c677e7682051065a40e4ae9e444899465cc088c38cc7ef8c53605d5016c21bf7

Sharing

Copy URL Twitter E-mail

General

Target
c677e7682051065a40e4ae9e444899465cc088c38cc7ef8c53605d5016c21bf7
Size 4.1MB
Sample260810-ffh29s1fne
SHA256 c677e7682051065a40e4ae9e444899465cc088c38cc7ef8c53605d5016c21bf7
MD5 11f082435b4e36f8013574cfc51c8cbd
SHA1 5865dbe30268ae896678af7b71a89492a872b487
SHA512 74fe64921300c432398f563a5169db18fb6f942aefcdc40cba008a5b31c19c5f73ac11f885bbacecb96467f609410d9c816839848b6c6c1c8b8abe5a947b53f2
SSDEEP 98304:7EZOKo4F/ebuaayDJE5g2OpYOdarvaqOKo4F/ebuaa7D0f27rwjPvSMY:7E9/IuEE6fkCw/IuQf2fKvSF
TLSH
T11E16331E45A5243C2C505ABB7AE387F1DAE44D8DCB8328BCCD2BE142A9B715E706435F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Targets

- Target
  DingTalkRevokeMsgPatcher.Control.dll
- Size 604KB
- SHA256 108e31a5d135cbcb3c459121aafdd5e429a49f72303f5decee467ca265c8cf75
- MD5 3fa87023e433bcc92828de23fcfaf69f
- SHA1 e9566347e61c7b307e1912c6483dad0dc78c013c
- SHA512 1a7e3770ac7b579e3caf388611a7a0ef93109592e1147b271cc5cad4f03d03953ee3a86cc5f1e1cc6157edbb1a85eb0ce319e5cea2b8534e09ba88a0feb82f85
- SSDEEP 12288:llOrG4mAKMxR4gKwiJn/ezMsOqBu6a359r:lr47KMxR4L9/ezMB76avr
- TLSH
  T13FD4D02EF2E0CE00D6881F35D6EF862503B2B65AB273E30E2F5451A59C833E69E553D5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  DingTalkRevokeMsgPatcher.Entity.dll
- Size 360KB
- SHA256 c2c9044be19b8f918c1749d898030c54cdc1c4ba3191cc6dddd3676e58c6d3e1
- MD5 44c659e999b88e09b3228e80876d5a73
- SHA1 6ca74ff970407633d3d8f3391c2cb58fb3ce912e
- SHA512 8d60b71abf57f8cd3a9e0af4ccbe5870f76d210fb6a3ec69234d94d00f6c694da616900755326852ff48ce8b1098923be37bea64c253b62da612bfb1294a9260
- SSDEEP 6144:CnpmGyQa8IGxmcDqDSd5lnYVkk5LS3FNYwzftndvVDrW7jBcpk+D:GVN92Sd5lYW0cFpf9dvprEqpd
- TLSH
  T16874AE1EB2B19F40D6942E79D4DB951653E2B483BAB3F31EAE1415D52C033F2AD863D0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  DingTalkRevokeMsgPatcher.IPlugin.dll
- Size 355KB
- SHA256 be5b3ce761140aafcef354a57740e55592a06c4971abba5660096894a47a1e27
- MD5 71ea99d58ec5e71eb4c1690cd866edd6
- SHA1 4b3f932ece13033451229a716f8bc5c7fe8f08ea
- SHA512 644004579da5154436e66d1f4fffb822ad75875dd498dafdd84e130777e6dd604a1d27254ed6ba0c130aa0c5cb7cca8fc7167e5bbcd882cc1b80b62ddeab2b41
- SSDEEP 6144:NxmYvqmigaXPHGP+80YjlVn3Q2gWYPsRx8JA343zh4vE2dai:fm0Mga+zBRgWHRx8JV4tF
- TLSH
  T10274AD1A72E18E10C3582E75D5E30A2057AAF9573373F38D6E58A3A6BE432F08D493D5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  DingTalkRevokeMsgPatcher.exe
- Size 1.1MB
- SHA256 eb66a31c8b717c62259199f48e05aa55f73b971590f700343392de7befff47ad
- MD5 7ff9b71b7d0adcfa1d21149b72456b6e
- SHA1 7ae0d378eef068e897dcf5752e8589b0e37bf60c
- SHA512 c6f93ed1c94c0839a360ed64df22be00d4a0875fbe6bab913b93703d3740419f1aa02a688fb21e641db41c8471df95d1909ed4ce29e45b1a3db484e03336cf82
- SSDEEP 24576:xk70TrcP8H3Jf2wUmKCT4tdW/eOrXxTvV6kt:xkQTAP85fKre8YRbpd6kt
- TLSH
  T16D356D82EE62E9D0EE3E06B26446976883567D7F4AC9245CF4DB36E25C3124D313B84F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  Plugins/DingTalkRevokeMsgPatcher.Control.dll
- Size 604KB
- SHA256 108e31a5d135cbcb3c459121aafdd5e429a49f72303f5decee467ca265c8cf75
- MD5 3fa87023e433bcc92828de23fcfaf69f
- SHA1 e9566347e61c7b307e1912c6483dad0dc78c013c
- SHA512 1a7e3770ac7b579e3caf388611a7a0ef93109592e1147b271cc5cad4f03d03953ee3a86cc5f1e1cc6157edbb1a85eb0ce319e5cea2b8534e09ba88a0feb82f85
- SSDEEP 12288:llOrG4mAKMxR4gKwiJn/ezMsOqBu6a359r:lr47KMxR4L9/ezMB76avr
- TLSH
  T13FD4D02EF2E0CE00D6881F35D6EF862503B2B65AB273E30E2F5451A59C833E69E553D5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  Plugins/DingTalkRevokeMsgPatcher.Entity.dll
- Size 360KB
- SHA256 c2c9044be19b8f918c1749d898030c54cdc1c4ba3191cc6dddd3676e58c6d3e1
- MD5 44c659e999b88e09b3228e80876d5a73
- SHA1 6ca74ff970407633d3d8f3391c2cb58fb3ce912e
- SHA512 8d60b71abf57f8cd3a9e0af4ccbe5870f76d210fb6a3ec69234d94d00f6c694da616900755326852ff48ce8b1098923be37bea64c253b62da612bfb1294a9260
- SSDEEP 6144:CnpmGyQa8IGxmcDqDSd5lnYVkk5LS3FNYwzftndvVDrW7jBcpk+D:GVN92Sd5lYW0cFpf9dvprEqpd
- TLSH
  T16874AE1EB2B19F40D6942E79D4DB951653E2B483BAB3F31EAE1415D52C033F2AD863D0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  Plugins/DingTalkRevokeMsgPatcher.IPlugin.dll
- Size 355KB
- SHA256 be5b3ce761140aafcef354a57740e55592a06c4971abba5660096894a47a1e27
- MD5 71ea99d58ec5e71eb4c1690cd866edd6
- SHA1 4b3f932ece13033451229a716f8bc5c7fe8f08ea
- SHA512 644004579da5154436e66d1f4fffb822ad75875dd498dafdd84e130777e6dd604a1d27254ed6ba0c130aa0c5cb7cca8fc7167e5bbcd882cc1b80b62ddeab2b41
- SSDEEP 6144:NxmYvqmigaXPHGP+80YjlVn3Q2gWYPsRx8JA343zh4vE2dai:fm0Mga+zBRgWHRx8JV4tF
- TLSH
  T10274AD1A72E18E10C3582E75D5E30A2057AAF9573373F38D6E58A3A6BE432F08D493D5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  Plugins/DingTalkRevokeMsgPatcher.Plugin.About.dll
- Size 449KB
- SHA256 ffbcfb9e96b1f973fcee4134307f3114278bf5b8106830bed9de7efa7d0d009a
- MD5 c5beb25facbd27df43c60cdd1e32f823
- SHA1 ab959f4750fbd45c88b50356bad3b6028cf0ca2a
- SHA512 d7d967e25db78cada42fae9b96e9d4347da18612dcaf26a5400ffd2fe421fe30cdbab0c2b79adf077315a0ddb6adffddbfade800c5c2a1d577cba69a390fee9a
- SSDEEP 6144:3KGmIDNjGopwRpi76eZkjZ2CIe/U0bEjit02tF7HNVcpkJ11FazSQVUXgk2Urpy:6fKCoGRU76e/ktdtypkRFa+V
- TLSH
  T11DA4BE2DB6A10F40E7883E35E5A7462417E1A4AB3273E30D3E55179A6E837F1CCE92C5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  Plugins/DingTalkRevokeMsgPatcher.Plugin.Install.dll
- Size 804KB
- SHA256 22e7d5f5fba2adc9fcb87a6fea88f05ea39f10e61f0e4c2c59784fa57d927b47
- MD5 1813b8c63e303f084ca860a080b79308
- SHA1 11ef10257522f779f2a7abfad786567bd9b98ee9
- SHA512 65f74115a1cf37aaa53d50adce15e6502b06ac05ff098528af0be1587a2f767d4f3f51462beb149a297a07dcd4e80eba9aba4e61d37d44255e685663a991506b
- SSDEEP 12288:BZs4aDhKoV75ixWfv30gy7aASprKjddjXcy:B2DN5dv3XmZorKjXMy
- TLSH
  T1E2058180BFFAC324F1FB2F34FA7A952A0835BE569C15D76E4511148E4862E45C836F3A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  Plugins/DingTalkRevokeMsgPatcher.Plugin.Mutex.dll
