c35e1fb33acd19b8c9a09fbaae29ea970ab1c4bba7d382ddbf95a38a1022bcd2

Sharing

Copy URL Twitter E-mail

General

Target
ss.zip
Size 15KB
Sample260809-wvf48abg75
SHA256 c35e1fb33acd19b8c9a09fbaae29ea970ab1c4bba7d382ddbf95a38a1022bcd2
MD5 3ab4b524cbf30e5bde196925369da5ee
SHA1 129420515bc6357d17bc673e422704ed03d86028
SHA512 b6594af5c481f14535b0dc52fc273faa8af9606fdc985ffb4b969d168e8e91d7a7a112380bd635cd27434650247d4339bb5b9b7b780b68323740c05f44f9aaf1
SSDEEP 384:TPrOHBxkehqAoFYlwjr6yoqa0EqHa1x/6QYZPmbpk:bKJqGwP+UZPmbC
TLSH
T1B9723B17C6EC8D53CD4BF77860CF1982E66CADAC1530BB278D10256F9C96E601F2A369
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  25IDC专用.bat
- Size 1006B
- SHA256 09454f6fac8094b2175249f05f3dba4a07946e0092d8ef790d7194a95787b93e
- MD5 63c0ae3873ba04dd393dde128f3707fa
- SHA1 37d2cb7b973b9020cd8c7308c9c06288395bf0a4
- SHA512 5b5b1dc7921a15431ca4b59b9d8b4fb39118b0afa8e4bf64715b90b07c4be14f1a6f5c919806e1329a2e37476bfb9d9af36abbb0218d0ad4662e6b98cb0b0fb0
- TLSH
  T163115909FD1AC0368C914F08D43E8A39F731B3DE43E7AC0815917E967257647228BE2D
- MD5 SHA1 SHA512 TLSH
Score

7^/10

adware defense_evasion discovery execution spyware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Stops running service(s)
  defense_evasion execution
- Drops file in System32 directory
behavioral1 behavioral2
- Target
  2s.bat
- Size 1KB
- SHA256 9e89aff0f090dda88765e1b8c4856d61ec54769c750454e0f86aaa7b1e033aff
- MD5 10ba6f586dca9fdfa58f8bb18c71a243
- SHA1 44edd479ce4a75ab7257f95480607a97494d5ee2
- SHA512 fc0386b3f1945d0d2a4eb7a7f0c391b854d685625cf4739bda449ca262f6625259faa76d8126b2cba76a1180172fd2c6fa598df513804de5c7ea2e31147388d8
- TLSH
  T111116A05FD1AC0358C914F08D83D8A2CB731B3DE43E7BC0C01912E967697687768AE6D
- MD5 SHA1 SHA512 TLSH
Score

7^/10

adware defense_evasion discovery execution persistence privilege_escalation spyware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Stops running service(s)
  defense_evasion execution
- Drops file in System32 directory
behavioral3 behavioral4
- Target
  33s江西重庆专用.bat
- Size 1018B
- SHA256 22dafbba1f00513ff2d68e3abc5b6aaef91e7447e9edaeb115c574467ce02d3d
- MD5 b2e1c7488c0da9f9073fbfb65a455d53
- SHA1 2923d5827bdc97b3e7721a4d584c772de73800f3
- SHA512 cd923e390d89eae039a0915a5e55ae85077f8ec6bbbcffe6b9123c21cf6b02cacaf303a2f90642822ac8406aa33ec159253795a8cb7c38ed73eab51c7028c631
- TLSH
  T1CD118909BD1AC032CC914F08D83D8A68F731B3DE43E7BC0811912DD17257687328AE2E
- MD5 SHA1 SHA512 TLSH
Score

7^/10

adware defense_evasion discovery execution spyware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Stops running service(s)
  defense_evasion execution
- Drops file in System32 directory
behavioral5 behavioral6
- Target
  33s陕西专用.bat
- Size 993B
- SHA256 345de910062091a5dfa5ac98e110d464c1bd3720737191fadb4c1b6f0756c56b
- MD5 12d2ad08bd47dbb64925d8e72042f9c0
- SHA1 257fe64e1d08806ffc48267bb15df26e3a992a25
- SHA512 24ab189cb877650a03b46addcfea347923cd0f644de8a2c4a2929c30a9838544eac80e667e70eae22f06ceccd70ffb6cbb48288aead505a1d64d3c0266d28c4a
- TLSH
  T16E115609FD1AC0358C914F08D83D8A28B731B3DE43E7BC0811916ED67697647368AE6E
- MD5 SHA1 SHA512 TLSH
Score

