39de95d15357fc59af3fec56feb7b7fcc9c334bfdb349e6ea0d91807aad2b8ca

Sharing

Copy URL Twitter E-mail

General

Target
VoiceChanger64(2.02).exe
Size 1.3MB
Sample260511-n29fcagy8s
SHA256 39de95d15357fc59af3fec56feb7b7fcc9c334bfdb349e6ea0d91807aad2b8ca
MD5 70e1883ae68b80a4f8d067d55df647a7
SHA1 b63364f2355da395bee2a06e8bae4e053db60500
SHA512 779d5ac69e688f6608da1f7361b49cbc93b388387b28f027e2e8af9c781c1a0f2dca75ea66595dc4590b183079c25c112a87f5654886269e7bf9782a652dfa2c
SSDEEP 24576:+Yj6WrS1V6C1tHcwENaCWuMdq3Cr+A5LTT/WLwznMnQD2nGZLqw:jeGSqs8wGVCq3Cr+DA+QMOLB
TLSH
T16F553359BFC0C4FBEF355674617A0EBAF810F8F81C27A64322424B57BE17161862E366
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Targets

- Target
  VoiceChanger64(2.02).exe
- Size 1.3MB
- SHA256 39de95d15357fc59af3fec56feb7b7fcc9c334bfdb349e6ea0d91807aad2b8ca
- MD5 70e1883ae68b80a4f8d067d55df647a7
- SHA1 b63364f2355da395bee2a06e8bae4e053db60500
- SHA512 779d5ac69e688f6608da1f7361b49cbc93b388387b28f027e2e8af9c781c1a0f2dca75ea66595dc4590b183079c25c112a87f5654886269e7bf9782a652dfa2c
- SSDEEP 24576:+Yj6WrS1V6C1tHcwENaCWuMdq3Cr+A5LTT/WLwznMnQD2nGZLqw:jeGSqs8wGVCq3Cr+DA+QMOLB
- TLSH
  T16F553359BFC0C4FBEF355674617A0EBAF810F8F81C27A64322424B57BE17161862E366
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

discovery persistence privilege_escalation
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral1 behavioral2
- Target
  $8/APOConfig.exe
- Size 196KB
- SHA256 e6220429ac44ce4b9a8ebd3a874e2b9c87ff3a70aa8283b9c662f152f8317db2
- MD5 b546c47aef93e1a0e325d43d5689d7c0
- SHA1 d16b55f49a7d2cd64ba63e79ab1695e6ab53e460
- SHA512 2b658c81c87cba2e31161783caa697043fe563616c9ae5740926a0bb8fb8b29fd05deca493531dee5ca0353a78d94eebf33119173d0d98a2b54bc99dc88ddc54
- SSDEEP 6144:+XtzpxJqoyk6H9APPQZLFlejj85JL7gRO:SpPK9A8LH5N7gU
- TLSH
  T10E146D25BDC2D073E666093069E8CA759A2DF8B10F609CDB63840FFA4D346D19734B3A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

discovery persistence privilege_escalation
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral3 behavioral4
- Target
  $8/AudioChanger.exe
- Size 161KB
- SHA256 cd11b47fb7ecd1e0b87a9eda2c64f7d7db1932631578fbda3b22ea84d8e41f82
- MD5 7cf29dfb1bba4ff4418486239d442b2c
- SHA1 e6965361c2413d7641f72cdb523d3d784fcdefa3
- SHA512 2fca6dc35199b699730fa870e82fe2908ecfb9cd61ae501e808dab98efd97d526bc2d5c65c19d09a77e7734d582203442f7f4bb8da73d5c4b90a89924b39b7ed
- SSDEEP 3072:Y65PxKAHTGwJyEDsUIzw69Ms9R7aXVR6+KPEqHufST:Y6SAHTGIxw7DasraKMqOA
- TLSH
  T180F37D5773A430F9E5278239C8A15A46F772B87217209B9F13A8477A1F137D09E3EB60
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  $8/ClownfishVoiceChanger.exe
- Size 940KB
- SHA256 f5e120c42af33940e3535fa998ba71dcb174268eb182aa3896bb8418743b97be
- MD5 4ebd611981c2d6939bfab01111c28a86
- SHA1 dd3fe5cfc7cbb4e79f30f49d1ba69465eefc9d93
- SHA512 10ceb2cb27aa804f3aed2e02229390e239ab0bf2a5414681c66f23c8136e88d11f0667712bd37cf38bd4e460dfc55d55ab607822323cc5335a143d5cfe7ccf49
- SSDEEP 12288:eQDjrYgyp9Hvrjayxfx39vC98aDZx1ZjrVcKibGiBaK+Eacm23XkJ18QsP/uQ1:eiry9Hvr5xfqyUPjrRcGHCk8QsP/uQ1
- TLSH
  T112254981B1D3D832D0724FB04C76AB91DA3D7D719BB1B8CF23D10AA945A82D1A935F27
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

