Overview
overview
10Static
static
10Calamari.zip
windows7-x64
1Calamari.zip
windows10-2004-x64
1Calamari/Calamari.exe
windows7-x64
6Calamari/Calamari.exe
windows10-2004-x64
6Calamari/S...ET.dll
windows7-x64
1Calamari/S...ET.dll
windows10-2004-x64
1Calamari/S...PI.dll
windows7-x64
1Calamari/S...PI.dll
windows10-2004-x64
1Calamari/c...16.txt
windows7-x64
1Calamari/c...16.txt
windows10-2004-x64
1Calamari/j...up.mp3
windows7-x64
1Calamari/j...up.mp3
windows10-2004-x64
6Calamari/sxlib.dll
windows7-x64
3Calamari/sxlib.dll
windows10-2004-x64
3Analysis
-
max time kernel
140s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
16-08-2024 18:05
Behavioral task
behavioral1
Sample
Calamari.zip
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
Calamari.zip
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
Calamari/Calamari.exe
Resource
win7-20240708-en
Behavioral task
behavioral4
Sample
Calamari/Calamari.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
Calamari/ScintillaNET.dll
Resource
win7-20240704-en
Behavioral task
behavioral6
Sample
Calamari/ScintillaNET.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
Calamari/SynapseZAPI.dll
Resource
win7-20240729-en
Behavioral task
behavioral8
Sample
Calamari/SynapseZAPI.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
Calamari/crashlogs/1812_15316.txt
Resource
win7-20240705-en
Behavioral task
behavioral10
Sample
Calamari/crashlogs/1812_15316.txt
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
Calamari/jacked_up.mp3
Resource
win7-20240708-en
Behavioral task
behavioral12
Sample
Calamari/jacked_up.mp3
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
Calamari/sxlib.dll
Resource
win7-20240705-en
Behavioral task
behavioral14
Sample
Calamari/sxlib.dll
Resource
win10v2004-20240802-en
General
-
Target
Calamari/jacked_up.mp3
-
Size
4.0MB
-
MD5
66ec6b7ee0786cba5a3ae13e4e4e20ba
-
SHA1
612861268f56692069b60a0218826cbf8e593ede
-
SHA256
fd0aa203f284a09dab3b6a24118db8ed30ad5fad2591b3367111bf27eb4df617
-
SHA512
6ad4182771b0e983394a4446b61eb6b43793b6db85a3e9035823b053594ae88bbd5da595b83e817b4739f2b4c5dd209546e4264a76d397c9ad71771a64329d3b
-
SSDEEP
98304:Tz9Vs3NlAYgX+bHn8DqaXP8J3tqnZaAITKdNi5zAwY:TzyNCYbbHEI0ZOTUjwY
Malware Config
Signatures
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
vlc.exepid process 2424 vlc.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
vlc.exepid process 2424 vlc.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
vlc.exedescription pid process Token: 33 2424 vlc.exe Token: SeIncBasePriorityPrivilege 2424 vlc.exe -
Suspicious use of FindShellTrayWindow 6 IoCs
Processes:
vlc.exepid process 2424 vlc.exe 2424 vlc.exe 2424 vlc.exe 2424 vlc.exe 2424 vlc.exe 2424 vlc.exe -
Suspicious use of SendNotifyMessage 5 IoCs
Processes:
vlc.exepid process 2424 vlc.exe 2424 vlc.exe 2424 vlc.exe 2424 vlc.exe 2424 vlc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
vlc.exepid process 2424 vlc.exe
Processes
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\Calamari\jacked_up.mp3"1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2424