7^/10

adware defense_evasion discovery execution spyware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Stops running service(s)
  defense_evasion execution
- Drops file in System32 directory
behavioral7 behavioral8
- Target
  3s.bat
- Size 945B
- SHA256 c47ed14c0e310e1298c8f93f635719963dfab17cec628aef052f4f75b5a23a11
- MD5 4c7c62263c1536c28832d9ec1e20e9e7
- SHA1 48284f3ef246f85b6b9d0d3a0a8a65eafd132374
- SHA512 c352cb28db8e26fe8fbc4f9521fa8a9d04f21ac92d68cc65761937563051650ea2684a0c7a15c9eee891ae8432927f9b320ed1dfe510376a3f2f9efcf16230ad
- TLSH
  T135113409BD1AC0358C914F08D83D8A29B731B3DE43E7AC0811916E967697647368BE2E
- MD5 SHA1 SHA512 TLSH
Score

7^/10

adware defense_evasion discovery execution spyware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Stops running service(s)
  defense_evasion execution
- Drops file in System32 directory
behavioral10 behavioral9
- Target
  9090/25IDC专用.bat
- Size 1011B
- SHA256 a2149dfec61dec144cdeae2b479bdc7f83d5466d4bfa647cfcbedf4fb8e2d250
- MD5 f1b005092facfe0c7218b8d4dd6d3403
- SHA1 685f427fa26657047a4859c68a9ff01768fa29cf
- SHA512 3605d8b233f3b7d03a57cedcddf1049dc16b667a1a0a57516d5fd39cb7b54cbc5c5df44bf8c4336bc1c884fc7e4416c9d72ebd5f22fb16360d480b83497f82cd
- TLSH
  T1D0115909FD1AC0368C914F08D43E8A39F731B3DE43E7AC0815913E967257647228BE2E
- MD5 SHA1 SHA512 TLSH
Score

7^/10

adware defense_evasion discovery execution spyware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Stops running service(s)
  defense_evasion execution
- Drops file in System32 directory
behavioral11 behavioral12
- Target
  9090/2s.bat
- Size 1KB
- SHA256 dc9030cc5201755edcf987f3dee3e7a4137c93bbc050c1d4613bc4b6ce3ba8fc
- MD5 045d93ce5a1f6528a89197e1d99cb98d
- SHA1 d24d2cdb777a3362c8b6af96084bea0872f12f7b
- SHA512 ef4dd4ea16cac3848791eb603c1a1c1160eb50fef10956140340ddbf8b5a3c779487a3698f939e29d165569699cf21bc61a049c1a9ecb3ebbde321869e756754
- TLSH
  T112116A05FD1AC0358C918F08D83D8A2CB731B3DE43E7BC0C01912E967697687768AE6E
- MD5 SHA1 SHA512 TLSH
Score

7^/10

adware defense_evasion discovery execution persistence privilege_escalation spyware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Stops running service(s)
  defense_evasion execution
- Drops file in System32 directory
behavioral13 behavioral14
- Target
  9090/33s江西重庆专用.bat
- Size 1023B
- SHA256 368b183b1d80f74e34b7300d432851409eecca577ff1db71c02957eb7b797584
- MD5 e56c57d3c9584c04a5423b36d5c9da15
- SHA1 eae1ca646e8afbccca4ada8fa3d57c04b17e0ee0
- SHA512 b1a47143797647f5e467abb50fa86a2a6a7d93a99442a1e92b060e36818c035562acbb4a73739ca5d6115c7def388bf3d75dcfbf10614ca4fa9406689ca17e7d
- TLSH
  T1B7116609BD1AC0328CA18F08D83D8A68F731B3DE43E7BC0811912D957256687328AE2E
- MD5 SHA1 SHA512 TLSH
Score

