General
- Target Image Custom Tool.exe
- Size 34.8MB
- Sample260913-v79rmatshy
- SHA256 0bd80015924a92f2319cc0962f865e4ddf4e5b1d8df45e0091e8706834d82fc2
Malware Config
Targets
-
- Target Image Custom Tool.exe
- Size 34.8MB
- SHA256 0bd80015924a92f2319cc0962f865e4ddf4e5b1d8df45e0091e8706834d82fc2
Score7/10-
Executes dropped EXE
-
Loads dropped DLL
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
- Target $PLUGINSDIR/BgWorker.dll
- Size 2KB
- SHA256 50f735ab8f3473423e6873d628150bbc0777be7b4f6405247cddf22bb00fb6be
Score3/10 -
- Target $PLUGINSDIR/System.dll
- Size 11KB
- SHA256 7851cb12fa4131f1fee5de390d650ef65cac561279f1cfe70ad16cc9780210af
Score3/10 -
- Target $PLUGINSDIR/nsNiuniuSkin.dll
- Size 896KB
- SHA256 148cb136ff5ae9711ddb869b5f22065ee89e13eaf5081ce39c07dbe89ccd97b7
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target $PLUGINSDIR/nsis7zU.dll
- Size 313KB
- SHA256 e4ab3064f2e094910ae80104ef9d371ccb74ebbeeed592582cf099acd83f5fe9
Score3/10 -
- Target DuiLib.dll
- Size 1.4MB
- SHA256 9c4bc62e98f78fdc51c034a30a7c790428b0cadbb899b23042aa70a67e4f053d
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target HookDLL.dll
- Size 44KB
- SHA256 9ab5e1ccff616db6e9a7d571b1d932953abadf85a489194827aee8326e436b12
Score3/10 -
- Target Image Custom Tool.exe
- Size 3.8MB
- SHA256 5cc64b2ffb0b582535add0410f938d8dffc5d8c6838775d87e0175bb8f0a2dfb
Score3/10 -
- Target SDK/x64/vista/osConfLib.dll
- Size 250KB
- SHA256 20c58530e75179529fc7af38141730cd77815251cb94f5dee296790a0d9ea3b6
Score1/10 -
- Target SDK/x86/vista/osConfLib.dll
- Size 236KB
- SHA256 b3997b03c2f842386af172cb96c2c63af4e5a69dfe07693646e5c23764a52127
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target opencv_ffmpeg320.dll
- Size 15.7MB
- SHA256 c2573fbeb40156436ab64e8bf3df960bb8b237001b7a1402086b9714afb6d72f
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target opencv_world320.dll
- Size 32.8MB
- SHA256 7426a67e2c486b8eca586ef7b3ee0b11e28031a81771baa55036d3e683db76c1
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target opencv_world320d.dll
- Size 48.7MB
- SHA256 a81989b1d7d77b8db2cebe26344dd0fe00aa2bb78ddcb6f11fc70dc3d4a26e43
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target uninst.exe
- Size 906KB
- SHA256 c5aa12f1d574cda59255dbdebe457d9e09349efe8ea63d4c90b56e4f7529f2e4
Score7/10-
Executes dropped EXE
-
Loads dropped DLL
-
- Target $PLUGINSDIR/BgWorker.dll
- Size 2KB
- SHA256 50f735ab8f3473423e6873d628150bbc0777be7b4f6405247cddf22bb00fb6be
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target $PLUGINSDIR/FindProcDLL.dll
- Size 3KB
- SHA256 0fa04f06a6de18d316832086891e9c23ae606d7784d5d5676385839b21ca2758
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.