0c05ea395d95cfe36bee974eeb435a3db87ea5594ff738370d5dc3068a9538ca

Sharing

Copy URL Twitter E-mail

General

Target
scrcpy-win64-v3.1.zip
Size 6.6MB
Sample260604-zl2lcaev41
SHA256 0c05ea395d95cfe36bee974eeb435a3db87ea5594ff738370d5dc3068a9538ca
MD5 6cfa2b01081f0b0b8922a4a167b01fcb
SHA1 5821c5e59d05be601a610ebfec885b5780bff275
SHA512 1e9b6a455d044589104c15bedba2f87e3a3fcfbb60d262a9b43f9d6482beb7f1f97c81fd78a9753b2af2ac928db984fc9da073030ef07ce4d443af73d9f4d72b
SSDEEP 196608:SEt3V3y7u/D/iwCnWG9VrlBCwjMCEJygWlEMsTphkdmczZu6gm2uKNs:SEtlCS/DiwCnWCrlBC9Jy0Ms1hk1KC
TLSH
T1DB663355D2CD395BF3AAD8A26C6B2F06001A3D2DD7978999F1B407FD62E97048232373
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

android discovery

Malware Config

Targets

- Target
  scrcpy-win64-v3.1/AdbWinApi.dll
- Size 105KB
- SHA256 db92f418f6c384faeebccadbc592fb339af3d51ecfec3ec04bd3572080247bae
- MD5 d2c034449be65653aec2459d9ab83ae5
- SHA1 6127adb5894a7b99293fd49c25ea5ac2710d0c4c
- SHA512 9294fbabaeb6f4907500aa5639b45cece492b78db79069fa950fd1020d08f1a5372b5153495da8d662b5a1509501685741add1bfea3b8a43343f9960fae73f78
- SSDEEP 1536:wwqdq+3pvspmLh8SCykrpTG7kfGHuNezq02XJqo+iFi1yCP17HxEyB:wwqD3L8Tezq0et+ui1y6L
- TLSH
  T1A9B36A227891C072C8D761B91AECF76593BEF5A10B7589C3339803DACE643C25B7529B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral1 behavioral2
- Target
  scrcpy-win64-v3.1/AdbWinUsbApi.dll
- Size 71KB
- SHA256 3ba13420d47c60d958e0d5b333440f9895704879bb7c983b55f195717f621a3e
- MD5 93a6075b7ae7d0df52ec55017a2f8214
- SHA1 af6729c67f09f27440a2354cf7a41db5defb70a5
- SHA512 c4b17a54edf4aa75a2456a3d3b647fc28016fdbc98cda725cc34e0f631f3d357c9abac9f7d089137401ddeefac7af0fd353aca3b89777093c1fcb55dca8de3eb
- SSDEEP 1536:J72doFmOiHizFbPlspcsbj5ZsP+YeTs1px7HxEw:JSSfN9+YeTs1px
- TLSH
  T12A636C227990C432CC9651B819ECE621A67FBA511BB1C4C3779D43DBDE203C1ABB9397
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  scrcpy-win64-v3.1/SDL2.dll
- Size 1.7MB
- SHA256 03f7a29385b62d347f99bb0dc478ec363b42dd2c3fd2a7c372344bb953c280b7
- MD5 8b97d08c5a30fc30600e3a8824209baf
- SHA1 f6e85fb64612c0320c254629459ce50b3f68ad3c
- SHA512 e83f18f8361ac3801305d78ea91f633f9a959994808731fc9ae59f974ee33cd2ea27e7452a4b8f1c22b15de3fdd64f5a0c568f83893509c0127ec8a3149b0a6f
- SSDEEP 49152:c8d5ATKADoQDMpiSDet61yD/el7ya0R85kChtM59jhRxy:c87Ts56sD2l7yagFChmzjhRk
- TLSH
  T116857E1FF3A315ACCB1BC035C257FB72A931B41801A46D7F2A94DB71AD22E50569EE38
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  scrcpy-win64-v3.1/adb.exe
- Size 5.7MB
- SHA256 0e606318957baac81b997ccd8ee4bcdff79964a9921da07c716aea3e8d856af7
- MD5 ae6975e7c2211152f5fa54a1fddf414d
- SHA1 928aac595aa43dfcf540e7b03f747b4c3bdf574e
- SHA512 1d84c25b228268bdb620098a01054e010f2afd007822497ae81057c4c73d887e62adc5edd9461ae5795f954909435935aa41f223de3a9a6969c5f31cb4e9462c
