9b5eb0b62cc60e63fe61a1f724d15d9e6bdc8493ec0dbe7610ecd5f9bb57783c

Sharing

Copy URL Twitter E-mail

General

Target
DroidCam.Setup.6.5.3.exe
Size 16.1MB
Sample260530-bvbvaacx7v
SHA256 9b5eb0b62cc60e63fe61a1f724d15d9e6bdc8493ec0dbe7610ecd5f9bb57783c
MD5 4b38008f43d59ec39f4d403bd0f36c7f
SHA1 0846f29337ebed9de1ca3ec1739adf7f12dc4476
SHA512 463980689f7930461680dd746ecf0eb8efbbc0171d6781e856b563a9ab63f062025d3636605ab0d10f0989f87517046f50e5885cafd268abd4b1d68dc81de511
SSDEEP 393216:qQLs5ZaexzzD12zS7SEOegn4j7BgNE9O+wcDGFdClu8ZLzzXC2:qQy7zzD1kS7249O3cDGvClnzC2
TLSH
T1310733CC64085563EE7EF0771B68110B53D36F15A283506A9639B9DB2CB0E82CF295BF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  DroidCam.Setup.6.5.3.exe
- Size 16.1MB
- SHA256 9b5eb0b62cc60e63fe61a1f724d15d9e6bdc8493ec0dbe7610ecd5f9bb57783c
- MD5 4b38008f43d59ec39f4d403bd0f36c7f
- SHA1 0846f29337ebed9de1ca3ec1739adf7f12dc4476
- SHA512 463980689f7930461680dd746ecf0eb8efbbc0171d6781e856b563a9ab63f062025d3636605ab0d10f0989f87517046f50e5885cafd268abd4b1d68dc81de511
- SSDEEP 393216:qQLs5ZaexzzD12zS7SEOegn4j7BgNE9O+wcDGFdClu8ZLzzXC2:qQy7zzD1kS7249O3cDGvClnzC2
- TLSH
  T1310733CC64085563EE7EF0771B68110B53D36F15A283506A9639B9DB2CB0E82CF295BF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery persistence privilege_escalation
- Drops file in Drivers directory
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops file in System32 directory
behavioral1 behavioral2
- Target
  $PLUGINSDIR/System.dll
- Size 11KB
- SHA256 b80a5cba69d1853ed5979b0ca0352437bf368a5cfb86cb4528edadd410e11352
- MD5 c9473cb90d79a374b2ba6040ca16e45c
- SHA1 ab95b54f12796dce57210d65f05124a6ed81234a
- SHA512 eafe7d5894622bc21f663bca4dd594392ee0f5b29270b6b56b0187093d6a3a103545464ff6398ad32d2cf15dab79b1f133218ba9ba337ddc01330b5ada804d7b
- SSDEEP 192:cPtkumJX7zBE2kGwfy9S9VkPsFQ1MZ1c:N7O2k5q9wA1MZa
- TLSH
  T1B2324C15031086F3E1D2853D682B39AB2FB969118AF04E438FB36952FE346C7AD79352
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 5157fe688cca27d348171bd5a8b117de348c0844ca5cb82bc68cbd7d873a3fdc
- MD5 12465ce89d3853918ed3476d70223226
- SHA1 4c9f4b8b77a254c2aeace08c78c1cffbb791640d
- SHA512 20495270bcd0cae3102ffae0a3e783fad5f0218a5e844c767b07a10d2cfab2fab0afb5e07befa531ba466393a3d6255741f89c6def21ec2887234f49adceea2f
- SSDEEP 96:oOYqZ4zC5RH3cXX1LlYlRowycxM2DjDf3GEst+Nt+jvDYx4L7qndYHnxss:oOYq+CP3uKrpyREs06YxA2dGn
- TLSH
  T1C4121A635A4455F3D5D7223A21AA2F2FD73C9324A062BC0287779E462BF431A7D3A341
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/nsExec.dll
- Size 6KB
- SHA256 370e47364561fa501b1300b056fb53fae12b1639fdf5f113275bee03546081c0
- MD5 0a6f707fa22c3f3e5d1abb54b0894ad6
- SHA1 610cb2c3623199d0d7461fc775297e23cef88c4e
- SHA512 af0c8ca0c892f1b757fbd700061f3d81417dff11d89bdff45e977de81ad51c97862406cf7e230e76cf99497f93f57bf09609740953cd81b0d795465ac2623ea8
