9f32ea63018b6217d63d0bf16af0ac237b477e89ce6ffbd7a56575d86a847680

Sharing

Copy URL Twitter E-mail

General

Target
增值税电子发票阅读器.zip
Size 41.8MB
Sample260825-jqthjavtht
SHA256 9f32ea63018b6217d63d0bf16af0ac237b477e89ce6ffbd7a56575d86a847680
MD5 0bc705c66edde3018ba2fa2209a04608
SHA1 59ebdb6e452236a7ce059d2d7423739a5eb2456c
SHA512 451b79c431221a0faea8309e20a9d07d0cb5e2699fb429bd8609dfcb882520acd2f7c56ff4dd977ef00841f1a2ada0293adc84631b191b885277af51d15a80da
SSDEEP 786432:fINRbegs4PEjN9uni05KReLZ1jQs7mbvz2NGtD1IuhwDCNfr0G:g7+yEjai00ReLZqKkiGJ1Iuhdr1
TLSH
T1B7A733FCD0B2262DE925F241E2D9EE2AF357C10379008E3B9FD540F4988647B659CBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  增值税电子发票阅读器（PC安装版）/gjswzjReaderper-3.0.20.0830-setup.exe
- Size 41.9MB
- SHA256 64c208865c75b600548e0eeb11164f4ff3803a9af25f20a692ef4dca5db9e229
- MD5 a7c299857bd7e06b39e75c3fdd1cd79a
- SHA1 8943f80e37b700af13b85671b02c4a263010f3e0
- SHA512 cea4347dd730a154ee8a02f1437ca7c1d9da4f22e29397918db70cd28a7f3d17bdfffa626bdd7c54d83399cf338e0da2615639a25d4adfb2c21ace2688eb9ba8
- SSDEEP 786432:RZZNvrFaGwhO6zptC/Kt7LQ2vdkTDZEJUa60ngNQBZyxdP22IcChO:RZZFROXpk/Kt7LbFY6Fn0eyxd+w
- TLSH
  T1BCA733F8D1B1163EE537F232C2E2EE6DA7D7402678254E334E8500E5A8C756396ACF58
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery execution persistence spyware stealer
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2
- Target
  $PLUGINSDIR/FindProcDLL.dll
- Size 27KB
- SHA256 c1f41ce0fb5ab8f378177c9b9272e69bd9798f7ee5bdb0e793dec03b0d2354db
- MD5 0b2e26e2a17c467d2888033eefcccd50
- SHA1 974f488de4faac0584fb9a65e2ca9e3f49884bb5
- SHA512 55ef17f740162c525966bb52836619e36e17baa442b85dda2295fc230340faa6f37eebb63ec3029814527a7943b1d533001555eaaad9e5442b9455dba75f8023
- SSDEEP 384:jZoRF0XXUuJReQg0Tw67ADWBTgmldIogUD3GLgFmyaX/fVYcWJQCDmrinogRdBl:jZaF0HtTwuz9yu3KgwRX1nWJ1q+noI
- TLSH
  T1D2C26C107C9042B7D28E5671A1E50F075B3F6E512AE65883CF256ADA2D612F0FA3F31B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/StartMenu.dll
- Size 7KB
- SHA256 f8f3c2ee3ba4a9701444c1b8b1807ef93711cf29b8c8464fdf002f1dc01d8ac3
- MD5 478a402693c3aa2250bde4af2f0a1dc3
- SHA1 56f45d0bdb220204eb56bb55c8ca26ad48f2204a
- SHA512 57c6732a0823ea44fd0f2544af1d8624bcf99c18b930ced625a1afcb17827e8f62d5f33a9c3f0a017aea5d6207afbbece99a1440c95fda25c44da7b8fe1d5321
- SSDEEP 96:FFwXEsZNrFAiAYLvl8RxjjLs2Orp2YiDFKIakCT9KNotMQl3QRkv:EXEs0YLvlcjDFxan9my3mo
- TLSH
  T1F0F1EA75E3E041E2F5AB02F434772F0B4B56F520176490B38692558E3AE52E2FE38B23
