79d352413ec91e3c74925718fd3a7e8d6f234d62a2ceffb6a1e7c5b257ec48e9

Sharing

Copy URL Twitter E-mail

General

Target
flstudio_11.1.exe
Size 348.2MB
Sample240224-vkn7eaha52
SHA256 79d352413ec91e3c74925718fd3a7e8d6f234d62a2ceffb6a1e7c5b257ec48e9
MD5 ddaaa231e042bfe80f378e4e0d006e76
SHA1 709e3cc71aec905938a0c0dd64c82d10249c8962
SHA512 f64e24c77c88c53f8ef396f384a0d094149f2c1fc2e7c9c48d71da56646e2ba8b093375b2829c1b8e9e84d19a76fc4f0eba98db19f2b0da7dabcbfc265921a59
SSDEEP 6291456:8/5YjuChKJa7uE1/r1m6iu8tA3Q8KarvxabS+pWdK+Okau9MTB5ViZGdZD:8R2ByuuE1DPmC1Gv7FVnIZGdZD
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Targets

- Target
  flstudio_11.1.exe
- Size 348.2MB
- SHA256 79d352413ec91e3c74925718fd3a7e8d6f234d62a2ceffb6a1e7c5b257ec48e9
- MD5 ddaaa231e042bfe80f378e4e0d006e76
- SHA1 709e3cc71aec905938a0c0dd64c82d10249c8962
- SHA512 f64e24c77c88c53f8ef396f384a0d094149f2c1fc2e7c9c48d71da56646e2ba8b093375b2829c1b8e9e84d19a76fc4f0eba98db19f2b0da7dabcbfc265921a59
- SSDEEP 6291456:8/5YjuChKJa7uE1/r1m6iu8tA3Q8KarvxabS+pWdK+Okau9MTB5ViZGdZD:8R2ByuuE1DPmC1Gv7FVnIZGdZD
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10

discovery persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Registers COM server for autorun
  persistence
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops file in System32 directory
behavioral1 behavioral2
- Target
  $0/ILMinihostBridge32.exe
- Size 2.6MB
- SHA256 04c1c64351fb8114e9bebff597c7074932dc27d03c640f98d742cf4bfc0d159c
- MD5 7e3e8f2ea58ce1f42d7b5c595700379e
- SHA1 12b7055e4ea26a46b19f702dcb76c9e2e7723b58
- SHA512 35d7c1b975e8c3435ea69c5c024cd60319a77d23e67701619dfbc9e99a750d9fe058e52608057327077f956b680edc4a25f6d23e3769e8c33826384fe3d9c1c6
- SSDEEP 24576:jJfNSplcxPVFx1fF7GRP01tZxI9v81nSosp0qiplM3TO6DfWZ:FNSjcx91Y10XOEEzOpMTJDfWZ
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral3 behavioral4
- Target
  $0/ILMinihostBridge64.exe
- Size 3.0MB
- SHA256 305d88f08355250eb2c3db78213264ce5b6ef69b3990710d04ae1dea72a5919b
- MD5 4226dc45950473419e8f3ef1503d27b3
- SHA1 9e7de1cc2a8d8066dca588672a43bf79abbd863b
- SHA512 55c3972f77f565c8d93f1ab1fc6c1a1097851e90be6eab48494c58a85c14020f78f71b495f8deb1d5e99b4c9c4409d524ff50b265346bc2da5067f830a7a2762
- SSDEEP 24576:777Pbvc6pEyjLZ1J1BHutiTvFHdQ0PIMayFr7+3+hNkDT7N+dBKJe3/0:zjbhZwiDbhKyF/+uUDT1JI/0
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral5 behavioral6
- Target
  $0/ILPluginScanner32.exe
- Size 2.6MB
- SHA256 8bda879bbd06e239ef0063731a3246896c95d269aee5d5bd0dd4050b5b260704
- MD5 16adf1344d2d2aae4d87b17e9957c5b3
- SHA1 e2b58ba0e2b3632a1b36989fbd17bd195d9fda09
- SHA512 5ca370e5688f93de93bcb1346d804b55d9933ce2e42b53b6005277b0f3b9e3e6d323bf872d97138830bdb1515cf05bc0fd772ca8dc09d3d9bf894f9c42d996cb
- SSDEEP 24576:IeowHAgPCvLMe2T1693ZiOsOWU2x8X6EcxI/ioMGkLqSTq0xoRf:Ieo2AgPCvBTPi9x4MGkLqST/iRf
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral7 behavioral8
- Target
  $0/ILPluginScanner64.exe
- Size 3.1MB
- SHA256 0ecdf93da82cbd2a4684befbc018277a6dde5319d2a7eca16e6a67d0d2afb3ed
- MD5 3f0b471ea570890e7b8503a58b5f3d42
- SHA1 fa0bbf0260ea77ff9f7b47eb9ce53062631f16a2
- SHA512 a6396eb304d7342c3db4902ee5b6bd79da9635c339ad98b01145911bc95b5da29f3e00b5ba687125e16b88d5085d0da5ccfacda386915554dd42c1e8ebc34cc6
- SSDEEP 24576:Hce4XVZXVSZu3E82KFwOQCB7V6gpRFS4tTNYIhTiR4NpfodKRKVu:A3GqwnWV6gwIYIhT30S
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral10 behavioral9
- Target
  $_3_/ILDownloadManager.exe
- Size 2.2MB
- SHA256 c76d28df4462548cc72d031988c3d6462321dbde6822faadf4bdcf46de47c298
- MD5 a5e7420e0faa985a79453060cab03908
- SHA1 0f0399cd501ccc81daf176390b7403a3f0436c04
- SHA512 76bfd4d233920e22a16f2bfbe58bbb97705bf72270b4629428eae0917dbdefd36eaf0192e098b8ff7f8abf0a0e323742730f176c60f9024b1ac81effabb879ee
- SSDEEP 24576:LSmWS5R/Dp8hrcuK9feMPl2drPkrIrFxrilynwdX0cjfeKTsydYQ+z:+mWSTV85cuKfVPl2Vmosywl9TsydYQ+z
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral11 behavioral12
- Target
  $_3_/Update/Updater.exe
- Size 703KB
- SHA256 ec6beb5b3a142ce2aa219cc3b7556c69d13389a3f1cc4582bf6ff915b62f6635
- MD5 899a0e5ad7f9bb816a49ad8722309d63
- SHA1 53605907568452a0c0b80d2feac7eef3f325920d
- SHA512 05c85850a2e39f36c43b4d38632b184ecf4cffea2a966735c2951c8cc3e5563498aba574a0e6282f7cd836b2bb069811d42cc1f8bb25ac1c0886abaf90972abf
- SSDEEP 12288:Va9zNU8kRagBIHGRRYP7vt8khukmPboYO6dwkaNTuof93a:VaBNRk8tmRRYek0ZPboYxdwkaNTuh
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10

