8b81f28551cfafcebdee48e83eeb09fe7eaed732b2eef9230d22e3386759c038

Sharing

Copy URL Twitter E-mail

General

Target
8b81f28551cfafcebdee48e83eeb09fe7eaed732b2eef9230d22e3386759c038
Size 4.0MB
Sample260709-kc1v5ae18k
SHA256 8b81f28551cfafcebdee48e83eeb09fe7eaed732b2eef9230d22e3386759c038
MD5 57d9701958f135f4031433df6c0b04b1
SHA1 8064ecfedd1ea179603dc993e9b9b184ce1495bf
SHA512 0ef20d1c2f2b4ad583fb55475bc1852db99f6c77f72302d696ba23061198a9340d4fe960d0201f51b202dd1c8889f6fa39d41f058fdd06f78bb423dcdc1203b4
SSDEEP 98304:JEnm9sDrn6BQhEnm9sDUR9OeP+5Q0v6YUetn6BQOzJUrU3os:qmr5mz2lv6Y1CxzJUAv
TLSH
T13D1633D888FE0D13407B9F7F226EE4C38A567EF9B1CC4A97172491D32846257819B7C9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  DingTalkRevokeMsgPatcher.Control.dll
- Size 593KB
- SHA256 cc9f5bbe4ebf60d1b3f5767657990d347495fe3858b87e80a96f6354bac945bf
- MD5 2da8c0f2659356340a97b93a56138ef0
- SHA1 3c4b21fe9c675181b0dfde6b27e1ef54dba59b3d
- SHA512 24c29acade7ba1d2270594fe1956bccd7baab573bb879e43788ca8ce04e128fd1258c859f1fb58ba715fe9b187f0fdf7d9996828ffe128f00efb704a09c3846c
- SSDEEP 12288:K4BYjVe3PhWmbL5dRitnLs22cNhqb2HaO3XIWGDCX42onD:ncA3PhW2es3cPqb7OI8oD
- TLSH
  T15BD4CF2EE9A68F00D6942E31E5F7491447BAE98273B7E38E2E6907931D433F54E423D4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  DingTalkRevokeMsgPatcher.Entity.dll
- Size 355KB
- SHA256 1a60a7fc9a42c474db67063bef24203041c77ce8f9679d28c19a00096a650dec
- MD5 9ef01c2bc996ec9a357d8c26fac2fb96
- SHA1 0ba20852729fdfff6ba548fc14951522aec94511
- SHA512 c239d8091e48061764eaf297fe2b3ab213295b95e7cead1d3831612d9fd33f5f62992127eb32225a210e5dd7eed7b2e8153580e2aa8f7ca341b827fc1183b211
- SSDEEP 6144:oZgpqx9ETKAd8wApVlSGB8NWYAoGSTiJWg8RtlxDWDa6eS:otxyFd8wABbdpoXBg8xJWDa6R
- TLSH
  T1DF74AE9EB6E14F80E2882E74E4E7591117B5B5EB3B37FB0E2E4816856C423F48E453E4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  DingTalkRevokeMsgPatcher.IPlugin.dll
- Size 348KB
- SHA256 421f4df3d1678074afb94167ab7c0486c48cc0b284db97769bdc58c722288e2e
- MD5 948c43c5648cf03571a2ee2c22e1fb1d
- SHA1 710105c5fa558ccca854124712fa33789249334b
- SHA512 d2cc52ec68f9356a9a3b7f810e3e41a43b89cbb26bac5f0704ab5a91c9fa233b00fbd4d44505875ace376487583a36b0ac7a16a984db32b15d9b0735e6f8f4ac
- SSDEEP 6144:MH1ZtwG8xdTcsgpVv5Mm7R1Cbms8K3BR3gS6mv3sGoK8WDp:+w5xdc9pVRZUb/j3hR3z1v
- TLSH
  T16974BF0AB2E14E31D2446F35E0A3562307AEF7533273E78E7E9812996C423F95CA27D5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral5 behavioral6
- Target
  DingTalkRevokeMsgPatcher.exe
- Size 1.1MB
- SHA256 29f8e88c6108eafcc79e525b09a7ae6c1555a58b74e5f59c05c22b8e966195ff
- MD5 93cfbe96f41bd8054b736ba27b94a062
- SHA1 7704427f10d5ec4a98e181981551455400c60012
- SHA512 85e57d424753de90de91236793bebd355af6796d9dd39e36a555ecef38a8b38428cb2ee12ff53230d4d67a346bd11a6a90887baaf40a03f9a575ae41f531135a
- SSDEEP 12288:4h1Lk70Tnvjc18HdPjTiGMtzItRiTubQssW5/oH1URUlBNPICAEeIqh:kk70Trc18HItctRjBD5QH1U8BKl
- TLSH
  T1B1357C82EE62E5D0EE3E06B26446966883963D7F4EC9145CF4DB32E25C7124D323B85F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral7 behavioral8