- SSDEEP 98304:Xk1cPO5m7ufbUgcuNd3FIicIGNhk56NW:XMFhbFhFPcIGLk5
- TLSH
  T18D569E86F693A1B8DA4315B0612EB23FBF340704C718CDF7C6E4DD74A472A91293B669
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  scrcpy-win64-v3.1/avcodec-61.dll
- Size 5.3MB
- SHA256 0625683c79407f14c29a94236cef304896272042e802796ce0d57d2a2626b486
- MD5 475d2b95355c04cf7a45381ff1e0641a
- SHA1 b2285cff117bd596564c28c53014248e8dbcf928
- SHA512 e455292049308b6afd338b018bb3b482fa06081ceb5fedaf572345d1acfb979ec6c25c63db184bf8193b592a4a257196b25ba38b9ffd4420aad4190b98f1912f
- SSDEEP 98304:ki4MRN57FruqlWu09XnUS3azrQ+WZ/flNxiYR:5VjFym109XUS3azKlbiYR
- TLSH
  T13F469E5FE29362DCD66FC870536BFB23F924341D9014B9364B85DB306AA2F905A5EF08
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  scrcpy-win64-v3.1/avformat-61.dll
- Size 614KB
- SHA256 fd0fe520480170a4a94519d34fba8dda1d1478160b736761f4b63fd3ffd042ea
- MD5 253aa9a030ce5fc6fde064cb0706f95b
- SHA1 15b4dd1d14fca1865da0e0fe685ade9ff6b8612b
- SHA512 3c40347da51a21ea3d83412a4a4f8c2c7e3845ea6d6f6767bf1c7344a7c562f615bf59dd53c3151f79063acc26badfc9cdcb93f4cd5855b4eff42130e294848e
- SSDEEP 12288:5QYpj7HcpAuCBiiypCLEBG/CVZ1DXrn7jw9cks5x7RrQZwEw7Wfk:5QuSCajD7nXick+tRrmk
- TLSH
  T100D45C17D5E314ACC62BC13043ABAB72BB31B86515307EBE2294DB312F46F90675E768
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  scrcpy-win64-v3.1/avutil-59.dll
- Size 1007KB
- SHA256 577214b1cf9d62c3c62e47d041694036ecb607436631c9c2dbfbb29e1c3a4ca6
- MD5 f1af569cbb790f0154e83795b686c4c2
- SHA1 e2e66c4bcb69f39cbec71489c6776120b9b50d30
- SHA512 6e5e336a8ab3d5dd8c67ebaf84874a92539ffcb9cd759c594e2b296b69fa545332af0100a2fa201fc9564b3c28e92b4c4c119f9eeb7eafd75b3770df98ae9d70
- SSDEEP 12288:UiQSbVO/oyhQlEGtiSYoR69ohkwN/ZSIAMytR+w/ntp12O:UgOgVlEGtiSYoR696Nx4MyO2v
- TLSH
  T100254C01A5E3642DC5AA913046EB7A57B6313452CA607E2F67A14D303F28F912ECFF39
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  scrcpy-win64-v3.1/libusb-1.0.dll
- Size 209KB
- SHA256 9dfa61009a49fcf12d2da95ba5a76a27cee87e6555133e5d9b80288b96395848
- MD5 bff63e43224b285c75da0e9cfbf0c6ba
- SHA1 ef814f47901f2b1d8e8d64c1e0073c87c1552a32
- SHA512 3c602aa11ff1d080edfba9a4b177715baad4625d1228ab87d6acdfca4a343adcdc24d844e0c283855cfcd6932a8532fcd929949fd3b061d25fff6f80454886b9
- SSDEEP 6144:xW+q6xnFfsRpaQqujkCCAcZvZNhgnBYP3W:xW+/xFfsRpaQtoCCuBYP3W
- TLSH
  T1AB247C5B12E7ACBCC547C0309AC7C672E971F4284321EDBF12A4C9751F42E92A75ED68
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  scrcpy-win64-v3.1/open_a_terminal_here.bat
- Size 5B
- SHA256 843758795a84d0d035a7d277ad29cc1ff1702048b4b61ae74b9e3439ae683423
- MD5 98359f622a36689d7d76e00c28c5636f
- SHA1 2dabc0389dd92cbe254a071958725d8ca7a2467c
- SHA512 46bef76e29bc0ea93e15a32f275a7e0607d978da5e1390d2b336e99fa6531e598e4468c43660adb406ab85964e36b859d402314da4af8f17bc5cb8ab7df0676f
- MD5 SHA1 SHA512
Score

