6ac4b199253cb3537865d11a861870b8e6d2cb446e0ab4a0b46e95e2ffe6d28b

Sharing

Copy URL Twitter E-mail

General

Target
DodoMusic-1.7.16-Windows-x64.exe
Size 98.3MB
Sample260620-lvjj8sft91
SHA256 6ac4b199253cb3537865d11a861870b8e6d2cb446e0ab4a0b46e95e2ffe6d28b
MD5 7149ee9928764223b0f62eb847facb9c
SHA1 08be7a0e19f0337477a365c96d5d44ef647c7eac
SHA512 a676b2332141cea54e67deaa968f015bd59997dd36e5b9d71d1b362a53fe93d532258292d75c200fbb6e5738b124a2a6f61d05d8fc4f1b75459f168699e69d09
SSDEEP 1572864:jdAKLvp2w3TVYglLoUyG2fGFjlEIVEbVnjtLWyV/ZBpQ6Ymdqgycoi:jdAKLh2ATVZVoVHGFqyEhnNWypLG6yi
TLSH
T1863833525F82DCFBFA88AF793525C430242F2E35F919D65904C234F18662CA335BE96E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  DodoMusic-1.7.16-Windows-x64.exe
- Size 98.3MB
- SHA256 6ac4b199253cb3537865d11a861870b8e6d2cb446e0ab4a0b46e95e2ffe6d28b
- MD5 7149ee9928764223b0f62eb847facb9c
- SHA1 08be7a0e19f0337477a365c96d5d44ef647c7eac
- SHA512 a676b2332141cea54e67deaa968f015bd59997dd36e5b9d71d1b362a53fe93d532258292d75c200fbb6e5738b124a2a6f61d05d8fc4f1b75459f168699e69d09
- SSDEEP 1572864:jdAKLvp2w3TVYglLoUyG2fGFjlEIVEbVnjtLWyV/ZBpQ6Ymdqgycoi:jdAKLh2ATVZVoVHGFqyEhnNWypLG6yi
- TLSH
  T1863833525F82DCFBFA88AF793525C430242F2E35F919D65904C234F18662CA335BE96E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Enumerates processes with tasklist
  discovery
behavioral1 behavioral2
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH
  T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/UAC.dll
- Size 14KB
- SHA256 2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
- MD5 adb29e6b186daa765dc750128649b63d
- SHA1 160cbdc4cb0ac2c142d361df138c537aa7e708c9
- SHA512 b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada
- SSDEEP 192:DiF6v2imI36Op/tGZGfWxdyWHD0I53vLl7WVl8e04IpDlPjs:DGVY6ClGoWxXH75T1WVl83lLs
- TLSH
  T10F623AAA62E847BEE2221636B96723130BFDB5203DA1D01F4D531E596C30BE3953D61A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $PLUGINSDIR/WinShell.dll
- Size 3KB
- SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
- MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
- SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
- SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
- TLSH
  T16A51365F13BED7A4C3071738A6FBDC85749B440012C659558BB2172ABF141E0BB3CD08
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  DodoMusic.exe
- Size 193.6MB
- SHA256 cf589c1f21f3f111f0dd809b993dac909a37e4a5db208d9278528f397834a203
- MD5 ddd74d93ce1481b7a76857da64c77ca1
- SHA1 fa0ba9d9b46e502e13d194ce589bc91a2034f3bf