- Target
  Plugins/DingTalkRevokeMsgPatcher.Control.dll
- Size 593KB
- SHA256 cc9f5bbe4ebf60d1b3f5767657990d347495fe3858b87e80a96f6354bac945bf
- MD5 2da8c0f2659356340a97b93a56138ef0
- SHA1 3c4b21fe9c675181b0dfde6b27e1ef54dba59b3d
- SHA512 24c29acade7ba1d2270594fe1956bccd7baab573bb879e43788ca8ce04e128fd1258c859f1fb58ba715fe9b187f0fdf7d9996828ffe128f00efb704a09c3846c
- SSDEEP 12288:K4BYjVe3PhWmbL5dRitnLs22cNhqb2HaO3XIWGDCX42onD:ncA3PhW2es3cPqb7OI8oD
- TLSH
  T15BD4CF2EE9A68F00D6942E31E5F7491447BAE98273B7E38E2E6907931D433F54E423D4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  Plugins/DingTalkRevokeMsgPatcher.Entity.dll
- Size 355KB
- SHA256 1a60a7fc9a42c474db67063bef24203041c77ce8f9679d28c19a00096a650dec
- MD5 9ef01c2bc996ec9a357d8c26fac2fb96
- SHA1 0ba20852729fdfff6ba548fc14951522aec94511
- SHA512 c239d8091e48061764eaf297fe2b3ab213295b95e7cead1d3831612d9fd33f5f62992127eb32225a210e5dd7eed7b2e8153580e2aa8f7ca341b827fc1183b211
- SSDEEP 6144:oZgpqx9ETKAd8wApVlSGB8NWYAoGSTiJWg8RtlxDWDa6eS:otxyFd8wABbdpoXBg8xJWDa6R
- TLSH
  T1DF74AE9EB6E14F80E2882E74E4E7591117B5B5EB3B37FB0E2E4816856C423F48E453E4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral11 behavioral12
- Target
  Plugins/DingTalkRevokeMsgPatcher.IPlugin.dll
- Size 348KB
- SHA256 421f4df3d1678074afb94167ab7c0486c48cc0b284db97769bdc58c722288e2e
- MD5 948c43c5648cf03571a2ee2c22e1fb1d
- SHA1 710105c5fa558ccca854124712fa33789249334b
- SHA512 d2cc52ec68f9356a9a3b7f810e3e41a43b89cbb26bac5f0704ab5a91c9fa233b00fbd4d44505875ace376487583a36b0ac7a16a984db32b15d9b0735e6f8f4ac
- SSDEEP 6144:MH1ZtwG8xdTcsgpVv5Mm7R1Cbms8K3BR3gS6mv3sGoK8WDp:+w5xdc9pVRZUb/j3hR3z1v
- TLSH
  T16974BF0AB2E14E31D2446F35E0A3562307AEF7533273E78E7E9812996C423F95CA27D5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  Plugins/DingTalkRevokeMsgPatcher.Plugin.About.dll
- Size 444KB
- SHA256 cb1f1dc2527d335220d61305175b785d34da89588ec8fa83328af83ddfdd02f1
- MD5 d731f7614191343b375129ef763a47ef
- SHA1 196c7cb4420880d0626b746a8dfb2a8eee81487f
- SHA512 8fb498c8347085b243d126a9589ea29e8b424b32c366194511b8ad0db47f81a916667b9968bd882ed16ec248960dce42313af4ba5d9e55351f168904a4146a2b
- SSDEEP 12288:3ioOnauJJLeNnqE1heAWYWob8NwdSxkSyi+Wa:34nLJLeNnqEn7W0R0ha
- TLSH
  T19CA4BE2E77A24F42D2683F75D0AF142057F6B95B72B3E30A3F9816912D42BF44D622C9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  Plugins/DingTalkRevokeMsgPatcher.Plugin.Install.dll
- Size 792KB
- SHA256 c5904d2af6b8d6a2acaa0aebce56c4fbce5407c3f2a7d0b18467818320efbc28
- MD5 743c9ac8e6fab22e8b7734e02f09becd
- SHA1 78fd3856dff8d70b26a8c1355b1c5c28519d2a9a
- SHA512 59d89b53d41f215880c4abd7ed6305bf123b7064afca580eb414a5f6d2810fa7417e930499877d3ac797cdcaa6fc697b343beb8711fb31b8ecf9b59542f386a0
- SSDEEP 12288:dJbpKRSrAFg0f2Yfvb6qfrkfYrfk3i+5KU:dJbpKRQAe04qfrCi+5
- TLSH
  T12D053096EBF75218F5B62F31EA7B56060835FEA29D25D21E05241C8F1823F46C876F32
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral17 behavioral18
