General
- Target NFCLOUD-windows-1.4.9.zip
- Size 53.5MB
- Sample260621-sa7vnaew71
- SHA256 db9e565a72e8afecd0ac6389ccf6bdb8eabfa84ee10990515e1407a9ac2b9d68
Malware Config
Targets
-
- Target app_links_plugin.dll
- Size 136KB
- SHA256 12a56dc634d296467a434fcd77d064267c80f890e4e25829c132e95eda06d09b
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target connectivity_plus_plugin.dll
- Size 97KB
- SHA256 94f8bdaedf2f2fa118cc59f5b4f9c698b4b08f0860e453ee37a476e6bb8fe0d8
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target data/app.so
- Size 10.5MB
- SHA256 d1653b59593955817444fcd2e2cb3816691778c693b38291e40e2b5879ad6594
Score1/10 -
- Target data/nfx-rt/nfxcore.dll
- Size 23.5MB
- SHA256 2e9c5529cf8983ffc4aa2f25bec510514389ffe3a0a2c514f1cdc82ed3acf375
Score1/10 -
- Target file_selector_windows_plugin.dll
- Size 109KB
- SHA256 4de7f5e358228031dac5a6def6636bd3288501d3c52671a339dfed92502d1961
Score1/10 -
- Target flutter_udid_plugin.dll
- Size 82KB
- SHA256 683b4096e809aa89e21e9a38e149cd0b8e7f4e2748d95d0168dd9b9ac1d86250
Score1/10 -
- Target flutter_windows.dll
- Size 17.1MB
- SHA256 2c1a0df64a7e8d0d1d229b3d157a924ce6a3704ca74468d5675492e52926e78b
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target local_notifier_plugin.dll
- Size 161KB
- SHA256 b601b50368a42af5364fb403676babc59343d3903e1e7326d72146920fa38708
Score1/10 -
- Target nfcloud.exe
- Size 434KB
- SHA256 550958b073d3978b68451540f58c095a004b76bd72e05e2d2471b28162dac84a
Score7/10-
Unexpected DNS network traffic destination
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
- Target pasteboard_plugin.dll
- Size 88KB
- SHA256 41f424a111bae3cb360e2d90c4165710d9ffe1c96d093654aa6cb6fec75c4900
Score1/10 -
- Target screen_retriever_windows_plugin.dll
- Size 116KB
- SHA256 ac1eb7d70c368bd11fee60801fd652845febd2ec00a8fd467a54ddb10a7cbcc2
Score1/10 -
- Target tray_manager_plugin.dll
- Size 104KB
- SHA256 ad54448b459d3db76438f17c3bee5cd06991a96c86c8b26fdf0e30da7e9a948c
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target url_launcher_windows_plugin.dll
- Size 96KB
- SHA256 971772e42125ebc3e7df01919254c207d0ba7c640496da75529cea98c50351f7
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target vc_redist.x64.exe
- Size 24.4MB
- SHA256 cc0ff0eb1dc3f5188ae6300faef32bf5beeba4bdd6e8e445a9184072096b713b
Score4/10 -
- Target window_manager_plugin.dll
- Size 127KB
- SHA256 098c7c41d62f571c1032e02143e035d925014081e70089d6cfe779672d6f7bd6
Score1/10 -
- Target wintun.dll
- Size 417KB
- SHA256 e5da8447dc2c320edc0fc52fa01885c103de8c118481f683643cacc3220dafce
Score6/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target wintun_installer.exe
- Size 13KB
- SHA256 10c95b00d96194d6d18d2d460ef07e11b8d0f06dc5bc8eeb63913bd32681c2cd
Score8/10-
Drops file in Drivers directory
-
Drops file in System32 directory