Overview

overview

7

Static

static

5

Application_1451.exe

windows10-2004-x64

7

$PLUGINSDIR/INetC.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...fo.dll

windows10-2004-x64

3

$PLUGINSDI...gs.dll

windows10-2004-x64

3

$PLUGINSDI...ss.dll

windows10-2004-x64

3

Zippex.exe

windows10-2004-x64

1

dragdropfilesdll.dll

windows10-2004-x64

1

pea.exe

windows10-2004-x64

1

res/bin/7z/7z.dll

windows10-2004-x64

1

res/bin/7z/7z.exe

windows10-2004-x64

1

res/bin/7z/7z.exe

windows10-2004-x64

1

res/bin/7z...ux.sfx

windows10-2004-x64

3

res/bin/7z/7zCon.exe

windows10-2004-x64

1

res/bin/7z...li.dll

windows10-2004-x64

1

res/bin/7z...a2.dll

windows10-2004-x64

1

res/bin/7z...rd.dll

windows10-2004-x64

1

res/bin/7z...z4.dll

windows10-2004-x64

1

res/bin/7z...z5.dll

windows10-2004-x64

1

res/bin/7z...td.dll

windows10-2004-x64

1

res/bin/Co...ex.exe

windows10-2004-x64

3

res/bin/arc/Arc.exe

windows10-2004-x64

3

res/bin/ar...ux.sfx

windows10-2004-x64

3

res/bin/ar...ny.exe

windows10-2004-x64

3

res/bin/ar...ss.dll

windows10-2004-x64

3

res/bin/ar...mt.dll

windows10-2004-x64

3

res/bin/ar...er.exe

windows10-2004-x64

3

res/bin/ar...ny.exe

windows10-2004-x64

5

res/bin/ar...rc.exe

windows10-2004-x64

5

res/bin/br...li.exe

windows10-2004-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target
    Application_1451.exe
  • Size 125.4MB
  • Sample260809-k3g6psvaqb
  • SHA256 545325cfcf25de4707792b46dd3df3117df99782898f504f9cc023a2cace41d2
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecutioninstallerupx

Malware Config

Targets

    • Target
      Application_1451.exe
    • Size 125.4MB
    • SHA256 545325cfcf25de4707792b46dd3df3117df99782898f504f9cc023a2cace41d2
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    7/10
    discovery

