Overview

overview

10

Static

static

Magix Vega....2.dll

windows10-2004-x64

3

Magix Vega...as.dll

windows10-2004-x64

3

Magix Vega...ry.dll

windows10-2004-x64

1

Magix Vega...00.exe

windows10-2004-x64

1

Magix Vega...14.exe

windows10-2004-x64

10

Magix Vega...ck.exe

windows10-2004-x64

10

Magix Vega...IM.dll

windows10-2004-x64

4

Magix Vega...ig.dll

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Magix Vegas Pro 20.0.0 Portable.rar

  • Size

    591.0MB

  • Sample

    230114-bmtecsbh21

  • MD5

    136f723779bbfd65d7468a54e248c188

  • SHA1

    c82fda84c7eea6cb6cd499b500242b5dc643032d

  • SHA256

    17b15b9e0dde478e6c60b124f8c754738d8f6bfe64416caff714b40a3edfbb6a

  • SHA512

    3de232857b0a65cb26253861da94e4ef8bccaab6f129bff78877443b682fe3f1f41d1d627b753dd2e2f7ad764173805480bf4fd78bc5eb3877acec56a60025c6

  • SSDEEP

    12582912:H1pNqRbHAbxg/Sj3M08pcx9TupFba0XJ9Q4Qi64HnaaaQ9AJxYQY2OX:HDNukg/Sp8pcxhupIUPVHa3Qu+L/