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/System.dll
- Size 11KB
- SHA256 03cd57ab00236c753e7ddeee8ee1c10839ace7c426769982365531042e1f6f8b
- MD5 959ea64598b9a3e494c00e8fa793be7e
- SHA1 40f284a3b92c2f04b1038def79579d4b3d066ee0
- SHA512 5e765e090f712beffce40c5264674f430b08719940d66e3a4d4a516fd4ade859f7853f614d9d6bbb602780de54e11110d66dbb0f9ca20ef6096ede531f9f6d64
- SSDEEP 192:sRer7uivwq1XpKs4FVWSjMd8tIg2cREbyCsZ8q2R4Sy+Xe:s67Xws4FVWig86/5eCBqSy+Xe
- TLSH
  T1B3322A2657B0D2F2E6A1827408A639336BBA762412B50D1BDFF74481FC15BC67E39327
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 2bee549b2816ba29f81c47778d9e299c3a364b81769e43d5255310c2bd146d6e
- MD5 f7b92b78f1a00a872c8a38f40afa7d65
- SHA1 872522498f69ad49270190c74cf3af28862057f2
- SHA512 3ad6afa6269b48f238b48cf09eeefdef03b58bab4e25282c8c2887b4509856cf5cbb0223fbb06c822fb745aeea000dd1eee878df46ad0ba7f2ef520a7a607f79
- SSDEEP 192:y1zQhZDqlJcKISw99ioU3MSfwLF/+nhHUisdz:ozoZDGKYw9goWyFGBU7z
- TLSH
  T1DB121B626688D5BBD2D1223636A92701DBF97328F0666C05D7B34E467DA42C67E39302
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  $PLUGINSDIR/nsExec.dll
- Size 6KB
- SHA256 8165c7aef7de3d3e0549776535bedc380ad9be7bb85e60ad6436f71528d092af
- MD5 08e9796ca20c5fc5076e3ac05fb5709a
- SHA1 07971d52dcbaa1054060073571ced046347177f7
- SHA512 02618317d6ab0302324aae4d3c5fca56b21e68c899e211cfa9412cf73820a1f931e56753c904fd7e510c638b4463aedbfe9536790279e096ea0387b67013e0c4
- SSDEEP 96:/Uspq2y5jOEEQrhySvUgfj74/vvrTBzfYZA4YF3Telac1nIq/2:/erjOELhySv5f2vvBjiAflaB1nIq
- TLSH
  T116C1F7B656C005F3E40D04B93E31280F87FEE426073242769E9B1ECA19D2AA6FD68751
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  Reader_Pro/GEA30597.dll
- Size 796KB
- SHA256 7145ff8832f33a4588d5e19f55cd8e0289e27f9de3606ad33a9a4c974b3e8add
- MD5 14e5eae15dabb38056ac162170778483
- SHA1 7ff43a4d7da11b139f3340549bff7d7f2a275960
- SHA512 fe8eb655c9c201ae587f9e15a0f5d352d2682299d0ce46884627a17f3eb1e9b146947a2be5195d570f376ddc763abd3573d22c35a1a8dfd219022cabb4b52ea9
- SSDEEP 12288:+JutLujzrCWZ+EKn3ZFGLN3gcz/y7erOAvt3dBd/Rp4czxMKEBVzo4rA4b+N8hsu:Jaz2YHYA8hC6h9fFBIBNLC
- TLSH
  T18505A0A3B5C1D8B3D64F01735077DF3A4E36A51241B9C2C3A7E4EAB64D32681BA2D385
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral13 behavioral14
- Target
  Reader_Pro/GEC30597.dll
- Size 306KB
- SHA256 f15dfbbc2c13c79e9060ecfad9b913cd05db29f215d17dcdbbdb79c06751735b
- MD5 7e63444bdeafb06da0ab3328d3d1f670
- SHA1 f95d180d09f34f95d398ec086f7e9cea2cc9b8eb
