ducktail | b129e97f69d29879931e00f9b7cc1827292ef5c1b8d9d368f26ecf0a8508effe

General

Target
Open AI Sora 4.0 Verison 4.89.zip
Size 186.1MB
Sample241016-sl557sweja
SHA256 b129e97f69d29879931e00f9b7cc1827292ef5c1b8d9d368f26ecf0a8508effe
MD5 a427239a82bd996d4759030297a859a7
SHA1 28100205b814f18d9c91ec55c0ff4a090ecef7d6
SHA512 a0e9f2a085c1ada27ac9a93074688cc59356d257e2e46dd5ba6c66a5c7909835fa43942b3cde493ecd28afa71b36f88ffe4897c93a408af3770cf53022812732
SSDEEP 3145728:ezSk13XnzjPJhUGVQ0zGTe23PuxSXTQ3e68p8/vLZEvx:ezSkBzjPflxYTqH8Ezw
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Targets

- Target
  Open AI Sora 4.0_Setup_Version 5.96.exe
- Size 349KB
- SHA256 92a304e64a65bbab9a45b6cb0d3f701fe0803616d23f5f9b860d3b00488f2482
- MD5 ceb804d5dcb9e543549fdf842611dcc3
- SHA1 630b4a55ec6ea4acb163422c1938ddb389340af7
- SHA512 9c380596001d7ed1ba18b826b13ac28fd9b3fed16a87fa1ed648f4534431e3dc756e3179ad5e5c12f1778ebe028446fb05597d3fc347221a6611f7af88998d82
- SSDEEP 3072:sV/GaFJJZ+Qima9IjVe9+L+xZ2N4OCSPQwZkXkAy5vHOQXQWXUjzBW2HwbvWUhIj:6Bmm+aVecLuK0uPZQk4QU9Wew7G
- MD5 SHA1 SHA512 SSDEEP
Score

6^/10

discovery persistence
- Adds Run key to start application
  persistence
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1 behavioral2
- Target
  app-5.96.0/Open AI Sora 4.0_Setup_Version 5.96.exe
- Size 744.1MB
- SHA256 99a4657b318daeec77a6ea8eb8082a16d58dd18c179e5df6f01e687bf99be58b
- MD5 33e4c114789665f10c3f11ffea9d2ba3
- SHA1 5fefd509d0e38b6bed0867fb9780ff1208d5cc6a
- SHA512 c16b9cb968a03f852046919f34b975363eaf8082510c6cc3da119ddaac107d3a65da0d02b5c1906396f8a1abe59cf3dbbdca568eaff106828cf0975c00410781
- SSDEEP 3145728:/hSx3pv753l36cJoYuuuuuuuvZzwJgFoR:pSnT53hVm6R
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10

discovery persistence spyware stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral3 behavioral4