aciddrop | aciddrop[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
aciddrop.zip
Size 196KB
Sample260803-sapdbatthw
SHA256 711826c478c7b16e4800b44ec68489850214003d7993055e833ac19580340ca3
MD5 a49842532f81b2b910b86f48ba92c88f
SHA1 744bab1ada078e52fac72bb50fabfdaece3598d5
SHA512 d84b3a98608b89f29e78d7b72bf2b887f080395db2f0137d763bb54028860b8a7e6cf1a5942da4350f46df13dc5721c433cf3e9dce9063cd3705489f7ba37dc6
SSDEEP 3072:46sXWByKSMmsdavraW4bgwHA4D7znmgDP9OzEN+HLt/6dbXNi/r9XZZ1fda/Hh8A:4Dk5gHhw1njZFZwLtyx9i/r9XF0/HhV
TLSH
T19B1412D447C6AC9EE34DB9F99C6D5B9C154F041EBE104219F94DA2528B08F872BB0737
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

upx aciddrop

Malware Config

Signatures

Family: aciddrop
aciddrop

Detects AcidDrop RAT 1 IoCs

Detects AcidDrop.

resource	yara_rule
static1/unpack001/acid drop.exe	family_aciddrop

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
static1/unpack001/YM11AUTH.DLL	acprotect

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
static1/unpack001/YM11AUTH.DLL	upx

Unsigned PE 4 IoCs

Checks for missing Authenticode signature.

resource
unpack001/ServerChecker3.ocx
unpack001/YM11AUTH.DLL
unpack001/acid drop.exe
unpack001/server.exe

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
unpack001/MSWINSCK.OCX

File Explorer

aciddrop.zip

.zip 196KB
MSWINSCK.OCX

.dll 106KB
ServerChecker3.ocx

.dll 48KB
YM11AUTH.DLL

.dll 44KB
acid drop.exe

.exe 188KB
server.exe

.exe 100KB

aciddrop.zip

SHA256 711826c478c7b16e4800b44ec68489850214003d7993055e833ac19580340ca3
MD5 a49842532f81b2b910b86f48ba92c88f
SHA1 744bab1ada078e52fac72bb50fabfdaece3598d5
SHA512 d84b3a98608b89f29e78d7b72bf2b887f080395db2f0137d763bb54028860b8a7e6cf1a5942da4350f46df13dc5721c433cf3e9dce9063cd3705489f7ba37dc6
SSDEEP 3072:46sXWByKSMmsdavraW4bgwHA4D7znmgDP9OzEN+HLt/6dbXNi/r9XZZ1fda/Hh8A:4Dk5gHhw1njZFZwLtyx9i/r9XF0/HhV
TLSH
T19B1412D447C6AC9EE34DB9F99C6D5B9C154F041EBE104219F94DA2528B08F872BB0737
MD5 SHA1 SHA512 SSDEEP TLSH

MSWINSCK.OCX

IMPHASH 5270274b4ff20c6f050b9c66331e50cb
SHA256 eba048e3a9cb11671d0e3c5a0b243b304d421762361fe24fd5ea08cb66704b09
MD5 3d8fd62d17a44221e07d5c535950449b
SHA1 6c9d2ecdd7c2d1b9660d342e2b95a82229486d27
SHA512 501e22a0f99e18f6405356184506bc5849adc2c1df3bdee71f2b4514ab0e3e36673b4aecbd615d24ebb4be5a28570b2a6f80bd52331edb658f7a5f5a9d686d10
SSDEEP 3072:YXMqLvIP75rTTK/h4KtBfqXKPRPRU6/OYqF3+8/xHvd:YDETTq7xPRU3P9
TLSH
T10CB35B02B3E681B2D6F21B300A361B55EBBABC246D31894F8354764D1D71B95FE3836B
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:4 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

d9:60:de:6d:7c:e6:a3:90:99:b2:e9:d2:b5:8f:f9:db

Digest Algorithm

md5

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=VeriSign Commercial Software Publishers CA+OU=www.verisign.com/repository/RPA Incorp. by Ref.\,LIAB.LTD(c)98+OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Microsoft Corporation,O=VeriSign\, Inc.,L=Internet+L=Redmond,ST=Washington,C=US

