2505c88de000799c274e8abd09743295b23a4b5c5bf5d3a3c294b2e001585dba

Sharing

Copy URL Twitter E-mail

General

Target
OBS-Studio-31.1.2-Windows-x64-Installer.exe
Size 150.0MB
Sample260504-bfzb2aew4p
SHA256 2505c88de000799c274e8abd09743295b23a4b5c5bf5d3a3c294b2e001585dba
MD5 a550562da21ac5147483b1cce7543429
SHA1 2d8e4d2740c2f6746f842e0fa22985f39c7f425b
SHA512 8322fd6be7bae60bfd2862d4ff878d8d8d3ccea5a9c59773ddd5978caab5b31b4662a2d88c6f69ca9c5d439c659c9aa046a073461cd71f58963547f2c4b15870
SSDEEP 3145728:qY3UcfoO70lEU86PZ/5f1wXUNtTv099GL0eqCwSVzu:dg6O/xZBf14UNRvwywCwSlu
TLSH
T1A47833001AED5C9ADF4ADF751B4FC9D5E3F8F3F0C855362295090E22EA643D7A608A4B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  OBS-Studio-31.1.2-Windows-x64-Installer.exe
- Size 150.0MB
- SHA256 2505c88de000799c274e8abd09743295b23a4b5c5bf5d3a3c294b2e001585dba
- MD5 a550562da21ac5147483b1cce7543429
- SHA1 2d8e4d2740c2f6746f842e0fa22985f39c7f425b
- SHA512 8322fd6be7bae60bfd2862d4ff878d8d8d3ccea5a9c59773ddd5978caab5b31b4662a2d88c6f69ca9c5d439c659c9aa046a073461cd71f58963547f2c4b15870
- SSDEEP 3145728:qY3UcfoO70lEU86PZ/5f1wXUNtTv099GL0eqCwSVzu:dg6O/xZBf14UNRvwywCwSlu
- TLSH
  T1A47833001AED5C9ADF4ADF751B4FC9D5E3F8F3F0C855362295090E22EA643D7A608A4B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery persistence privilege_escalation ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2
- Target
  $APPDATA/obs-studio-hook/graphics-hook32.dll
- Size 242KB
- SHA256 9943d4a903771d0876af3039fb3a2ef8ed5696b7996195ea9e867d166e5d7ee2
- MD5 3231a269ee8417bc5323c1045fb01f5c
- SHA1 be1f3ffec4e18806834c3f95f784596d053bd4a6
- SHA512 572504d1959b1c90cc62178fa10946db4dd4e9cdda4523fe7461d04177e210a86435d2b3fa36552cacd5ef1682e87ce13f9a1d552f7b68839ba425a06051e997
- SSDEEP 6144:sgfkSFE8IFJpetU9YiwznRYRjZpJBMNFxkNYrtprwahcWr:F8rVJpeeYiwznRYPBgbkNYrtprw2cWr
- TLSH
  T17134AE02B0509575C5BE0A3459B6F7759E7CA9702BB485EBA7704CBCCE202C2A97CE1F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $APPDATA/obs-studio-hook/graphics-hook64.dll
- Size 296KB
- SHA256 945c312cda7b4551dbf7515c36b17907334b318f480c10f3621626e937dcb9f4
- MD5 eca11c850b76a03e5e7c58f75e9cd472
- SHA1 b16eb9bad8d47cdb5aa25a9951a2ee04f473a0ea
- SHA512 299530fa7c5a6c80f6a14865a2cda76dabf4e917ff215d1f662f7d8e30367afe3e8370563a4019c1b1fac856048a28984ed4bcc7e5cebfbf2cdfc7f926c5da9f
- SSDEEP 6144:BT0bzhLenwJjb1XftCAIYAs1kNYrtprwkR:BT0bzxtxb11iYAs1kNYrtprw+
- TLSH
  T141547C1AB7A508E6E8778279C4A3A116F7F1B8650370C3DB232141A99F733E0AD3E745
