9722de39c342d8ca26a195d2d4f25fc5b4b1aaa6f3f0177585f8b8243a0dac4b

Sharing

Copy URL Twitter E-mail

General

Target
pingzhu-0.10.3-win-x64.zip
Size 1.9MB
Sample261030-tecqradt7z
SHA256 9722de39c342d8ca26a195d2d4f25fc5b4b1aaa6f3f0177585f8b8243a0dac4b
MD5 53fe64f0ea7cba3eb55ce1d17235420d
SHA1 37062d4d80b5d1fecff43c576e55c5c3e921d53c
SHA512 6178b78550c459a8fd9edcdc7f9dc7feba3d04ddb7e9a8c5fcb5633b8110b4584165da7d1629efb7ae16b26d81726b3fcdf246495ac369f59d73ba522a940dc2
SSDEEP 49152:CYrIrgutf6mnbypyHT3+6ACdabcR49AzgiDaVPa0v:CrrjtftCqjycR49Asd1v
TLSH
T1E495333E9E7492B05B51216C86AAB49135201D779B1E3F36FAD0107912BBFE63F25B03
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  pingzhu-0.10.3-win-x64/install-languagebar.cmd
- Size 1KB
- SHA256 678819cf54827105a7598a3c26c53b4aa5efa568745b4e3fc3276f8e2fa66ebe
- MD5 0afdf153f87fef7378fa894c57f4ebb8
- SHA1 803c928132e219ed56ca9ea6af5b014c94a573f1
- SHA512 cbdeb8551fd04b3a35451696997c2417bf77f35b0d207903c4a156429dc508e816153d74c215e790fc8507eb2ad4a7e8b114290ef85ee15b0bfdfc3c0eb3553d
- TLSH
  T1E8310E17F235E231DEE10A562E3552707B1694FB271A4D1126FB8078B3821CD333A1C6
- MD5 SHA1 SHA512 TLSH
Score