Score
10/10
redline5939542734_99discoveryinfostealerpersistenceransomware

Malware Config

Extracted

Path

C:\Program Files\VEGAS\VEGAS Pro 20.0\VEGASCapture\LICENSES.chromium.html

Ransom Note
<!-- Generated by licenses.py; do not edit. --><!doctype html> <html> <head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width"> <title>Credits</title> <link rel="stylesheet" href="chrome://resources/css/text_defaults.css"> <style> body { background-color: white; font-size: 84%; max-width: 1020px; } .page-title { font-size: 164%; font-weight: bold; } .product { background-color: #c3d9ff; border-radius: 5px; margin-top: 16px; overflow: auto; padding: 2px; } .product .title { float: left; font-size: 110%; font-weight: bold; margin: 3px; } .product .homepage { color: blue; float: right; margin: 3px; text-align: right; } .product .homepage::before { content: " - "; } .product .show { color: blue; float: right; margin: 3px; text-align: right; text-decoration: underline; } .licence { background-color: #e8eef7; border-radius: 3px; clear: both; display: none; padding: 16px; } .licence h3 { margin-top: 0; } .licence pre { white-space: pre-wrap; } .dialog #print-link, .dialog .homepage { display: none; } input + label + div { display: none; } input + label::after { content: "show license"; cursor: pointer; } input:checked + label + div { display: block; } input:checked + label::after { content: "hide license"; cursor: pointer; } </style> </head> <body> <span class="page-title" style="float:left;">Credits</span> <a id="print-link" href="#" style="float:right;" hidden>Print</a> <div style="clear:both; overflow:auto;"><!-- Chromium <3s the following projects --> <div class="product"> <span class="title">Abseil</span> <span class="homepage"><a href="https://github.com/abseil/abseil-cpp">homepage</a></span> <input type="checkbox" hidden id="0"> <label class="show" for="0" tabindex="0"></label> <div class="licence"> <pre> Apache License Version 2.0, January 2004 http://www.apache.org/licenses/ TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION 1. Definitions. "License" shall mean the terms and conditions for use, reproduction, and distribution as defined by Sections 1 through 9 of this document. "Licensor" shall mean the copyright owner or entity authorized by the copyright owner that is granting the License. "Legal Entity" shall mean the union of the acting entity and all other entities that control, are controlled by, or are under common control with that entity. For the purposes of this definition, "control" means (i) the power, direct or indirect, to cause the direction or management of such entity, whether by contract or otherwise, or (ii) ownership of fifty percent (50%) or more of the outstanding shares, or (iii) beneficial ownership of such entity. "You" (or "Your") shall mean an individual or Legal Entity exercising permissions granted by this License. "Source" form shall mean the preferred form for making modifications, including but not limited to software source code, documentation source, and configuration files. "Object" form shall mean any form resulting from mechanical transformation or translation of a Source form, including but not limited to compiled object code, generated documentation, and conversions to other media types. "Work" shall mean the work of authorship, whether in Source or Object form, made available under the License, as indicated by a copyright notice that is included in or attached to the work (an example is provided in the Appendix below). "Derivative Works" shall mean any work, whether in Source or Object form, that is based on (or derived from) the Work and for which the editorial revisions, annotations, elaborations, or other modifications represent, as a whole, an original work of authorship. For the purposes of this License, Derivative Works shall not include works that remain separable from, or merely link (or bind by name) to the interfaces of, the Work and Derivative Works thereof. "Contribution" shall mean any work of authorship, including the original version of the Work and any modifications or additions to that Work or Derivative Works thereof, that is intentionally submitted to Licensor for inclusion in the Work by the copyright owner or by an individual or Legal Entity authorized to submit on behalf of the copyright owner. For the purposes of this definition, "submitted" means any form of electronic, verbal, or written communication sent to the Licensor or its representatives, including but not limited to communication on electronic mailing lists, source code control systems, and issue tracking systems that are managed by, or on behalf of, the Licensor for the purpose of discussing and improving the Work, but excluding communication that is conspicuously marked or otherwise designated in writing by the copyright owner as "Not a Contribution." "Contributor" shall mean Licensor and any individual or Legal Entity on behalf of whom a Contribution has been received by Licensor and subsequently incorporated within the Work. 2. Grant of Copyright License. Subject to the terms and conditions of this License, each Contributor hereby grants to You a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare Derivative Works of, publicly display, publicly perform, sublicense, and distribute the Work and such Derivative Works in Source or Object form. 3. Grant of Patent License. Subject to the terms and conditions of this License, each Contributor hereby grants to You a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable (except as stated in this section) patent license to make, have made, use, offer to sell, sell, import, and otherwise transfer the Work, where such license applies only to those patent claims licensable by such Contributor that are necessarily infringed by their Contribution(s) alone or by combination of their Contribution(s) with the Work to which such Contribution(s) was submitted. If You institute patent litigation against any entity (including a cross-claim or counterclaim in a lawsuit) alleging that the Work or a Contribution incorporated within the Work constitutes direct or contributory patent infringement, then any patent licenses granted to You under this License for that Work shall terminate as of the date such litigation is filed. 