Chains

Jan 1, 0001

Minor OS version

Major OS version

Entry point

4932

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED IMAGE_FILE_DLL

PDB paths

wsock32

accept listen inet_ntoa recv WSAGetLastError WSASetLastError select __WSAFDIsSet shutdown ntohs sendto recvfrom connect getsockopt setsockopt getsockname getpeername closesocket WSACancelAsyncRequest gethostbyaddr bind WSAAsyncSelect socket WSAStartup WSACleanup inet_addr WSAAsyncGetHostByName WSAAsyncGetHostByAddr gethostbyname htons gethostname ioctlsocket send

kernel32

lstrlenW GetProcAddress GetModuleFileNameA InitializeCriticalSection HeapFree HeapAlloc GetProcessHeap lstrcpynA lstrcpyA lstrlenA lstrcatA IsBadWritePtr WideCharToMultiByte GetVersion LeaveCriticalSection GetCurrentThreadId EnterCriticalSection LocalFree FormatMessageA GetTickCount MultiByteToWideChar SetLastError GetLocaleInfoA LoadLibraryA DeleteCriticalSection FreeLibrary DisableThreadLibraryCalls lstrcmpA InterlockedDecrement GetFileAttributesA GetWindowsDirectoryA HeapReAlloc InterlockedIncrement lstrcmpiA GetLastError LockResource LoadResource FindResourceA

user32

EndDialog DialogBoxParamA GetActiveWindow MessageBoxA DrawEdge GetDC CharNextA LoadCursorA wsprintfA GetWindowRect SetWindowPos ShowWindow IsDialogMessageA GetWindow GetNextDlgTabItem IsWindowEnabled GetDlgItem IsChild GetKeyState SetParent WinHelpA IsWindowVisible EndPaint GetClientRect BeginPaint SendDlgItemMessageA LoadStringA ClientToScreen OffsetRect EqualRect IntersectRect SetWindowRgn PtInRect MessageBeep LoadBitmapA GetSystemMetrics GetParent CreateDialogIndirectParamA GetDlgItemTextA SetDlgItemInt SendMessageA DefWindowProcA GetWindowLongA DestroyWindow KillTimer SetTimer UnregisterClassA RegisterClassA PeekMessageA PostMessageA SetDlgItemTextA SetFocus GetDlgItemInt MoveWindow SetWindowLongA CreateWindowExA ReleaseDC

ole32

CoTaskMemAlloc CoTaskMemFree CoCreateInstance CreateOleAdviseHolder

advapi32

RegDeleteValueA RegQueryValueA RegOpenKeyA RegQueryValueExA RegEnumKeyExA RegDeleteKeyA RegOpenKeyExA RegCreateKeyExA RegSetValueExA RegCloseKey

oleaut32

SysAllocString VariantChangeType SysAllocStringLen SysStringLen SafeArrayRedim RegisterTypeLi LoadTypeLi UnRegisterTypeLi LoadTypeLibEx OleCreatePropertyFrame LoadRegTypeLi SafeArrayDestroy SafeArrayUnaccessData SetErrorInfo CreateErrorInfo GetErrorInfo SysFreeString SysAllocStringByteLen SafeArrayCreate VariantClear SafeArrayGetUBound SafeArrayGetLBound SysStringByteLen SafeArrayAccessData SafeArrayGetElemsize SafeArrayGetDim VariantInit

gdi32

GetDeviceCaps CreateCompatibleDC CreateRectRgnIndirect GetWindowExtEx GetViewportExtEx DeleteDC DeleteObject GetObjectA LPtoDP SetMapMode SetViewportExtEx SetWindowExtEx SetViewportOrgEx SetWindowOrgEx CreateDCA BitBlt SelectObject

