Overview
overview
8Static
static
1Payload/Ma...32.png
windows7-x64
3Payload/Ma...32.png
windows10-2004-x64
3Payload/Ma...38.png
windows7-x64
3Payload/Ma...38.png
windows10-2004-x64
3Payload/Ma...48.png
windows7-x64
3Payload/Ma...48.png
windows10-2004-x64
3Payload/Ma...72.png
windows7-x64
3Payload/Ma...72.png
windows10-2004-x64
3Payload/Ma...t.json
windows7-x64
3Payload/Ma...t.json
windows10-2004-x64
3Payload/Ma...up.css
windows7-x64
3Payload/Ma...up.css
windows10-2004-x64
7Payload/Ma...es.xml
windows7-x64
3Payload/Ma...es.xml
windows10-2004-x64
1Payload/Ma...pi.cer
windows7-x64
8Payload/Ma...pi.cer
windows10-2004-x64
8Payload/Ma...ck.mp4
windows7-x64
1Payload/Ma...ck.mp4
windows10-2004-x64
6Payload/Ma.../c.wav
windows7-x64
1Payload/Ma.../c.wav
windows10-2004-x64
6Payload/Ma...er.cer
windows7-x64
8Payload/Ma...er.cer
windows10-2004-x64
8Payload/Ma...vision
windows7-x64
3Payload/Ma...vision
windows10-2004-x64
3Payload/Ma...eo.mov
windows7-x64
1Payload/Ma...eo.mov
windows10-2004-x64
6Payload/Ma...al.mp4
windows7-x64
1Payload/Ma...al.mp4
windows10-2004-x64
6Analysis
-
max time kernel
147s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
15/10/2024, 23:54
Static task
static1
Behavioral task
behavioral1
Sample
Payload/Mabz.app/PlugIns/CAREx.appex/images/toolbar-icon-32.png
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
Payload/Mabz.app/PlugIns/CAREx.appex/images/toolbar-icon-32.png
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
Payload/Mabz.app/PlugIns/CAREx.appex/images/toolbar-icon-38.png
Resource
win7-20241010-en
Behavioral task
behavioral4
Sample
Payload/Mabz.app/PlugIns/CAREx.appex/images/toolbar-icon-38.png
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
Payload/Mabz.app/PlugIns/CAREx.appex/images/toolbar-icon-48.png
Resource
win7-20240729-en
Behavioral task
behavioral6
Sample
Payload/Mabz.app/PlugIns/CAREx.appex/images/toolbar-icon-48.png
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
Payload/Mabz.app/PlugIns/CAREx.appex/images/toolbar-icon-72.png
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
Payload/Mabz.app/PlugIns/CAREx.appex/images/toolbar-icon-72.png
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
Payload/Mabz.app/PlugIns/CAREx.appex/manifest.json
Resource
win7-20240708-en
Behavioral task
behavioral10
Sample
Payload/Mabz.app/PlugIns/CAREx.appex/manifest.json
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
Payload/Mabz.app/PlugIns/CAREx.appex/popup.css
Resource
win7-20241010-en
Behavioral task
behavioral12
Sample
Payload/Mabz.app/PlugIns/CAREx.appex/popup.css
Resource
win10v2004-20241007-en
Behavioral task
behavioral13
Sample
Payload/Mabz.app/_CodeSignature/CodeResources.xml
Resource
win7-20240903-en
Behavioral task
behavioral14
Sample
Payload/Mabz.app/_CodeSignature/CodeResources.xml
Resource
win10v2004-20241007-en
Behavioral task
behavioral15
Sample
Payload/Mabz.app/api.cer
Resource
win7-20240903-en
Behavioral task
behavioral16
Sample
Payload/Mabz.app/api.cer
Resource