7^/10

adware defense_evasion discovery execution spyware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Stops running service(s)
  defense_evasion execution
- Drops file in System32 directory
behavioral15 behavioral16
- Target
  9090/33s陕西专用.bat
- Size 998B
- SHA256 5723f791e3d18696a2c7b57ee5f5ffdbf5b0053e2d037f189f6a44e9fedf1135
- MD5 d3d2f39c1ad49c82fcff021010545cfd
- SHA1 1700b0fb91ff86cdc9a4fba99286fcddeb47b05d
- SHA512 bade4f40d3fc79f3a2418c8245a9023f0ac212faa98dc61bf6f0f60fd137bd22c3f78ad50dc44872ebcd2abb8a5cfa89ba188cb453910e8691a9f379dd18b775
- TLSH
  T193115609FD1AC0368C914F08D83D8A28B731B3DE43E7BC0811912ED67697647368AE6E
- MD5 SHA1 SHA512 TLSH
Score

7^/10

adware defense_evasion discovery execution spyware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Stops running service(s)
  defense_evasion execution
- Drops file in System32 directory
behavioral17 behavioral18
- Target
  9090/3s.bat
- Size 950B
- SHA256 89f352b18d7c96e8e6b44dcfb2a02eb811b50a1d4f690e811cbec00f3233dc2f
- MD5 0b046d8aaeab77f98caaa0e3b05d2c6a
- SHA1 429fb930a9dfe75d5fccaf3b9cb7e7378e502db1
- SHA512 c85f3bb19e91317066d0d76b8b0f7477094b86ce6a8e2a1b2b021ae79e6a900155c5050464bf92e82b582d9939973b02cccd1bfe5b10bb5bc29d707db52900ea
- TLSH
  T17C113409BD1AC0368C914F08D83D8A29B731B3DE43E7AC0811912E967697647368BE2E
- MD5 SHA1 SHA512 TLSH
Score

7^/10

adware defense_evasion discovery execution spyware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Stops running service(s)
  defense_evasion execution
- Drops file in System32 directory
behavioral19 behavioral20
- Target
  9090/hkre.bat
- Size 21B
- SHA256 c29bf0f7df9e6b5088c6d05faa0e25232a7ccfb66ce979e495128034fb54666e
- MD5 06e26646ec432464764f375ea835dd6b
- SHA1 fab313bf48ca0bf8d6cdbfaa860821cf93366919
- SHA512 2c5258617dd190c452eb0e75a24464d25f6dbbbdc7fd16e7c9b8981d34c7170a1ececc86c16dbee810e0d6632e57aadaf94f31b66afb1cfae90032e916b8c4c4
- MD5 SHA1 SHA512
Score

3^/10

execution
behavioral21 behavioral22
- Target
  9090/kh2d.bat
- Size 21B
- SHA256 e6e323bc5a44b804c28a2bd4492ecb6b029a90bc80eac92f3129309b2d6e088d
- MD5 80655168a63a1f0c32ba2766f8889b61
- SHA1 1759fff9ec634e87680cee4107d71081178192a0
- SHA512 fbb3e5c267f51af9f23fceacc50f33218d9374af995a0d1b3468937bbf87e39ed1a720a6aaee620388fc80f347fc9538fb95e9b5a304633086ec2f9d6ba53eb0
- MD5 SHA1 SHA512
Score

3^/10

execution
behavioral23 behavioral24
- Target
  9090/korea.bat
- Size 950B
- SHA256 89f352b18d7c96e8e6b44dcfb2a02eb811b50a1d4f690e811cbec00f3233dc2f
- MD5 0b046d8aaeab77f98caaa0e3b05d2c6a
- SHA1 429fb930a9dfe75d5fccaf3b9cb7e7378e502db1
- SHA512 c85f3bb19e91317066d0d76b8b0f7477094b86ce6a8e2a1b2b021ae79e6a900155c5050464bf92e82b582d9939973b02cccd1bfe5b10bb5bc29d707db52900ea
- TLSH
  T17C113409BD1AC0368C914F08D83D8A29B731B3DE43E7AC0811912E967697647368BE2E
- MD5 SHA1 SHA512 TLSH
Score