7^/10

adware discovery execution persistence privilege_escalation spyware
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Command and Scripting Interpreter: PowerShell
  Start PowerShell.
  execution
behavioral1 behavioral2
- Target
  pingzhu-0.10.3-win-x64/install.cmd
- Size 494B
- SHA256 ecb310950600f660178b1cf065d4e5d66a237392bcdd5489c822d05a28372cd3
- MD5 3b363b4eac49888026fbfccc309cf4f1
- SHA1 d935c5e9f6c1c46d75afd334f885fbe86c47453b
- SHA512 6cf47a9f402c7c03d8a714af6bfce252db6442ca7092e0fcc3a98041c276890de3ad870649c0ca01d2e9694bfe4cba75c942479db6de124c1cd55eab8c559da2
- TLSH
  T1EFF005063C2663B474D58D061C6E41A4E01951725103D88139B74338BD051D2D5B81D2
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery execution
behavioral3 behavioral4
- Target
  pingzhu-0.10.3-win-x64/install.ps1
- Size 5KB
- SHA256 c7f20663236693c15c25a35e2e07febf546f8689dba03f7e10d0e202f9232a15
- MD5 c2aa085fb654bf35141058e96a9d34b7
- SHA1 a77c525e22eb667754c2c38d65eff7ca12e5de01
- SHA512 8516e4f367c818444c683fc61d6fa59ca0d74de28bad9226554cd814b2d9d14e1c278ff41ba936c21638252cbfdbb274ac7c2126e8265c7c1f57c512958cf06a
- SSDEEP 96:DIB9wit22lVlt00rmNRio+pvpGWRZ9pspUowiHPVA:DIB9/vrmNRUpZRZ9pspUoXA
- TLSH
  T171C1B8256C11166CFAF2C31AA612F646DDD7003FA0411E94B6AC10D9BF7263C8B7F65B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery execution
behavioral5 behavioral6
- Target
  pingzhu-0.10.3-win-x64/pingzhu-engine-test.exe
- Size 32KB
- SHA256 4b1566b154eeb22a030a2b689cbaabaa227a23f64987f0b6ed546f8dd0967d24
- MD5 1688e2d40015aea66dec81231005105f
- SHA1 fb8616e609dddc18d4c0439d6407a97d2059fcd7
- SHA512 4618b14765998af66262a0aef5ecda7ac8bb3cc77f363d73c383d6daa04f483b3be9c7ef26dc84a82e4807b196fa3bff00303bcb88c21d0053767677eae799bb
- SSDEEP 384:1kLjEiAv3Zlp4tHmMhhV8rgelF+NetqAsaZwx+8fQ7h88iYprnX30njfqXS8IylH:28Py/48348qMEkdzr3h5ERwhje3q
- TLSH
  T111E2082A6B5800BCF166D33FE9735A91E6B1344547A1DBCF0BE111922E672D07C3BA92
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  pingzhu-0.10.3-win-x64/pingzhu-ime.exe
- Size 88KB
- SHA256 6fa7170dd14856b7f7385fb9ff2c58e35d25939e1044bc80850e1d49746efb8d
- MD5 122ed04ac342e58bc81f9475ad0e1874
- SHA1 9fe8dc3ff4a21f343cb06916bfc56b730eff600b
- SHA512 837d1ce8ba81f27b55ec1a14517f72f4eb6f6131bc949de0f2c3d0c2e360e56514171f5ba40ee167a73a4e2ebae2708cac91b3c9bc42c09bc01e8266394e490b
- SSDEEP 1536:cZH579M64IA/hkO6vxKzGOeC8LJsLKWe89UuEpDMYi+YoMS:K5RM6s/hkOSx4GOn8tsLX9UzHcoj
- TLSH
  T1BF932C26CA15517EF26ACA7DCA524C42EB327C4647D1ABCF0B905CE21E6AAD45F3D303
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  pingzhu-0.10.3-win-x64/pingzhu-regtool.exe
- Size 40KB
- SHA256 5ab85531cdde1baa141f3a598eacae1f7e744e72955ca5b5687af571b086fd6e
- MD5 c3b55abdd3a17b6ef64c5ca59ad6de09
- SHA1 f2b626ba61317a5a5d0fec6a1d36807128536ae5
- SHA512 02ba0e64a76f6c8d81203f61b3669cc0fe4530f1c2dd4361836fa4eb8ba91aecdcbd068ea3516aac3568da7f0cafab8a07ac29c2f94e4f702c62f6a4a88953d6
- SSDEEP 384:PSk4GRPKP5W7js3KxfdD8ICYXxpFmBqP1vpvci7AdjLWyKnS3fV7UrrgcedO2kGU:PNBRPKMko9+VEpV2vuRnAgTSLhXM
- TLSH
  T16403A616DD6AA17FD35E8D78CA528C05DE63BCD6CBD1A58F57400CE209B1AE4AB3D302
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  pingzhu-0.10.3-win-x64/pingzhu-router-test.exe
- Size 54KB
- SHA256 258dd2842b0cc9324cae8885a8e3b500c67078dcc4f22a65d2f9a46de829d7b3
- MD5 5ecba1263bc8cd35cc535e52e4de07b6
- SHA1 838694361e72bfd50c0821f12861719521b4faa3
- SHA512 f7ffb5a8fdeee18b22297f5de4dd723167c2c282b3d49b1a913c39c6629f89389ec31a6ab85127936f1034a70a7b50bd0cf74607307438cc0031d32505668ece
- SSDEEP 768:45DnlGPSFuDJqYpYzYN2CB2mfpyZYkLn8sS3dkS:MWAYNdcJ8J
- TLSH
  T1EC430A7ADF1691BAD21E8D74D5130A02DB72BCC64B90B2CF5B916CE60D31AE49B3D702
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral13 behavioral14
- Target
  pingzhu-0.10.3-win-x64/pingzhu-tsf-0.10.2.dll
- Size 110KB
- SHA256 b57ff5b95edb05c2c6748aaad2bd43a93ceb02d74621d3b8ad201b0a5b9c0f5c
- MD5 55a5f1a704bea10308214e3c12683b4a
- SHA1 131c8242dddb1149a6f83b6239041c5258a33743
- SHA512 413dcd87fdb2e9673de13128638000684df4cb60ca7f7a10da005a0a65ffb7e07f166e2e4de4d70a21030cf192651fa95afdb1b931a5249beaceac5393b3def5
- SSDEEP 3072:+xvLwbZEtkLMbbQ8nr/i9sULOdGWWgkkwYbKjjgD+:CvLwdEzbbQ8nrK/LOdGWWmbKjjQ+
- TLSH
  T116B32B17FA15413EF1A5C77CCA938C42DB72788A0791ABCF07904DE65EA67E45F3A202
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery persistence privilege_escalation
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral15 behavioral16
- Target
  pingzhu-0.10.3-win-x64/pingzhu-tsf-test.exe
- Size 55KB
- SHA256 e00fd93b9eeaf955207733bcac19dc69d281672be1663f2128f2923c55f9dd9e
- MD5 28b51d5ccd49fb26f473bac2089c5ab3
- SHA1 ff5c1cc4864e571e8f2afc55fd01bdff8d9d1f11
- SHA512 7ee95fee46c0f491e5d38eaad5d24e38e9bf5e21781e53f8d98587366914ae84ba850b66339fac07b87c67f95ff4c42bb5017f84492f1134edfafcdc055b8d72
- SSDEEP 768:92V5fYAOtkDlREea0Arx2ezetHZXc15RbZF/mucFV/N0Lp0YDgP3dx9:92DR/aDrxwH1c15R9ZmuwV/L2Sx
- TLSH
  T1BF430B29DD56907FE31ACD79CA134C41EE627C8A8BE1A5CF4B900DE20D756E4AF39702
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral17 behavioral18
- Target
  pingzhu-0.10.3-win-x64/pingzhu_core.dll
- Size 356KB
- SHA256 546515da39ea3427a3626febc0cff69a28a7da28f018ce32a8a30d088a94b557
- MD5 16791d62bbe122bbd95a5d3d69f20d1e
- SHA1 472a309edfa3c60de6cab72ac550d4db24445aa6
- SHA512 86308ddcb35d1b384d19c814ff45959d6fc774452d291261e04234c1bdfb6856800d18cc1f0e99d5e7031df1a750bd41355a0a14f249fce78ba5d8b0b9c8d37a
- SSDEEP 6144:WJFyi5ZEXFrNCTNO3pYu8EjlYshiHYPUQ8RdyDOfQdOJvd:CF/0C5cDz32
- TLSH
  T10D746B13F556586CD00AC478432A85A26A7270CE1B29BDFF12D581783FADFE16F38369
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral19 behavioral20
- Target
  pingzhu-0.10.3-win-x64/uninstall-languagebar.cmd
- Size 509B
- SHA256 4c84162fb4ecc7f1a8dc772201b15c8088b2747f6e4d3a53c1c03ac1802c3eaa
- MD5 3d5bc81fde1b920f4151e0c4a108f5f8
- SHA1 f354f34fa25edf7b11ec8f8532a11263f17df04a
- SHA512 762a9d68fa80e9910c07728c803a85e76dc0aea1dae5527e7dd54c5d625518bcc6ebe71f778b916657f07e1672a7b8bb2062bdc8539ee7e7a2d66c51954b479d
- TLSH
  T10FF05006B45667B5ACE24E9518B955519959D1D933279E0172BB5030B343246B3381D1
- MD5 SHA1 SHA512 TLSH
Score

