8808c794c24367438f183e4be941876f1d3ecd0c8d2eb43b10d2380841d2283b
- SHA256 8808c794c24367438f183e4be941876f1d3ecd0c8d2eb43b10d2380841d2283b
Behavioral task
behavioral1
Sample
file/Connection.dll
Resource
win10v2004-20260911-en
Behavioral task
behavioral2
Sample
file/Connection.dll
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral3
Sample
file/SignatureExplorer.exe
Resource
win10v2004-20260911-en
Behavioral task
behavioral4
Sample
setup.exe
Resource
win10v2004-20260911-en
Behavioral task
behavioral5
Sample
unbcl.dll
Resource
win10v2004-20260911-en
Behavioral task
behavioral6
Sample
unbcl.dll
Resource
win11ltsc2024-20260911-en
minijunk
https://NanoMatrix.azurewebsites.net
https://QuantumWeave.azurewebsites.net
https://ElementShift.azurewebsites.net
| resource | yara_rule |
|---|---|
| static1/unpack001/file/Connection.dll | family_minijunk_v1 |
Signed PE file loads submitted unsigned PE file, allowing DLL hijacking/sideloading/preloading.
| resource |
|---|
| unpack001/unbcl.dll |
| unpack001/unbcl.dll |
Checks for missing Authenticode signature.
| resource |
|---|
| unpack001/file/Connection.dll |
| unpack001/unbcl.dll |
Detects MiniJunk Backdoor
Unsigned PE
Checks for missing Authenticode signature.
count=165, id=261, version=33145,
count=18, id=260, version=33145,
count=7, id=259, version=33145,
count=10, id=259, version=35403,
count=14, id=260, version=35403,
count=81, id=261, version=35403,
count=3, id=257, version=33145,
count=105, id=1, productName=Unmarked objects,
count=7, id=265, version=35721,
count=1, id=256, version=35721,
count=1, id=255, version=35721,
count=1, id=258, version=35721,
Nov 16, 2024
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=5, id=259, version=33140,
count=21, id=260, version=33140,
count=266, id=1, productName=Unmarked objects,
count=15, id=257, version=33140,
count=7, id=261, version=33140,
count=18, id=264, version=33140,
count=1, id=255, version=33140,
count=1, id=258, version=33140,
Nov 16, 2024
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=5, id=259, version=33140,
count=21, id=260, version=33140,
count=266, id=1, productName=Unmarked objects,
count=15, id=257, version=33140,
count=7, id=261, version=33140,
count=18, id=264, version=33140,
count=1, id=255, version=33140,
count=1, id=258, version=33140,
DLL Hijacking vulnerability
Signed PE file loads submitted unsigned PE file, allowing DLL hijacking/sideloading/preloading.
Unsigned PE
Checks for missing Authenticode signature.
count=140, id=261, version=33145,
count=13, id=260, version=33145,
count=7, id=259, version=33145,
count=10, id=259, version=35403,
count=14, id=260, version=35403,
count=45, id=261, version=35403,
count=11, id=257, version=33145,
count=137, id=1, productName=Unmarked objects,
count=6, id=265, version=35721,
count=1, id=256, version=35721,
count=1, id=255, version=35721,
count=1, id=258, version=35721,