1229e9423090238d18491ee4e68d85dc11e6b8d3b9da7dad349c0931d3aeb0bf

Sharing

Copy URL Twitter E-mail

General

Target
pingzhu-0.10.2-win-x64.zip
Size 1.9MB
Sample261030-vbksmazxev
SHA256 1229e9423090238d18491ee4e68d85dc11e6b8d3b9da7dad349c0931d3aeb0bf
MD5 2c9ba264281182e5c294754c3b913568
SHA1 bd2f13095327df8cad067ade7660b6aa2cafebe8
SHA512 bc3350337c2cd441fd63809348c2782bae2cce21ed0e86a255a71dc16fdc1413d34419fa5121e0a4719fc0f69a35bb4298523f3e18525b65a44fbbb583d3f278
SSDEEP 49152:aYrIrgutf6mnbypyHT3+6ACdabcR49AzgiDtOk31tJN:arrjtftCqjycR49Asg5JN
TLSH
T19895332F4FB496B015652A6C8A64ECD776240C2B9D0B7E36F690116C22F7DE71F22A07
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  pingzhu-0.10.2-win-x64/install-languagebar.cmd
- Size 1KB
- SHA256 678819cf54827105a7598a3c26c53b4aa5efa568745b4e3fc3276f8e2fa66ebe
- MD5 0afdf153f87fef7378fa894c57f4ebb8
- SHA1 803c928132e219ed56ca9ea6af5b014c94a573f1
- SHA512 cbdeb8551fd04b3a35451696997c2417bf77f35b0d207903c4a156429dc508e816153d74c215e790fc8507eb2ad4a7e8b114290ef85ee15b0bfdfc3c0eb3553d
- TLSH
  T1E8310E17F235E231DEE10A562E3552707B1694FB271A4D1126FB8078B3821CD333A1C6
- MD5 SHA1 SHA512 TLSH
Score

