Overview
overview
5Static
static
3VoiceChang...2).exe
windows10-2004-x64
5VoiceChang...2).exe
windows11-21h2-x64
4$8/APOConfig.exe
windows10-2004-x64
5$8/APOConfig.exe
windows11-21h2-x64
5$8/AudioChanger.exe
windows10-2004-x64
1$8/AudioChanger.exe
windows11-21h2-x64
1$8/Clownfi...er.exe
windows10-2004-x64
5$8/Clownfi...er.exe
windows11-21h2-x64
5$8/ClownfshAPO64.dll
windows10-2004-x64
5$8/ClownfshAPO64.dll
windows11-21h2-x64
5$PLUGINSDI...LL.dll
windows10-2004-x64
3$PLUGINSDI...LL.dll
windows11-21h2-x64
3$PLUGINSDI...st.dll
windows10-2004-x64
3$PLUGINSDI...st.dll
windows11-21h2-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows11-21h2-x64
3$PLUGINSDI...gs.dll
windows10-2004-x64
3$PLUGINSDI...gs.dll
windows11-21h2-x64
3Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
11/05/2026, 11:54
Static task
static1
Behavioral task
behavioral1
Sample
VoiceChanger64(2.02).exe
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral2
Sample
VoiceChanger64(2.02).exe
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral3
Sample
$8/APOConfig.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral4
Sample
$8/APOConfig.exe
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral5
Sample
$8/AudioChanger.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral6
Sample
$8/AudioChanger.exe
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral7
Sample
$8/ClownfishVoiceChanger.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral8
Sample
$8/ClownfishVoiceChanger.exe
Resource
win11-20250619-en
windows11-21h2-x64
Behavioral task
behavioral9
Sample
$8/ClownfshAPO64.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral10
Sample
$8/ClownfshAPO64.dll
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral11
Sample
$PLUGINSDIR/KillProcDLL.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral12
Sample
$PLUGINSDIR/KillProcDLL.dll
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral13
Sample
$PLUGINSDIR/LockedList.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral14
Sample
$PLUGINSDIR/LockedList.dll
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral15
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral16
Sample
$PLUGINSDIR/System.dll
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral17
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win10v2004-20250619-en
windows10-2004-x64
Behavioral task
behavioral18
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win11-20260130-en
windows11-21h2-x64
General
- Target $8/ClownfshAPO64.dll
- Size 370KB
- Sample260511-n29fcagy8s
- SHA256 e85fe346dd40992a1b6e647e2496d91414018ef1947d665e9ab747016a015c71
- MD5 5403da3eb1790acd091018b7700388e6
- SHA1 bcce6b03e6a73d6596e146332731ef9a87dc2133
- SHA512 3de328b485b82657255468901a286c4dffb2d362e8e92ce0b6f0ea21a5a4ecf577ad32d3b82268536a6810b871aaae01494163829e5940f155bda0de2a84f4cc
- SSDEEP 6144:ULNGaRce+0tXlwLGF+wUsbyO7RPcsX4m9V5CI4RpKsVGvEoS5+0w:ULN3qe+1Ls+wULNsX7CUCpo9
- TLSH T19484BF06FAA504F9E173903D84B7A54BF7B2385C0760CAEB03A44A6A2F677D05E7B711
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Modifies registry class 19 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{80E0C6D1-9465-43B2-9BD5-27A3A56CF1B3} regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{80E0C6D1-9465-43B2-9BD5-27A3A56CF1B3}\MinorVersion = "0" regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{80E0C6D1-9465-43B2-9BD5-27A3A56CF1B3}\MinOutputConnections = "1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{80E0C6D1-9465-43B2-9BD5-27A3A56CF1B3} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{80E0C6D1-9465-43B2-9BD5-27A3A56CF1B3}\ = "ClownfishAPO" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{80E0C6D1-9465-43B2-9BD5-27A3A56CF1B3}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{80E0C6D1-9465-43B2-9BD5-27A3A56CF1B3}\FriendlyName = "ClownfishAPO" regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{80E0C6D1-9465-43B2-9BD5-27A3A56CF1B3}\MajorVersion = "1" regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{80E0C6D1-9465-43B2-9BD5-27A3A56CF1B3}\Flags = "15" regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{80E0C6D1-9465-43B2-9BD5-27A3A56CF1B3}\MaxOutputConnections = "1" regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{80E0C6D1-9465-43B2-9BD5-27A3A56CF1B3}\MaxInstances = "4294967295" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{80E0C6D1-9465-43B2-9BD5-27A3A56CF1B3}\InprocServer32\ThreadingModel = "Both" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{80E0C6D1-9465-43B2-9BD5-27A3A56CF1B3}\Copyright = "Developed in Shark Labs, Sofia, 2016-2026" regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{80E0C6D1-9465-43B2-9BD5-27A3A56CF1B3}\MinInputConnections = "1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{80E0C6D1-9465-43B2-9BD5-27A3A56CF1B3}\APOInterface0 = "{FD7F2B29-24D0-4B5C-B177-592C39F9CA10}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{80E0C6D1-9465-43B2-9BD5-27A3A56CF1B3}\MaxInputConnections = "1" regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{80E0C6D1-9465-43B2-9BD5-27A3A56CF1B3}\NumAPOInterfaces = "1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{80E0C6D1-9465-43B2-9BD5-27A3A56CF1B3}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\$8\\ClownfshAPO64.dll" regsvr32.exe