General
- Target CTS setup.zip
- Size 136.9MB
- Sample260816-qeptjaydma
- SHA256 84594b679ec834ed150d4a1167d53e7a1d5e8379266dd6f9fdaee35c8c977aa1
Malware Config
Targets
-
- Target CTS setup.zip
- Size 136.9MB
- SHA256 84594b679ec834ed150d4a1167d53e7a1d5e8379266dd6f9fdaee35c8c977aa1
Score1/10 -
- Target Setup.exe
- Size 137.1MB
- SHA256 f841bd32b70e5df9bcedb886848b68481d56d6c8d044bc8eeb7fb0f4f472d8c1
Score7/10-
Loads dropped DLL
-
- Target $PLUGINSDIR/modern-wizard.bmp
- Size 25KB
- SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
Score1/10 -
- Target AddressBookDBObjectsCreationScript.sql
- Size 13KB
- SHA256 9834ddc70c6c776583d126ed87ee290ed6ecf0cddfdebbce34b4c76b3cdb6493
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target DBCreationScript.sql
- Size 300B
- SHA256 ae2dc9c777d72bf2b3f813e12cb3c819fa5a04fd10d75883cb7e75aa78629ce8
Score3/10 -
- Target Data/Addressbook.dat
- Size 3KB
- SHA256 d5056e587a2260d27b2d516f1c6d2a64a011eee31ce1b4344f868f9a69ec627c
Score3/10 -
- Target Data/Addressbook.version
- Size 4B
- SHA256 8d284220975da66c6cba4a32aaedfa0b897187d86ed9f7a2419c9bd10a103505
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target Data/Global.dat
- Size 17KB
- SHA256 ff428abe4576efc313c6072fe8803955fd12499e49ef0a14a001e9db6b26444c
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target Data/Global.version
- Size 5B
- SHA256 d89d2994c6d535dcef86b8dbc8d969574f0f0f5725790c679ea2c4089192659e
Score3/10 -
- Target Data/Indexes.sql
- Size 553B
- SHA256 4d082299ea6dc4de1035be41ecc9e05e10925dfd5b6703935a850727c3b0c870
Score3/10 -
- Target Data/Local.dat
- Size 2KB
- SHA256 7eb7d12bd33f0140f6a99368f766ee790ec312ac1e3cb4bd2cc84a15b7a8bfa9
Score3/10 -
- Target Data/Local.version
- Size 6B
- SHA256 f9c60617dc64848907cec9b3e8fac3db200a7c2dd406cc0691b36f3a9f8f3819
Score3/10 -
- Target Data/Main.dat
- Size 49KB
- SHA256 a88a25157fb87346df7743566845b52db9bb7397a7e8f48d8e9fed75971e15c3
Score3/10 -
- Target Data/Main.version
- Size 6B
- SHA256 e01bed5384800f061b66025d79f0609b15a34f6fd306be37eb5fcb7c0d9bc6b3
Score3/10 -
- Target Data/RegionA.dat
- Size 19.8MB
- SHA256 18cda20211e41cd5f365312007d879c2769f0f3e0691b774fc375bc6ca1f7891
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target Data/RegionA.version
- Size 6B
- SHA256 dacf2bed952aaed68d7449e6ad3d3ba21bab958c0f08f93a4f65b98c9473a00d
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target Data/RegionB.dat
- Size 15.1MB
- SHA256 80ffefb454c9e7849026f54371538e50688232fe5658977d426c939d2396e0e5
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target Data/RegionB.version
- Size 6B
- SHA256 4e9e25ef6c8e342291e150f747922d05b5304ad5d1b6e4cd588c287902376c8f
Score3/10 -
- Target Data/RegionC.dat
- Size 10.3MB
- SHA256 ba2c52f2d9706c896cd9216fb3d2897f9217af49ea193503d15bcdeb82936f02
Score3/10 -
- Target Data/RegionC.version
- Size 6B
- SHA256 39e8c5070f478968d3a9bd8fe2c802ca7c64a413ee024859883854c3f65bdb50
Score3/10 -
- Target Data/RegionD.dat
- Size 16.6MB
- SHA256 835a48176bc40964619bada0b0866e4bdd2bdfd5fb00cfe825d9e082ba124df1
Score3/10 -
- Target Data/RegionD.version
- Size 6B
- SHA256 18234b145d7aada4d4162db556732201d9635a0fda4c281dc79ed70441c2c262
Score3/10 -
- Target GlobalDBObjectsCreationScript.sql
- Size 5KB
- SHA256 33c279ffeb5c6c0fc28295df71c54650030fc525fca7584bb3dcb5f10e462755
Score3/10 -
- Target LocalDBObjectsCreationScript.sql
- Size 7KB
- SHA256 3e3b8cb9d249308d3e74dea3f82511e0da073ae99789048e35a951775b278f34
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target MainDBObjectsCreationScript.sql
- Size 313KB
- SHA256 3510f9bc9d5e54d8357817f37f0b84eb58766493e154805d19a21d8cda2e1cf4
Score3/10 -
- Target RegionDBObjectsCreationScript.sql
- Size 11KB
- SHA256 d45ff52b041b99cba22a1d5985fca3c8050fbf81de71236b619cccc5542f1a6f
Score3/10 -
- Target UpgradeManager.exe
- Size 9.9MB
- SHA256 2728c51105423e491bd0344fa25043064b540db4449cbbad953b3f2a9ba80862
Score1/10 -
- Target en/ClickToShip.resources.dll
- Size 3.8MB
- SHA256 414a6562e8c0d3a39e2b6fd3c0436303ef9fa9a70fc07b65c67bcd55292dfa33
Score1/10 -
- Target ka/ClickToShip.resources.dll
- Size 3.9MB
- SHA256 93c228b619f86c0f9791eaef34bcca3088d0f0c4a3767bc06a4579b715b92147
Score1/10 -
- Target ru/ClickToShip.resources.dll
- Size 3.9MB
- SHA256 478c1aee079db9e83d4bfa643567e28d04f7172e97f62811b75779ccd4501108
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target tr/ClickToShip.resources.dll
- Size 3.9MB
- SHA256 8b39f16593688c76b21f6445cb055b73055288e72d7da2772cfae66e71520495
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target zh/ClickToShip.resources.dll
- Size 3.8MB
- SHA256 394c124a73880d5af27817ab6cd3be416a225e828d2bc16b54b6cf6446942b10
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.