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  $PLUGINSDIR/InstallOptions.dll
- Size 15KB
- SHA256 89dd7d646278d8bfc41d5446bdc348b9a9afaa832abf02c1396272bb7ac7262a
- MD5 d1eefb07abc2577dfb92eb2e95a975e4
- SHA1 0584c2b1807bc3bd10d4b60d2d23eeb0e6832ca2
- SHA512 eaffd9940b1df59e95e2adb79b3b6415fff5bf196ebea5fe625a6c52e552a00b44d985a36a8dd9eb33eba2425ffea4244ed07a75d87284ff51ec9f9a5e1ac65e
- SSDEEP 192:E6GQtZkTktEQUrJaZfuyCnSmUsv3sY7L7cW8Y6Q86QvoT311929WtshLAzgSrX8:E6Nt+4t7uJalUnGesY7Lt8nC3/Yosa
- TLSH
  T186624D1137D598B3E2E62A797EF377138FA5F722A4428E0BC7332E4678565805D78311
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $PLUGINSDIR/OBSInstallerUtils.dll
- Size 426KB
- SHA256 1d84aa191fbbd842d5eeed302195579de1256a9acb980308bf31a631ac01e530
- MD5 e1f825260e7224ef0526514754f7d0e8
- SHA1 553d67289b039ffea5d8b59f509b9265dca2ba19
- SHA512 b9453eb4ae6edbfd86e438ed0825725ab91100b8403a933bb0e359703be462f6d3d37f8bfb32eeae375a46512c619370f9802925ae0d8898f540f933b05b281f
- SSDEEP 6144:+fxKVpKLECSq5oMIMOfv6yZsA1eetlFnnI8+dATAxe97TGYKh:GxgpKLEBq5oMnOfv6yWaeetlxnpgh
- TLSH
  T18A946C1078818172DDFA20BD46ECB931056DA8F007345AC796DC0BFAEA645D2BB3669F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 23d618a0293c78ce00f7c6e6dd8b8923621da7dd1f63a070163ef4c0ec3033d6
- MD5 192639861e3dc2dc5c08bb8f8c7260d5
- SHA1 58d30e460609e22fa0098bc27d928b689ef9af78
- SHA512 6e573d8b2ef6ed719e271fd0b2fd9cd451f61fc9a9459330108d6d7a65a0f64016303318cad787aa1d5334ba670d8f1c7c13074e1be550b4a316963ecc465cdc
- SSDEEP 192:ljHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZqE0QPi:R/Qlt7wiij/lMRv/9V4bfr
- TLSH
  T1B1427C1297B089F2F551493419667F2A6FBEAC5C13F405A3CFE304C63D212CB9839243
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  $PLUGINSDIR/VC_redist.x64.exe
- Size 24.2MB
- SHA256 3642e3f95d50cc193e4b5a0b0ffbf7fe2c08801517758b4c8aeb7105a091208a
- MD5 1d545507009cc4ec7409c1bc6e93b17b
- SHA1 84c61fadf8cd38016fb7632969b3ace9e54b763a
- SHA512 5935b69f5138ac3fbc33813c74da853269ba079f910936aefa95e230c6092b92f6225bffb594e5dd35ff29bf260e4b35f91adede90fdf5f062030d8666fd0104
- SSDEEP 786432:tSp+Ty2SfUfnbDDko5dFMYqlQbgAVLSElbmucMuZZxs6Sf:4p+Ty2SfWnHDk8FjVbfzPTq4
- TLSH
  T19F4733339648042AEBE34573AD99F5241D38A52C63024DF6EAECDD5E177829237FB702
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral13 behavioral14
- Target
  $PLUGINSDIR/check_for_64bit_visual_studio_2022_runtimes.exe
- Size 10KB
- SHA256 b324a6025986306656fc2a03d0a3e9ed5917dfa7cf14fbfca888d65b39822074
- MD5 9baff51bb8539498c81d0c2ed0034d9d
- SHA1 e85ff796a54221f723ad36412329d8c650b7717f