discovery persistence privilege_escalation
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral7 behavioral8
- Target
  $8/ClownfshAPO64.dll
- Size 370KB
- SHA256 e85fe346dd40992a1b6e647e2496d91414018ef1947d665e9ab747016a015c71
- MD5 5403da3eb1790acd091018b7700388e6
- SHA1 bcce6b03e6a73d6596e146332731ef9a87dc2133
- SHA512 3de328b485b82657255468901a286c4dffb2d362e8e92ce0b6f0ea21a5a4ecf577ad32d3b82268536a6810b871aaae01494163829e5940f155bda0de2a84f4cc
- SSDEEP 6144:ULNGaRce+0tXlwLGF+wUsbyO7RPcsX4m9V5CI4RpKsVGvEoS5+0w:ULN3qe+1Ls+wULNsX7CUCpo9
- TLSH
  T19484BF06FAA504F9E173903D84B7A54BF7B2385C0760CAEB03A44A6A2F677D05E7B711
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

persistence privilege_escalation
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral10 behavioral9
- Target
  $PLUGINSDIR/KillProcDLL.dll
- Size 14KB
- SHA256 0fe15b023e21b7054fabb3d47b6084d60f8e474d8f9ca3a0a25dcb2097d6f0b8
- MD5 586270250a1acce8126a0877fd5bb981
- SHA1 9f5645b37b3af04004697639855da5c99a41aca1
- SHA512 a1994b91337385ab153860a013912f9cacdf9c233395868bf8eedfbe6dd13841619a8048c1d8407ee4b77c466fd8f31fc5cac2c779a2ef58c3a2a02caeded055
- SSDEEP 192:/BZa4DYIcJ4nS1ejJThugw4LBs4TJjdjqJVQXS3p16ZGntrefncWCV:JZ8IcJ4nSkJlums4TJJjsVh3pwZs/
- TLSH
  T15852F79EF117F6F6D4CB46B045E2FF3B443E29028836A8B4DF50EA207D1789E6529047
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  $PLUGINSDIR/LockedList.dll
- Size 28KB
- SHA256 671570118024c9132f12999e198cebc87b3bf1846695553bf478c5a42efec226
- MD5 2ee096682cc84f5fd44fb5291c00596c
- SHA1 8dccebf054abe13e5b324dfdfbe6605553971396
- SHA512 1ffdc3a5256b8eb62aff82c6429dcdf582009a908d43ab30d3fad84770b012be59c972323b6ae2b8d7ea2ae29d8ab3a99913205a0b33582e95dc813c31507d3d
- SSDEEP 768:Mne3kAZoxbRX66y11T9vBD3fNUHeBuf6qW:MnnTZyX9vBDvNU+UZ
- TLSH
  T107D2194457E000F7F7BE1AB079A92B0A5ABEF91868F195AB4F3754CA1D61112F628343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral13 behavioral14
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
- MD5 cff85c549d536f651d4fb8387f1976f2
- SHA1 d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e
- SHA512 531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88
- SSDEEP 192:Zjvco0qWTlt70m5Aj/lQ0sEWD/wtYbBHFNaDybC7y+XBz0QPi:FHQlt70mij/lQRv/9VMjzr
- TLSH
  T126426B129BB089F2F591583814667F2A6FBE9C5D27F50563CFE304D63D212CB983A283
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral15 behavioral16
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 56b96add1978b1abba286f7f8982b0efbe007d4a48b3ded6a4d408e01d753fe2
- MD5 6c3f8c94d0727894d706940a8a980543
- SHA1 0d1bcad901be377f38d579aafc0c41c0ef8dcefd
- SHA512 2094f0e4bb7c806a5ff27f83a1d572a5512d979eefda3345baff27d2c89e828f68466d08c3ca250da11b01fc0407a21743037c25e94fbe688566dd7deaebd355
- SSDEEP 96:o0svUu3Uy+sytcS8176b+XR8pCHFcMcxSgB5PKtAtgt+Nt+rnt3DVEB3YcNqkzfS:o0svWyNO81b8pCHFcM0PuAgkOyuIFc
- TLSH
  T17012F992E6A450B3C5D6533B35AA2F2DCBBD5325B0926C00C7738E4D39395B66E38353
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral17 behavioral18

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Event Triggered Execution: Component Object Model Hijacking

Checks computer location settings

Event Triggered Execution: Component Object Model Hijacking

Checks computer location settings

Event Triggered Execution: Component Object Model Hijacking

Event Triggered Execution: Component Object Model Hijacking

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18