5^/10

discovery execution persistence
- Command and Scripting Interpreter: PowerShell
  Start PowerShell.
  execution
behavioral21 behavioral22
- Target
  pingzhu-0.10.3-win-x64/uninstall.cmd
- Size 222B
- SHA256 c3cf321e7f7c2e83077c4b5d0c441abfb3503f5c7247353e242eb32d1c28ab96
- MD5 74d377fb7ac34bc44d662ccacbc9847e
- SHA1 dc082be1ba0f531086bb8cd621c9f2752cf9b4b0
- SHA512 849b1f45f44e9ffd9633025dd9be81a537da34dd635479d82063192f6effee7332985e223e2aecd846f4b37205640bf995636be20b4f3b320e3d1c550d50998f
- TLSH
  T161D0A787741752AD7CE28D121CB69574F44A534303035D45A9B78234780625AE73A192
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery execution
behavioral23 behavioral24
- Target
  pingzhu-0.10.3-win-x64/uninstall.ps1
- Size 1KB
- SHA256 be2fb2d5eee828ee6bd368a94a5d6b8f2f6ecb6eba4f99f850acbf044325fd9c
- MD5 a7330350c805233132e731279a5b9559
- SHA1 ebf1d78475f19be8fcafed0535a739133eb2adb5
- SHA512 844b7cfa8b3cce7c91da380313aca39217880146ae5720cc4e5c1e92d363b2ab310afe62010adc267c7dc21e28b79e5789b4fb2790bf4bc7986d3ade737986c6
- TLSH
  T1A64194341012182EE7FA0B164A063F04EE8F413FA1622E60BD7D80C93F63A3C5725E6A
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery execution
behavioral25 behavioral26

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Event Triggered Execution: Component Object Model Hijacking

Command and Scripting Interpreter: PowerShell

Event Triggered Execution: Component Object Model Hijacking

Command and Scripting Interpreter: PowerShell

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26