win10v2004-20241007-en
Behavioral task
behavioral17
Sample
Payload/Mabz.app/back.mp4
Resource
win7-20240729-en
Behavioral task
behavioral18
Sample
Payload/Mabz.app/back.mp4
Resource
win10v2004-20241007-en
Behavioral task
behavioral19
Sample
Payload/Mabz.app/c.wav
Resource
win7-20240903-en
Behavioral task
behavioral20
Sample
Payload/Mabz.app/c.wav
Resource
win10v2004-20241007-en
Behavioral task
behavioral21
Sample
Payload/Mabz.app/cer.cer
Resource
win7-20241010-en
Behavioral task
behavioral22
Sample
Payload/Mabz.app/cer.cer
Resource
win10v2004-20241007-en
Behavioral task
behavioral23
Sample
Payload/Mabz.app/embedded.mobileprovision
Resource
win7-20241010-en
Behavioral task
behavioral24
Sample
Payload/Mabz.app/embedded.mobileprovision
Resource
win10v2004-20241007-en
Behavioral task
behavioral25
Sample
Payload/Mabz.app/onVideo.mov
Resource
win7-20240729-en
Behavioral task
behavioral26
Sample
Payload/Mabz.app/onVideo.mov
Resource
win10v2004-20241007-en
Behavioral task
behavioral27
Sample
Payload/Mabz.app/tutorial.mp4
Resource
win7-20240903-en
Behavioral task
behavioral28
Sample
Payload/Mabz.app/tutorial.mp4
Resource
win10v2004-20241007-en
General
-
Target
Payload/Mabz.app/onVideo.mov
-
Size
4.6MB
-
MD5
b61a8e8b22a2e8437bec98bc0dfc836e
-
SHA1
f11ea0029ef2af666c1b0407f56c8a632f1b2fa9
-
SHA256
22f52fa85bd35a90cc6c008f34434c436bdefc14c01177a8c25ba9bd2e7401e5
-
SHA512
4d217faa7f664e61b20a397e61c629f2729289d22b6c6811c92d02f38891ac3f84107064a4b91eb83e339b5291f93c78dda49af7b5173c583bfeeebcfb6005ce
-
SSDEEP
98304:P8myUtCEPbJt6DOWvwIm+m9r53wf2YGgcMuy4A:lymPlb+Ir9JMu6
Malware Config
Signatures
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2500 vlc.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2500 vlc.exe -
Suspicious use of FindShellTrayWindow 58 IoCs
pid Process 2500 vlc.exe 2500 vlc.exe 2500 vlc.exe 2500 vlc.exe 2500 vlc.exe 2500 vlc.exe 2500 vlc.exe 2500 vlc.exe 2500 vlc.exe 2500 vlc.exe 2500 vlc.exe 2500 vlc.exe 2500 vlc.exe 2500 vlc.exe 2500 vlc.exe 2500 vlc.exe 2500 vlc.exe 2500 vlc.exe 2500 vlc.exe 2500 vlc.exe 2500 vlc.exe 2500 vlc.exe 2500 vlc.exe 2500 vlc.exe 2500 vlc.exe 2500 vlc.exe 2500 vlc.exe 2500 vlc.exe 2500 vlc.exe 2500 vlc.exe 2500 vlc.exe 2500 vlc.exe 2500 vlc.exe 2500 vlc.exe 2500 vlc.exe 2500 vlc.exe 2500 vlc.exe 2500 vlc.exe 2500 vlc.exe 2500 vlc.exe 2500 vlc.exe 2500 vlc.exe 2500 vlc.exe 2500 vlc.exe 2500 vlc.exe 2500 vlc.exe 2500 vlc.exe 2500 vlc.exe 2500 vlc.exe 2500 vlc.exe 2500 vlc.exe 2500 vlc.exe 2500 vlc.exe 2500 vlc.exe 2500 vlc.exe 2500 vlc.exe 2500 vlc.exe 2500 vlc.exe -
Suspicious use of SendNotifyMessage 14 IoCs
pid Process 2500 vlc.exe 2500 vlc.exe 2500 vlc.exe 2500 vlc.exe 2500 vlc.exe 2500 vlc.exe 2500 vlc.exe 2500 vlc.exe 2500 vlc.exe 2500 vlc.exe 2500 vlc.exe 2500 vlc.exe 2500 vlc.exe 2500 vlc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2500 vlc.exe
Processes
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\Payload\Mabz.app\onVideo.mov"1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2500