7^/10

adware discovery execution persistence privilege_escalation spyware
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Command and Scripting Interpreter: PowerShell
  Start PowerShell.
  execution
behavioral1 behavioral2
- Target
  pingzhu-0.10.2-win-x64/install.cmd
- Size 494B
- SHA256 ecb310950600f660178b1cf065d4e5d66a237392bcdd5489c822d05a28372cd3
- MD5 3b363b4eac49888026fbfccc309cf4f1
- SHA1 d935c5e9f6c1c46d75afd334f885fbe86c47453b
- SHA512 6cf47a9f402c7c03d8a714af6bfce252db6442ca7092e0fcc3a98041c276890de3ad870649c0ca01d2e9694bfe4cba75c942479db6de124c1cd55eab8c559da2
- TLSH
  T1EFF005063C2663B474D58D061C6E41A4E01951725103D88139B74338BD051D2D5B81D2
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery execution
behavioral3 behavioral4
- Target
  pingzhu-0.10.2-win-x64/install.ps1
- Size 5KB
- SHA256 c7f20663236693c15c25a35e2e07febf546f8689dba03f7e10d0e202f9232a15
- MD5 c2aa085fb654bf35141058e96a9d34b7
- SHA1 a77c525e22eb667754c2c38d65eff7ca12e5de01
- SHA512 8516e4f367c818444c683fc61d6fa59ca0d74de28bad9226554cd814b2d9d14e1c278ff41ba936c21638252cbfdbb274ac7c2126e8265c7c1f57c512958cf06a
- SSDEEP 96:DIB9wit22lVlt00rmNRio+pvpGWRZ9pspUowiHPVA:DIB9/vrmNRUpZRZ9pspUoXA
- TLSH
  T171C1B8256C11166CFAF2C31AA612F646DDD7003FA0411E94B6AC10D9BF7263C8B7F65B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery execution
behavioral5 behavioral6
- Target
  pingzhu-0.10.2-win-x64/pingzhu-engine-test.exe
- Size 32KB
- SHA256 dca79c9eac5a92bc3f53d1049fb5d30f5a497bc10cf7d0bc9b0dfd2b4d847310
- MD5 10c68696095b490c2a4bccb8589b120a
- SHA1 8caadb6df56c7b70b235fe288d22ac520ae8985c
- SHA512 7112effe810de14f56c0090bc8df7dfdd0c73f7263f5179666c59166711a9ed2cd7ebbe19c49c4dffeffbbc035ac11c4c3805638253dc2b171f20aa0afad659b
- SSDEEP 384:fkLjEiAv3Zlp4tHmMhhV8rgelF+NetqAsaZwx+8fQ7h88iYprnX30njfqXS8Iylp:M8Py/48348qMEkdzr3h5ERwHje3q
- TLSH
  T1B8E2093A6B5800BCF166D33FE9735A91E6B1344547A1DBCF0BE111922E672D07C3BA92
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  pingzhu-0.10.2-win-x64/pingzhu-ime.exe
- Size 88KB
- SHA256 4e7cf81b1242628b39c964f5433975a11a0b2b1efc59b14063d92f1b165c7ffb
- MD5 90126e51a2e75359341b7f21f67111e5
- SHA1 dfa4c973d18c9aa710122ac02b4f30ff48b7dc0d
- SHA512 e587d792c540c971a461f22d5d2e9dcb8a09e0420794b329771dedf8cff82e75d62f12dfb491367918ef913d5ae2dcf2cc3a3afc68ef423e2020b15c50d8898e
- SSDEEP 1536:JZH579M64IA/hkO6vxKzGOeC8LJsLKWe89UuEpDzYi+YoMS:v5RM6s/hkOSx4GOn8tsLX9Uzwcoj
- TLSH
  T13D932C26CA15517EF26ACA7DCA524C42EB327C4647D1ABCF0B904CE21E6AAD45F3D303
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  pingzhu-0.10.2-win-x64/pingzhu-regtool.exe
- Size 40KB
- SHA256 569254f86875e8f959b31fcf2c66aff6272189b52dafa8b53aca473de9bf2a33
- MD5 a0d24ffcd1f7b0baad6d8587b74eba08
- SHA1 0886635f4f5fab3c5981e888b4b520f6f7c9ecde
- SHA512 4b7d13370810abeee558a140c096226274edbd100eced7c51a450f40b58a77de98f89f8aa1abf991443ed078f3ebe4d9b360cf28f549c6fc54c0197a6403c888
- SSDEEP 384:GSk4GRPKP5W7js3KxfdD8ICYXxpFmBqP1vpvci7AdjLWyKnS3fV7UrrgcedO2kGd:GNBRPKMko9+VEpV2vXRnAgTSLhXM
- TLSH
  T1FD03A616DD6AA17FD35E8D78CA528C05DE63BCD6CBD1A58F57400CE209B1AE4AB3D302
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  pingzhu-0.10.2-win-x64/pingzhu-router-test.exe
- Size 54KB
- SHA256 2cb458cb797be18655dfbe038272c120e7120fe3bc2f5d22409ddadcca6d6703
- MD5 c574fa8d79ed5ce0fc0bd5cd9041108a
- SHA1 aca24b444bff23b6190de51675b2e6f38f0b7473
- SHA512 3e6c394c212005e58f2cdae877fe334c2e28358978984e7c5b75d09d65a19c4223d891a3aed174cbe2824479fbe2baea31d3a311235330e151f6f35e236457e5
- SSDEEP 768:41DnlGPSFuDJqYpYzYN2CB2mfpyZYkLH8sS3dkS:MWAYNdcZ8J
- TLSH
  T16F430A7ADF1691BAD21E8D74D5130A02DB72BCC64B90B2CF5B916CE60D31AE49B3D702
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral13 behavioral14
- Target
  pingzhu-0.10.2-win-x64/pingzhu-tsf-0.10.2.dll
- Size 110KB
- SHA256 d31194c8174969a9988fd79687d5b1afe9be32ab9a4c345db588b587fa1177e0
- MD5 3e2e73884f4ab1d0861e310fdf6b679f
- SHA1 12e37c4286b4c7b803e1926f9789f2d7bd2b1e42
- SHA512 6f1b6e9ce2eb58113b7e0e1fc128e8661b88415d8a34f326b651f10278df374146035b58b44642a7feebc7ac166b0040248c83767e347a59dd8515dfe43af29d
- SSDEEP 3072:/xvLwbZEtkLMbbQ8nr/i9sULOdGWWdkkwYbKjjgD+:ZvLwdEzbbQ8nrK/LOdGWWPbKjjQ+
- TLSH
  T116B33B17FA15413EF1A5C77CCA938C42DB72788A0791ABCF07904DE65EA67E45F3A202
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery persistence privilege_escalation
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral15 behavioral16
- Target
  pingzhu-0.10.2-win-x64/pingzhu-tsf-test.exe
- Size 55KB
- SHA256 9f2c8a089e9c2079cb3c98ccf6cc7e094b9adae0f1f7cac6e44daa7cbe32f045
- MD5 a200f16dd9d094e10725bb12aad0d7d6
- SHA1 c58e3fe953a1c114fa3be88947669a15fa7de688
- SHA512 d09ad126348b23f82614571c6ea0da4f75ea8819e3ceca346cc4a62d9c274711592ab7d0d206020802b4a6287e9f289a0ef494b71f382636ce17b0c5b7bb6567
- SSDEEP 768:12V5fYAOtkDlREea0Arx2ezetHZXc15RbZF/mucFV/NgLp0YDgP3dx9:12DR/aDrxwH1c15R9ZmuwV/X2Sx
- TLSH
  T164430B29DD56907FE31ACD79CA134C41EE627C8A8BE1A5CF4B900DE20D756E4AF39702
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral17 behavioral18
- Target
  pingzhu-0.10.2-win-x64/pingzhu_core.dll
- Size 355KB
- SHA256 12a3d79272063d71749f446156923d44bb4b5ca6cf33eb6e9e8e074239bae857
- MD5 6f238f46c24459b26b15614e0bafaf5e
- SHA1 ae6cb782183c0bdc2f9ed29aae24650dc6fca2d9
- SHA512 844adb60183a6b4a8f1dad22f9851db246840e8e0bdfca5086526f284d4fee8a63dac5ac9c19c678e12864393b50b680995b8718a6027ab1a51bbe77eb283631
- SSDEEP 6144:s5JQNmcV/QmLSEVdi9zQyXSxXxPvgGce6qijFXEZFlFkY5T:A2yme7rDZxf3
- TLSH
  T12A747C02F55658ADD09BC474432A84636A7170CE1B35ADFF12D982783FADFE25B38368
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral19 behavioral20
- Target
  pingzhu-0.10.2-win-x64/uninstall-languagebar.cmd
- Size 509B
- SHA256 4c84162fb4ecc7f1a8dc772201b15c8088b2747f6e4d3a53c1c03ac1802c3eaa
- MD5 3d5bc81fde1b920f4151e0c4a108f5f8
- SHA1 f354f34fa25edf7b11ec8f8532a11263f17df04a
- SHA512 762a9d68fa80e9910c07728c803a85e76dc0aea1dae5527e7dd54c5d625518bcc6ebe71f778b916657f07e1672a7b8bb2062bdc8539ee7e7a2d66c51954b479d
- TLSH
  T10FF05006B45667B5ACE24E9518B955519959D1D933279E0172BB5030B343246B3381D1
- MD5 SHA1 SHA512 TLSH
Score