1^/10
behavioral17 behavioral18
- Target
  scrcpy-win64-v3.1/scrcpy-console.bat
- Size 51B
- SHA256 b49a3eb642898269e7e690e80f3de17898f966f69e75f11abeb31eb7023b0ee5
- MD5 7b8d3b0d87dd886730d4993af807fae1
- SHA1 2b1a383c41fc2a571165cd2b640a6b8a936d5559
- SHA512 805ad1f121432b0edb22fefecffe76e3071ef1eaba073fab0d57e0bee4c379a34f154dbf9fc980c3412a917969275cf7af4528b36746834693687ed7d0011fdd
- TLSH
  T1C6900217462A49865646C821548B30C5F54641C166154EA22262407179C85524F542D2
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral19 behavioral20
- Target
  scrcpy-win64-v3.1/scrcpy-noconsole.vbs
- Size 212B
- SHA256 3ccda94c161f18cef07c50d4d3c4913eb883d4b0fe3b939c35fae52784fb1d2b
- MD5 a6adb14566ed94e5d80107aeb0fa5291
- SHA1 4160262f99cc0d34573d6538001430f0c6f8c5ee
- SHA512 29540dfb671b71e3daec748a60324913028d236a458855f971d40a8ac41538c1636b94c6a31469f281419c8bd2f4e1cf8c9f16beb03fa005242c277e1dc08d29
- TLSH
  T16DD0C007DFBDD90301130013C8306C0BCCC10E99220308B3AFA4FC181A8C5E808F58C7
- MD5 SHA1 SHA512 TLSH
Score

7^/10

discovery
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral21 behavioral22
- Target
  scrcpy-win64-v3.1/scrcpy-server
- Size 88KB
- SHA256 958f0944a62f23b1f33a16e9eb14844c1a04b882ca175a738c16d23cb22b86c0
- MD5 b2d1245f74fc7d77c3370e847002cc95
- SHA1 e6b99ac5854d4437c01d6db4e77d09f778fe70d0
- SHA512 1f8b06c1f530233daa48f086229e17d033ff0a119ab3c3bdf52ed30c62ec27978a7f20aac06bd134f67976805772343a5dced6ebccf15192fca7093997a72327
- SSDEEP 1536:OHmGL/3uhv5ipkZUrv1S2EwupxdNR95vP+GsmcnTbtPpNjVCXndxz0a82/NSfVs/:OHxbusC61S2EwWbfvmjmEtPrVCXnb0az
- TLSH
  T1E4930213C6FAC6EAE6D8E372BE2A5D3847561240C7FDC552E446ED94C2816FF38E0115
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24 behavioral25
- Target
  scrcpy-win64-v3.1/scrcpy.exe
- Size 695KB
- SHA256 831cb2317e7040c7a2693c5f495b963883b9cdc8a9c40c5719cacbcc5de40ac3
- MD5 b19a6030cf56ca7646940f9bd7dd0ccb
- SHA1 8715ed6dc5a32531cf7d805e167cadde7334cf9e
- SHA512 1dc934bfbbc78e1479a67e504a73e45c6d2ee39c6b23955a18363ba888ab19c9275da2087dea9e76f062af6772e6a35285947d445a0ac55480d43427c088afdd
- SSDEEP 12288:fNBTMBUS09roBBMgPyP8Kc1kSlAppeHcrOrNNga4p5nT3rLAjvOIF:f0BUS09UTRPyP8Kc1k1ppe8VpVAjvRF
- TLSH
  T17BE49D97B38ABCE6C602813989DBC3653338B0E143179F17192466357E13EE1EE9761B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral26 behavioral27
- Target
  scrcpy-win64-v3.1/swresample-5.dll
- Size 120KB
- SHA256 33278f72119ff5bb51b053838b6e14f18d6349d4bf91fe74167919ff8e82dd90
- MD5 864de3bc8a59611059971d6a9ac0dc09
- SHA1 27e231d41ab7ed6494f441a6307b2750323823f6
- SHA512 54e0452e7b90372665833460c999006ff44024361479348a42bf7046fb7c0d7c0fd87ae8b4b259cfe6162c03ba95ceefd3f43f78a78439b7ba58d2b8bbce4e41
- SSDEEP 1536:iSZK3sQH/wktGnmiAsE0QDS6odGoVjulqkF6dSoiV6cLoqxM0CZoZh:iSZK3sQfwktm+F9SFiV6ixVC8
- TLSH
  T1C0C35D56E95369EEC62BE030827B7B22BF61747402682F3949D4C9391C17F40AF5FB26
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral28 behavioral29

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29