Trojan[.]MSIL[.]EvilClusterFuck[.]7z | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Trojan.MSIL.EvilClusterFuck.7z
Size 29KB
Sample260703-yfdfwsft6y
SHA256 358b726011c9c66f2b13dbedf4d12223bcfba86878e385aa2be4abf707685906
MD5 f5eb1546dca6e6fc8c7143f07ec0f18f
SHA1 6518277a568a9f68836488420004ceae9d3fd8a6
SHA512 d3cf7ebd5f34202abb8d9b62fcf5f132197bd78bcdd773fbaae0d29ee5571403457938236bc28891d306c7e6172d456ab693862b5cd99880b071ce7fad5d8de1
SSDEEP 768:azVFVjZGm4rQEpqweWp8i4L/2frZDjcsFWXg5TNc:aR70Ps4z4L/A9ssMQ5Tu
TLSH
T163D2E0F344CA107BDD750EB54756B1146A8F4E52D84EB96FC2EA5C5C110CB7B3809EE8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Trojan.MSIL.EvilClusterFuck.exe

File Explorer

Trojan.MSIL.EvilClusterFuck.7z

.7z 29KB
Trojan.MSIL.EvilClusterFuck.exe

.exe 64KB

Trojan.MSIL.EvilClusterFuck.7z

SHA256 358b726011c9c66f2b13dbedf4d12223bcfba86878e385aa2be4abf707685906
MD5 f5eb1546dca6e6fc8c7143f07ec0f18f
SHA1 6518277a568a9f68836488420004ceae9d3fd8a6
SHA512 d3cf7ebd5f34202abb8d9b62fcf5f132197bd78bcdd773fbaae0d29ee5571403457938236bc28891d306c7e6172d456ab693862b5cd99880b071ce7fad5d8de1
SSDEEP 768:azVFVjZGm4rQEpqweWp8i4L/2frZDjcsFWXg5TNc:aR70Ps4z4L/A9ssMQ5Tu
TLSH
T163D2E0F344CA107BDD750EB54756B1146A8F4E52D84EB96FC2EA5C5C110CB7B3809EE8
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

Trojan.MSIL.EvilClusterFuck.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 c9b98408ca67d08e1986d1855c4d99944caad5580533d18496cd8de86dd0885f
MD5 2e84f71165225ba0f7f8187c0b2f0f37
SHA1 3c9bf036163ede4b7f9152d04d1a83b7253dd029
SHA512 82c39aaef6103877c8472a55eab6270d57f4d7c46830aedf5fbb5661d7e3fd7aee2e172cdc830cba22cd9034f37784a8cc34f70a5918491bccf148ee923db389
SSDEEP 768:S5ohpPUa2T1VZj4jkVQu7MKquVspXKCxiJrFnMWDmLfe9NZ+OAhaptX/71tXHHi4:tcd1Pl7ZVsw3rFiLfe9NZmAP5ZC6N+
TLSH
T17253194156C1C8B6C669637488338E8446B17C71DD85BB2EE76CF22E3D723839947B1E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

20098

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Users\Michael B\Documents\Visual Studio 2015\Projects\File Overwriter [EvilClusterFuck]\Infection\obj\x86\Release\Win32.EvilClusterFuck.pdb