- Target
  Plugins/DingTalkRevokeMsgPatcher.Plugin.Mutex.dll
- Size 363KB
- SHA256 b916a8ba0f83cf881c9f2bbbdffdd2e772dbb370143f85471a4931363eff9695
- MD5 fdcb99cd135626abd619148ec4c62abe
- SHA1 c37eed0eee0683a7ea7a3d7e333c5512a7ca183b
- SHA512 ff30f3a7e2267184a4958e2fb91afb6875197995b9e602d78399b1dec53c098d811d66f57078ea4a863ce827b65e4824f6fda42bd5c720597ab4ab21fe645a17
- SSDEEP 6144:1AxtMtTb6Qz9yUXM8EifO5QqjtpnrjCca90oBhXXZR5hnJIdILo:uMpS8BObjtpn3FhoB5XbPwILo
- TLSH
  T1F7848C2EB6D04F00D3592F75D4AF852553A9AA4AA233EB0F2F5C179A7D423F18D423C9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  Plugins/DingTalkRevokeMsgPatcher.Plugin.Recover.dll
- Size 357KB
- SHA256 2b5ce5a6bd16ec5d26059a6c106b049e57c0da500387161a655b81e0683cf571
- MD5 477e4866eb694193f9b939ed16879f26
- SHA1 8f1f96936b3c57230aadf15270e5b061a16804e7
- SHA512 955e28485e233c20926e3ad6a12c75b2baaf3f58299598938ba458d337e33ff2a60207f54ebc800ef7a4daf5e9929cd8c06704f85e21a76b0b5267b837eddb9e
- SSDEEP 6144:IyR0NdhYUnQhPd1X7I6sEO8pl/j+TKLdqM1r+LuDwFf:J0hNnQVd1X7zptl4KLZ1nS
- TLSH
  T14C749D0AB6A58F01D3553F35D5E7592503E2A98727B3E70F2E2812A73E437F05C8A6C9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral21 behavioral22
- Target
  Plugins/DingTalkRevokeMsgPatcher.Plugin.Update.dll
- Size 357KB
- SHA256 bbd5bc232de2b09c49a87dd5e0747145fa17f9796baa77e6c3e1e695d4172a64
- MD5 2370cd33364a1ea66b95125002b97d11
- SHA1 cb3d52a5be8447487012be42a2dedc8d7c7dd6fa
- SHA512 efbdfa8e8d762c5f1f99dc4e8c9410d066b8264fd25364d13825d87222aa274c69cc15c9fcd860ff254a5a4472257addf1e6ab2e33c6362751ad85adb6e1bc57
- SSDEEP 6144:aO5k5m9rUqWp7LaEwlNpYfqZVBKuB/IMeOSsvAu1nNBg9p9miNpA:ToFrqPBK6Ir3O3v6nHA
- TLSH
  T18A749E06B6A0DF01D7662F75C2A7951113F2EA9B3373E34A2E5853963E423F48D863C9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral23 behavioral24
- Target
  Plugins/ICSharpCode.SharpZipLib.dll
- Size 196KB
- SHA256 40b3d590f95191f3e33e5d00e534fa40f823d9b1bb2a9afe05f139c4e0a3af8d
- MD5 c8164876b6f66616d68387443621510c
- SHA1 7a9df9c25d49690b6a3c451607d311a866b131f4
- SHA512 44a6accc70c312a16d0e533d3287e380997c5e5d610dbeaa14b2dbb5567f2c41253b895c9817ecd96c85d286795bbe6ab35fd2352fddd9d191669a2fb0774bc4
- SSDEEP 3072:hjMibqfQqFyGCDXiW9Pp/+Tl4abpuu201PB1BBXIDwtqSPVINrAfvp1:GibqI59PpOPf201/z7p
- TLSH
  T16E14061967FC4A5BF6EA4BB8E47524A5C3F0B966362ED74E8D8050FF1C127A0C825363
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral25 behavioral26
- Target
  吾乐吧软件站.url
- Size 192B
- SHA256 315ad35131f398dceb4d46d0ebd551599b740b145c17380ba289e72cbba688c1
- MD5 17ff5b62e5297abc1020fcb255cc3fd2
- SHA1 5f976f58f00f42d30e7f43391ee1811b5b5fc5e3
- SHA512 36e2f47e625638a8bd67f33268301417f7cecd7420b0ca1ef28b584ac4cbaab49056a6e983e71198a97ecdd6284bc3cc569f18ce3a345b35e86ddd98890fdc39
- TLSH
  T13EC0C07C4708C154D143C4069038FC4CE80F701408F6D4DC1284C8C9CCD0096CC04577
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral27 behavioral28

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28