d4665cc4f142eeae38f48b0c3325a706d6a898444da6ebd1a89a2b2b79b43987

Sharing

Copy URL Twitter E-mail

General

Target
Graillon-FREE-2.8.zip
Size 29.5MB
Sample260620-dkl9daes4w
SHA256 d4665cc4f142eeae38f48b0c3325a706d6a898444da6ebd1a89a2b2b79b43987
MD5 6b42e7643e124fdacc76204a644363f5
SHA1 25a9249ecf668cb8c202a7ce418ab0a0445aa669
SHA512 42176741cad0b2c608ca34427ab6d513b1932eff19e6a5c671f0034c3390eabcde6d8237ac5701db4c123fc743f526c07d720c99406125082e89aa7b0b06f2ad
SSDEEP 786432:otrrFG6p7wip1Pl6txN8CUd3fssKapjDLiR1:ahJbd6tQbXpj3iR1
TLSH
T12E67339594A0D130557C03BB2432BEB0AA155592EAFF4137F36B5FE402B370BA1BB89D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Graillon-FREE-2.8.zip
- Size 29.5MB
- SHA256 d4665cc4f142eeae38f48b0c3325a706d6a898444da6ebd1a89a2b2b79b43987
- MD5 6b42e7643e124fdacc76204a644363f5
- SHA1 25a9249ecf668cb8c202a7ce418ab0a0445aa669
- SHA512 42176741cad0b2c608ca34427ab6d513b1932eff19e6a5c671f0034c3390eabcde6d8237ac5701db4c123fc743f526c07d720c99406125082e89aa7b0b06f2ad
- SSDEEP 786432:otrrFG6p7wip1Pl6txN8CUd3fssKapjDLiR1:ahJbd6tQbXpj3iR1
- TLSH
  T12E67339594A0D130557C03BB2432BEB0AA155592EAFF4137F36B5FE402B370BA1BB89D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  Graillon-FREE-2.8/Graillon 2 User's Guide.pdf
- Size 1.3MB
- SHA256 44d4ab58ab19bae55b1b31a60ffac4d7a17529356c94270251aa0ef43581c2e0
- MD5 59b3677c6e3062fed2caeff815ff92af
- SHA1 c88a30f959b5fe27201a2d7e46ac25036b4654d6
- SHA512 d540ca3881c5af6be62fd0e0d183ede2b8c4a6ae08d499b015780e8831ea84eeeabc2c276e4144e0e168e8cea7b282de677e9a534100c74d1dc3b4f9d02b31e7
- SSDEEP 24576:TdXU+4DDZMGWh8T5isXXS1As81LBVfeddbxsAKvD:1U+4yGW2bXXUAz1dVedHFKL
- TLSH
  T1AB65399E124544EDBAD9CDE15B83F690E3AF820E7B7C3522121C8445EEE4F49C87F899
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral3 behavioral4
- Target
  Graillon-FREE-2.8/Graillon Datasheet.pdf
- Size 1.2MB
- SHA256 b74f3bdf456155b6e7eccb1099653a88e9f3215a7e88b60c03451a4d127a408f
- MD5 1a002aeb0e728c249c15c01cb9d6b3b7
- SHA1 c5f4b709a2147cdee87d067fb912c5b5c8967b9c
- SHA512 ec869faa02323279087307821e0f9718992dc610df8f7ccb3c370101b6febd0af02b16ea6c453e537dca1af5d0c74b74d5ac89fc362a2f73c03dcd1002d2d9ca
- SSDEEP 24576:z8Lj5F4nwiZImhMN+1wZXtgkNKFbbbyIqtQ9Fx3Q9/:zWjMZIvgONKFbny8FN4
- TLSH
  T1F845F0D90C1AE444F478E6D2B383AFA7F157FC4A349D1EF4C49B037DA5B2899A8C2464
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral5 behavioral6
- Target
  Graillon-FREE-2.8/Linux/Linux-64b-LV2-FREE/Auburn Sounds Graillon 2.lv2/AuburnSoundsGraillon2.so
- Size 3.3MB
- SHA256 d5c762d5f7607754ccdcfdece17758b21ea6d6bd8b2cd650bbe53d98cdb5f25a
- MD5 50709bc20ad31df746665ee7e6905b4c
- SHA1 ad03efd4df18c6b9567a21f664494c194aaf2745
- SHA512 19b540b6c975b383364fb28b320893d2e7d749aa1e2d1dc5fcd326bf8058ad4646aa09cd01778fb7c4d3f0e646bb955d9527a4b54242a2cafcb0737b38cc2439