- SHA512 cc4008bb5586840c1f031f09ce04904b22ae5ec43c3331586593fefffa22725c076835627253d6aa0468fd24124068603b82eb45490cf96e20a6c4f1d5472576
- SSDEEP 192:bFVKI1e9KOftazT6hmA5K+o/y2sE9jBF0NyeaBM:5Vr1ecQeT6hmAM+o/8E9VF0NyJe
- TLSH
  T1402208A3CA69AC41DD5F4E7670C4D82BAE7563C61A94C5E32215C010CB923477BF92F9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  bin/64bit/Qt6Core.dll
- Size 5.8MB
- SHA256 16933095dac0db9be28ed7c1bec2d15dd97d373482e4758563087b358443d52f
- MD5 b0ff1574b0a48f21d1c8f9385d924410
- SHA1 5c3eaf24beba7db0f207890a1774f813582a0402
- SHA512 367d592edef5f4a49d01362fa16156367d433691bbf3e98d761c1485de13123fde1c66a7237dfb5cf77a83abc8f30a34967d361831c3733ac0671c0bf52b62ff
- SSDEEP 98304:wisQ93hlai7CGOyi/ePkKFdu9CwJsv6t0GdVZ/3p:tlx+T/hKFdu9CwJsv6t0u/3p
- TLSH
  T155566C17A3F50194D8FAC139CA579113EAB378160721ABDB02A8A7156F73BF11A7F318
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  bin/64bit/Qt6Gui.dll
- Size 7.6MB
- SHA256 d5cce83d78f34cddabead240a64d6e816d9d5096b9919080ddd2bec1486a9bcd
- MD5 8a877616bff489ff0796883432645df2
- SHA1 ec176807ce92d67fff5bf952c84ab4e77e23188a
- SHA512 7b5f41d4214fb89a3449fdd6c7d6b6d20084af5c2ddec9207f50f69b93f25e72c28f20ec2aa91677d1234b865b99904c995a58ceef1e781a9301cf8b5834b942
- SSDEEP 49152:BL+S7y6nG+MqtXd0YLUbdTXQq/58ZiZKL3TjHQL2mtnHw5xgiFVS7a7A7FD2DY55:rZwdV87HKz+sNdNkHU+LO7xAGhion
- TLSH
  T155868D97B2A911D9C43BD13C8B9B9507EFB2701503529BDB01A58A592F33BE12BBF311
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  bin/64bit/Qt6Network.dll
- Size 1.7MB
- SHA256 5966d71a23a5a5f825aae2aa18d7f5b8e995334974af28697565547e9f4946e0
- MD5 21265737ca024cbc876d52298d6bd2dc
- SHA1 5d3eb65249f30da6278c5fbbd69c681056ee21f6
- SHA512 ab4c04eaebc97c0963944f790c8aee63a3ac2f40325f033e88a13fe1750b0ae0b1184b907bc273c1558f5c58fb2cc99f48f5c3b89fa41c53d7d5c8e716f9f848
- SSDEEP 24576:+ZccdsY79vYAgZWPup9pZjouNE2fgtg+5UAAv8:+ZcGj7lYBZEuLvsuNzf2g+5Uw
- TLSH
  T1A0858D57A3A44196D86ED179CB4B8A0BEB73700543629BDF06248F152F73BE22B7E350
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  bin/64bit/Qt6Svg.dll
- Size 506KB
- SHA256 e0ca09dfb034b52e4c908abf63d09c9b4be56f680e3179543104d5bf03070e92
- MD5 34bc1b44d68c2f997a24f5cfd00482fb
- SHA1 bdb181b3afe1e59fcc031e281e42fd5485cc384c
- SHA512 40f15b1a3a7fe61872dc1932ca9df2037495d8f13bbcb5ae7ae3a26c64a8af0da6a97be604c119453711ae591334e83b9e504a0e52daadde5b9b6755afedf4bf
- SSDEEP 6144:VNav27KGPGYwtTnwl1btOMz9X01Ga88XXrcFgkx42vs7B+cARwZadZPXy/H4:VNA2l+wjtOWX01lX7cWAk4
- TLSH
