Overview
overview
7Static
static
7okayfreedom-vpn.exe
windows7-x64
7okayfreedom-vpn.exe
windows10-2004-x64
7$PLUGINSDI...es.dll
windows7-x64
3$PLUGINSDI...es.dll
windows10-2004-x64
3$PLUGINSDI...SC.dll
windows7-x64
3$PLUGINSDI...SC.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDIR/UAC.dll
windows7-x64
3$PLUGINSDIR/UAC.dll
windows10-2004-x64
3$PLUGINSDI...gs.dll
windows7-x64
3$PLUGINSDI...gs.dll
windows10-2004-x64
3$PLUGINSDI...om.dll
windows7-x64
7$PLUGINSDI...om.dll
windows10-2004-x64
77-zip/7-zip.chm
windows7-x64
17-zip/7-zip.chm
windows10-2004-x64
17-zip/7za.exe
windows7-x64
37-zip/7za.exe
windows10-2004-x64
3OkayFreedomClient.exe
windows7-x64
1OkayFreedomClient.exe
windows10-2004-x64
1res/TEXTST...LL.vbs
windows7-x64
1res/TEXTST...LL.vbs
windows10-2004-x64
1client.dll
windows7-x64
3client.dll
windows10-2004-x64
3concrt140.dll
windows7-x64
3concrt140.dll
windows10-2004-x64
3msvcp140.dll
windows7-x64
3msvcp140.dll
windows10-2004-x64
3openvpn/7/tap0901.sys
windows10-2004-x64
1openvpn/addtap.bat
windows7-x64
1openvpn/addtap.bat
windows10-2004-x64
1openvpn/deltapall.bat
windows7-x64
1Analysis
-
max time kernel
94s -
max time network
135s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
14-09-2024 16:05
Behavioral task
behavioral1
Sample
okayfreedom-vpn.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
okayfreedom-vpn.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/Processes.dll
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/Processes.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/SimpleSC.dll
Resource
win7-20240708-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/SimpleSC.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240708-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
$PLUGINSDIR/UAC.dll
Resource
win7-20240729-en
Behavioral task
behavioral10
Sample
$PLUGINSDIR/UAC.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
$PLUGINSDIR/nsRandom.dll
Resource
win7-20240708-en
Behavioral task
behavioral14
Sample
$PLUGINSDIR/nsRandom.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral15
Sample
7-zip/7-zip.chm
Resource
win7-20240704-en
Behavioral task
behavioral16
Sample
7-zip/7-zip.chm
Resource
win10v2004-20240802-en
Behavioral task
behavioral17
Sample
7-zip/7za.exe
Resource
win7-20240729-en
Behavioral task
behavioral18
Sample
7-zip/7za.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral19
Sample
OkayFreedomClient.exe
Resource
win7-20240903-en
Behavioral task
behavioral20
Sample
OkayFreedomClient.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral21
Sample
res/TEXTSTRINGTABLE/EN_STEGANOSUIDLL.vbs
Resource
win7-20240903-en
Behavioral task
behavioral22
Sample
res/TEXTSTRINGTABLE/EN_STEGANOSUIDLL.vbs
Resource
win10v2004-20240802-en
Behavioral task
behavioral23
Sample
client.dll
Resource
win7-20240903-en
Behavioral task
behavioral24
Sample
client.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral25
Sample
concrt140.dll
Resource
win7-20240708-en
Behavioral task
behavioral26
Sample
concrt140.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral27
Sample
msvcp140.dll
Resource
win7-20240903-en
Behavioral task
behavioral28
Sample
msvcp140.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral29
Sample
openvpn/7/tap0901.sys
Resource
win10v2004-20240802-en
Behavioral task
behavioral30
Sample
openvpn/addtap.bat
Resource
win7-20240903-en
Behavioral task
behavioral31
Sample
openvpn/addtap.bat
Resource
win10v2004-20240802-en
Behavioral task
behavioral32
Sample
openvpn/deltapall.bat
Resource
win7-20240903-en
General
-
Target
7-zip/7-zip.chm
-
Size
88KB
-
MD5
eb101ac9dc4db7c05ffb636c629384ef
-
SHA1
eee66e6bb8b4167b7adaa4e30219ddbdd0b1abe0
-
SHA256
bcd680a6b67fb8fc518430ecd459608b693842d54b3256bce608362f4dba8d2e
-
SHA512
9d311f8197cdb5a29357dd0541f059f44f6bc5be5cdcfdc5be0651e64328b69504db33e726bb56ce03da2aa395bb23fa35bdb25c71f29976aca90b01638c62c2
-
SSDEEP
1536:WdGioBPOzWtepmt0CtWUZ/+rSfff7ehP2NGwJCPn3diFefcI9F0VYapTrsoBk:Z4G0mdZ8cff7ehuH4P3diFOcyq62TQ7
Malware Config
Signatures
-
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
hh.exepid process 564 hh.exe 564 hh.exe