General
- Target WorkshopDLv2.0.4.7z
- Size 1.0MB
- Sample260823-k92tpazxbt
- SHA256 91c4c9d3be903775878e99c4f17d23904a2a7976ca2368828dfb005059e58fb2
Malware Config
Targets
-
- Target Modules/AdvTray.mfx
- Size 98KB
- SHA256 eab82ab6dae40b99d5170a003d7b406c3e362ca1372fc3567a716c1f2c0807a5
Score3/10 -
- Target Modules/Archive.mfx
- Size 97KB
- SHA256 c75918d99dd8983fff3dc51ea3f28ad7a9da8c84f273e5a20736f227626fb50b
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target Modules/Download.mfx
- Size 24KB
- SHA256 935e69577bd7312b44338538df5ac0b35f0a55b23a660bbb54a2e45f49371ab0
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target Modules/FileReadWrite.mfx
- Size 295KB
- SHA256 22dad1a35a73468156565c97f05658f1342ec85c0b6faacbbb85ae706788c939
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target Modules/Get.mfx
- Size 340KB
- SHA256 791e717345991c4bf183c6450667498a89b59c4e8a5abb52e2751fde63d3ad43
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target Modules/KcBoxA.mfx
- Size 44KB
- SHA256 1cae93696ec030be6317a338c3c8bc4274a53632c03ca60aab0bee59d361a380
Score3/10 -
- Target Modules/KcBoxB.mfx
- Size 40KB
- SHA256 7f129f2a2305fbd396661ef2910ab48346d589f20ebc7eb85249ecce80d307af
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target Modules/KcButton.mfx
- Size 40KB
- SHA256 94cea0df9febe19fc2e1a905bd7df0bdab63797a42a7006f14bc8838003e5a45
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target Modules/PopupMenu.mfx
- Size 28KB
- SHA256 9dcf112c2be2c8e9615fee89f44da81fdce4259b83843822a52774a03e9441d3
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target Modules/ProgressBar.mfx
- Size 25KB
- SHA256 a33dad51bdbc04a76f69944eeeb3415f3d2c5a9dda229ac0caeb0e165c651088
Score3/10 -
- Target Modules/StringTokenizer.mfx
- Size 76KB
- SHA256 d1a0edb43969a1c4621527dfaaf6bbe97e63e9cbb495e615c3292aeb2a5e9ce8
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target Modules/TreeControl.mfx
- Size 52KB
- SHA256 b4a4c2a98c6df42a88ce794f072246eac9acf128ba31d8685b220fb06f210df2
Score3/10 -
- Target Modules/fcFolder.mfx
- Size 120KB
- SHA256 b69d14b730f9d527139719138a336a570127d62a4e27fbb0b9c6bdcde6504a57
Score3/10 -
- Target Modules/gmad.exe
- Size 337KB
- SHA256 861cd764ab2bf9d7c254e7237294c1a5884a23d5badbbf14ba67a2f9751b7b9b
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target Modules/kccombo.mfx
- Size 32KB
- SHA256 046d8726045276064396972fa12421d7d83b7d665d23d118e04a9e94bdcd1c49
Score3/10 -
- Target Modules/kcedit.mfx
- Size 32KB
- SHA256 1fb56c1a5fb313c8c51fead10472566328c9260aacc72aa8dde8d345acf53203
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target Modules/kcfile.mfx
- Size 116KB
- SHA256 7daa995fbf72b941859177b08b2785dc107f1a3deb99f6ab4c675d2b0f03a06b
Score3/10 -
- Target Modules/kcini.mfx
- Size 114KB
- SHA256 d1471b2685d45956c323baa2cab11dfe479eb1021f04e2949f03557527c5fc84
Score3/10 -
- Target Modules/kcinput.mfx
- Size 11KB
- SHA256 63348ec89cf004c64688fadeb78e0a697cfdcac1cd8c599c66a2a5aacb8407a0
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target Modules/kclist.mfx
- Size 32KB
- SHA256 c83bcec56f1666d6871e077cc54d0ee7f6462773c03afbb301b9180a4ad0a31a
Score3/10 -
- Target Modules/kcpop.mfx
- Size 10KB
- SHA256 28726ae556cbe1e2b4995ab135da1bfc72d0bc4e4f56d821e95dab738eed61a6
Score3/10 -
- Target Modules/kcriched.mfx
- Size 52KB
- SHA256 274a7d1e89514f3c9809ac0baa5faeb31820340d7e032479ecd3e6183ad79887
Score3/10 -
- Target Modules/kcwctrl.mfx
- Size 79KB
- SHA256 a0ada42e3a4760097c1c2f98905f12b19de47159543aa21e1c604dbcac7337f2
Score3/10 -
- Target Modules/mmfs2.dll
- Size 510KB
- SHA256 6c9ff6036404e71b0bc2c12bc739eeef0d9200925f5796487af2aa4ef5c5ef97
Score3/10 -
- Target WorkshopDL.exe
- Size 939KB
- SHA256 138c07a2c5ab8f21d45dd7eb982d82544b984a05e813962847738e14f2bf5062
Score6/10-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.