General

  • Target
    8808c794c24367438f183e4be941876f1d3ecd0c8d2eb43b10d2380841d2283b
  • Size 1.2MB
  • Sample260923-net25ssdqe
  • SHA256 8808c794c24367438f183e4be941876f1d3ecd0c8d2eb43b10d2380841d2283b
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Extracted

Family
  • minijunk

C2
  • https://NanoMatrix.azurewebsites.net

  • https://QuantumWeave.azurewebsites.net

  • https://ElementShift.azurewebsites.net

Signatures

  • Family: MiniJunk

    MiniJunk is a backdoor deployed by the Iran-linked Nimbus Manticore (UNC1549/TAG-117) threat actor.

  • Detects MiniJunk Backdoor 1 IoCs
  • DLL Hijacking vulnerability 2 IoCs

    Signed PE file loads submitted unsigned PE file, allowing DLL hijacking/sideloading/preloading.

  • Unsigned PE 2 IoCs

    Checks for missing Authenticode signature.

File Explorer

  • 8808c794c24367438f183e4be941876f1d3ecd0c8d2eb43b10d2380841d2283b
    .zip 1.2MB
  • file/Connection.dll
    .dll 2.2MB
  • file/SignatureExplorer.exe
    .exe 249KB
  • setup.exe
    .exe 249KB
  • unbcl.dll
    .dll 812KB

8808c794c24367438f183e4be941876f1d3ecd0c8d2eb43b10d2380841d2283b

  • SHA256 8808c794c24367438f183e4be941876f1d3ecd0c8d2eb43b10d2380841d2283b
  • MD5 SHA1 SHA512 SSDEEP TLSH