General
- Target vposDataUploadService_v1.00.00.06.zip
- Size 9.9MB
- Sample260705-pc65csct2y
- SHA256 4828e9d742c61657b1f19a35ba7598e1be2ce9b7fba23afcc0f4a8d7de64def4
Malware Config
Targets
-
- Target CommunityToolkit.Mvvm.dll
- Size 112KB
- SHA256 e81f937cb4a70645e5106b22cc4972d4009f0527f19efa10eb74115c155fc66b
Score1/10 -
- Target Confluent.Kafka.dll
- Size 249KB
- SHA256 0a5045271d29bb22238ec55019845178534bd2a79967ba345a22390abd325e20
Score1/10 -
- Target LazyCache.dll
- Size 23KB
- SHA256 cf651e1abcfc71695e54bc0b6a9293a377f34a409608a9559e6506f3928d5994
Score1/10 -
- Target LibUpdate.dll
- Size 9KB
- SHA256 41d7c3dfb7b744ba2dc58a6f07b3a9a325f66c598a8e06277bcc56003bda6129
Score1/10 -
- Target MQTTnet.dll
- Size 338KB
- SHA256 74b409fb5524b61f49132abacb335050767b00d49108a2cb6b574d97ce699b40
Score1/10 -
- Target Microsoft.AspNetCore.Connections.Abstractions.dll
- Size 44KB
- SHA256 c659351a57f70fcaecc5fd467a0bbc9d0e89339a5728d73b166e7269ed973568
Score1/10 -
- Target Microsoft.AspNetCore.Http.Connections.Client.dll
- Size 117KB
- SHA256 b771660d3c4e2c878f8ef8a2fc32e63f6fd317bc436eb0df894f1ae69ea78f16
Score1/10 -
- Target Microsoft.AspNetCore.Http.Connections.Common.dll
- Size 30KB
- SHA256 b53c65890a957a4b7e266fc69f866a26ce0ff172eee2ae8babadf1116552b1d4
Score6/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target Microsoft.AspNetCore.SignalR.Client.Core.dll
- Size 206KB
- SHA256 3e433bfb52e400c703849ecd17633cb4bf332351408f7b5c4bc3cd3406252ed4
Score1/10 -
- Target Microsoft.AspNetCore.SignalR.Client.dll
- Size 23KB
- SHA256 a3a7af8700dba48ad12c0d939af13178a9d08cafc858185a1742d62e87ece694
Score1/10 -
- Target Microsoft.AspNetCore.SignalR.Common.dll
- Size 44KB
- SHA256 ac1240627a27e00cab3037409a2bbd40df4d884a89dba0bd6110649388092db2
Score6/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target Microsoft.AspNetCore.SignalR.Protocols.Json.dll
- Size 42KB
- SHA256 39faeb60b15d0c1cc0df2dbf2deb4f646b5828f7b62a5a74919ee283e429c125
Score1/10 -
- Target Microsoft.Bcl.AsyncInterfaces.dll
- Size 25KB
- SHA256 8fdf7184ef57acf0ecb94841dcf7ff2efe482022d394748452c84a3f2ff2ea43
Score6/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target Microsoft.Bcl.TimeProvider.dll
- Size 31KB
- SHA256 1d9ca732b4e2de0896044333b2b3bb57139696398cb1bee6ff33ec035d57e427
Score6/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target Microsoft.Extensions.Caching.Abstractions.dll
- Size 39KB
- SHA256 bc308f1e4e8e7fa1ac72923e6f70feae9b65fe47db5eae64137e712514edb5ca
Score6/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target Microsoft.Extensions.Caching.Memory.dll
- Size 51KB
- SHA256 e444a2dac55c924ee4467ae7ae667278eda9b5d19751fb611e406777fbf096dd
Score1/10