- SHA512 1723b6b2254fd3597a1a4aebc76f4d77f7522b5bc0a117e00b9f242853d1d001bf1c3fe5eb6386b6dfbad7c5946ec8bcc49a9ae39e869ee63db9fcb7ec8c3712
- SSDEEP 6144:DvqPSN82qB0IZMZI+nKgwV7FrMWqqDLuq9cWJwI:DvqPM8lHcp07Fraqnuq9cWmI
- TLSH
  T1FF648D2272C1C072C16E1975690AC3B45AFEBC7068B5C947BBD667AD9F30743CA2934B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral15 behavioral16
- Target
  Reader_Pro/OFDInk.dll
- Size 22KB
- SHA256 e638205d5027aa5a7c1e0e5eefae17dc6b7f4b359f99e89c7b3eb635c7f3af85
- MD5 c14dcfba7185f8bdcce8867da97759a2
- SHA1 b2e4fed43af4ed0558768f32a0f3806d4d6298d1
- SHA512 44ba0c65605e3bc2a1d1fa5f35dfbc88263ce83d674b1f9e5c8ad97869a59a7882849a3c2c6ac50e0fdbd01af0778206f39d891f117377e6445c16a51ab482cc
- SSDEEP 384:MUbuNXlpQCnjaW+mBJw8DnKHhTuG1OnhPV5f:5mrQCjaVmBiUUhXOnhd1
- TLSH
  T1D5A20940FF7A51B2D38DA17D076612764422F4A19BE642C3DFDB7E162CB82C35C7928A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral17 behavioral18
- Target
  Reader_Pro/OFDTablet.dll
- Size 45KB
- SHA256 843576ee3ad6ae0908489f2221cce4d139434fb54d8710045255d6411fcf06b8
- MD5 ce9625d3ed330115afb2f8626c536de2
- SHA1 dfc858d35da93185fd67db3f845b2bbd13103d28
- SHA512 dcbe1e1e8e699751db5bcdd7dd416de56040e56751925921c1470a9f8d4892012e6eab1add47f71c308ec36e8a833f979210f7c6638476386d2e9ee26680f92e
- SSDEEP 768:0HkVJu3OOIfv5qsdsHjvMXxfIPhiGtOfhd+D+FULO5kDqKB:0HkSeOI37diHPhpOf6cyqy
- TLSH
  T177232B10B79943F1C68FD171193643A61239B5825BE582F3EBABBF761C722E26C70706
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral19 behavioral20
- Target
  Reader_Pro/QtCore4.dll
- Size 2.5MB
- SHA256 f95ba92c08affc03a8cdcf5fd0651a4ab0033147f3d72609c9912a7fb8480caa
- MD5 39ab4cfd73e692024bcc51681766936c
- SHA1 f19472990a9bfd665bf947d20773d92cb8f1b65c
- SHA512 65ac7b2c27a16a58e4e4cd1e30ce227633be8e8ebb7f7ff5cb4dff370e8d689b46091a29444a2982fc0aa566480c3618fd1ddc82fafe8feda7833668ddf2ce39
- SSDEEP 49152:vNt3iB8mwK6LX/DE4GKJsv6tWKFdu9CAT/LyvL/6mShMZtmjNUVrciV5P+7QVg0M:vn3iawKJsv6tWKFdu9CQ
- TLSH
  T15FC56D81E7EB81F2EAE393B5496F921E413B9A5287104BD7D14C2A031CB56D1BD3B34B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral21 behavioral22
- Target
  Reader_Pro/QtGui4.dll
- Size 8.2MB
- SHA256 beaa9078d9430847a9b282b002ce4ba706ffe426013bfba1c47c15fea87e1fb0
- MD5 987bac907f89421f80d09c50200985b6
- SHA1 f64b9dc42bb538b76131bfb93bf59ba2e1429681
- SHA512 6e443dbdb4ae35df79da9fef45842f6649e6ce31f6e1ac621ece244435c09c0432268981f812259eccbcb4777e5320885c8982f847f594b7116880c35ec06a0f
- SSDEEP 98304:fxNaZQ6UniGwuN9ZXcrF06kUj+9XoMlxhApnsQqrbXnnJ68tNnBkFi8xKi:fxIZQ7t9cP5jQXoMOl8rMV
