Overview

overview

7

Static

static

3

FabFilter_KeyGen.exe

windows10-2004-x64

7

$TEMP/BASSMOD.dll

windows10-2004-x64

1

$TEMP/R2RFBFKG.dll

windows10-2004-x64

3

$TEMP/keygen.exe

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    FabFilter_KeyGen.exe

  • Size

    595KB

  • Sample

    240424-gqq2asfd6s

  • MD5

    c482cbba8d390a0488f33ef36daf2a9e

  • SHA1

    cefb2cd5a09c7f20bb42187acae38fbd3f2da4da

  • SHA256

    7d35e4d663f952f93ef7b271772fc9ce9bc2ff22cb07d9a99f48e47b21517a28

  • SHA512

    b18575e6537d936cd97a0efbf9805081d3e97c540022b46104905a30eae404c0bfbab33a09cf282bfb5cad834886c27e21fda5198bac8d431d5a75af236cab78

  • SSDEEP

    12288:XYkc9t2Sll/5+Fu/dCzO6bqTYFD3fUtPPR5HnCYLJZKrdezL:XYkcL54S4RbYIz89PR1LGBuL

Score
7/10

Malware Config

Targets

    • Target

      FabFilter_KeyGen.exe

    • Size

      595KB

    • MD5

      c482cbba8d390a0488f33ef36daf2a9e

    • SHA1

      cefb2cd5a09c7f20bb42187acae38fbd3f2da4da

    • SHA256

      7d35e4d663f952f93ef7b271772fc9ce9bc2ff22cb07d9a99f48e47b21517a28

    • SHA512

      b18575e6537d936cd97a0efbf9805081d3e97c540022b46104905a30eae404c0bfbab33a09cf282bfb5cad834886c27e21fda5198bac8d431d5a75af236cab78

    • SSDEEP

      12288:XYkc9t2Sll/5+Fu/dCzO6bqTYFD3fUtPPR5HnCYLJZKrdezL:XYkcL54S4RbYIz89PR1LGBuL

    Score
    7/10

    • Executes dropped EXE

    • Loads dropped DLL

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1

    • Target

      $TEMP/BASSMOD.dll

    • Size

      33KB

    • MD5

      e4ec57e8508c5c4040383ebe6d367928

    • SHA1

      b22bcce36d9fdeae8ab7a7ecc0b01c8176648d06

    • SHA256

      8ad9e47693e292f381da42ddc13724a3063040e51c26f4ca8e1f8e2f1ddd547f

    • SHA512

      77d5cf66caf06e192e668fae2b2594e60a498e8e0ccef5b09b9710721a4cdb0c852d00c446fd32c5b5c85e739de2e73cb1f1f6044879fe7d237341bbb6f27822

    • SSDEEP

      768:qQmS5iUgi5czW+DlrQOS1DeDdjgNtbX4O6DHix84H0:qQz5Tgof+DdpS1+djctLSHiZ0

    Score
    1/10
    behavioral2

    • Target

      $TEMP/R2RFBFKG.dll

    • Size

      91KB

    • MD5

      62695f6fa2a85fc9993f57dfcbdc2749

    • SHA1

      07a9b478df63fba4cf3002974b4cf56b404d0914

    • SHA256

      1ab33027c4965b027298651781a1c780c272818da189e2c3a8101ac578069260

    • SHA512

      69dd0de913629853400106811bffdebd8ec2037c93c9f9820d3f140e84576912de3ab57434086e20cf8698185015c27fa307e06047e2219dcf38a927a36f3c95

    • SSDEEP

      1536:NWTHBAtr5cPLOWpTo5iw4AInivibbb+S4A39:0ThAtr5cPLOiaBRIig3

    Score
    3/10
    behavioral3

    • Target

      $TEMP/keygen.exe

    • Size

      1.0MB

    • MD5

      d46b062d7f8ecf948d579ebe809cd597

    • SHA1

      bba400b955bca8729bfdffb343d3b9f54cbb42f3

    • SHA256

      9dca86bab19f5f0cd7c71ac4797921c93c03894f2378b8b3f4e97d742c9c2ea3

    • SHA512

      2c93a1e061a9a77b5c4b5ba8e5f6b4809f225c28b9279cf341c54b8cb586834c7e1ca583df8d8ad4ce8458fcdee306b9f43043b5c2e3f9441f024b4591ce7d49

    • SSDEEP

      6144:bcmzikEPDonRgNgz1+hw6hNgPfHv9PAimIAOhn43xFLNhBa41v2jrPzYjYXlMyhQ:bc/kEPDonR6Y436vRrynhSlMyhq8uH

    Score
    1/10
    behavioral4

MITRE ATT&CK Enterprise v15

Tasks