ServerChecker3.ocx

IMPHASH 834219cbb4e0b2c83c823851bc2573de
SHA256 009e1994bc6eb1b2f39641b55ff135a7a82023f8260f305f8e7d6c3215398a35
MD5 251ac9470695a9d141f0a3f673727b2f
SHA1 bcf921363504194eadfa3fd301734c5f0adda46d
SHA512 7bfffaf4a7d397e0950565bb4a9aeccac3ff1272eccd3261a3903597b1c4e76ec54127ac1e0c0c820ca9d48854f02640e207be3bcc07b9f07c73d26c4d934196
SSDEEP 768:Ha8VJIb/dJ7Rrgkd4Cw4EO2Vj4EyrHw0RF1JZcn:Ha8VJIDdJ7eI4Cw4CpMJZcn
TLSH
T16723D632F7CE8457F76902F61AA386ED092A3D919B51C60F624EF34C2F75A840929F17
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5564

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

msvbvm60

__vbaVarSub __vbaStrI2 _CIcos _adj_fptan __vbaStrI4 __vbaVarMove __vbaVarVargNofree __vbaFreeVar __vbaLenBstr __vbaLineInputStr __vbaLateIdCall __vbaStrVarMove __vbaAptOffset __vbaFreeVarList _adj_fdiv_m64 __vbaRaiseEvent __vbaFreeObjList ord516 __vbaStrErrVarCopy _adj_fprem1 ord518 __vbaResume __vbaVarCmpNe __vbaStrCat __vbaLsetFixstr __vbaSetSystemError __vbaHresultCheckObj _adj_fdiv_m32 __vbaVarForInit __vbaExitProc __vbaOnError __vbaObjSet ord595 _adj_fdiv_m16i __vbaObjSetAddref _adj_fdivr_m16i ord598 __vbaVarIndexLoad ord520 __vbaBoolVar __vbaBoolVarNull __vbaRefVarAry _CIsin ord632 __vbaChkstk __vbaFileClose ord526 EVENT_SINK_AddRef __vbaStrCmp __vbaVarTstEq __vbaR4Str __vbaObjVar __vbaI2I4 DllFunctionCall __vbaVarLateMemSt _adj_fpatan __vbaFixstrConstruct __vbaLateIdCallLd __vbaStrR8 EVENT_SINK_Release _CIsqrt __vbaVarAnd EVENT_SINK_QueryInterface __vbaExceptHandler ord711 __vbaStrToUnicode __vbaInputFile __vbaPrintFile _adj_fprem _adj_fdivr_m64 ord607 __vbaI2Str ord608 __vbaFPException __vbaInStrVar __vbaStrVarVal __vbaUbound __vbaVarCat __vbaCheckType ord645 _CIlog __vbaErrorOverflow __vbaFileOpen __vbaInStr __vbaNew2 ord648 __vbaVarLateMemCallLdRf __vbaR8Str ord571 _adj_fdiv_m32i _adj_fdivr_m32i __vbaStrCopy ord573 ord681 __vbaFreeStrList _adj_fdivr_m32 _adj_fdiv_r ord685 ord101 __vbaVarSetVar ord102 __vbaI4Var ord103 ord104 ord105 __vbaLateMemCall __vbaVarAdd __vbaStrToAnsi __vbaVarDup ord613 __vbaCheckTypeVar __vbaVarLateMemCallLd __vbaFpI4 __vbaVarCopy ord617 __vbaLateMemCallLd _CIatan __vbaStrMove ord619 _allmul __vbaLateIdSt _CItan __vbaVarForNext _CIexp __vbaFreeObj __vbaFreeStr ord581

YM11AUTH.DLL

SHA256 681a5eda952c3f1ee46e9367dcf4b88fb905f257e178ef09bd612e71b4c1bcdb
MD5 65b3b82006f849a37e07bac4a3d5cde3
SHA1 5d0b715e888edf378c6a7f5a2693151fc910d76b
SHA512 e0a8248f0a417325e76f43d6e165fedf588c7191ae83c9d5e3e01da701103adba533e2e9cd94abebbefd4e06ea8c5d86c99ab70e85c9a0b18a11cb7e8e9c155a
SSDEEP 768:xTTxyfAhdrEEH93ons8VHHhw/U9RLhp5LBmuaUQNb+cekAruM/XgjQoyvDX:xT1yfedrEUonfVC8PFp5L/6b+cZxKgjg
TLSH
T16123E1556A2989EAC2F36FB1C2A80B76CE14BCED2BF8F3551799C1FC30F16504994B12
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