- TLSH
  T133869E92F78B81F5CE8A61F4295ADB0E852AB1174F274AD3D2DC5E135C306C1BC3A636
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral23 behavioral24
- Target
  Reader_Pro/QtNetwork4.dll
- Size 1.0MB
- SHA256 2d7f56e115cb77067d67d24af27431ac75b979a19e6fa0e12b87afcd4206580d
- MD5 da051416dc20b309dec04c3095de71a3
- SHA1 5289f3a56c6bab189d74ac9ef96d6cf45e14e6df
- SHA512 a729c9284f24898de9272d47e29d114e7f7c0496757ae0042a4c93817bfcb2c91091d6151d7063f7225a0305200ff97f54c0f685b0555280b19ad58b33841bb4
- SSDEEP 24576:KixRX8bN72+YWsi5fZVU82ugkpgU32lhh5di:KEjIhVAugKg0E5di
- TLSH
  T18625291EFB9F8AF5EFC525F54C15DB0A4B3AA90107624ED3E24D2B7A08791C1BD39206
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral25 behavioral26
- Target
  Reader_Pro/QtSvg4.dll
- Size 276KB
- SHA256 dd17639dd960d00ecea56b633cbd05209412bb0f75f3c6a6748665fa9f899de9
- MD5 d22b832024d9692fa3c0a042e55a4491
- SHA1 c4027c6c529744f649e2682a1a13e502bdec8065
- SHA512 39bf431c1b862fa71365f3f496e34bc7d8a5f313b00552f393c94253cb8ff748e1c30d7245c76f9aef122d97d9a2e896f480a040a2150ee88141751e5226fe23
- SSDEEP 6144:cSDy9X6BB0e/xLIQnP8gdcP/TuK/W0uH9SRYoYfza78vYOnYNcK1DvCr6zwI8:fy9X6BuepLIQn0gCTV/PGmwI8
- TLSH
  T144544C41FF5B81B6CA9BB179054FC62B3436A542C77A8BEBD11E6E3708192C1FD39209
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral27 behavioral28
- Target
  Reader_Pro/QtXml4.dll
- Size 353KB
- SHA256 a53f6236086f0971317c5671f5d926c1306767a9c394bef4a421f2caec4f9b13
- MD5 9689ea720343938d97dc2f335ad30f6b
- SHA1 7e10e3ea0e2a29f23592f127e65b3e68e9a10b7c
- SHA512 95d2b5ce3b3252ac61ecebdd43e089a5dc2d1c86b36448b86daaea0d11d115e0aca3eadc4a76c86d6d133f6d017a6a996fb7f8305538c3bf2f15d91a5d0bd21e
- SSDEEP 6144:CraBTdFifYn8ifEPxYjqFZIeWtwkCQ0BOb1hwY:CraBBFSYn8isYjAZpUD6Y
- TLSH
  T1ED7409E2EEABC6F2ED4752340939AA4D402D99551BE58FD3D50C2A9A383E1C3FC35346
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral29 behavioral30
- Target
  Reader_Pro/SKFAPI30597.dll
- Size 125KB
- SHA256 6954f73e92706e946608fa2dd74107906da09c5a74e0ba4e28aa36fbebd45045
- MD5 e1b39e509893f8d29d5661ec3b3fd9a4
- SHA1 f7119d2cc6013f50e0f2f3edc1de99b3586bb404
- SHA512 d21e44ab0ce8c494f74056d99652fc341740f2e95f684f0fd007f384d2447b5650ed96c48067198b9f4388b9ef88d39ec3636fb00c1e8bf0cc759da409ecf17e
- SSDEEP 3072:2AoyC3LtNGjTU8PxaHske2qEhPU3br7j45H29m:2AoTbtmQVhPP29
- TLSH
  T166C35A317A26D032D5AA12784C26D79E693E71969FB080C373B81BEF9F341C15E3A167
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral31 behavioral32