evasion
- Identifies Wine through registry keys
  Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
  evasion
behavioral13 behavioral14
- Target
  $_4_/ILDownloadManager.exe
- Size 2.2MB
- SHA256 c76d28df4462548cc72d031988c3d6462321dbde6822faadf4bdcf46de47c298
- MD5 a5e7420e0faa985a79453060cab03908
- SHA1 0f0399cd501ccc81daf176390b7403a3f0436c04
- SHA512 76bfd4d233920e22a16f2bfbe58bbb97705bf72270b4629428eae0917dbdefd36eaf0192e098b8ff7f8abf0a0e323742730f176c60f9024b1ac81effabb879ee
- SSDEEP 24576:LSmWS5R/Dp8hrcuK9feMPl2drPkrIrFxrilynwdX0cjfeKTsydYQ+z:+mWSTV85cuKfVPl2Vmosywl9TsydYQ+z
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral15 behavioral16
- Target
  $_4_/Update/Updater.exe
- Size 703KB
- SHA256 ec6beb5b3a142ce2aa219cc3b7556c69d13389a3f1cc4582bf6ff915b62f6635
- MD5 899a0e5ad7f9bb816a49ad8722309d63
- SHA1 53605907568452a0c0b80d2feac7eef3f325920d
- SHA512 05c85850a2e39f36c43b4d38632b184ecf4cffea2a966735c2951c8cc3e5563498aba574a0e6282f7cd836b2bb069811d42cc1f8bb25ac1c0886abaf90972abf
- SSDEEP 12288:Va9zNU8kRagBIHGRRYP7vt8khukmPboYO6dwkaNTuof93a:VaBNRk8tmRRYek0ZPboYxdwkaNTuh
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10

evasion
- Identifies Wine through registry keys
  Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
  evasion
behavioral17 behavioral18

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Registers COM server for autorun

Adds Run key to start application

Checks installed software on the system

Drops file in System32 directory

Identifies Wine through registry keys

Identifies Wine through registry keys

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18