Overview
overview
8Static
static
1Payload/Ma...32.png
windows7-x64
3Payload/Ma...32.png
windows10-2004-x64
3Payload/Ma...38.png
windows7-x64
3Payload/Ma...38.png
windows10-2004-x64
3Payload/Ma...48.png
windows7-x64
3Payload/Ma...48.png
windows10-2004-x64
3Payload/Ma...72.png
windows7-x64
3Payload/Ma...72.png
windows10-2004-x64
3Payload/Ma...t.json
windows7-x64
3Payload/Ma...t.json
windows10-2004-x64
3Payload/Ma...up.css
windows7-x64
3Payload/Ma...up.css
windows10-2004-x64
7Payload/Ma...es.xml
windows7-x64
3Payload/Ma...es.xml
windows10-2004-x64
1Payload/Ma...pi.cer
windows7-x64
8Payload/Ma...pi.cer
windows10-2004-x64
8Payload/Ma...ck.mp4
windows7-x64
1Payload/Ma...ck.mp4
windows10-2004-x64
6Payload/Ma.../c.wav
windows7-x64
1Payload/Ma.../c.wav
windows10-2004-x64
6Payload/Ma...er.cer
windows7-x64
8Payload/Ma...er.cer
windows10-2004-x64
8Payload/Ma...vision
windows7-x64
3Payload/Ma...vision
windows10-2004-x64
3Payload/Ma...eo.mov
windows7-x64
1Payload/Ma...eo.mov
windows10-2004-x64
6Payload/Ma...al.mp4
windows7-x64
1Payload/Ma...al.mp4
windows10-2004-x64
6Analysis
-
max time kernel
140s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
15/10/2024, 23:54
Static task
static1
Behavioral task
behavioral1
Sample
Payload/Mabz.app/PlugIns/CAREx.appex/images/toolbar-icon-32.png
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
Payload/Mabz.app/PlugIns/CAREx.appex/images/toolbar-icon-32.png
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
Payload/Mabz.app/PlugIns/CAREx.appex/images/toolbar-icon-38.png
Resource
win7-20241010-en
Behavioral task
behavioral4
Sample
Payload/Mabz.app/PlugIns/CAREx.appex/images/toolbar-icon-38.png
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
Payload/Mabz.app/PlugIns/CAREx.appex/images/toolbar-icon-48.png
Resource
win7-20240729-en
Behavioral task
behavioral6
Sample
Payload/Mabz.app/PlugIns/CAREx.appex/images/toolbar-icon-48.png
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
Payload/Mabz.app/PlugIns/CAREx.appex/images/toolbar-icon-72.png
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
Payload/Mabz.app/PlugIns/CAREx.appex/images/toolbar-icon-72.png
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
Payload/Mabz.app/PlugIns/CAREx.appex/manifest.json
Resource
win7-20240708-en
Behavioral task
behavioral10
Sample
Payload/Mabz.app/PlugIns/CAREx.appex/manifest.json
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
Payload/Mabz.app/PlugIns/CAREx.appex/popup.css
Resource
win7-20241010-en
Behavioral task
behavioral12
Sample
Payload/Mabz.app/PlugIns/CAREx.appex/popup.css
Resource
win10v2004-20241007-en
Behavioral task
behavioral13
Sample
Payload/Mabz.app/_CodeSignature/CodeResources.xml
Resource
win7-20240903-en
Behavioral task
behavioral14
Sample
Payload/Mabz.app/_CodeSignature/CodeResources.xml
Resource
win10v2004-20241007-en
Behavioral task
behavioral15
Sample
Payload/Mabz.app/api.cer
Resource
win7-20240903-en
Behavioral task
behavioral16
Sample
Payload/Mabz.app/api.cer
Resource
win10v2004-20241007-en
Behavioral task
behavioral17
