plusdrop | 1332bcf6a74b9ab73d07af0ae39a2d1e7a3fae678ae02d364b5d022b88cf1255

General

Target
2026-06-09_2c250a28a3b5bc77dc6e2be0bef25729_amadey_coinminer_dosia_glassworm_icedid_njrat_quasar-rat_vidar
Size 70.8MB
Sample260609-1wvq8aay2k
SHA256 1332bcf6a74b9ab73d07af0ae39a2d1e7a3fae678ae02d364b5d022b88cf1255
MD5 2c250a28a3b5bc77dc6e2be0bef25729
SHA1 9b464ea9aaaecf698a1dcadf1cbc9d61878d840c
SHA512 f0d76e8ccf80ee10f3912aa5bd7d425a931cfa0338937fc7ce613270d0631ce0c1db24c65f6df709bed74709b152703929293b7ecf9634f875b467f5982d7001
SSDEEP 196608:j7sSRA8C9WCkyKaMTFG0HhV5fMJP6HtmW6h+buxhZ++MfT9qlYKAyZ6JQBhDRcRV:/sSRA8PRc0drHtm/8bE++MglYI4eRcv
TLSH
T1AEF7F8477706CDC7F556E23848AB8F94A32AF8B15A71835332A5232D1FFE34C5EA2944
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-06-09_2c250a28a3b5bc77dc6e2be0bef25729_amadey_coinminer_dosia_glassworm_icedid_njrat_quasar-rat_vidar
- Size 70.8MB
- SHA256 1332bcf6a74b9ab73d07af0ae39a2d1e7a3fae678ae02d364b5d022b88cf1255
- MD5 2c250a28a3b5bc77dc6e2be0bef25729
- SHA1 9b464ea9aaaecf698a1dcadf1cbc9d61878d840c
- SHA512 f0d76e8ccf80ee10f3912aa5bd7d425a931cfa0338937fc7ce613270d0631ce0c1db24c65f6df709bed74709b152703929293b7ecf9634f875b467f5982d7001
- SSDEEP 196608:j7sSRA8C9WCkyKaMTFG0HhV5fMJP6HtmW6h+buxhZ++MfT9qlYKAyZ6JQBhDRcRV:/sSRA8PRc0drHtm/8bE++MglYI4eRcv
- TLSH
  T1AEF7F8477706CDC7F556E23848AB8F94A32AF8B15A71835332A5232D1FFE34C5EA2944
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

apt41 apt backdoor defense_evasion discovery execution exploit plusdrop persistence privilege_escalation trojan
- Detects Plusdrop Payload
  backdoor apt apt41
- Family: Plusdrop, toughprogress
  Plusdrop is a backdoor used by APT41 in Toughprogress campaign that abuses Google Calendar events as its C2.
  backdoor plusdrop
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Detects executables calling ClearMyTracksByProcess
- Detects executables containing artifacts associated with disabling Widnows Defender
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2