- SSDEEP 49152:irJPegB6Ifeyqbz8x8GgcqJCSDscuZ/LdiSnHS9ey+bDVq7V0Y/U5+ZTa3JU0/kp:irJ2g7etng8uHZ/Lxy+bZqxscQufzJ
- TLSH
  T142F59E5EF91758ADCE79843058199173A2347948C213BB3632D8FA303B76B54EF4ABD8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7
- Target
  Graillon-FREE-2.8/Linux/Linux-64b-LV2-FREE/Auburn Sounds Graillon 2.lv2/manifest.ttl
- Size 125KB
- SHA256 4c15b210b0d17a6dc8cebb786e1bf40e5bff011f7852ea47523a831688abed88
- MD5 b5c18cb5f302f6d4613fa5917247627b
- SHA1 7febf07ad9d8313fde366aa9f159f1c32afc2af4
- SHA512 8c0d19044130c67012d4713d09b2e3ac4bd37cf5e12256e06d8710eacce3ddb463d4c846297de265f65c18bc4cad5917cbc695a155bd973aff45657a1f265e33
- SSDEEP 1536:5+VmB9W8AHmyCL5FAazF+9vBbMHOe9nAJ6zc1U:V
- TLSH
  T167C3E216B78A4DE894170465831FEE013E6990DFDF51EEA9F24C5A8DBFA061D093FA30
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral8 behavioral9
- Target
  Graillon-FREE-2.8/Linux/Linux-64b-VST2-FREE/Auburn Sounds Graillon 2.so
- Size 3.2MB
- SHA256 f7817040e79ad2d313113b40faa666c37e4ad0d9b066251d8dfdd74706dbeb71
- MD5 246002573c22c75c579efd07dc76f137
- SHA1 007fa7370729f8543fd04c40bb8780de40526db5
- SHA512 7bdf5dc827c7f5bb84dc5689c8550c4267d008e7ce24c4836e180dfc0c59d29319cc499d9d10e5424ecfdd93599d82034dd027c7b4f1fca5e21b745a94755e01
- SSDEEP 49152:zHFxtevU2F/RpNfZSu5knaPnzHlUnknqEey3bDVq7V0Y/U5+WTVbA6x3LU7Bx:zlxMHJbfPnzUy3bZqxscBdx
- TLSH
  T174F5AF56F92754ADCE39943059199137A2307A15C213FB3233C8FA703A7BB45EF4AB98
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10
- Target
  Graillon-FREE-2.8/Linux/Linux-64b-VST3-FREE/Auburn Sounds Graillon 2.vst3/Contents/x86_64-linux/Auburn Sounds Graillon 2.so
- Size 3.3MB
- SHA256 2d4e008706a88782c19d5c18ed5171983cb13c41f25ab8507a629bb10541fa5e
- MD5 304929932aa0a962a284823e887ed74d
- SHA1 0934ec2bfa4303361af13734381379a4248b02e4
- SHA512 b19841f406f6181cbdc1c2a42e726ba9863a9c1c08c7aa73256905c8b29cb918610465eecb388ecbb38dfe03e90985abe34e3ad51793d96829514ea420bc1347
- SSDEEP 49152:7uaD7EAXBL5kDrtrgGaCydyVHHZLMrTvyeysbDVq7V0Y/UG+8Ty7A6x3LiJOD:7LDVh5mRrTHHMysbZqxs3EYD
- TLSH
  T139F59E5BF92744ADCE39843499199137A2347D04C213FB3662D8FA343B77A41EF4AAD8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11
- Target
  Graillon-FREE-2.8/Mac/Graillon-2-FREE-2.8.0.pkg
- Size 12.7MB
- SHA256 d43d40e8a4d3a3dba7c64b06c85291e24b64d495b1e6bb7528208554b68775ea
- MD5 b57e28749eb979bda5e12783af0f4d78
- SHA1 29f3617a2c58fd29bffd38d37aad7a6660d11aff
- SHA512 fda9bffae2f0b73c2210543a9bfdbd2198313154b192ceb2f4aaf8232d7f5ff712c829d79fd2cc48dae626cd5d86e32ea36ee17f534c2e7026c9dc7c14192b75
- SSDEEP 393216:zfmbIgX4ybsaRS6G++yQHCbQC81U4oOn+PHoWZW+15:jGt8UgHCb66vD5
- TLSH
  T1C1D633405C28A404913903BA7462B5B2AB1F5D4667FF67BAB14E2FF802A310EF177DD9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