4. Redistribution. You may reproduce and distribute copies of the Work or Derivative Works thereof in any medium, with or without modifications, and in Source or Object form, provided that You meet the following conditions: (a) You must give any other recipients of the Work or Derivative Works a copy of this License; and (b) You must cause any modified files to carry prominent notices stating that You changed the files; and (c) You must retain, in the Source form of any Derivative Works that You distribute, all copyright, patent, trademark, and attribution notices from the Source form of the Work, excluding those notices that do not pertain to any part of the Derivative Works; and (d) If the Work includes a "NOTICE" text file as part of its distribution, then any Derivative Works that You distribute must include a readable copy of the attribution notices contained within such NOTICE file, excluding those notices that do not pertain to any part of the Derivative Works, in at least one of the following places: within a NOTICE text file distributed as part of the Derivative Works; within the Source form or documentation, if provided along with the Derivative Works; or, within a display generated by the Derivative Works, if and wherever such third-party notices normally appear. The contents of the NOTICE file are for informational purposes only and do not modify the License. You may add Your own attribution notices within Derivative Works that You distribute, alongside or as an addendum to the NOTICE text from the Work, provided that such additional attribution notices cannot be construed as modifying the License. You may add Your own copyright statement to Your modifications and may provide additional or different license terms and conditions for use, reproduction, or distribution of Your modifications, or for any such Derivative Works as a whole, provided Your use, reproduction, and distribution of the Work otherwise complies with the conditions stated in this License. 5. Submission of Contributions. Unless You explicitly state otherwise, any Contribution intentionally submitted for inclusion in the Work by You to the Licensor shall be under the terms and conditions of this License, without any additional terms or conditions. Notwithstanding the above, nothing herein shall supersede or modify the terms of any separate license agreement you may have executed with Licensor regarding such Contributions. 6. Trademarks. This License does not grant permission to use the trade names, trademarks, service marks, or product names of the Licensor, except as required for reasonable and customary use in describing the origin of the Work and reproducing the content of the NOTICE file. 7. Disclaimer of Warranty. Unless required by applicable law or agreed to in writing, Licensor provides the Work (and each Contributor provides its Contributions) on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. You are solely responsible for determining the appropriateness of using or redistributing the Work and assume any risks associated with Your exercise of permissions under this License. 8. Limitation of Liability. In no event and under no legal theory, whether in tort (including negligence), contract, or otherwise, unless required by applicable law (such as deliberate and grossly negligent acts) or agreed to in writing, shall any Contributor be liable to You for damages, including any direct, indirect, special, incidental, or consequential damages of any character arising as a result of this License or out of the use or inability to use the Work (including but not limited to damages for loss of goodwill, work stoppage, computer failure or malfunction, or any and all other commercial damages or losses), even if such Contributor has been advised of the possibility of such damages. 9. Accepting Warranty or Additional Liability. While redistributing the Work or Derivative Works thereof, You may choose to offer, and charge a fee for, acceptance of support, warranty, indemnity, or other liability obligations and/or rights consistent with this License. However, in accepting such obligations, You may act only on Your own behalf and on Your sole responsibility, not on behalf of any other Contributor, and only if You agree to indemnify, defend, and hold each Contributor harmless for any liability incurred by, or claims asserted against, such Contributor by reason of your accepting any such warranty or additional liability. END OF TERMS AND CONDITIONS APPENDIX: How to apply the Apache License to your work. To apply the Apache License to your work, attach the following boilerplate notice, with the fields enclosed by brackets "[]" replaced with your own identifying information. (Don't include the brackets!) The text should be enclosed in the appropriate comment syntax for the file format. We also recommend that a file or class name and description of purpose be included on the same "printed page" as the copyright notice for easier identification within third-party archives. Copyright [yyyy] [name of copyright owner] Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. </pre> </div> </div> <div class="product"> <span class="title">Accessibility Audit library, from Accessibility Developer Tools</span> <span class="homepage"><a href="https://raw.githubusercontent.com/GoogleChrome/accessibility-developer-tools/master/dist/js/axs_testing.js">homepage</a></span> <input type="checkbox" hidden id="1"> <label class="show" for="1" tabindex="0"></label> <div class="licence"> <pre> Apache License Version 2.0, January 2004 http://www.apache.org/licenses/ TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION 1. Definitions. "License" shall mean the terms and conditions for use, reproduction, and distribution as defined by Sections 1 through 9 of this document. "Licensor" shall mean the copyright owner or entity authorized by the copyright owner that is granting the License. "Legal Entity" shall mean the union of the acting entity and all other entities that control, are controlled by, or are under common control with that entity. For the purposes of this definition, "control" means (i) the power, direct or indirect, to cause the direction or management of such entity, whether by contract or otherwise, or (ii) ownership of fifty percent (50%) or more of the outstanding shares, or (iii) beneficial ownership of such entity. "You" (or "Your") shall mean an individual or Legal Entity exercising permissions granted by this License. "Source" form shall mean the preferred form for making modifications, including but not limited to software source code, documentation source, and configuration files. "Object" form shall mean any form resulting from mechanical transformation or translation of a Source form, including but not limited to compiled object code, generated documentation, and conversions to other media types. "Work" shall mean the work of authorship, whether in Source or Object form, made available under the License, as indicated by a copyright notice that is included in or attached to the work (an example is provided in the Appendix below). "Derivative Works" shall mean any work, whether in Source or Object form, that is based on (or derived from) the Work and for which the editorial revisions, annotations, elaborations, or other modifications represent, as a whole, an original work of authorship. For the purposes of this License, Derivative Works shall not include works that remain separable from, or merely link (or bind by name) to the interfaces of, the Work and Derivative Works thereof. "Contribution" shall mean any work of authorship, including the original ver
Emails