5^/10

discovery execution persistence
- Command and Scripting Interpreter: PowerShell
  Start PowerShell.
  execution
behavioral21 behavioral22
- Target
  pingzhu-0.10.2-win-x64/uninstall.cmd
- Size 222B
- SHA256 c3cf321e7f7c2e83077c4b5d0c441abfb3503f5c7247353e242eb32d1c28ab96
- MD5 74d377fb7ac34bc44d662ccacbc9847e
- SHA1 dc082be1ba0f531086bb8cd621c9f2752cf9b4b0
- SHA512 849b1f45f44e9ffd9633025dd9be81a537da34dd635479d82063192f6effee7332985e223e2aecd846f4b37205640bf995636be20b4f3b320e3d1c550d50998f
- TLSH
  T161D0A787741752AD7CE28D121CB69574F44A534303035D45A9B78234780625AE73A192
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery execution
behavioral23 behavioral24
- Target
  pingzhu-0.10.2-win-x64/uninstall.ps1
- Size 1KB
- SHA256 be2fb2d5eee828ee6bd368a94a5d6b8f2f6ecb6eba4f99f850acbf044325fd9c
- MD5 a7330350c805233132e731279a5b9559
- SHA1 ebf1d78475f19be8fcafed0535a739133eb2adb5
- SHA512 844b7cfa8b3cce7c91da380313aca39217880146ae5720cc4e5c1e92d363b2ab310afe62010adc267c7dc21e28b79e5789b4fb2790bf4bc7986d3ade737986c6
- TLSH
  T1A64194341012182EE7FA0B164A063F04EE8F413FA1622E60BD7D80C93F63A3C5725E6A
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery execution
behavioral25 behavioral26

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Event Triggered Execution: Component Object Model Hijacking

Command and Scripting Interpreter: PowerShell

Event Triggered Execution: Component Object Model Hijacking

Command and Scripting Interpreter: PowerShell

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26