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1
    • Target
      $PLUGINSDIR/INetC.dll
    • Size 140KB
    • SHA256 eaf793dccf3edd7c1d80b34d693c2f535c89ab5b75001579e20beee8874e7196
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral2
    • Target
      $PLUGINSDIR/System.dll
    • Size 12KB
    • SHA256 8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral3
    • Target
      $PLUGINSDIR/UserInfo.dll
    • Size 4KB
    • SHA256 e0dc3112796dbaa37f25ab54b7fac2fbf791cbc6e36a84fc61c6423b84a3677b
    • MD5 SHA1 SHA512 TLSH
    Score
    3/10
    discovery
    behavioral4
    • Target
      $PLUGINSDIR/nsDialogs.dll
    • Size 9KB
    • SHA256 b1350f487692057c8ffde75dcc55287a52a3272240d4d4912f24464b27551fc0
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral5
    • Target
      $PLUGINSDIR/nsProcess.dll
    • Size 133KB
    • SHA256 f21826feaa3623fd8e26abeaa12447eb1cfb8a3850dbfeac5c78940461954333
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral6
    • Target
      Zippex.exe
    • Size 7.2MB
    • SHA256 879e995719d9b7b9ce08f56799b0a71e0b29ce560986e7a9cdebdcf9c1d7750f
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral7
    • Target
      dragdropfilesdll.dll
    • Size 2.7MB
    • SHA256 e4acd142d36a3a16532c85c9a7ccd50f9abc25721fa35706b16f6ceec565b44c
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral8
    • Target
      pea.exe
    • Size 4.2MB
    • SHA256 8cce1360e7a4ef635d6d2fcc0a130615d8ff5e9339c095e5e7626a95ade42055
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral9
    • Target
      res/bin/7z/7z.dll
    • Size 1.8MB
    • SHA256 bbd705e3b58ca7677c1e9e67473f166a6712da034dcb567d571fbb67507a443f
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral10
    • Target
      res/bin/7z/7z.exe
    • Size 562KB
    • SHA256 4a41aa37786c7eae7451e81c2c97458d5d1ae5a3a8154637a0d5f77adc05e619
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral11
    • Target
      res/bin/7z/7z.sfx
    • Size 424KB
    • SHA256 353a3f6d7cbd06c6f25589df00b40f363e9f597c4edc4ad782f6d6b21f297f09
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral12
    • Target
      res/bin/7z/7zCon.linux.sfx
    • Size 478KB
    • SHA256 c29701887677adc82aaf3f2c55432007b3228f5d05ec3b932e08bfc3ed1a7159
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    execution
    behavioral13
    • Target
      res/bin/7z/7zCon.sfx
    • Size 415KB
    • SHA256 5f5a7f958c8a9cdbf43a8135670a8e389050b5aeb0c0325300f6c08e640aa24b
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral14
    • Target
      res/bin/7z/Codecs/brotli.dll
    • Size 904KB
    • SHA256 eff4866a407d876f722068b2bbf77dfa271ad828b090bc7ec735237ab6bb33f4
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral15
    • Target
      res/bin/7z/Codecs/flzma2.dll
    • Size 282KB
    • SHA256 41b3042c2ad45a6645e34b1ea587e024a0b8721980676ec5fb7cb4763e25004d
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral16
    • Target
      res/bin/7z/Codecs/lizard.dll
    • Size 358KB
    • SHA256 22365eb170af99ee72881d099eff996f2dfaaa5fa6642aea58c5094cc7cd8e97
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral17
    • Target
      res/bin/7z/Codecs/lz4.dll
    • Size 258KB
    • SHA256 f23791027eaab2b6daaab1f4a3f31e8a5afd2340fac0311d1517699be1eac1b2
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral18
    • Target
      res/bin/7z/Codecs/lz5.dll
    • Size 236KB
    • SHA256 3cd81ffe67e4c61ffd7861166841a35fbf8481415319f439e8b2eb09e1339144
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral19
    • Target
      res/bin/7z/Codecs/zstd.dll
    • Size 639KB
    • SHA256 818e8ea81319b719daa09e373132eef287b7c8730500c07fca9d1d3c9e92f9ed
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral20
    • Target
      res/bin/Configure Zippex.exe
    • Size 755KB
    • SHA256 9a3c100297074e8055cb0ffff61d4a0db28cbdca169321471be223f45aab35aa
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discoveryinstaller
    behavioral21
    • Target
      res/bin/arc/Arc.exe
    • Size 3.6MB
    • SHA256 b36b1be0a3c329675af4eece3193f08cf343ede57a6933033bf6004a50ab2a65
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral22
    • Target
      res/bin/arc/arc-tiny.linux.sfx
    • Size 28KB
    • SHA256 4f00384cfc55bbe91c3e2ea9a2a94f63de5ccbb8360141df0e4c4aef30fbd383
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    execution
    behavioral23
    • Target
      res/bin/arc/arc-tiny.sfx
    • Size 127KB
    • SHA256 1229a21e326612de63cb6f7b5b871da2913b9c3e52475763af5fee7ac785022a
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral24
    • Target
      res/bin/arc/facompress.dll
    • Size 355KB
    • SHA256 17a9ffdf381f7a9f6cdfc85b157fc6cf80cd4b45ed8ad43edac73008923501a0
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral25
    • Target
      res/bin/arc/facompress_mt.dll
    • Size 204KB
    • SHA256 7eeb2c50920e30544e2f180b0c39488501372a8f8bd8393bcb095353e9114cde
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral26
    • Target
      res/bin/arc/freearc-installer.sfx
    • Size 465KB
    • SHA256 2143076c94fc6838e2c705e4ac8cfa7f1b9e8b30c247a3ab44707744d2e3209b
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral27
    • Target
      res/bin/arc/freearc-tiny.sfx
    • Size 50KB
    • SHA256 38b6fb72a5bc35b62d89ca835d0a9a719734fbd9f79683c8773156a4a43fe34b
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    5/10
    discoveryupx

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral28
    • Target
      res/bin/arc/freearc.sfx
    • Size 124KB
    • SHA256 df9ef81163ff5c9390f2680aff22148e623af6ac8713612625ed3d2168d2f56b
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    5/10
    discoveryupx

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral29
    • Target
      res/bin/brotli/brotli.exe
    • Size 841KB
    • SHA256 1f91d8f4575482373ad7d3b7bbddbfbedc7e69ed2ee2725ac12d14a13daa624b
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral30

MITRE ATT&CK Enterprise v16

Tasks

static1

installerupx
Score
5/10

behavioral1

discovery
Score
7/10

behavioral2

discovery
Score
3/10

behavioral3

discovery
Score
3/10

behavioral4

discovery
Score
3/10

behavioral5

discovery
Score
3/10

behavioral6

discovery
Score
3/10

behavioral7

Score
1/10

behavioral8

Score
1/10

behavioral9

Score
1/10

behavioral10

Score
1/10

behavioral11

Score
1/10

behavioral12

Score
1/10

behavioral13

execution
Score
3/10

behavioral14

Score
1/10

behavioral15

Score
1/10

behavioral16

Score
1/10

behavioral17

Score
1/10

behavioral18

Score
1/10

behavioral19

Score
1/10

behavioral20

Score
1/10

behavioral21

discoveryinstaller
Score
3/10

behavioral22

discovery
Score
3/10

behavioral23

execution
Score
3/10

behavioral24

discovery
Score
3/10

behavioral25

discovery
Score
3/10

behavioral26

discovery
Score
3/10

behavioral27

discovery
Score
3/10

behavioral28

discoveryupx
Score
5/10

behavioral29

discoveryupx
Score
5/10

behavioral30

Score
1/10