MAR-10135536-G Malware Characterization //node() | //@* This report is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is marked TLP:WHITE. Disclosure is not limited. Sources may use TLP:WHITE when information carries minimal or no foreseeable risk of misuse, in accordance with applicable rules and procedures for public release. Subject to standard copyright rules, TLP:WHITE information may be distributed without restriction. For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp. US-CERT 2018-02-06T19:06:29.202939+00:00 bmachine F694.F694.F694.F694.F694.F694.F694.F694.F694 6.4.17 C6F78AD187C365D117CACBEE140F6230 208896 PE32 executable (GUI) Intel 80386, for MS Windows MD5 c6f78ad187c365d117cacbee140f6230 SHA1 5116f281c61639b48fd58caaed60018bafdefe7a SHA256 d1f3b9372a6be9c02430b6e4526202974179a674ce94fe22028d7212ae6be9e7 SHA512 f03fe686fac20714a6a7141bff1471c9187b0d4630752fb5eb922605dbb74105c1ecced7e1980a0d79195c1a7f1b2f221e483bc9f7e2164a8b4290b512e06503 SSDEEP 1536:X86D0r4QxG5+XCFpaG7+esyzktLYUwnZ7hUOKYUwnZ7hUOaeYUwnZ7hUOKYUwnZr:X8O0IgCvH7+UzktMxzxgRxzx9 Microsoft Visual C++ v6.0 6.83311979555 5 2016-02-07T03:17:51Z 4096 MD5 a8f97910c62034b318e17aa17fb97f1c 0.688105697711 .text 53248 6.50896736344 MD5 08112b571663ff5ed42e331a00ccce0c .rdata 8192 4.57323662515 MD5 ca61927558a4dfe9305eb037a5432960 .data 139264 6.94127887342 MD5 bb49b2fb00c1ae88ad440971914711a7 .sxdata 4096 0.181138192206 MD5 c58b62cf949e8636ebd5c75f482207c3 Related_To Related_To Related_To Related_To Figure 1 Related_To Figure 2 Related_To Figure 3 Related_To Figure 4 Related_To C01DC42F65ACAF1C917C0CC29BA63ADC 233472 PE32 executable (DLL) (GUI) Intel 80386, for MS Windows MD5 c01dc42f65acaf1c917c0cc29ba63adc SHA1 d288766fa268bc2534f85fd06a5d52264e646c47 SHA256 4257bb11570ed15b8a15aa3fc051a580eab5d09c2f9d79e4b264b752c8e584fc SHA512 0ff6745ef787e89bd0f154bd96571f086f6b6596621e7211bb8ce8f970a26a72770a44b9aa1b906e6599dd5f421e0dd50895e2cde9ba85be78b9efbc3e8db5c0 SSDEEP 1536:cseScclTQDYY3TSF00sK/LVtKYUwnZ7hUO1YUwnZ7hUOAeYUwnZ7hUO7YUwnZ7hj:cseScjYY3Tyc0LVt9xsxuRxSxzxg0j Microsoft Visual C++ 6.0 Microsoft Visual C++ 6.0 DLL (Debug) 6.8618428232 5 2016-02-05T18:16:54Z 4096 MD5 f0cb80c557b1172362064c51bbb9b271 0.696473380789 .text 45056 6.32403974333 MD5 e9d0219343e64c8c8aa6f084db44b92c .rdata 8192 3.77533292527 MD5 1092801819f120298e2ddac6a96e3fd0 .data 167936 7.04539309174 MD5 5109fb1db61b533c23762d9044579db7 .reloc 8192 2.76766633365 MD5 9ce04d3e820fa7056f351dbcfa05b0fb Related_To Related_To Related_To Figure 5 Related_To Figure 6 Related_To Figure 7 Related_To MD5 c01dc42f65acaf1c917c0cc29ba63adc SHA1 d288766fa268bc2534f85fd06a5d52264e646c47 MD5 c6f78ad187c365d117cacbee140f6230 SHA1 5116f281c61639b48fd58caaed60018bafdefe7a MD5 d93b6a5c04d392fc8ed30375be17beb4 SHA1 f862c2899c41a4d1120a7739cdaff561d2490360 D93B6A5C04D392FC8ED30375BE17BEB4 321730 Java archive data (JAR) MD5 d93b6a5c04d392fc8ed30375be17beb4 SHA1 f862c2899c41a4d1120a7739cdaff561d2490360 SHA256 edd2aff8fad0c76021adc74fe3cb3cb1a02913a839ad0f2cf31fdea8b5aa8195 SHA512 709931cec37cedf4c5f84f1a2242e48c8465b97217be96a77627a83f317cbb1d0a1a1886955b982b0bf9b92ccf7ab1bef8d782622f81ce1eba337f0530589333 SSDEEP 6144:1c35mQ6aHY0wxxp/2o0uK1uv8q8lY1pr/Cc800a0sdOQypHIKO9kxZ4:+J5Hlwxmo0Tuv8q8i3+c800NsdFyKKOR 7.98967099439 DLL - MD5 Malware Artifacts US-CERT 2018-01-03T17:12:18.594317+00:00 DLL - SHA1 Malware Artifacts US-CERT 2018-01-03T17:12:18.595153+00:00 PE32 - MD5 Malware Artifacts US-CERT 2018-01-03T17:12:25.946699+00:00 PE32 - SHA1 Malware Artifacts US-CERT 2018-01-03T17:12:25.947456+00:00 JAR - MD5 Malware Artifacts US-CERT 2018-01-03T17:12:31.155357+00:00 JAR - SHA1 Malware Artifacts US-CERT 2018-01-03T17:12:31.156256+00:00 MAEC Characterization of d93b6a5c04d392fc8ed30375be17beb4 Sophos Andr/Spy-ANK Ikarus Trojan.AndroidOS.SMForw MAEC Characterization of c6f78ad187c365d117cacbee140f6230 Ahnlab Backdoor/Win32.Akdoor MAEC Characterization of c01dc42f65acaf1c917c0cc29ba63adc nProtect Trojan/W32.Agent.233472.APN F-secure Trojan.Agent.CBEJ BitDefender Trojan.Agent.CBEJ Microsoft Security Essentials Trojan:Win32/Autophyte.B!dha Emsisoft Trojan.Agent.CBEJ (B) Ahnlab Backdoor/Win32.Akdoor Ikarus Trojan.Agent 10135536-G Malicious Code Malicious Artifact Detected Malicious Artifact Detected Malicious Artifact Detected Malicious Artifact Detected Malicious Artifact Detected Malicious Artifact Detected Malicious Artifact Detected Malicious Artifact Detected Malicious Artifact Detected Malicious Artifact Detected Malicious Artifact Detected Malicious Artifact Detected Malicious Artifact Detected Malicious Artifact Detected Malicious Artifact Detected Malicious Artifact Detected