faf416a42199707bb6a33297ac7ba0102d82b65ef17db1064369dfc253d5be75

Sharing

Copy URL

Twitter E-mail

General

Target

Sony Vegas Pro 18.0.rar
Size

693.3MB
Sample

240522-zkjn5sfh9y
MD5

4aeb2a7febdd19801d762d6017198a5c
SHA1

177b7fa713355a30eaf3cbb2c26caebbe3a9aceb
SHA256

faf416a42199707bb6a33297ac7ba0102d82b65ef17db1064369dfc253d5be75
SHA512

dd8d5cb6226e413106e9b4b851ed66d202ec32d44b976390023dcf3ca2680e1e577dfa91dc0f10b2295982a00bdf98d0e6c77ab1e3ac05d1ef246bacd8dd2c2e
SSDEEP

12582912:BrBUd1bnChyabX/0ogGpAl6CowW0wo6QLoiqHUkRt0Y4EY4AQQXuzFoZJeq9:ZGbcDbcUCHBb6gkRt0Ypfvq9

Score

7^/10

persistence

Malware Config

Targets

- Target
  
  Sony Vegas Pro 18.0/Replace Files and folders/protein/Protein_x64.4.1.dll
- Size
  
  3KB
- MD5
  
  4f1ba0bef9467b2525ec453792461b31
- SHA1
  
  799fded6489ad4df7d3459cc3bb7ef167c04da6c
- SHA256
  
  d328c59733c4953ca4a923ccf04b37a4de8839e54d9e8901730797311c7ab6b8
- SHA512
  
  cf9677fbeba412a8a43eda4f67dc2711b89e8262564e425b949ce8e52be75bbbfc75ced1492d7b84113f7cf373f4d3cb1b5ad5e43d11c4fe40749a803448db9c
Score

1^/10
behavioral1 behavioral2 behavioral3
- Target
  
  Sony Vegas Pro 18.0/Replace Files and folders/vegas180.exe
- Size
  
  45.3MB
- MD5
  
  d932a569ee0f966bd8e0be4912354dbf
- SHA1
  
  f3f4bafb99ddbda654881f57e5c2e71f15290395
- SHA256
  
  7f486830c02c2b9f66b62068b5ac7b44d84632a4a9d95d5eb57e26cd11201b23
- SHA512
  
  3fd11f79e864e67a7baf01923adfe31d14e91f13316dcae2daccbe9a5cd0d8d4bff4cb87b2ae0bc910b024114ec1f0785e8c3f2c5b2aa83da8625ff6b29a2e5e
- SSDEEP
  
  786432:roJ+9MQQmondAy+d0mpjsHBOOopBnktRSYSOfvz08BCjjUOE:roJk1QF0tpjMAZ/ktijjUJ
Score

1^/10
behavioral4 behavioral5 behavioral6
- Target
  
  Sony Vegas Pro 18.0/Setup.exe
- Size
  
  693.2MB
- MD5
  
  1afd68147ac485753917930116210a40
- SHA1
  
  8c8deec48a8a7c3d4e5af8e26e8b3d09decad08b
- SHA256
  
  3988557312ceca76bee86e2df0c34f2cdc7b2dc370846ba8390ae1d36d61e900
- SHA512
  
  4cd02d60b7f30c7b5e08e312330342c124c9fb4cda01ba99e8d765a4040ee7832760a25c1d9e32a5e5a3a4521a4bd2c2a75a6b48395f32da1959f2117dadeacb
- SSDEEP
  
  12582912:bGbk9hNMUyBXnkRSuLBCF8WwX2VX0I/wY3jCMQRoMCb+RSGcYHqEtZF8:lM5XnVTSX2VX0I/fjCpob+RSGdx8
Score

7^/10

persistence
- Executes dropped EXE
- Loads dropped DLL
- Registers COM server for autorun
  persistence
- Blocklisted process makes network request
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral7 behavioral8 behavioral9