defense_evasion
behavioral12
- Target
  Graillon-FREE-2.8/Windows/Graillon-2-FREE-2.8.0.exe
- Size 9.4MB
- SHA256 b17c4d698a7ff93edbe0512bbf180c896e3ff96c6be8495d3b08dfa1d5c1cf8d
- MD5 b15e6247e307fe3438f17aa05688ae5e
- SHA1 f68fe99bf6e6ed87b8d192406f01a3669e440cd2
- SHA512 cdfe99a47ada756f5898dc91dda695926293b4ac5207d585d30d7572b17246443a9ddeba1f9d440e6e800cef535d8b9f6a4be21301f67c6f55cb0795ddf9032c
- SSDEEP 196608:1tJV+nIDBO8XnlxYmRtxtGnScMHRAErNWw+xOE1h5hOUOkqkDioCnck10:1taIDBO8XlxYmttdcMHRzOxDOUO1CXCI
- TLSH
  T17AA63312AC90E515C8750379A87025B4562EA8769FAE163FE3231F5C98B370FB22B5DC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral13 behavioral14
- Target
  $PLUGINSDIR/modern-header.bmp
- Size 25KB
- SHA256 d0fcf2b4f8d621190e00ee260abf219b6cb2247e99638df0b038c4af6b5b7f81
- MD5 98a96e7e7dab282d6de957595e4e5aa9
- SHA1 50cd2dcbdc9445ce58c3df67c8947decae33a7af
- SHA512 335b7ee84fb1fd055df3365f65a50f57378fe71bb99bc0594bcc9812513085b705bc7f7fff941fecd3ea066915101ef1ccc48a6186eb25e34c3a0113bc77320a
- SSDEEP 192:dOCN2Rmai8gP0O080egRt9uaWJ9sSriln25KVxxLvKBDiOCPDShjyDCVJlgzNcYL:oUNisiXxxLKBDiOEEA3Y6
- TLSH
  T198C29DED7D0DB9E87EA3566C2E1848C1B42AAEA400A776A1903DB757107E2D4DCF1DB0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  $PROGRAMFILES64/Common Files/Avid/Audio/Plug-Ins/Auburn Sounds Graillon 2.aaxplugin/Contents/Factory Presets/Graillon 2/Auburn Sounds Graillon 2 Factory Presets/Add Sub Quint.tfx
- Size 232B
- SHA256 be167fd3384d76300f03ee3872198fbe9ff8c476bbc91058fcd00096b95fe393
- MD5 165b00e91c0c8156c237acb36c627d14
- SHA1 c4921ead6303415ab9e317a72bb975405b852e44
- SHA512 4a5737b8947171b2559e553f6f63813b26600290fca8341c3d814eea32db6d7c74eb10a5a555171da7fde4c213d9cb851543d0fad82ea506aa1abaeaadea03dc
- TLSH
  T168D0122D440892EED9703B7344074FA0C1B0C40114BC3537A33A050C1CE036E0D22520
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral17 behavioral18
- Target
  $PROGRAMFILES64/Common Files/Avid/Audio/Plug-Ins/Auburn Sounds Graillon 2.aaxplugin/Contents/Factory Presets/Graillon 2/Auburn Sounds Graillon 2 Factory Presets/Correct A major.tfx
- Size 232B
- SHA256 d83cbb5a0541fe58afd5ce2627ea7e561cb4b782a24249c845f8be36d110cfcc
- MD5 82ede8f6255fd482cf717ed507474e43
- SHA1 0e6b24fe541a58e4c03b13d6d5b19a5501e10eb0
- SHA512 81f30eb3b588573b0b93d19646d40b1525f058abeaec8cc0b5132d7a7119608e80021f336e60a5fe1b71a61e1298d64f0d59ad9e4f6f94cec835e8885040e5cc
- TLSH
  T16DD01108080820CEEA30B3B308838FA0C838C8000CBC28F3A33A808C0CC03BE0A22A20
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral19 behavioral20
- Target
  $PROGRAMFILES64/Common Files/Avid/Audio/Plug-Ins/Auburn Sounds Graillon 2.aaxplugin/Contents/Factory Presets/Graillon 2/Auburn Sounds Graillon 2 Factory Presets/Correct A minor.tfx
- Size 232B
- SHA256 8c758e9aca23451726afbfcd44bb0e9e22651908e4968acb5a3e26af5d48fc47
- MD5 cf08946e5c0bddecd693368ff3f394f4
- SHA1 2f32501d9cf5d5189fc5e52c76e0ce32e5baefda
- SHA512 0851f81ae0c7bc9756b610609d945e5bd2118fb97b2447ef3a47b3cda747d5fd3ccdbefa4ded90c194f55fdf0f248a3f9d797f3408b1ef2ae9bc29a48242438f
- TLSH
  T1AED01208040850DED930737224434F90C434C0000CBC28F35338C14C0CC037D0A11610
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral21 behavioral22
- Target
