General
- Target 944be60b0fbcbf625b47a4ea8064100124d3c0430855da6ec051cd3d494d964b.exe
- Size 865KB
- Sample260630-csct8sdv4l
- SHA256 944be60b0fbcbf625b47a4ea8064100124d3c0430855da6ec051cd3d494d964b
Malware Config
Targets
-
- Target 944be60b0fbcbf625b47a4ea8064100124d3c0430855da6ec051cd3d494d964b.exe
- Size 865KB
- SHA256 944be60b0fbcbf625b47a4ea8064100124d3c0430855da6ec051cd3d494d964b
Score7/10-
Drops startup file
-
- Target ᠇/swbck.exe
- Size 802KB
- SHA256 68769189f293c9031726a051303e5dc8a4d2b1254e0a62c006e0a84988672a35
Score1/10 -
- Target $PLUGINSDIR/SelfDel.dll
- Size 5KB
- SHA256 d115bce0a787b4f895e700efe943695c8f1087782807d91d831f6015b0f98774
Score7/10-
ACProtect 1.3x - 1.4x DLL software
Detects file using ACProtect software.
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
-
- Target $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 9111099efe9d5c9b391dc132b2faf0a3851a760d4106d5368e30ac744eb42706
Score3/10 -
- Target $PLUGINSDIR/nsExec.dll
- Size 7KB
- SHA256 01e72332362345c415a7edcb366d6a1b52be9ac6e946fb9da49785c140ba1a4b
Score3/10 -
- Target $TEMP/w.exe
- Size 706KB
- SHA256 5d4b9e922576f0203376d98508239b2266b7b43cf591699c181f15797adffad9
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
ACProtect 1.3x - 1.4x DLL software
Detects file using ACProtect software.
-
Deletes itself
-
Loads dropped DLL
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Suspicious use of SetThreadContext
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
-
- Target $PLUGINSDIR/HashInfo.dll
- Size 1.5MB
- SHA256 6ed33858b59ca6cb769db55c6a841288a1e08603409d5448867bc15eda4068ce
Score3/10 -
- Target $PLUGINSDIR/SelfDel.dll
- Size 5KB
- SHA256 d115bce0a787b4f895e700efe943695c8f1087782807d91d831f6015b0f98774
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
ACProtect 1.3x - 1.4x DLL software
Detects file using ACProtect software.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
-
- Target $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 9111099efe9d5c9b391dc132b2faf0a3851a760d4106d5368e30ac744eb42706
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target $PLUGINSDIR/nsExec.dll
- Size 7KB
- SHA256 01e72332362345c415a7edcb366d6a1b52be9ac6e946fb9da49785c140ba1a4b
Score3/10 -
- Target $PLUGINSDIR/waf-waf.exe
- Size 577KB
- SHA256 1b16c41ae39b679384b06f1492b587b650716430ff9c2e079dca2ad1f62c952d
Score3/10