- SSDEEP 96:e97GUxNkO6GR0t9GKKr1Zd8NHYVVHp4dEeY3kRnHdMqqyVgN0u3e:eBXhHR0aTQN4gRHdMqJVgN0N
- TLSH
  T130D1097675E22EB3C50ECA353C527A2B57F8C8111B9401549B938BD238C5EB3EA39282
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  DroidCamApp.exe
- Size 1.0MB
- SHA256 ca9db57a8458f476ecd78eb242ff72d5f17c87f3047bc6fe4802f2e92577533a
- MD5 8f643d9b52d686ec7e7f467d2c4ac1bb
- SHA1 0c79f3ca05024e66dc570f82cc207a6c24798300
- SHA512 5725b52413c0125f86a41431b7e61973a978ac699945cf538ce9893ec750e14994f49c77e4b90359a1a535fe9a5c7eea56d6002f327fa860f98673969723d83d
- SSDEEP 24576:UNDm+YP8ZKK3SO/qnXG9tzr/b5M1FIb3DZxYqyPBKmr:UNDm+I8ZWO/Xf5M4vZ9oBKo
- TLSH
  T1C335B202725688A2CB8128F9CD15EE6297283E1E57F2CEB771F4791B6530A83FD1416F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  adb/AdbWinApi.dll
- Size 95KB
- SHA256 d60103a5e99bc9888f786ee916f5d6e45493c3247972cb053833803de7e95cf9
- MD5 ed5a809dc0024d83cbab4fb9933d598d
- SHA1 0bc5a82327f8641d9287101e4cc7041af20bad57
- SHA512 1fdb74ee5912fbdd2c0cba501e998349fecfbef5f4f743c7978c38996aa7e1f38e8ac750f2dc8f84b8094de3dd6fa3f983a29f290b3fa2cdbdaed691748baf17
- SSDEEP 1536:Jwqdq+3pvspmLh8SCykrpTG7kfGHuNezq02XJqo+iFi1yCP:JwqD3L8Tezq0et+ui1y
- TLSH
  T17BA3592138A1C172C8D261B90AECF76193AEF4B10B3599C7379803DEDD653D25B7528B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  adb/AdbWinUsbApi.dll
- Size 61KB
- SHA256 25207c506d29c4e8dceb61b4bd50e8669ba26012988a43fbf26a890b1e60fc97
- MD5 0e24119daf1909e398fa1850b6112077
- SHA1 293eedadb3172e756a421790d551e407457e0a8c
- SHA512 9cbb26e555ab40b019a446337db58770b9a0c9c08316ff1e1909c4b6d99c00bd33522d05890870a91b4b581e20c7dce87488ab0d22fc3c4bbdd7e9b38f164b43
- SSDEEP 1536:l72doFmOiHizFbPlspcsbj5ZsP+YeTs1p:lSSfN9+YeTs1p
- TLSH
  T1C8534B227991C072C89661B909FDE651A27FBA601BB184C7779C03EBED303D1AB79347
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral13 behavioral14
- Target
  adb/adb.exe
- Size 5.7MB
- SHA256 70daef5ddbb03bd5afe90b75dfae03fb737409de53fec66f7bc718587ea82eb7
- MD5 4b058cfa71f681aa437554d35560d51d
- SHA1 fc26163315e41838ceb01fcf9f1cb723c61e0f07
- SHA512 7ff2a1caf2f6262c6ca1e9fbf5c1a43ba256039df21c3e4d9535b86c00200f3b50fa97437c0c46352f35a158b0ce2b0ff4da91565d47d01199357fce6d986ff7
- SSDEEP 98304:A9qZpA8KUIw6soXF9fajeQpGE2fzGe6P:AcZcOeaGRfzG
- TLSH
  T118568C49F69371B8DA4714B0206FB23FAF340A05C724CEF7CAD4CD747953A92253A66A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral15 behavioral16
- Target
  lib/DroidCamFilter32.ax
- Size 84KB
- SHA256 ffb22ab7b98ecc98c22cf675bfab61c875127137277e1f66bc3d7269c3b42652
- MD5 efe71ae8a02ca59a0855cd649f5e58b8
- SHA1 0a5ba3257ad82f71890c0fa55a5f7405d0b6b4ac
- SHA512 bad93c560355019f739158d2a25e7643a08cdcb000b378099aa2431ba4d023aa72741e674912d738b0ac6d21e44417f5406eee67f16035f6a783a5226b0d65a4