ACProtect 1.3x - 1.4x DLL software

Detects file using ACProtect software.
UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

128544

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

acid drop.exe

IMPHASH fb87cca630e8e54aee5bda65197a9559
SHA256 b0eb82dad0a54c907da1c3c3e7b830b35a089cf33e511a334cb4264f0c5e3f38
MD5 9a14dd2cad68190f6901f0cd1e462945
SHA1 6b068a8eeb85249ca11dab0c9d89895b9d8591e5
SHA512 bc9139cc5efcd20de49aa67b6501e7b12f28466c974f55511bfa70deea5c38d6a0bf63a0d6a0dafcbf468dc5a0624123787aa20eb0d73d1bfd2d126938189e2f
SSDEEP 3072:tP2h3twh/3/2yJdQkYC62fjNHji5SXsZsEyu6fRWchr:Ah3ryJN7pHji5SXsZVyu6fRWch
TLSH
T14B1419229EBC1982EED31A330BF2DE7556347C8512235F8BA734BB0D1476A82196573F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects AcidDrop RAT

Detects AcidDrop.
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

7088

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

msvbvm60

__vbaVarTstGt __vbaVarSub ord690 __vbaStrI2 _CIcos _adj_fptan __vbaVarMove __vbaVarVargNofree __vbaFreeVar __vbaLineInputStr __vbaLenBstr __vbaLateIdCall __vbaStrVarMove __vbaEnd __vbaFreeVarList __vbaPut3 _adj_fdiv_m64 ord621 __vbaFreeObjList ord516 ord517 _adj_fprem1 ord518 ord519 __vbaStrCat ord660 __vbaSetSystemError __vbaHresultCheckObj ord558 __vbaLenVar _adj_fdiv_m32 __vbaAryVar __vbaAryDestruct __vbaLateMemSt ord593 __vbaExitProc __vbaVarForInit ord300 __vbaFileCloseAll __vbaObjSet ord595 __vbaOnError ord596 _adj_fdiv_m16i ord303 ord597 __vbaObjSetAddref _adj_fdivr_m16i ord304 __vbaVarIndexLoad ord598 ord599 ord306 ord309 __vbaBoolVarNull __vbaVarTstLt _CIsin ord709 ord631 __vbaVargVarMove ord632 __vbaChkstk __vbaFileClose EVENT_SINK_AddRef ord528 __vbaGenerateBoundsError __vbaStrCmp __vbaAryConstruct2 __vbaVarTstEq __vbaI2I4 DllFunctionCall __vbaVarOr __vbaLbound _adj_fpatan __vbaLateIdCallLd __vbaStrR8 EVENT_SINK_Release ord600 __vbaUI1I2 _CIsqrt ord310 __vbaVarAnd EVENT_SINK_QueryInterface __vbaExceptHandler ord312 ord711 ord712 __vbaPrintFile __vbaStrToUnicode ord606 ord713 _adj_fprem _adj_fdivr_m64 ord607 __vbaI2Str ord608 ord609 __vbaFPException __vbaInStrVar __vbaStrVarVal __vbaUbound ord534 __vbaVarCat ord535 __vbaI2Var ord537 _CIlog __vbaErrorOverflow __vbaFileOpen ord648 ord570 __vbaR8Str __vbaNew2 __vbaInStr ord571 _adj_fdiv_m32i _adj_fdivr_m32i ord573 __vbaStrCopy __vbaI4Str __vbaVarNot __vbaFreeStrList _adj_fdivr_m32 _adj_fdiv_r ord685 ord100 __vbaVarTstNe __vbaI4Var ord689 __vbaVarCmpEq ord611 __vbaVarAdd __vbaVarDup __vbaStrToAnsi __vbaFpI2 ord616 __vbaFpI4 __vbaVarCopy ord617 _CIatan __vbaStrMove __vbaAryCopy ord619 ord650 _allmul __vbaLateIdSt _CItan __vbaVarForNext _CIexp __vbaFreeStr __vbaFreeObj ord581

