB95710A198C35E267B2E45206161B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  360epp1346196724[360.bjits.net-8080]-ws.exe
- Size 21.6MB
- SHA256 418c0d9b9075cb862bf20c3bda95dec0417678a75a25ffd545eeffe4bc6b9551
- MD5 0a7bd9ba003b78b693f9d75d1823306e
- SHA1 6b17943eec5f6ebb4c2970b98f247d10bdefeed2
- SHA512 6b546aa2ff36481e51fa268d5a5f712f0bd739fe329b1d2b0c00300ca2916fcb573c5b19b79a9ce2992eb71ce689981c2dd3489047d0a2f3a2d633e4e430fe44
- SSDEEP 393216:RU8QRutlYkR7fwrowYHcASNedmdAAffydfMBMm03IOLILxalR6v/ju:Rqm7f6owYHcK0dPaNMZ07w8R6vK
- TLSH
  T1933733536B3CCFE2C9C1BE3CFE169A700F665E72CB95710A198C35E267B2E45206161B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral1 behavioral2
- Target
  $PLUGINSDIR/AccessControl.dll
- Size 15KB
- SHA256 5fd5d8aec97cffaad9b7df6371b348d436cf1401e86fab614dc4cb8575428e52
- MD5 d74bb4447af48da081c7d9b499f3a023
- SHA1 dadf6e140e6fd8e49a1851cc144bb022e0adb185
- SHA512 9a15de5c6b08914f5e5bbc1c318fb0e84da28a316cf51ccddca8dfb64cd67b7ad06acac307b41d5086a0740055d327007ff890807d6853bb2e767179a3b3d758
- SSDEEP 192:0hdGZ2E0hm+Gc7ROMzCPvXWROt086dXHGrEKcDDi0b5ZsgMgiCXyo1Fp01eLLuIt:0hdGZ2E0YWV2908oj21ILud8
- TLSH
  T1B362A6124FF90BFEF1F16B352AB5553303A2B50124B1C21D5B91CE9A2831B9B5D74327
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/LogEx.dll
- Size 44KB
- SHA256 57ede354532937e38c4ae9da3710ee295705ea9770c402dfb3a5c56a32fd4314
- MD5 0f96d9eb959ad4e8fd205e6d58cf01b8
- SHA1 7c45512cbdb24216afd23a9e8cdce0cfeaa7660f
- SHA512 9f3afb61d75ac7b7dc84abcbf1b04f759b7055992d46140dc5dcc269aed22268d044ee8030f5ea260bbb912774e5bbb751560c16e54efa99c700b9fc7d48832c
- SSDEEP 384:w4NSXFjXCATBAQR4F1Y5u6I3wa4W7KNP66BjLjyXB0JyuDchv8EnohgSil2X:woaF+ATCQye/I3KWmxj00Jyb8Enov
- TLSH
  T1C8136B90788601F3C34E833155A19F37AEBF662027E54883DB659ADA2D316F1E23B307
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/SimpleSC.dll
- Size 1.1MB
- SHA256 1620cdf739f459d1d83411f93648f29dcf947a910cc761e85ac79a69639d127d
- MD5 7b89329c6d8693fb2f6a4330100490a0
- SHA1 851b605cdc1c390c4244db56659b6b9aa8abd22c
- SHA512 ac07972987ee610a677ea049a8ec521a720f7352d8b93411a95fd4b35ec29bfd1d6ccf55b48f32cc84c3dceef05855f723a88708eb4cf23caec77e7f6596786a
- SSDEEP 12288:fRdJsAp4dXFcLBz75cwoCmJKHwe6VuoH9v0D/LF5mM6:fBsmyVS151oCmJKE1dv0DX
- TLSH
  T12F354B2BF645693EC5AF063E4673E714993BBB726912CC1F56F0084CCE2A5406B3EA47
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 acf90ab6f4edc687e94aaf604d05e16e6cfb5e35873783b50c66f307a35c6506
- MD5 6e55a6e7c3fdbd244042eb15cb1ec739
- SHA1 070ea80e2192abc42f358d47b276990b5fa285a9
- SHA512 2d504b74da38edc967e3859733a2a9cacd885db82f0ca69bfb66872e882707314c54238344d45945dc98bae85772aceef71a741787922d640627d3c8ae8f1c35
- SSDEEP 192:MenY0qWTlt70IAj/lQ0sEWc/wtYbBH2aDybC7y+XBaIwL:M8+Qlt70Fj/lQRY/9VjjgL
- TLSH
  T1BE428D1193B089F2F590593805A67F2A6FBEAC5C27E44A63CFE345853D702DFA47A243
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  $PLUGINSDIR/md5dll.dll
- Size 6KB
- SHA256 32c3d36f38e7e8a8bafd4a53663203ef24a10431bda16af9e353c7d5d108610f
- MD5 7059f133ea2316b9e7e39094a52a8c34
- SHA1 ee9f1487c8152d8c42fecf2efb8ed1db68395802
- SHA512 9115986754a74d3084dd18018e757d3b281a2c2fde48c73b71dba882e13bd9b2ded0e6e7f45dc5b019e6d53d086090ccb06e18e6efeec091f655a128510cbe51
- SSDEEP 96:5mArJv6F3TqDmgK4ghEin1US36eHQZDUDgGogZcko5Nt4AMP:5XJ63LhR6inZ6dsgZkKQT
- TLSH
  T1FDD10A66F7DC1B6BF1730B722BF903214936B9B19BB7D76D16901159AC612208C31F2D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery upx
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral11 behavioral12
- Target
  $PLUGINSDIR/nsplugin.dll
- Size 9KB
- SHA256 e71b9359f2f55bfb22385b65bf09557c9877fa3348bd5ffe75a83570de263258
- MD5 6ee003875c43a2f2578710710ee9fb56
- SHA1 ab23dc12e5ccdc91366938ab13b198f76ec5a879
- SHA512 ede939e2eb1a1cd5d20abb35075734cfde4b655da17ad3f367ee3e2e6eee34b0da3ee00c61c09128c540ea4410b62b4b78e92c4f0b7e07c269c5b5f5cc99ee23
- SSDEEP 192:4230inPvpIibVEICOne9mxo6ANLz18ce:421PhIcqIZnKmO60zyc
- TLSH
  T1C812F75F2F5844B2D58245B83289263B97AF9B34B2D57C13DB438D853CB56E2BD3A203
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral13 behavioral14
- Target
  $R0
- Size 82KB
- SHA256 4a82beed7831f94311a150d5f9db84dda47f0c44256b37339159df3e60d48470
- MD5 ad996e90f5a345370499392af57c5007
- SHA1 cd0f35e475fb5e598d3270bb2bc8737ee661d431
- SHA512 072112cc52414fd338a8d516e97c2b2c6832d774c5c38d85207a6e6710eb5cb89a12d747c1a4cbe901c8d53013490f9f02bb7e0bc916c6f08f926d7c85668188
- SSDEEP 1536:mI/K1PnRRjZ8LDJ9gUdtF9nnCo7vGyD5TFN9NXrn9+EtN/IrQ:p8/jZ+J9lH7vGyD5TFN9NXL9Jt5Is
- TLSH
  T14A839E20B660D033C99B653860A4C712AE7C7D616BE9C487BF6A47781F503C2B77E366
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral15 behavioral16
- Target
  $TEMP/KB931125-rootsupd.exe
- Size 448KB
- SHA256 2bff74b83dc66fc74df2f527071c1ca80a992ba2b887f6043b09564d1b814213
- MD5 9909aa216b30b502f677bfff05000b0e
- SHA1 01a26e5c75ff5b3e34fb6b763ace486fe6836aac
- SHA512 d46d00aa05c1fb08232ea7281d18254edc55de5e7d1e681ca5c1c18324f724565a89ded04507de4f725971301762b91f4aa90a357bb3b09dad2ea26a676c1c3f
- SSDEEP 12288:ikfk12vJnVGeGVbT5vQtYnObeJWDPO7RuXawA:Q1qnVGVV3nYeIjOQXawA
- TLSH
  T1F9A4011196E48577D4E63BB849FAA3231E3EB9E15B3493DF228515E85D327C08A3831F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

