MAR-10135536.r21.v3 Malware Characterization //node() | //@* This document is marked TLP:WHITE--Disclosure is not limited. Sources may use TLP:WHITE when information carries minimal or no foreseeable risk of misuse, in accordance with applicable rules and procedures for public release. Subject to standard copyright rules, TLP:WHITE information may be distributed without restriction. For more information on the Traffic Light Protocol (TLP), see http://www.us-cert.gov/tlp. US-CERT 2019-09-06T09:01:42-04:00 BMachine 161 7.1.0 8d9123cd2648020292b5c35edc9ae22e 1422336 PE32 executable (GUI) Intel 80386, for MS Windows MD5 8d9123cd2648020292b5c35edc9ae22e SHA1 0939363ff55d914e92635e5f693099fb28047602 SHA256 a1260fd3e9221d1bc5b9ece6e7a5a98669c79e124453f2ac58625085759ed3bb SHA512 646697e3d5146e05a221183f6c9f00f5eb38400ef9a2f83bfd0fcf2f8af1a7efff99c0a3486740c745ce6cf0939c4f0678cb818cbbff8ed2b28a703fe8d823bb SSDEEP 24576:HsO8RKL6OLnWZGFbHq0aMow5Q3gkD/74tU3hYPgP5IyrMsEOhVRpxHkADUHEPbzJ:0KjKHMbO3pkoBIyIstVRpxHL1bF Microsoft Visual C++ ?.? 6.703195 6 2018-09-29 11:55:36-04:00 1024 MD5 08bb17d8e839e7fc92426e813a696e73 2.590786 .text 983040 6.595856 MD5 6c3daca3c522ab98a8ac12a45087297c .rdata 340480 6.187858 MD5 3d3d7962d16652002018640a3fa27d44 .data 37888 4.714377 MD5 b7f382ea7e6c9c8e737cb92551341e64 .rsrc 512 5.112624 MD5 871fb8486e5ea3307ff7b65ddf46518a .reloc 59392 6.015022 MD5 382715f8e776a544bf70f843a52e3ff2 Characterized_By Characterized_By Characterized_By Characterized_By Characterized_By Characterized_By Characterized_By Figure 1 Figure 2 Figure 3 Figure 4 Figure 5 Figure 6 Figure 7 0BA6BB2AD05D86207B5303657E3F6874 1436160 PE32 executable (GUI) Intel 80386, for MS Windows MD5 0ba6bb2ad05d86207b5303657e3f6874 SHA1 ad44567c8709df4889d381a0a64cc4b49e5004c3 SHA256 7cf5d86cc75cd8f0e22e35213a9c051b740bd4667d9879a446f06277782bffd1 SHA512 cce39d397a661a5b1c7504f4001e1683231b4d8fb77499102c06532b3ec38f775e544493166e75076460f444b27a15a1ab68237ceb26454b934ee6020c2b0e16 SSDEEP 24576:NUPhrrn8YtZM9hjGMjxyK9Ws/6oYJt1wY2ZJIZ7IOAZSRpxtwQDCbzEG:qKjGMjQcGsw7IFSRpxtnDCbF Microsoft Visual C++ ?.? 6.704631 6 2018-11-14 20:15:34-05:00 1024 MD5 a781fcd65f93beca71b7b94c3a82ba84 2.613318 .text 996352 6.592977 MD5 b081ec452c4927cbc91e8d5d36e75eeb .rdata 340992 6.19619 MD5 131c905ab5153076e77c057bedabcb0d .data 37888 4.740711 MD5 7261cf1375f63e279189afc08b5486f4 .rsrc 512 5.112624 MD5 bef352ccee242ff585187966059808aa .reloc 59392 6.065172 MD5 39f472191c636cf6112a68713b5e6114 hidden_cobra_consolidated.yara: electricfish Malware Artifacts MD5 8d9123cd2648020292b5c35edc9ae22e SHA1 0939363ff55d914e92635e5f693099fb28047602 SHA256 a1260fd3e9221d1bc5b9ece6e7a5a98669c79e124453f2ac58625085759ed3bb NCCIC http://plusvic.github.io/yara/ NCCIC 2019-09-06T13:04:56+00:00 hidden_cobra_consolidated.yara: electricfish Malware Artifacts MD5 0ba6bb2ad05d86207b5303657e3f6874 SHA1 ad44567c8709df4889d381a0a64cc4b49e5004c3 SHA256 7cf5d86cc75cd8f0e22e35213a9c051b740bd4667d9879a446f06277782bffd1 NCCIC http://plusvic.github.io/yara/ NCCIC 2019-09-06T13:04:57+00:00 MAEC Characterization of 8d9123cd2648020292b5c35edc9ae22e ClamAV Win.Dropper.Electricfish-6976665-0 McAfee ElectricFish K7 Hacktool ( 0054e46d1 ) Cyren W32/Trojan.TWUO-7654 Symantec Unavailable (production) Zillya! Tool.ElectricFish.Win32.2 Antiy Trojan[Banker]/Win32.Alreay Kaspersky Trojan.Win32.Agent.xaadtn BitDefender Gen:Variant.Ursu.349885Unclassified Microsoft Security Essentials HackTool:Win32/ElecFish.A!dha Sophos Troj/ElecFish-A Emsisoft Gen:Variant.Ursu.349885 (B) Avira TR/AD.Stantinko.gkqij VirusBlokAda Trojan.Agent Ahnlab HackTool/Win32.Agent ESET a variant of Win32/NukeSped.FQ trojan NANOAV Trojan.Win32.Alreay.fvrmai TACHYON Trojan/W32.Electricfish.1422336 Quick Heal Trojan.Ursu Ikarus Trojan.Win32.HackTool dropper trojan MAEC Characterization of 0ba6bb2ad05d86207b5303657e3f6874 K7 Trojan ( 00555fff1 ) Cyren W32/Alreay.DVWS-3035 Symantec Unavailable (production) Antiy Trojan[Banker]/Win32.Alreay Kaspersky Trojan-Banker.Win32.Alreay.gen BitDefender Trojan.GenericKD.32262757Unclassified Sophos Troj/ElecFish-A Emsisoft Trojan.GenericKD.32262757 (B) Avira TR/AD.Stantinko.ysgqb AegisLab Trojan.Win32.Alreay.tqBn VirusBlokAda TrojanBanker.Alreay Ahnlab HackTool/Win32.Agent ESET a variant of Win32/NukeSped.FQ trojan NANOAV Trojan.Win32.Alreay.fvvzst Quick Heal Trojan.Alreay Ikarus Trojan.Win32.HackTool 10135536.r21.v3 Malicious Code Malicious Artifact Detected Malicious Artifact Detected Malicious Artifact Detected Malicious Artifact Detected Malicious Artifact Detected Malicious Artifact Detected Malicious Artifact Detected Malicious Artifact Detected Malicious Artifact Detected