Overview

overview

7

Static

static

3

CapCut_2_2..._0.exe

windows10-1703-x64

7

Resubmissions

13-07-2023 13:45

230713-q2d1jsgh87 7

11-07-2023 19:06

230711-xr6fdabf3v 7

11-07-2023 19:04

230711-xq3cbsae78 3

11-07-2023 18:41

230711-xb55nsae49 7

11-07-2023 18:30

230711-w5nbaaae42 7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    CapCut_2_2_0_491_capcutpc_0.gz

  • Size

    21.0MB

  • Sample

    230713-q2d1jsgh87

  • MD5

    1148ec3fbaf703ff99d63e4be173db46

  • SHA1

    88a37a64365ef6b6c2cd113313faed825bd74022

  • SHA256

    9832647d56bce277c025944ca38095da9942add7aa235893785a3d8e86eaa4ed

  • SHA512

    b08bcf60f7641c91a7fae604387ab5a7cffcced7c72108e168225cbc17fd037542f2f70691b663a935598a2f91648ee4a3b6caa47f72b906d206bf669ca6bc37

  • SSDEEP

    393216:eDOT+7oif4tug1xIgD87Sui8hgUZ8X5+qhBcczwSjm6tqI/XfSmImmn9h120NxeB:eDl7jwuAxl87SN8hgi8v/ccDm+/XamIO

Score
7/10
persistencespywarestealer

Malware Config

Targets

    • Target

      CapCut_2_2_0_491_capcutpc_0/CapCut_2_2_0_491_capcutpc_0.exe

    • Size

      58.6MB

    • MD5

      bbe506388a97274805cc8d3c91cf67ac

    • SHA1

      b2896db7d28fe66c612d900971ca05a9f7c37429

    • SHA256

      d6aee63ffe429ddb9340090bff2127efad340240954364f1c996a8da6b711374

    • SHA512

      4d27b1de445be7440b3c80e4070b60aefabf2cad45e2f73acfed79675ef8af2dd12c696e3f6adebbe9a7a809160ecbd672260ffa8e8e0b7b75462b9d89adfa95

    • SSDEEP

      393216:SQgHDlanaGBXvDKtz+bhPWES4tiNQPNrIKc4gaPbUAgrO4mgd96l+ZArYsFRlLNK:S3on1HvSzxAMNdFZArYsTNSgIm1G

    Score
    7/10
    persistencespywarestealer

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1

MITRE ATT&CK Enterprise v6

Tasks