c4518b3a7320927c6394ba0d0c390a61af3b5872bf26195299cc9771ef801017

Sharing

Copy URL Twitter E-mail

General

Target
22092026_1455_21092026_UTR_8718-9-2026.img.zip
Size 6.5MB
Sample260922-saqldagg73
SHA256 c4518b3a7320927c6394ba0d0c390a61af3b5872bf26195299cc9771ef801017
MD5 d16bb54252f21e0df611b1b7fbb32c8d
SHA1 3b30b94c9f2c6b62ac2bee80113a6b1fc1ce99aa
SHA512 ea3e87a9cb0eac4c0798dcbae2fcf4ac0a316d00c07e4ed82458b92fc649d828be6283892c38c555b2107a0e130e73c47f9e9e67f5f51eb83ee7a047e9563a5e
SSDEEP 196608:e7XEvkizOfBo6hvvruYlJmspZVmbgiYNPP:e32OpowHaYlJmyZ3iEPP
TLSH
T1AF66338634F236BCD2C9AD30134B614AAE2D1ECB7673D6B9D6C4546DB341C824C3E95B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  ARPHADUMP.DLL
- Size 8.7MB
- SHA256 20e11d7e0ca3f756c57558dc95c089a7364f7f86e21201c0a1cf7464e8ff9d56
- MD5 7b35f82012893f82e6cef467e97300ce
- SHA1 cbee4b8ff5240beb740146546b73595af8276e23
- SHA512 208cfa98940f987f268b6ea8df24acdeaf861d3273274d2589ee73d729e2e5562c9880e97b080463c063eab48ab8f5f6a4451055446430b73a8258795ce963c4
- SSDEEP 196608:lEe9s+bzqT+NGm57AofDhZgOZ9KeXZHOf/4O7NADtV6v+ud:KeG+5HAEFGOZ9KEZU7B
- TLSH
  T16E96F1163D4C046BE00A2330CE59A1F8F7AE6C603E7744573AF9FA1ABA33B415E4955B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

backdoor defense_evasion discovery execution rat spyware trojan
- Downloads MZ/PE file
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- DCAgent remote management tool
  DCAgent is part of ManageEngine, a remote administration tool that can be used as a backdoor
  backdoor rat
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral1 behavioral2
- Target
  KBDMLT48.DLL
- Size 7KB
- SHA256 18092b68f4d009b7d9cd721ab10deb27216301e1b4b6cd324acf9beea2ce96f5
- MD5 0025cbb9f5559a57ceb0515ca13ce0bb
- SHA1 3bfecba64e48a6240b2dc92ec882b630fb920a9c
- SHA512 cc264feb59f91ed38dd8eded8f599757390bac6529486d9271a141dbdd2bfbd5a81249a85f1f926f6a5610fb96f69fa46863ac035983b7ee161bfac6238948ce
- SSDEEP 48:S3unweAAgynkYIoaZMVk1jvHRQzuXt8i1+zOkRI//l5zVUNc6szecRKx9QyZWNu1:HN1aZkkJv8Kbku/LyNcbaccHW3VWwYv
- TLSH
  T15AE12141DFF98639F1FFC73458A66A3E75297C1194F3CB6A0080115B186B5019F6AF3A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3
- Target
  UTR_8718-9-2026.EXE
- Size 206KB
- SHA256 b2ee510d0b5012487dee143b459e4e2fcfb758960d3fe7ec4743552bc91be9e2
- MD5 8521949e487368f1708d68ffcc581665
- SHA1 a2c753371ba79eb673ff4987d9044af9c7a1b89b
- SHA512 7722abb534f11dc71ac0797d881eb5c2dee524e19d99c219697efa1037164d92a23a5f098f76e5471f1bcfbcb05b44c497ba85f724267cb70591a448af4358ba
- SSDEEP 6144:UJgVV8K6VGrE8y3CtcKn6yv8zRkDVn5iJg:SGQ8y3CtcoRv6i
- TLSH
  T1CE247C1536D1CC72EAE3083564E8D676597DBA703FA649D7A384033D7E207C12F38A2A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

backdoor defense_evasion discovery dropper execution rat spyware trojan
- Download via BitsAdmin
  dropper
- DCAgent remote management tool
  DCAgent is part of ManageEngine, a remote administration tool that can be used as a backdoor
  backdoor rat
- Modifies file permissions
  discovery
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Downloads MZ/PE file
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops file in System32 directory
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral4 behavioral5
- Target
  UTR_8718-9-2026.docx.lnk
- Size 441B
- SHA256 d3d3929ef17a89a6da0579aae72a42a1041f28a653f9130025dadfb015fc67af
- MD5 6b2267e2d48993186cf772984ca25b80
- SHA1 6ff6215bb15481dc2b521d75cb8cec83ed2e210c
- SHA512 89ff93bd82350433522bfbf1260147c8a67eec710c1f865116fa95ad8eae0ca2a1cfc61932b46620927e313437d46fc847cc80892b917ae14311d5318e17526f
- TLSH
  T12FF0E62C8D547B21D250E175FC8EFA53F6721EC1EAE50F7204C146D9542F113B945F2A
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral6 behavioral7
- Target
  bcrypt.dll
- Size 95KB
- SHA256 f68419d8fd7f39c7fd9367505b5c8b4c562ed07f6e14b8dd9919f70b21a7017e
- MD5 52ec24eac47b68f5e982510d2e90159f
- SHA1 a009c03783c3ed5c71272917ffc1fc652152477e
- SHA512 f174fdf05c0ae2323cdb3f2a29676ea2acda8e0e99a029e2dc4dc102628b93a900c83a4f5f4c14d3e3a02621fed338aeb8eb4761e7981ce2640ec70659bdb4e9
- SSDEEP 1536:6fMKYvyCKlcTiDm/ky+1LmpX4npN7uuodEXyLwndCbd7mMcPN:6dYvZKqTiDmctSonpNSuSECwQd+l
- TLSH
  T1CA936D41B9D848B1EDE1217C21EEB67A677EA3A00B6066C7830467DFAC91BD15F3124F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral8
- Target
  dpmodemx.dll
- Size 8KB
- SHA256 6472e68238639b56ee3e0251cb33fe49ff6bcc9baba4573d50c913660290be0f
- MD5 8e2eee594df35fbcbef1d0bd4739475f
- SHA1 5a9d68f3c2a7452946f763ec6c5e275436131a9b
- SHA512 4882748fd761976c65172f2e223c53f0d2c95f3ade8dce31ef7e23e168c5210944b9c101ab30eaf69cf4aaf4e45f518b6eb668c85102825de90e7cf0b1265cef
- SSDEEP 96:9hGZ64xoCcbQMcy9Emzshq/qHGUhaUls4EW5uWwdbaG:7G3RmQw0sqHGU8UlaW5uWiaG
- TLSH
  T12F02C55AF75446B9FAEE1BB854BE1A27113EB9200FE147D31951120E2CE59C1FC74722
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral9