General

  • Target

    b854b365e4954c37929c26b657fc5a05

  • Size

    9.6MB

  • MD5

    b854b365e4954c37929c26b657fc5a05

  • SHA1

    d0ecd518673c32e03471834a11793b188503de01

  • SHA256

    edcd412eef8000be5040f480b633c317e1949444b1368dae34f5c256336647ca

  • SHA512

    f080fe763e0df67a2925a5a77d2796678d1162ae65be07563b41639eb7d18303c51af689d73dc28e6d445fbc3d2634f55712bfe4b11bdf99af0fe5557eb7372d

  • SSDEEP

    196608:YRZ8DXkEpRGeIVqirKawKnmykcQEED8ewORmU2aXRV1vAfBPrdKZzlfjnmfFn:S8ueWMaDnXkfJDbmU2Y/ARRCAfFn

Score
10/10

Malware Config

Signatures

  • Detect Lumma Stealer payload V4 1 IoCs
  • Lumma family
  • ACProtect 1.3x - 1.4x DLL software 2 IoCs

    Detects file using ACProtect software.

  • ASPack v2.12-2.42 4 IoCs

    Detects executables packed with ASPack v2.12-2.42

  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Unsigned PE 53 IoCs

    Checks for missing Authenticode signature.

  • NSIS installer 4 IoCs

Files

  • b854b365e4954c37929c26b657fc5a05
    .rar
  • ttlivesetup.exe
    .exe windows:4 windows x86 arch:x86

    18bc6fa81e19f21156316b1ae696ed6b


    Headers

    Imports

    Sections

  • $PLUGINSDIR/InstallOptions.dll
    .dll windows:4 windows x86 arch:x86

    57354bdeea3dfae6e948101add87501a


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/ioSpecial.ini
  • $PLUGINSDIR/modern-header.bmp
  • $PLUGINSDIR/modern-wizard.bmp
  • $WINDIR/ACNSTAT.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    592c94bcc37885b282516cfc8fa1d596


    Headers

    Imports

    Exports

    Sections

  • $WINDIR/Syn.dll
    .dll windows:4 windows x86 arch:x86

    fda99d71ee9f0e10c807baa66ee1698c


    Headers

    Imports

    Exports

    Sections

  • $WINDIR/TransLayer.exe
    .exe windows:4 windows x86 arch:x86

    33add0014131e4c7ce049470188d9270


    Headers

    Imports

    Sections

  • $WINDIR/UDPlayerCtl.ocx
    .dll regsvr32 windows:4 windows x86 arch:x86

    0b67b6836e08cabae78f6051b96c1ee6


    Headers

    Imports

    Exports

    Sections

  • $WINDIR/UDPlayerUP.ini
  • $WINDIR/UnloadCtl.exe
    .exe windows:4 windows x86 arch:x86

    7e5ab8defcac6f826f9e615ec81580ca


    Headers

    Imports

    Sections

  • $WINDIR/UpAppendant.exe
    .exe windows:4 windows x86 arch:x86

    88d9e81fb566a1cb9430ac6d1d472a5d


    Headers

    Imports

    Sections

  • Modules/BOBO/BoBo_ActiveX_V3.ocx
    .dll regsvr32 windows:4 windows x86 arch:x86

    5856629c684136aa0dbdf242aafa2491


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Modules/Feidian/MMCShell.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    05a126a1d2fd71e90e05ad6aa80746af


    Headers

    Imports

    Exports

    Sections

  • Modules/MySee/Booter.ocx
    .dll regsvr32 windows:4 windows x86 arch:x86

    4f387f0ae635f629f7391590578a355a


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Modules/PPStream/PSNetwork.dll
    .dll windows:4 windows x86 arch:x86

    eae8e3d7c0216c3320deeb729741320c


    Headers

    Imports

    Exports

    Sections

  • Modules/PPStream/PowerList.ocx
    .dll regsvr32 windows:4 windows x86 arch:x86

    1286fd51359211eeeade06f82fcd525e


    Headers

    Imports

    Exports

    Sections

  • Modules/PPStream/PowerPlayer.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    bc11a1ab4ca2c50dbe513d23f84679c4


    Headers

    Imports

    Exports

    Sections

  • Modules/QQLive/P2PPlayer.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    a972765d4f7da0ffccb4375291449098


    Headers

    Imports

    Exports

    Sections

  • Modules/QQLive/QQLive.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    200367198fe9ec3c2938c49f3afed75b


    Headers

    Imports

    Exports

    Sections

  • Modules/QQLive/QQLive.ocx
    .dll regsvr32 windows:4 windows x86 arch:x86

    0298f8d4265383da1c838571cb552377


    Headers

    Imports

    Exports

    Sections

  • Modules/QQLive/QQLiveSrcDec.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    2eb4f7046a577b1ce2ecff21f5ea5685


    Headers

    Imports

    Exports

    Sections

  • Modules/QQLive/TNProxy.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    cd70e39e6e438786ef4a72074fe055fb


    Headers

    Imports

    Exports

    Sections

  • Modules/QQLive/TRadio.ocx
    .dll regsvr32 windows:4 windows x86 arch:x86

    dd27a8fc8270628e2b7a039bf349b8db


    Headers

    Imports

    Exports

    Sections

  • Modules/QQLive/TVChannel.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    a3e31be2f7962d46237211d249faa5d0


    Headers

    Imports

    Exports

    Sections

  • Modules/QQLive/VCodec.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    7bb281f2034c5cb2d33ce586943ce4e6


    Headers

    Imports

    Exports

    Sections

  • Modules/QQLive/busy.gif
    .gif
  • Modules/QQLive/loading.gif
    .gif
  • Modules/QQLive/notAllowd.gif
    .gif
  • Modules/TVKoo/KooPlayer.ocx
    .dll regsvr32 windows:4 windows x86 arch:x86


    Code Sign

    Headers

    Exports

    Sections

  • Modules/TVUPlayer/TVUAx.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    f1df47ce50ba71c257ca7f2b46ab2de7


    Headers

    Imports

    Exports

    Sections

  • Modules/TVUPlayer/msvcp71.dll
    .dll windows:4 windows x86 arch:x86

    5e2398adb60a70c7ab04e7cba75a7983


    Headers

    Imports

    Exports

    Sections

  • Modules/TVUPlayer/msvcr71.dll
    .dll windows:4 windows x86 arch:x86

    7acc8c379c768a1ecd81ec502ff5f33e


    Headers

    Imports

    Exports

    Sections

  • Modules/kumool/AutoUpdate.exe
    .exe windows:4 windows x86 arch:x86

    10be314a3aec2aaf842e0c4956d3d533


    Headers

    Imports

    Exports

    Sections

  • Modules/kumool/Core.dll
    .dll windows:4 windows x86 arch:x86

    d4c2d5f9f88520ddb68bfd8d1a62b1be


    Headers

    Imports

    Exports

    Sections

  • Modules/kumool/KuMoolOcx.ocx
    .dll regsvr32 windows:4 windows x86 arch:x86

    780fb97f6c3d1e4b11e66c3c426951b9


    Headers

    Imports

    Exports

    Sections

  • Modules/kumool/ad.html
    .html
  • Modules/kumool/ad.jpg
    .jpg
  • Modules/kumool/msg.html
    .html
  • Modules/kumool/tips.html
  • Modules/moptv/pCastCtl.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    b0517ebfd5dbd69335fc4ff43a95a0b4


    Headers

    Imports

    Exports

    Sections

  • Modules/moptv/pcast.dll
    .dll windows:4 windows x86 arch:x86

    4969a2954c65dac7bf4437f34fbe8680


    Headers

    Imports

    Exports

    Sections

  • Modules/other/ClientX.ocx
    .dll regsvr32 windows:4 windows x86 arch:x86

    2815ef9d67b8807e19f4a7cd1d0d2dd7


    Headers

    Imports

    Exports

    Sections

  • Modules/other/QHLive.ocx
    .dll regsvr32 windows:4 windows x86 arch:x86

    e4e5fbc549e3a1212ce18ed61801e0c5


    Headers

    Imports

    Exports

    Sections

  • Modules/pplive/pplive.exe
    .exe windows:4 windows x86 arch:x86

    9c523d8653da5455667e3f82274f2f88


    Code Sign

    Headers

    Imports

    Sections

  • $PLUGINSDIR/ERoc.dll
    .dll windows:4 windows x86 arch:x86

    e43bbcb8f87ee846306b634ce05db32f


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/InstallOptions.dll
    .dll windows:4 windows x86 arch:x86

    57354bdeea3dfae6e948101add87501a


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/KOM.dll
    .dll windows:4 windows x86 arch:x86

    6903731fae21a3a4d1993323396b9b1c


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/MIR.dll
    .dll windows:4 windows x86 arch:x86

    f8c4a4bb769de40d3b381996f6a7acef


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/System.dll
    .dll windows:4 windows x86 arch:x86

    4ec328f99bdd944fc98d8a5cf11f7a62


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/TEN.dll
    .dll windows:4 windows x86 arch:x86

    69630f4e49cba917c47d520250bf1ff5


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/cmpver.dll
    .dll windows:4 windows x86 arch:x86

    71a33d9638f070315c658f06153bf2d3


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/tpi.dll
    .dll windows:4 windows x86 arch:x86

    90547e4eb5ec31263ac362ca3152bc21


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Modules/ppmate/ppmate2ctrl-2.1.0.42.exe
    .exe windows:4 windows x86 arch:x86

    4a9446e5cc2412c6405cea69dddb93be


    Headers

    Imports

    Sections

  • $APPDATA/PPMate/PPMate/channels.xml
    .xml
  • $PLUGINSDIR/InstallOptions.dll
    .dll windows:4 windows x86 arch:x86

    b3d296ff6f7abb1319ee006fcc6c4d98


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/LangDLL.dll
    .dll windows:4 windows x86 arch:x86

    2db813254ea8b4d2a92d703ecb659f39


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/ioSpecial.ini
  • $PLUGINSDIR/modern-wizard.bmp
  • $PROGRAM_FILES_COMMON/Synacast/SynaLive/PP/GAL.dll
    .dll windows:4 windows x86 arch:x86

    34cdb0d333236a9df55e2e9e73b8b4c5


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $PROGRAM_FILES_COMMON/Synacast/SynaLive/PP/KOM.dll
    .dll windows:4 windows x86 arch:x86

    6f28788c82f7564f3e3a292c5f997368


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $PROGRAM_FILES_COMMON/Synacast/SynaLive/PP/MUL.DLL
    .dll windows:4 windows x86 arch:x86

    9aaeceb8f6d61aa7caf74c2a192e81c3


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $PROGRAM_FILES_COMMON/Synacast/SynaLive/PP/eroc.dll
    .dll windows:4 windows x86 arch:x86

    e43bbcb8f87ee846306b634ce05db32f


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $PROGRAM_FILES_COMMON/Synacast/SynaLive/PP/mir.dll
    .dll windows:4 windows x86 arch:x86

    18bef7d3203bb9e669b2d8f2f067884e


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $PROGRAM_FILES_COMMON/Synacast/SynaLive/PP/ten.dll
    .dll windows:4 windows x86 arch:x86

    69630f4e49cba917c47d520250bf1ff5


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $PROGRAM_FILES_COMMON/Synacast/SynaLive/SynacastEWA.ocx
    .dll regsvr32 windows:4 windows x86 arch:x86

    b2e71a5cc96a2e6a148e590ffbf7e021


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $PROGRAM_FILES_COMMON/Synacast/SynaLive/common.dll
    .dll windows:4 windows x86 arch:x86

    4af413a6eee4fec07c0985b05516f3f9


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • PPMNet.exe
    .exe windows:4 windows x86 arch:x86

    ee1df67d522aa8016e9c02a656843980


    Code Sign

    Headers

    Imports

    Sections

  • PPMPlayer.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    d73d55c7d0f60b0b27dfc71c0880385c


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • PSNetwork.dll
    .dll windows:4 windows x86 arch:x86


    Headers

    Exports

    Sections

  • PowerPlayer.dll
    .dll regsvr32 windows:4 windows x86 arch:x86


    Headers

    Exports

    Sections

  • RecordPlan.exe
    .exe windows:4 windows x86 arch:x86

    0c002c2c1c5729e7133e586d5b77fd73


    Headers

    Imports

    Sections

  • Recorder.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    4316aaef3652b911b4a625e3bab765b1


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • TVUAx.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    29fb99baff583352fc14c8c791be329b


    Headers

    Imports

    Exports

    Sections

  • dllcheck.exe
    .exe windows:4 windows x86 arch:x86

    7bc47012256ec9788e27c7c27c1ce1c1


    Headers

    Imports

    Sections

  • msvcp71.dll
    .dll windows:4 windows x86 arch:x86

    5e2398adb60a70c7ab04e7cba75a7983


    Headers

    Imports

    Exports

    Sections

  • msvcr71.dll
    .dll windows:4 windows x86 arch:x86

    7acc8c379c768a1ecd81ec502ff5f33e


    Headers

    Imports

    Exports

    Sections

  • network.dll
    .dll windows:4 windows x86 arch:x86

    a7ecca27bc48740abd24610fd00e04bd


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • plugin/CheckOS.dll
    .dll windows:4 windows x86 arch:x86

    0bd51211f1803ff41ceed9ab8c00dbdd


    Headers

    Imports

    Exports

    Sections

  • ppdoctor.exe
    .exe windows:4 windows x86 arch:x86

    462eabe3a4afd28bcef939ab08a6b8b4


    Code Sign

    Headers

    Imports

    Sections

  • pplivesession.dll
    .dll windows:4 windows x86 arch:x86

    49732021d5d66ecf1993daccd8d373cf


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • ppmate.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    a0944c2fb20de2459834c2cabd2598a1


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • ppmate.exe
    .exe windows:4 windows x86 arch:x86

    93dfe6a28611c7ae00a6530619585981


    Code Sign

    Headers

    Imports

    Sections

  • ppmlist.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    3a2edaa0cad5d25096ddec630117df5e


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • ppstreamsession.dll
    .dll windows:4 windows x86 arch:x86

    155389df29ac066fea2486418dc21303


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • tvuplayersession.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    cc8c4f99ec1bd6abad69c5c27a4c5ae6


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • uninst.exe
    .exe windows:4 windows x86 arch:x86

    4a9446e5cc2412c6405cea69dddb93be


    Headers

    Imports

    Sections

  • $PLUGINSDIR/LangDLL.dll
    .dll windows:4 windows x86 arch:x86

    2db813254ea8b4d2a92d703ecb659f39


    Headers

    Imports

    Exports

    Sections

  • version.ini
  • xpsp2tcppatch.exe
    .exe windows:4 windows x86 arch:x86

    52208d004a89bc8f2b0dc87d13a97979


    Code Sign

    Headers

    Imports

    Sections

  • Modules/sopcast/SopCore.ocx
    .dll regsvr32 windows:4 windows x86 arch:x86

    74cde3a886ed38bb98935593d4cc654a


    Headers

    Imports

    Exports

    Sections

  • Modules/tvants/TvantsX.ocx
    .dll regsvr32 windows:4 windows x86 arch:x86

    e30173e53653c5ecab50382f510f9f28


    Headers

    Imports

    Exports

    Sections

  • Modules/uusee/updateC2.ocx
    .dll regsvr32 windows:4 windows x86 arch:x86


    Headers

    Exports

    Sections

  • out.upx
    .dll windows:4 windows x86 arch:x86


    Headers

    Sections

  • TTlive Player.EXE
    .exe windows:1 windows x86 arch:x86


    Headers

    Sections

  • uninstall.exe
    .exe windows:4 windows x86 arch:x86

    18bc6fa81e19f21156316b1ae696ed6b


    Headers

    Imports

    Sections

  • $PLUGINSDIR/modern-header.bmp
  • ֱ.EXE
    .exe windows:1 windows x86 arch:x86


    Headers

    Sections

  • 安装说明.url
    .url