- SHA512 b3fa087e5933ba856fe8cb19b199746647dfbedf09a8122c4a861ea5a1a561c501a2c90ac9507286b861bfdac99796fda37517a91bee1e3d9b4ff35c40374c97
- SSDEEP 1572864:aHM/7SRmD4j25lgATnMN1+i6uv6rsRi6a7hBqL3ANqgXWcBOCqVF5xzN0iq3RuwD:b/BiQAs8OvGK
- TLSH
  T11FA88C13F39A10E9E05DD17587469633EEB1B8864328A2DF2B5407522F77EE86B3DB10
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral11
- Target
  LICENSES.chromium.html
- Size 14.5MB
- SHA256 c54df6af4da6dbe8199869b48d1a7c8c457bd96441d944377b83e173af2bb2f7
- MD5 61d40de61cb10894d29d83cb9b1b9cc4
- SHA1 b0cf36717416009dbfb5b89affd9a88e5c94624e
- SHA512 92dbcefd624742c2d26db51cbe246a86088b044cf15469d3f606d49d7e0e0514f69a79ffd72741feeb7a565de089d86fedfb4b0a17e450957d73b03437d3dd0f
- SSDEEP 24576:wBS3jZ6foujZ6X1jZ6vCjK6DLUwROuTgmf3Kjr6ZjK6xjr6mjK6ajK64jK6QjR6+:wSyeFma8mE
- TLSH
  T1BBE6A42F7B48037306C642A2AB8B65CAF31E903F3B561654345CD1681F6BA2583FF6D9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral12 behavioral13
- Target
  d3dcompiler_47.dll
- Size 4.7MB
- SHA256 289767b49dc8525bce262ea06fee4ef9fced2e131a55b25654ce871c1f0498b2
- MD5 1a7544f942a9a9de9354e7a0f9060e3a
- SHA1 fe86bc104eaaa01357d98db905711e9c73d437ce
- SHA512 c8edf94f58d8007472737351d697682cb74153455d3dbd5a529efc7eab3d862581d1a1eb22b4e5df5176d9952b6b056a720cc77225b5c5a83f2299d90453cbb0
- SSDEEP 49152:1CZnRO4XyM53Rkq4ypQqdoRpmruVNYvkaRwvdiD0N+YEzI4og/RfzHLeHTRhFRNd:UG2QCwmHjnog/pzHAo/AyU
- TLSH
  T13A367C5673EA40B9C1ABD178CE479213EBB1781403345BEB4190C669AF73BE16A3E734
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral14
- Target
  ffmpeg.dll
- Size 2.9MB
- SHA256 9da80727db8bb2760ece1aa5dc2a2ce9920e1794bed6de0ae63ec21924349a8a
- MD5 3210f5bd846b76504195274663731607
- SHA1 ca0fddee7b3efc98028f39266ee5f0f3ebfc9b37
- SHA512 7b7feca1aa7a73d98edd2690d83537717baea9c3cf1bf8fa75f18ec4882c4d33b1b6c57290cb28a14272aec3581efe341884ef6c16c9d0239c3012547cc0aaab
- SSDEEP 49152:HsZovSNDmM5IGHeo9a12wL+bQmBhj0usks6jENRyD9HefWgbjhpLjIEb4t4a5Y3B:sDOGHeo90usks6jENRyD9HefWgbjhpLV
- TLSH
  T198E5AD07F6D6109DD029C070979F9213F671344A8B2065EF26D08A243FABFD86E7E769
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15
- Target
  libEGL.dll
- Size 481KB
- SHA256 a6d315c7ea7c240f6c82afa57b39b96191a62d3f5a0d25982e8567395ecb4694
- MD5 0923b2b6f9a88791d7e42a229fdf84bd
- SHA1 d3719daa82b4b95e2f1735548c71d77dc8651a72
- SHA512 4ba8001822cf9abbbf0852ab75389ed6d892504f699d85e015f20b3f28db1aa54f5b171b4da546f1318f8c6044abe06c56f7c27621d039cf706af5b615a67cab
- SSDEEP 6144:/Krfdptu9AvnJUCu536qq6Z64Vc+ALNwYyn23:i7dpvnS506Z64VcJFg2
- TLSH
  T158A48D15B3D948A9E06AD1348A474642DB7678860B65FBDF03E093792F3BBF45B3A310
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral16