server.exe

IMPHASH 132184ed06193baafc11080792f7be04
SHA256 93ee3bcaf743c81d20a9b67f3b481fd48d4ce895968d7e93cab65ef7a1fa0e75
MD5 52f59906844acc5525c519d0ee4b2947
SHA1 f39b1ddc44904a7b8087b5c3deac0012184ad569
SHA512 53be187be7f11bdbed4f65ba54e15eaa5505dae804473d2db659f9e83bcc8a5755f8268a2c098178cb611dde90730d672774d1305b95df52a887568a23dc352c
SSDEEP 1536:b0q0peCZulxEclzB+eFtNiFC2NyDCUhQDWJIT1gR9xevB9P1j:YlpeCUbESftNaFpwEV
TLSH
T143A3B5DBA640501FF127C5B02EB585AD29D9FD3120629C277B81AE4E397E6D3A4F430B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

7668

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

msvbvm60

__vbaVarSub _CIcos _adj_fptan __vbaVarMove __vbaStrI4 __vbaVarVargNofree __vbaFreeVar __vbaLateIdCall __vbaStrVarMove __vbaLenBstr __vbaPut3 __vbaEnd __vbaFreeVarList _adj_fdiv_m64 __vbaLineInputVar __vbaFreeObjList ord516 ord517 _adj_fprem1 __vbaRecAnsiToUni ord518 ord519 __vbaStrCat __vbaRecDestruct __vbaSetSystemError __vbaHresultCheckObj __vbaNameFile __vbaLenVar _adj_fdiv_m32 __vbaAryVar __vbaAryDestruct __vbaVarForInit __vbaExitProc ord300 ord595 __vbaObjSet __vbaOnError _adj_fdiv_m16i __vbaObjSetAddref _adj_fdivr_m16i __vbaVarIndexLoad ord598 ord306 __vbaRefVarAry __vbaVarTstLt __vbaBoolVarNull _CIsin ord631 ord525 ord632 __vbaChkstk ord526 __vbaFileClose EVENT_SINK_AddRef __vbaGenerateBoundsError ord528 ord529 __vbaGet3 __vbaStrCmp __vbaVarTstEq __vbaObjVar __vbaI2I4 DllFunctionCall __vbaRedimPreserve __vbaLbound _adj_fpatan __vbaLateIdCallLd __vbaRecUniToAnsi EVENT_SINK_Release ord600 __vbaUI1I2 _CIsqrt EVENT_SINK_QueryInterface __vbaVarMul __vbaExceptHandler ord711 __vbaPrintFile __vbaStrToUnicode ord606 _adj_fprem _adj_fdivr_m64 ord607 ord608 __vbaFPException __vbaInStrVar __vbaUbound __vbaStrVarVal __vbaVarCat ord535 __vbaI2Var ord537 ord645 _CIlog __vbaErrorOverflow __vbaFileOpen __vbaInStr __vbaNew2 __vbaVarInt ord571 _adj_fdiv_m32i _adj_fdivr_m32i ord573 __vbaStrCopy __vbaI4Str __vbaVarNot __vbaFreeStrList _adj_fdivr_m32 _adj_fdiv_r ord578 ord685 ord100 __vbaVarTstNe __vbaI4Var __vbaVarCmpEq ord610 __vbaLateMemCall __vbaVarAdd ord612 __vbaStrToAnsi __vbaVarDup ord616 __vbaVarCopy __vbaRecDestructAnsi ord617 _CIatan ord618 __vbaAryCopy __vbaCastObj __vbaStrMove __vbaStrVarCopy ord619 _allmul __vbaLateIdSt _CItan __vbaVarForNext _CIexp __vbaFreeObj __vbaFreeStr ord581

aciddrop.zip

MSWINSCK.OCX

PE Signature issue

wsock32

kernel32

user32

ole32

advapi32

oleaut32

gdi32

generic

ServerChecker3.ocx

msvbvm60

generic

YM11AUTH.DLL

generic

acid drop.exe

msvbvm60

generic

server.exe

msvbvm60

generic