- Size 369KB
- SHA256 845c315d8df9ab066faa46ae24fc117c64a26aac21f52215df765923db0163fa
- MD5 a8b397968219aa98f1ab8bfc24c0de53
- SHA1 105d01d41879d22020df5a3cf02cab77c204bda6
- SHA512 c0cafaa660a766de04edf92b6e93ac7ea4f9a18fface355c0b32b83d2546ba07983ddb1c55e5222cfd9bb291a8c9e7daa715b52e91f363c42576bc61a906c757
- SSDEEP 6144:qpeKE3F2YrWVgkz9yiknXoRqnBunJE9Pe13oFHk80mSTjbrrSt+5JNvL:q4lIpBtR0BVmcHSTfr2t+5J
- TLSH
  T1E684AE1AF6A05F11D3942E71CD9B8A150BA6F4437637E74E2E6866B67E833F04D813C2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  Plugins/DingTalkRevokeMsgPatcher.Plugin.Recover.dll
- Size 360KB
- SHA256 4149095b5a05726f6870276e339dd6455ec4e969e935c88c8032c281ae4193f3
- MD5 e73a6a49544709ea615ad17f0b843ba7
- SHA1 a27e977085e14d9d12054490af1198286311d727
- SHA512 169ac2a1da769e9327162d6cc4981cdda449b2ac7dee5a7b1ac5cce28c3c3d8679dd15210cea36bb7c346f1d57c042d5e147274c889e02b00a6bfa28d390fb51
- SSDEEP 6144:tEjSspL4jkZEbF9cnq7qgtXbFPrA48uK1viZ6AZlidrGHm/rISrkg:fkqbF9cq+w1TfSUtlhHirhr
- TLSH
  T1DE749D6EB2E18E11C2802EB4C5B7451407A6B6AB77B3F3DD2D6422D66C433F48E457E8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  Plugins/DingTalkRevokeMsgPatcher.Plugin.Update.dll
- Size 361KB
- SHA256 e6133929a76825daf4f02659efe001d78aa96fb863bb12a07c7d3fe6ec65ede8
- MD5 df0b8f7265510b466c332956ab7fa068
- SHA1 3a3eebb8091a0b3111cfad81610c73e3852a205f
- SHA512 d24c5938f73e512e6a9ed91b3687276e7f2e52bf04a6aedbcceeb8953363a418c402a4ed8f41ba4897271cb05aa7b83cd6e856a9c1ab061505945e1d96463c43
- SSDEEP 6144:7x2RQIyXQl7cTnM2MBEZwvIQdLWhncF4+w+c5urL1YhYuyEy/rNKfpvAwwlcp4n:7xPAJcvMKwNGcF4oprLxbwwcp4
- TLSH
  T17474AE19F3D98F01C2942F79E0BB651553BAA58B32B3E75E7E2812957C023F14C8A7C9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  Plugins/ICSharpCode.SharpZipLib.dll
- Size 196KB
- SHA256 40b3d590f95191f3e33e5d00e534fa40f823d9b1bb2a9afe05f139c4e0a3af8d
- MD5 c8164876b6f66616d68387443621510c
- SHA1 7a9df9c25d49690b6a3c451607d311a866b131f4
- SHA512 44a6accc70c312a16d0e533d3287e380997c5e5d610dbeaa14b2dbb5567f2c41253b895c9817ecd96c85d286795bbe6ab35fd2352fddd9d191669a2fb0774bc4
- SSDEEP 3072:hjMibqfQqFyGCDXiW9Pp/+Tl4abpuu201PB1BBXIDwtqSPVINrAfvp1:GibqI59PpOPf201/z7p
- TLSH
  T16E14061967FC4A5BF6EA4BB8E47524A5C3F0B966362ED74E8D8050FF1C127A0C825363
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  吾乐吧软件站.url
- Size 192B
- SHA256 315ad35131f398dceb4d46d0ebd551599b740b145c17380ba289e72cbba688c1
- MD5 17ff5b62e5297abc1020fcb255cc3fd2
- SHA1 5f976f58f00f42d30e7f43391ee1811b5b5fc5e3
- SHA512 36e2f47e625638a8bd67f33268301417f7cecd7420b0ca1ef28b584ac4cbaab49056a6e983e71198a97ecdd6284bc3cc569f18ce3a345b35e86ddd98890fdc39
- TLSH
  T13EC0C07C4708C154D143C4069038FC4CE80F701408F6D4DC1284C8C9CCD0096CC04577
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral27 behavioral28

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28