36c5eb2e8f95081f40912af74268f78030352cca3cbfc30f0839135ba95b6a42

General

Target
pingplotter_v5_23_3-(PRO-Indiana Department of Administration).exe
Size 20.9MB
Sample260703-dm4lfafw9k
SHA256 36c5eb2e8f95081f40912af74268f78030352cca3cbfc30f0839135ba95b6a42
MD5 9846e17fdb56a7a562422343876c97db
SHA1 4dee26aec0a3b5491da548dfd5894f20b286819a
SHA512 ba874a190ca13d4c71d552e78d7c1348af9e259381868acdcab436a2cec0107a24bdf6cf20571acfa405deb7830ee68f688dbb1ccc95dfab44796d32047de1d3
SSDEEP 393216:7StR9MlyPA/o0rT/cdVgI2uhP7dKdROoIgKaAJN8VgronoK:7Sb9K//3UbhPIugKahdno
TLSH
T15A2733C53293B0D3E2669D70EF965272C00DACD491719E2A7B2EFC3031762A855BBE53
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  pingplotter_v5_23_3-(PRO-Indiana Department of Administration).exe
- Size 20.9MB
- SHA256 36c5eb2e8f95081f40912af74268f78030352cca3cbfc30f0839135ba95b6a42
- MD5 9846e17fdb56a7a562422343876c97db
- SHA1 4dee26aec0a3b5491da548dfd5894f20b286819a
- SHA512 ba874a190ca13d4c71d552e78d7c1348af9e259381868acdcab436a2cec0107a24bdf6cf20571acfa405deb7830ee68f688dbb1ccc95dfab44796d32047de1d3
- SSDEEP 393216:7StR9MlyPA/o0rT/cdVgI2uhP7dKdROoIgKaAJN8VgronoK:7Sb9K//3UbhPIugKahdno
- TLSH
  T15A2733C53293B0D3E2669D70EF965272C00DACD491719E2A7B2EFC3031762A855BBE53
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery spyware trojan
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1
- Target
  $PLUGINSDIR/DotNetChecker.dll
- Size 84KB
- SHA256 39c43d67f546fc898f7406d213b73dcb1bc30fc811ddfa3a02b6b50c29d11f91
- MD5 f18364fa5084add86c6e73e457404f18
- SHA1 6d87c4b9dbf78af88fddf0d4d5febe845c8e4e6a
- SHA512 716892492390fe4314f3289286f733d07b8b84de1f5af0676b26e68c0be01808682d35ad2bb9e9491247b7bb5a0ea297a6850e26de9baf88621c789206107db3
- SSDEEP 1536:AZBjgSXlkq8su+OudgGpGlmQSMqJS4HGsorJKQUDs0OsWPIcdGbk2HeJ:AYvo7PMqEuiKQGbk2HeJ
- TLSH
  T14D835B1076D0C1B5E57F1D3948A6D661076EB810EFE4CDEB279A03690E702C1BE3AE23
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral2
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 37KB
- SHA256 23da25dbf9f9392e29652084881d7ecedec770bc672800d8300b3f902594e890
- MD5 0493dcc333f413ae01afb74652128fe8
- SHA1 c6c5d131279da08a54efc7ec565ec03863f62baf
- SHA512 113c81010a55181d2ed9dd6cf197fc7c14c3caea06fb4bfe56534eb6075969d2ef4a86ab516217c6a26e2eab892c3d5a0d446b80038d5972fbb8ea8e09093f0e
- SSDEEP 384:SRHnRp1w0RUPEACdnlfyXNEkbLitX44KmIQxMkioOcJAMzT8P5nwHkzkBOoWzpf3:cRp1kP8NgWk6tohm7xFi4iMfdOoWRA
- TLSH
  T13703198756B08866F3FA5A71BAFA3E138A7DBD2871E0842E8F53154C4C32261E4553B7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3
- Target
  $PLUGINSDIR/System.dll
- Size 11KB
- SHA256 df5ae79fa558dc7af244ec6e53939563b966e7dbd8867e114e928678dbd56e5d
- MD5 ca332bb753b0775d5e806e236ddcec55
- SHA1 f35ef76592f20850baef2ebbd3c9a2cfb5ad8d8f
- SHA512 2de0956a1ad58ad7086e427e89b819089f2a7f1e4133ed2a0a736adc0614e8588ebe2d97f1b59ab8886d662aeb40e0b4838c6a65fbfc652253e3a45664a03a00
- SSDEEP 192:eo24sihno00Wfl97nH6T2enXwWobpWBTU4VtHT7dmN35Ol6Sl:k8QIl975eXqlWBrz7YLOl6
- TLSH
  T1C3325C02135481F3E4918138C86B3A276B6A15029BF98E57DFD39646BE20BE3BD7D603
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral4
- Target
  $PLUGINSDIR/nsisdl.dll
- Size 15KB
- SHA256 1dd9cf437ce9a98db66d1132c8e116531d0b0c08b06226045652382918a23dbc
- MD5 39b76431ab111d118f6759c1946a89b4
- SHA1 ae3704cc4d1585c79a0ca5e757c95d5288790b97
- SHA512 9d65b6a004c5fbd0e9bfcef5319e32993d41c3023f82bfa4b946cadb6d8946694efec2d6808fba82f3c9542020527b1b80a90f5f043ebaa076fe78d224ee5fe8
- SSDEEP 384:shyd8Y6pu8ZaLf6Uksnw1g8BUcyHisU/b:shyd8Y67WGg8B/Eiv
- TLSH
  T142623C45AA6084F2C7A3167034E33A3E6BB19F751A1485C38BF34D4EAE15307B33A987
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5
- Target
  $_4_
- Size 66.8MB
- SHA256 8ada96aca5b85f96d189b1fbc15d911439be1e12a2aa0d2985db19e577373978
- MD5 6ef858e8b8574159de4fafcd63a2cc61
- SHA1 dab43b1230ddb64004a33b2c167bf9c094737025
- SHA512 702b0aa6a9066f81e8eb1464f4e387bf778cbb3f79b5b392fe6aede8e62e2752b70c8704270982173920d4e16bca870dc97925a25e949a70ac2bbd630b624a92
- SSDEEP 393216:ieMb+49eAIY8fAhws35V7hMYq64yKccQBDL+7b1h0OTE69JNBpK+mWySbmgVgvft:ibb8Aws/hjNL+7b1zI0FMdVb
- TLSH
  T16BE7BF0273A48A36C5BF5372A5750A0493B1F5096B13D78F368CE6F91EA37814E217BB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery persistence privilege_escalation ransomware
- Executes dropped EXE
- Loads dropped DLL
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
- SmartAssembly .NET packer
  Detects SmartAssembly .NET packer.
behavioral6