  $PROGRAMFILES64/Common Files/Avid/Audio/Plug-Ins/Auburn Sounds Graillon 2.aaxplugin/Contents/Factory Presets/Graillon 2/Auburn Sounds Graillon 2 Factory Presets/Correct A# major.tfx
- Size 232B
- SHA256 b26fff5209ab89a647f073e0cfbfdd0ef9c49b99da63129867f76553250188bb
- MD5 8e888cbd8cc727180ac62ea96498ee3d
- SHA1 906d35dd4a3369f8321b6b96c5b735e193865e3d
- SHA512 2488001399c4cee9341b260f0d96731f4adec07581b8851ba8a854d79adc74d9210a6f3229592fa8a82f45e2b281210464bef6ae247333dfdbd32aa6ef7885ee
- TLSH
  T1A7D01208040810DED930737314834F91C434C0000CFC28F7533C814C1CC037D0A11510
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral23 behavioral24
- Target
  $PROGRAMFILES64/Common Files/Avid/Audio/Plug-Ins/Auburn Sounds Graillon 2.aaxplugin/Contents/Factory Presets/Graillon 2/Auburn Sounds Graillon 2 Factory Presets/Correct A# minor.tfx
- Size 232B
- SHA256 d19e4b4ac0d74038e599e286d4313d5212d5ca96acd32b1ee456277b1f3847bc
- MD5 1b9a972c14b1177cbfb8f5d6d3afc808
- SHA1 4eec7622c6e013909939360f5c11e42b63a904e9
- SHA512 6e7e215887845948a75f6a2ddb060f6c6b29bac9be936d6f91d544d5ce24034f4a2e006783f1b956d600ff88c9dd809962096550be2a207ed8c8871d4704fe12
- TLSH
  T15FD01208440811DED93473B314474FD0C434C0000CBC28F35338814C1CC037D0A11510
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral25 behavioral26
- Target
  $PROGRAMFILES64/Common Files/Avid/Audio/Plug-Ins/Auburn Sounds Graillon 2.aaxplugin/Contents/Factory Presets/Graillon 2/Auburn Sounds Graillon 2 Factory Presets/Correct B major.tfx
- Size 232B
- SHA256 faaf409047bf9b3acda9360673cab7dabc4ab3dc0b0c7fb370c7fa04d627f7fc
- MD5 fe81b57acd1f16a6c44c64b53ee0c275
- SHA1 525476694eea2268b54d017ec27e250e12f816c9
- SHA512 5e2c6825b30c60d7b0baf90b2bca512b621bac13839ff7281ede1503521e25648fdb1b649555bc07f7298a60f5de4a4d54baf8e79c5f2416a2c24119a777ec59
- TLSH
  T184D01208040810CED930737704434FA0C4B4C0040CBC28F35339804C0CC037D0A21514
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral27 behavioral28
- Target
  $PROGRAMFILES64/Common Files/Avid/Audio/Plug-Ins/Auburn Sounds Graillon 2.aaxplugin/Contents/Factory Presets/Graillon 2/Auburn Sounds Graillon 2 Factory Presets/Correct B minor.tfx
- Size 232B
- SHA256 caa2bcdd2d53e49b2386264cd954b151f0156a9e3156693027902d0590c27b95
- MD5 031508f8c5015ee44db6111819d7fc18
- SHA1 1d586b8482b04ba5eaaf86e3b3ec3eb08d022d4a
- SHA512 2287425d67dbbcd2a797c8bc190be3395d495a1388dfdcd9377525d6c82bdaf289ecc52373b811f884cb06f8c3d4b80abb110669d3d2e802a68c1f854ebe5b4d
- TLSH
  T1F0D01208080890CED930737304434F91C434C0000CBC28F39339804C0CC037D0A21510
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral29 behavioral30
- Target
  $PROGRAMFILES64/Common Files/Avid/Audio/Plug-Ins/Auburn Sounds Graillon 2.aaxplugin/Contents/Factory Presets/Graillon 2/Auburn Sounds Graillon 2 Factory Presets/Correct C major.tfx
- Size 232B
- SHA256 2b31cfa836845e58cb2c80ed8b4c03da11df05f758686cd9c51f8dfdece210df
- MD5 6bf6794253f161a57099b9af60c028d4
- SHA1 cee4eeea7852c9a803e6b61aa02db32b67cd1de3
- SHA512 107268a8027653ce5d21862636b1e43c0cde9f0e0a7e25ac7991c798b8462867a459260a6140d617b998abe7e11775a11d7a1d4ebc93346d2d1dcdf8d9c69af1
- TLSH
  T127D01218040810DED934737214834F90C834C0000CBC28F35338814C0CC037D0A11510
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Hide Artifacts

T1564

Resource Forking

T1564.009

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32