defense_evasion discovery persistence spyware trojan
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
behavioral17 behavioral18
- Target
  Utils/$R0
- Size 956KB
- SHA256 dfb3ebc5720bf8744fc9a973f86f758d59eb2b9e0a24d87c245066d8192215f3
- MD5 62e62d824d538cdf3d4a2c7fb466d56a
- SHA1 238de7f7934e7844701aeca27ce28a11fb34c497
- SHA512 9f2eb1b533a0c7edffdba4e025b31bb8682033b67dac02a02c60ac8aad3d379b10ec241380212ee00c036fba4724f5f374d848faf104cea733fefa691bc34d79
- SSDEEP 12288:n7xrE9yGcw9IuA1YmbA++zxFNDmdVI4ucH+fOkEXRTrC6/mdD0o9BB9B:7xrbwCXby9FNidVI45/mdD0uB9B
- TLSH
  T1E9252902F940D075E9B708BACBBF56B9853ABC71471A50C393C43E797A719E37A31226
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral19 behavioral20
- Target
  WscReg.exe
- Size 396KB
- SHA256 ab41fb32b2c2f810b60ed60257f7fd9c551d321d63fe8827b335d03ed911fd1d
- MD5 f93227417c9d6bb351d552c1fc68aef2
- SHA1 876587ba848a4e5c7a60e919500828dc6f9f486a
- SHA512 7b0198da3a89a5f2f7f3447b4983448f2a745b2a82b40b77e3e290e13542f3db0471c4d99886b6e748b507327b5421e2696ce94f5afade0a5559d118d454c8db
- SSDEEP 6144:LJOHCVyG1ia7j+jf3bzI8Mz1fG3yoM9PeTAH1zpGYRHQ9b:4ixj+jD88Mzo3fQPek7Rw9b
- TLSH
  T1F2847B107BD0D072D5A215318655C7B65E7ABD315B2289CBB7CC3EBD2F30AC1AA3670A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral21 behavioral22

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

ACProtect 1.3x - 1.4x DLL software

UPX packed file

Boot or Logon Autostart Execution: Active Setup

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22