Sample
Payload/Mabz.app/back.mp4
Resource
win7-20240729-en
Behavioral task
behavioral18
Sample
Payload/Mabz.app/back.mp4
Resource
win10v2004-20241007-en
Behavioral task
behavioral19
Sample
Payload/Mabz.app/c.wav
Resource
win7-20240903-en
Behavioral task
behavioral20
Sample
Payload/Mabz.app/c.wav
Resource
win10v2004-20241007-en
Behavioral task
behavioral21
Sample
Payload/Mabz.app/cer.cer
Resource
win7-20241010-en
Behavioral task
behavioral22
Sample
Payload/Mabz.app/cer.cer
Resource
win10v2004-20241007-en
Behavioral task
behavioral23
Sample
Payload/Mabz.app/embedded.mobileprovision
Resource
win7-20241010-en
Behavioral task
behavioral24
Sample
Payload/Mabz.app/embedded.mobileprovision
Resource
win10v2004-20241007-en
Behavioral task
behavioral25
Sample
Payload/Mabz.app/onVideo.mov
Resource
win7-20240729-en
Behavioral task
behavioral26
Sample
Payload/Mabz.app/onVideo.mov
Resource
win10v2004-20241007-en
Behavioral task
behavioral27
Sample
Payload/Mabz.app/tutorial.mp4
Resource
win7-20240903-en
Behavioral task
behavioral28
Sample
Payload/Mabz.app/tutorial.mp4
Resource
win10v2004-20241007-en
General
-
Target
Payload/Mabz.app/back.mp4
-
Size
1.1MB
-
MD5
47bf44170a778891f33ba0303eb1f8ca
-
SHA1
7a9fd4e37fb3ad35dce325a3de1e672e5c0f41ab
-
SHA256
72eaa3f85cdd325c38987925c84af255ba88fece77c3ea94d0fc679ad71ac9f8
-
SHA512
dac266eb49bf0ccb59425e798d9d79889fe7e34eb6b0bf4782d7afb57c0fb7926396ea9db51dd527c9b1a2af0b99d5927ff888cd97a4d3017b6e31b279e7b8aa
-
SSDEEP
24576:LGJgV9LV1Yv1x0xw24+Ub984a2aecGpuTZ:aCLLPQ1IU+698maZ
Malware Config
Signatures
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 1520 vlc.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1520 vlc.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1520 vlc.exe 1520 vlc.exe 1520 vlc.exe 1520 vlc.exe 1520 vlc.exe 1520 vlc.exe 1520 vlc.exe 1520 vlc.exe 1520 vlc.exe 1520 vlc.exe 1520 vlc.exe 1520 vlc.exe 1520 vlc.exe 1520 vlc.exe 1520 vlc.exe 1520 vlc.exe 1520 vlc.exe 1520 vlc.exe 1520 vlc.exe 1520 vlc.exe 1520 vlc.exe 1520 vlc.exe 1520 vlc.exe 1520 vlc.exe 1520 vlc.exe 1520 vlc.exe 1520 vlc.exe 1520 vlc.exe 1520 vlc.exe 1520 vlc.exe 1520 vlc.exe 1520 vlc.exe 1520 vlc.exe 1520 vlc.exe 1520 vlc.exe 1520 vlc.exe 1520 vlc.exe 1520 vlc.exe 1520 vlc.exe 1520 vlc.exe 1520 vlc.exe 1520 vlc.exe 1520 vlc.exe 1520 vlc.exe 1520 vlc.exe 1520 vlc.exe 1520 vlc.exe 1520 vlc.exe 1520 vlc.exe 1520 vlc.exe 1520 vlc.exe 1520 vlc.exe 1520 vlc.exe 1520 vlc.exe 1520 vlc.exe 1520 vlc.exe 1520 vlc.exe 1520 vlc.exe 1520 vlc.exe 1520 vlc.exe 1520 vlc.exe 1520 vlc.exe 1520 vlc.exe 1520 vlc.exe -
Suspicious use of SendNotifyMessage 15 IoCs
pid Process 1520 vlc.exe 1520 vlc.exe 1520 vlc.exe 1520 vlc.exe 1520 vlc.exe 1520 vlc.exe 1520 vlc.exe 1520 vlc.exe 1520 vlc.exe 1520 vlc.exe 1520 vlc.exe 1520 vlc.exe 1520 vlc.exe 1520 vlc.exe 1520 vlc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1520 vlc.exe
Processes
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\Payload\Mabz.app\back.mp4"1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1520