7^/10

adware defense_evasion discovery execution spyware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Stops running service(s)
  defense_evasion execution
- Drops file in System32 directory
behavioral25 behavioral26
- Target
  9090/s2.bat
- Size 1001B
- SHA256 506eebbd67919158ecb9a69bc17e69671cea7647821d4b5b5323f9186f331fc1
- MD5 4e57bae5c836fad5d54676807c716eb2
- SHA1 5a80435e2b89383aee77d69d880a000f5784dae0
- SHA512 4e594110f77c2cda4fa244d237d102c18030894cff0f860632fda7fe0eb00c76b19bb0934f1fdf7b830cfa239fa2b47fd55b365ba0e53a1cf2511903a6ae8fab
- TLSH
  T1DB115905BD1AC0358C914B08D93D8A29B731B3DE43E7BC0C01912D967697687728AE6E
- MD5 SHA1 SHA512 TLSH
Score

7^/10

adware defense_evasion discovery execution persistence privilege_escalation spyware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Stops running service(s)
  defense_evasion execution
- Drops file in System32 directory
behavioral27 behavioral28
- Target
  9090/s3.bat
- Size 948B
- SHA256 63f899f04817be6621aa883b51b8ebfc219df275dc1948cf5c5af1d7cc9e4b14
- MD5 937647181c234b987a94a3d336a08fdc
- SHA1 291186dff09e3a9fc81ab9860ae85b8d7594db0e
- SHA512 388f64a59872c602c55fe82dce919c59147f2d0eab4e32e34e1ae4f8fec0f862c6e9d3480e008ff94535f8737623494b63389eb814a77a6b546949e41a9bd2a6
- TLSH
  T1AD113409BD1AC0368C914F08D83D8A29B731B3DE43E7BC0801912E967697647368BE2E
- MD5 SHA1 SHA512 TLSH
Score

7^/10

adware defense_evasion discovery execution spyware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Stops running service(s)
  defense_evasion execution
- Drops file in System32 directory
behavioral29 behavioral30
- Target
  9090/ss2.bat
- Size 939B
- SHA256 9d87ee00229c8705eee68e5de9dc42110fc062c4483e12bf45c5864be2a1a0e4
- MD5 24fbd3b1033416a500017d9b1730badc
- SHA1 2001c3779dce6d6347924c48dd1a4d25a02b1619
- SHA512 94deb04484a6d684c49dbdd194881e0d276349fa8c4d332bbd440130c5f625353292412012cfc3312b8af22bb473f7692d4ef2e786245c4460f6428d22424c99
- TLSH
  T1B6115708AD1AC031CCA14F08D93C8A2CB731B3DE43F7BC0C41906DA57593687328AE5E
- MD5 SHA1 SHA512 TLSH
Score

7^/10

adware discovery execution persistence privilege_escalation spyware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops file in System32 directory
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

Disables service(s)

Stops running service(s)

Drops file in System32 directory

Checks computer location settings

Disables service(s)

Stops running service(s)

Drops file in System32 directory

Checks computer location settings

Disables service(s)

Stops running service(s)

Drops file in System32 directory

Checks computer location settings

Disables service(s)

Stops running service(s)

Drops file in System32 directory

Checks computer location settings

Disables service(s)

Stops running service(s)

Drops file in System32 directory

Checks computer location settings

Disables service(s)

Stops running service(s)

Drops file in System32 directory

Checks computer location settings

Disables service(s)

Stops running service(s)

Drops file in System32 directory

Checks computer location settings

Disables service(s)

Stops running service(s)

Drops file in System32 directory

Checks computer location settings

Disables service(s)

Stops running service(s)

Drops file in System32 directory

Checks computer location settings

Disables service(s)

Stops running service(s)

Drops file in System32 directory

Checks computer location settings

Disables service(s)

Stops running service(s)

Drops file in System32 directory

Checks computer location settings

Disables service(s)

Stops running service(s)

Drops file in System32 directory

Checks computer location settings

Disables service(s)

Stops running service(s)

Drops file in System32 directory

Checks computer location settings

Drops file in System32 directory

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19