&lt;[email protected]&gt

&lt;[email protected]&gt

&lt;[email protected]&gt

&lt;[email protected]&gt

&lt;[email protected]&gt

&lt;[email protected]&gt

&lt;[email protected]&gt

&lt;[email protected]&gt

&lt;[email protected]&gt

&lt;[email protected]&gt

&lt;[email protected]&gt

&lt;[email protected]&gt

&lt;[email protected]&gt

&lt;[email protected]&gt

&lt;[email protected]&gt

&lt;[email protected]&gt

&lt;[email protected]&gt

&lt;[email protected]&gt

&lt;[email protected]&gt

&lt;[email protected]&gt
URLs

http://www.apache.org/licenses/

http://www.apache.org/licenses/LICENSE-2.0

http://code.google.com/p/y2038

http://www.openbsd.org/cgi-bin/man.cgi/OpenBSD-current/man2/getentropy.2

http://mozilla.org/MPL/2.0/

http://www.torchmobile.com/

https://cla.developers.google.com/clas

http://www.openssl.org/)"

https://github.com/mit-plv/fiat-crypto/blob/master/AUTHORS

http://www.opensource.apple.com/apsl/

http://www.mozilla.org/MPL/

http://www.apple.com/legal/guidelinesfor3rdparties.html

http://developer.intel.com/vtune/cbts/strmsimd/922down.htm

http://skal.planet-d.net/coding/dct.html

http://developer.intel.com/vtune/cbts/strmsimd/appnotes.htm

http://www.elecard.com/peter/idct.html

http://www.linuxvideo.org/mpeg2dec/

https://firebase.google.com/terms/analytics/

https://www.freetype.org

https://www.khronos.org/registry/

Extracted

Family

redline

Botnet

5939542734_99

C2

doshirak.top:3306

doshirak.top:28786
Attributes
  • auth_value

    1340a80e7706fce55b48096c1e5d3943

Targets

    • Target

      Magix Vegas Pro 20.0.0 Portable/Pro.v20.0.0.214.Incl.Emulator-R2R/R2R/Protein/Protein_x64.4.2.dll

    • Size

      6KB

    • MD5

      2e3ee4ff84a37d1735734650a9dbb396

    • SHA1

      4af595a73f7f7021ede5289b28698c811ed56b06

    • SHA256

      359c2dfbb0bc5754997f18fc36154e295f9df9af00e2d7e92cc9d10fccf9567d

    • SHA512

      b8c6fcf227e47eb0e9e1a18f8983a31599679e1f613feddfc1af788956be2dc0d8b8dfc66cb84672b96dff54d2748dac717e53eea1e96d37109dda5e1cb9c3e4

    • SSDEEP

      96:oyFbybt970AslycDnzyhiv2Kt4t2HvwQOH:hbybt97lslycD+cv7t4tCvwQOH

    Score
    3/10
    behavioral1

    • Target

      Magix Vegas Pro 20.0.0 Portable/Pro.v20.0.0.214.Incl.Emulator-R2R/R2R/ScriptPortal.Vegas.dll

    • Size

      557KB

    • MD5

      9912603e3daac9b7bcd6921a161555d7

    • SHA1

      09f83c2838d57cd84b6b5157f96194325785eed0

    • SHA256

      1da4759a87e70bdaa202ab3974ac74c380feef67aa3c7f50f799cae04d659e7e

    • SHA512

      34f3b6bc51df08b3186a727ac631634c6bc1fe2819fb5bc23d0b1e784ed97bbf3f2d8befd500caa0e15fc2f4840d73bb785ce1b3874f6a52cafb9a46aabd1944

    • SSDEEP

      6144:vbtACoJDUa6AHEK/Jb3UrUUOA1jezMqRvZL3cbe4v+UZxyBoJH1aaqeTl:v6CoJDUa1JbcOA1xhl

    Score
    3/10
    behavioral2

    • Target

      Magix Vegas Pro 20.0.0 Portable/Pro.v20.0.0.214.Incl.Emulator-R2R/R2R/TransitionWPFLibrary.dll

    • Size

      310KB

    • MD5

      f36477b4eaabf9565de311077c6e630a

    • SHA1

      25b5786d5b600f2702022589e3b462a60d1b1093

    • SHA256

      dc946a363b2e37b088b9172d364ade379ffe8fbdae0debba1cbb02f57ae4575b

    • SHA512

      c0736332e861fdd9a79dff9321f6249b09727a99c744ba87d533c3da4f021ae4cd1f5f787fc5dcab485b70d983e03d919dd53c69ffc60fe406dfcd3b39577e8f

    • SSDEEP

      3072:Xj7YmbeLTPzP4eF7d/NFg1GoAxQNRxjFoGN4XbuwdRTpCGDZ:fBKLTPz7F7RNFLoAxQNRxjfO

    Score
    1/10
    behavioral3

    • Target

      Magix Vegas Pro 20.0.0 Portable/Pro.v20.0.0.214.Incl.Emulator-R2R/R2R/vegas200.exe

    • Size

      40.7MB

    • MD5

      0c59544fe02749613b04fed8dd5275ab

    • SHA1

      4986922c3d7ecb43ee238c126d2ac0c4b254ff6f

    • SHA256

      5f367181830a601b2293ceecf3993f2ef87f9025b67c5fc7618aa7b736dc7f17

    • SHA512

      ec2a777a82e80eaa107dc8aeb55f3262808bcdbd5cccc0e879714c86e423b48d09d4d4f5283ab360db8cb3210e3631e2b36b3e5d4a4945ebf073dc6bef380b3b

