silentnet | 5a11b2391438d4329e97f997db4ede05571c0d392167c76fa2e76e4059b02a19

General

Target
chickennw-dupeV2.jar
Size 658KB
Sample260705-am3scsa18k
SHA256 5a11b2391438d4329e97f997db4ede05571c0d392167c76fa2e76e4059b02a19
MD5 bc9acf040fd126bd2d79f6060608bf4f
SHA1 0fe5527cacbd1f5137748a2c68d2a6cd5bfe56d9
SHA512 0ebb5848c23135a94a1c5c81ca259063183aaaec3fb5019c4966a4d8a0c2072ba09d8ba553af59c749b9b96ecd19acf16c39c1ec20d4f8241f13186be752517e
SSDEEP 12288:dWylW9pUO4tV8ZLNhyMHFdRy1qHvY66nH7Zg4bhbeJpia8gDypmd:d2o+ZLNIKyZHlgabeJygDy8
TLSH
T1BEE4238F31AA0A4DDC37B3FEE9958A86745E93E0D1068C2D0C6576D28451AFE0F0E75B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  chickennw-dupeV2.jar
- Size 658KB
- SHA256 5a11b2391438d4329e97f997db4ede05571c0d392167c76fa2e76e4059b02a19
- MD5 bc9acf040fd126bd2d79f6060608bf4f
- SHA1 0fe5527cacbd1f5137748a2c68d2a6cd5bfe56d9
- SHA512 0ebb5848c23135a94a1c5c81ca259063183aaaec3fb5019c4966a4d8a0c2072ba09d8ba553af59c749b9b96ecd19acf16c39c1ec20d4f8241f13186be752517e
- SSDEEP 12288:dWylW9pUO4tV8ZLNhyMHFdRy1qHvY66nH7Zg4bhbeJpia8gDypmd:d2o+ZLNIKyZHlgabeJygDy8
- TLSH
  T1BEE4238F31AA0A4DDC37B3FEE9958A86745E93E0D1068C2D0C6576D28451AFE0F0E75B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

adware defense_evasion discovery persistence privilege_escalation ransomware spyware stealer trojan
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Downloads MZ/PE file
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Patched UPX-packed file
  Sample is packed with UPX but required header fields are zeroed out to prevent unpacking with the default UPX tool.
- Sets service image path in registry
  This determines the executable launched when a service starts. It can be used to establish persistence.
  persistence
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Impair Defenses: Safe Mode Boot
  defense_evasion
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  defense_evasion trojan
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- ConfuserEx .NET packer
  Detects ConfuserEx .NET packer.
- Drops file in System32 directory
behavioral1