  T1C5B45C67F3A20786E46EE13CC66B8806EAB370040392DBDF45698D542F637E12A7F751
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  bin/64bit/Qt6Widgets.dll
- Size 6.2MB
- SHA256 1a5dcc41f66a7006ab707cb99308ad8c68333b253f8a7f2808439fffc6ec6d04
- MD5 a6ecfce73dced22706c56e4cc64d0473
- SHA1 33be4f733da0bb12f64d5182952c641461d6efc2
- SHA512 f63efec743dde95c8ca14d376269244679e97c8e09d4431e3f43febaaf18b94091c01aa78296a6562020be22d610b9f67a15a8a126732226069e3ef48e7d3cff
- SSDEEP 98304:I57dzMRgKELnu+T9gC6p+Y0WnwW0h5FBPkf:I57dzMRpELnXT9gC6p+Y0pWCLB8f
- TLSH
  T171566C57B3AA0289C56BD13DCB5B8A13EAB2B40443629BCF0165CE552F737E12E7E350
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  bin/64bit/Qt6Xml.dll
- Size 147KB
- SHA256 5811dc4965f498d7d1ac1f450a519c90ded5bf4ee65a5413b27e1310a91104b2
- MD5 37df0b1e56dbc0ee16c1f6618d4bbe77
- SHA1 7630a4a4e51288e8a210fe968d9e25c7da413053
- SHA512 eed10747a189eb7c3dc15f51274332948d8669de480dd2f35483c1e348a5ad098b7f3ac8d1c5c9fa805730caa83220ccc8531d19362f14f9bd0fde33491017ea
- SSDEEP 1536:gwW7cROwfxxiVjkpZ3QuqJV0Dp7XISEKiA1uKdCTu8bYTOj9EISEKiffVWVAqig4:rR3xxiVjkpZwUDp79d+fVWVZi1
- TLSH
  T1C8E34C8773A80186E56AC278CA1F491EFB73705087129BEF8255893A2F27FD26D7D350
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  bin/64bit/avcodec-61.dll
- Size 36.1MB
- SHA256 b41040a961e75ec79df35725fde1cd7f091155fd83565cf510d6b1a1aa8b01c0
- MD5 351abe7f1cb229b710ce337a2ac3b389
- SHA1 53d5dd353a291247de238d4c232c712f06c71bf5
- SHA512 6d979bcf2cdfd893d21951c4c0a84dc063b6ce4ac8921229fe0a42aee7ebad6e2d42d888e62e65a98fe8d74e11c0edf2d197d46807b9a985fffccfee6d6be899
- SSDEEP 393216:NKVZ9Q+dVddZTOdkbbMXg9vswh1a/Lu2jJ1Euxj:N4VdLTOabZjaieNxj
- TLSH
  T17987AE4AF2A351E4C76BC874827A9E13FE28346D43141AF766D959253B63BF05B3AF00
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  bin/64bit/avdevice-61.dll
- Size 81KB
- SHA256 0b00389b11dbfaee758d25212e8d0ec3639afa6270c9a38a3407e5a12e4d941a
- MD5 029b4b7341f8656b000740bf2d53bc39
- SHA1 d5a8a418557f26ea8c5ea30ef50b7f0b0580a035
- SHA512 f9b19177a171ea747bd92932a5c0da58c7b4ae857cd0da7fe07a5bb6100aa5f0a3c014490c7a96391c761bedd0f36971a39cfd3b93e936b90787d72f2c8ef157
- SSDEEP 1536:e3UEeAj7BeWB3BMqhFP3kGCcqMhlAEXgZ3lA4efNHyKGDim:XqhFPJ0EQw/fNz8
- TLSH
  T103835B07F1F4048DE4668176EAA21917E7B1F01E2301A3DF2764C36E2F237D16E7AA59
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

Event Triggered Execution: Component Object Model Hijacking

Executes dropped EXE

Loads dropped DLL

Checks installed software on the system

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32