    • SSDEEP

      393216:md3zdUWV6kL6mrCEzyFdwL4kzLKGQc54yBVcGyYE60tyMTWeqLTULwoOQF3SpPlE:MP6EX4OQqX5w9k0YVhHFD+

    Score
    1/10
    behavioral4

    • Target

      Magix Vegas Pro 20.0.0 Portable/Pro.v20.0.0.214.Incl.Emulator-R2R/VEGAS_Pro_20.0.0.214.exe

    • Size

      574.9MB

    • MD5

      059274e07bbf83ec5b5d4f1d957681eb

    • SHA1

      b0dd598c4dd719ccfc80d769becf5d0589a74eaa

    • SHA256

      e3e504169f03591d5ac617e027c124549f9073a2c357c64cac92cb2b83639145

    • SHA512

      3e6b5305eca533809dac53be730c8f525bf28c54aa4e17d151272f05efa4da03172a700f932a2510ea0c349b822136ae8ad76ed47c621e4b0f34e4394616da43

    • SSDEEP

      12582912:jDMbxgS/TLHSky47LmxRPF/ELbsnW4sxs2K53K2Cm/Fi2DPScaXm:jDyxgS/HXyGLmxRh4s+xs2w3KTm/Fi2T

    Score
    10/10
    discoverypersistenceransomware

    • Blocklisted process makes network request

    • Executes dropped EXE

    • Registers COM server for autorun

      persistence

    • Sets file execution options in registry

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

    behavioral5

    • Target

      Magix Vegas Pro 20.0.0 Portable/Setup Crack.exe

    • Size

      403.6MB

    • MD5

      bc85d45f3fc861b8ee661234a86a8b2a

    • SHA1

      c6fc381393ad68bd862e79576ef0684c796613a3

    • SHA256

      625050dee4ac73d925ecf1b7c0c6ea637e8aedfd511c11a6f895336bc171ece0

    • SHA512

      cd1c97c7821bced2bb47a302275c36347c88b33c6fe6ae5e7c819c79889acc1982ec7e3b8c30a53bf7de9ddeabb00e0602ada66a3c0a4f761c6d04993a6602f1

    • SSDEEP

      3072:gD7kvws1y+IW9xdlmg1vjsZn/nw12LGben3ZvA9Af8i+9PaUtwel2Zpp5Q:k7kvw5+F9Dl5vjsBvwoLGytA9nybQ

    Score
    10/10
    redline5939542734_99infostealer

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • Suspicious use of SetThreadContext

    behavioral6

    • Target

      Magix Vegas Pro 20.0.0 Portable/resources/AdobePIM.dll

    • Size

      2.0MB

    • MD5

      44ee9b45aeba8522b4143a9cfeed24c1

    • SHA1

      2fc95cf7eaad9860e5e90ea1a3fec13a3ff13c9c

    • SHA256

      f6862b0124122a50b7e16a8a8ad3c18e41dda66e22751fc916f39a9700891779

    • SHA512

      6c6e699b200a3c94ac10cc59a480ce2197aae04b58a2cb640681b3de1c18eaecd902d635ea24d793be1c976f5384a98282465d1912e317cbfcddb0516c2925a7

    • SSDEEP

      49152:lBxNXbGevf30HlhHRPErtXFqVn1P2Rt8JUaRMXA3IloTf7pFixuYZ:lBxFGY1Un1P2Rt8JUaRMXn

    Score
    4/10
    behavioral7

    • Target

      Magix Vegas Pro 20.0.0 Portable/resources/Config.dat

    • Size

      88KB

    • MD5

      1ab8210cba504dbacc3631dbece4f83d

    • SHA1

      2826a0d77c2953185cbb9967ee09536ca25eecb2

    • SHA256

      63ddf01c90b6ac2f43c0f2ad3e6d7c04449bffac49423aeaf52640058cf01074

    • SHA512

      980c81c8eb4632c4e41d9edb9943b9fcc53caf6c1092664a9a407e9f131e8dc247299faa008244e0281decf183df47bc4e29b80323bd60c38d2094a3015ababe

    • SSDEEP

      1536:zPnaFNlZG6Ca//LTA/C3qDoxysfQuvm+U0sW7bcdy95ZrpzO6qPp:TEZG6CKTTA/C33xdvtUfyvZrpqFPp

    Score
    1/10
    behavioral8

MITRE ATT&CK Enterprise v6

Tasks