- SSDEEP 1536:Jld1X/W0/2LAd2btU5b7ToSWVd1MjYx0EY6uJotlzoOaB2mu0gFfhdtmPv2kXlOZ:J/1Xue2LY2e5b7ToSWV7MjYFuJotlSug
- TLSH
  T13E8316057BE381F2D68B1835544643CA9BBECA83BBD426DFDF57269B0A611C42CB41F2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral17 behavioral18
- Target
  lib/insdrv.exe
- Size 12KB
- SHA256 1cd0c2ba5eeaf5519055924f049a4c7feae999126a7c81a16961e486902a1bad
- MD5 b32d29447b5a7a4b8e62f7df5efec272
- SHA1 4cf32f4a969f62e8c580be3641748b4832397811
- SHA512 f26e3e9e9bb3700422843a54a3ef45dcda7073f1af2c36c105f88a6ccead4b4931007341e58f468b4481b676e713c708e3f7aa27360a86599ad7dc01e26b91e6
- SSDEEP 192:HI4SGHjM9zdjKgOMNhbwi5BlLot6OnTVYy78b55Tl/QJEu7aPHAVIb/K:oVUM9RegOMrbwVtzTNuTKb7aPTu
- TLSH
  T158420809BE45D07ED8C9213D139C722345296930E72273CFBA461996AC68BD059BA26B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral19 behavioral20
- Target
  plist.dll
- Size 53KB
- SHA256 0a1e27ced2f8ce0314353c82f30ee8140fde2e2725c4276390922930aafca773
- MD5 ab595bc9a0f6f0d00b1f50a7e81ac5fb
- SHA1 5798394a3863c2eb67d541eac914562d831e769c
- SHA512 ac6607e0da96e11b54f1d4b2a2c918deb1acad021823df2cc9c27b3d9c9556c29db5fe6aec3e9767999e3c0250544196bed47ff047176adf3fece63baccd2480
- SSDEEP 768:VOjVJ0t2d6Q1rk4G5aN0pn6ZWj+Hgq7yeHT9kyLfPPAVXSC6IHpyU:KeMkRQUj+Hgq7DkyLfHAVXSBII
- TLSH
  T189336D16EF0089B2D8C6047671BD9B77B93C6D36931039C3669538BD99788F2AF35A02
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral21 behavioral22
- Target
  usbmuxd.dll
- Size 31KB
- SHA256 333bda59aea7770d4a1f7ab7a320d1b5e904b67f7c710988b5893177924a0d5f
- MD5 b2da89f5aaf0f2b85a4c41f5a7019125
- SHA1 38bb05d675e12a68bc80ecc819e0e363b673bb05
- SHA512 5c71afe1a8d768c51781dc0b633369e4a47c4068fd7eaea81088a538e57d8421ec021b357ac902dde91f468da5c4cbae7dbcd636434eda215a8a6b948472e641
- SSDEEP 768:be22XU9oFPG+aFTqsxrPHC1dHmkrQWrJg:S22XYhY15mAtg
- TLSH
  T15EE2F802A6CAD0EAE79A2279757A572EC931C10413C605C317E259F94EF96E7F13B382
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral23 behavioral24
- Target
  vc_redist.x86.exe
- Size 13.1MB
- SHA256 fdd1e1f0dcae2d0aa0720895eff33b927d13076e64464bb7c7e5843b7667cd14
- MD5 1a15e6606bac9647e7ad3caa543377cf
- SHA1 bfb74e498c44d3a103ca3aa2831763fb417134d1
- SHA512 e8cb67fc8e0312da3cc98364b96dfa1a63150ab9de60069c4af60c1cf77d440b7dffe630b4784ba07ea9bf146bdbf6ad5282a900ffd6ab7d86433456a752b2fd
- SSDEEP 393216:S1RPq5dCsKSR65cX7Eyd/qnejOFxP7OEnl4L/Vvc:yP5iw56oyleej2OEnlwc
- TLSH
  T189D63336A3648126C5E30573EE15E1206F687329BB1488FBD3447E1D3E69587A3BB34B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral25 behavioral26

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Drops file in Drivers directory

Event Triggered Execution: Component Object Model Hijacking

Executes dropped EXE

Loads dropped DLL

Checks installed software on the system

Drops file in System32 directory

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26