General
- Target droidkit-en-setup.exe
- Size 19.5MB
- Sample260705-pdefqsct4v
- SHA256 ababd93e9650eaa5ee657813bc9e33515dd10acc5a900592bb1ba36b6a3165fa
Malware Config
Targets
-
- Target droidkit-en-setup.exe
- Size 19.5MB
- SHA256 ababd93e9650eaa5ee657813bc9e33515dd10acc5a900592bb1ba36b6a3165fa
Score6/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
- Target $PLUGINSDIR/BgWorker.dll
- Size 2KB
- SHA256 50f735ab8f3473423e6873d628150bbc0777be7b4f6405247cddf22bb00fb6be
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target $PLUGINSDIR/CheckProVs.dll
- Size 7KB
- SHA256 ee7e26894cbf89c93ae4df15bdb12cd9a21f5deacedfa99a01eefe8fa52daec2
Score3/10 -
- Target $PLUGINSDIR/GoogleTracingLib.dll
- Size 36KB
- SHA256 ad873f1e51e6d033e5507235ec735957256ebeeb0d3f22aa0b57bb4bd0846e4c
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target $PLUGINSDIR/System.dll
- Size 11KB
- SHA256 df5ae79fa558dc7af244ec6e53939563b966e7dbd8867e114e928678dbd56e5d
Score3/10 -
- Target $PLUGINSDIR/dotNetFx45_Full_setup.exe
- Size 982KB
- SHA256 e434828818f81e6e1f5955e84caec08662bd154a80b24a71a2eda530d8b2f66a
Score4/10 -
- Target $PLUGINSDIR/msvcp100.dll
- Size 593KB
- SHA256 934d882efd3c0f3f1efbc238ef87708f3879f5bb456d30af62f3368d58b6aa4c
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target $PLUGINSDIR/msvcr100.dll
- Size 809KB
- SHA256 ae3cb6c6afba9a4aa5c85f66023c35338ca579b30326dd02918f9d55259503d5
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target $PLUGINSDIR/nsDui.dll
- Size 10.0MB
- SHA256 3be54dea5aedc0d8d16d6c4bd4e046e2d93bfc550a1a035a94768c2d5901e327
Score3/10 -
- Target $PLUGINSDIR/nsExec.dll
- Size 6KB
- SHA256 193d396fc7be5fed9d585de3c43e23d640c1dce725499f0274b3898c248545aa
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target $PLUGINSDIR/nsProcess.dll
- Size 4KB
- SHA256 30c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11
Score3/10 -
- Target $PLUGINSDIR/nsis7z.dll
- Size 313KB
- SHA256 e4ab3064f2e094910ae80104ef9d371ccb74ebbeeed592582cf099acd83f5fe9
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target $PLUGINSDIR/registry.dll
- Size 24KB
- SHA256 0b25b20f26de5d5bd795f934c70447112b4981343fcb2dfab3374a4018d28c2d
Score3/10 -
- Target $PLUGINSDIR/uninstall.exe
- Size 8.1MB
- SHA256 0623c7e8ec5261965f79e7cc680e2985837e30ec04dbc31b9a348112f9ff80fc
Score6/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
- Target $PLUGINSDIR/BgWorker.dll
- Size 2KB
- SHA256 50f735ab8f3473423e6873d628150bbc0777be7b4f6405247cddf22bb00fb6be
Score3/10 -
- Target $PLUGINSDIR/GoogleTracingLib.dll
- Size 36KB
- SHA256 ad873f1e51e6d033e5507235ec735957256ebeeb0d3f22aa0b57bb4bd0846e4c
Score3/10