- Target
  libGLESv2.dll
- Size 7.6MB
- SHA256 71cc200c14725793888932d63142bda9ca6b4d2988c7e16d44387351c56d68a8
- MD5 5056eb3e4a076afcc9bb8018e783746c
- SHA1 7b9ea35aebed96e36c55b8f72d6137f280dae647
- SHA512 223ba329b61a5a830d5cd0f8462d2d2d3a47b27e082bd694815f3f62b3715a8ec25cbbc069f09d3001dfb8c473019eab2ac3287e544f02ddb973ded4d647842d
- SSDEEP 98304:FaeBlw64Uag0hVPrTg0gQo1JiYIjGJXKt7:YeBlfwCoqw
- TLSH
  T1A5867B03F39940DAC04DE2B8D7579626FA35B8850734B6CF269407292F67BE0EB7A714
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17
- Target
  resources/app.asar.unpacked/bin/win32-x64-135/dodomusic.node
- Size 138KB
- SHA256 929e14cf6f979f3efa4d2d2c8fd39cabc7952e79200ce5d70b277392aed21781
- MD5 3d20403154d94ae45906c6d745df95d0
- SHA1 192109a10176768b96eb383b560554cbf2eda0f0
- SHA512 b2767272af41ccba9aaee1efe34927d657a53c98973ba0d1dc3503dab19808d4ace6d3b1bb534f9536380d4f7a66356e02af9e88df142c183c5df493642d0fcd
- SSDEEP 3072:MFJ+/ZRQP2ENVUXnwCJAfmk/q8CynYR9Z2Q2S:t/P4hNVF2/k0tb
- TLSH
  T1ECD35C5BB3A601BBD577C279C5934602EB72B8155720AFEF076042A91F237D18D3EB21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral18 behavioral19
- Target
  resources/app.asar.unpacked/bin/win32-x64/libgcc_s_seh-1.dll
- Size 914KB
- SHA256 5bfd4e07b255bdacf5f83e20ac353acb1df3fe4aec8c78c1d6a9c50ecfae99c0
- MD5 c6c340c3b1159fc06a2a2cb22dc6d276
- SHA1 43a4c1aa2f7049b5ffa3968eebe9896e389d547c
- SHA512 44369eb9ce647a86d554393e03ca09aa23859dca00251ca2afed7c2a1e0c9c634d6bee5ef52c3b430c47c5a2820ba24cce8fa28bee0c78a6b5d3f9d79de5756b
- SSDEEP 12288:rvgojKdK8K85Fd52Gnp2yQg+R0DCaIjHs21h0ZtCIRWOLer8:rYoju5FHVMyu7aIjHs21h0ZtCser8
- TLSH
  T1C3155C85779DA4DBD03002F14A9B0357233069893396AB3BB99C7A38DCD33D9CD996D2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral20 behavioral21
- Target
  resources/app.asar.unpacked/bin/win32-x64/libstdc++-6.dll
- Size 2.3MB
- SHA256 d066507e0baf45861992054f797a1cc7726984b2b1bfd1e57f2fd5053e7bda3b
- MD5 b987778a0835b4152cc1b6e99b35c8ad
- SHA1 3ff2073fa0d61cf3e12802609823bf424ca26f23
- SHA512 5849dbef8b0c3f57cced42e5dfa59385cc90b1ad6749c4eb5a60c2191d95bcdcea10ed843cd747b6435b1584af8d15f524f8b06898d9deb5928dccb818892cfe
- SSDEEP 49152:rCRsPR2DxqPZBdhvWE/H97H5rJ7hLUiqoGsOYLXto+wFq:uRsPR2gPN97HVL2o42to+wFq
- TLSH
  T1C3B55C03D6934C78C9EBEBB4524B56369620FC2985387D3E5E9CC3346B52E50A32FB64
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral22 behavioral23
- Target
  resources/app.asar.unpacked/bin/win32-x64/libwinpthread-1.dll
- Size 92KB
- SHA256 ded69de31320aba223b1542149cb599ed3fde34b94297101f20e1a7a7f2b86da
- MD5 4d51397e62ade7dba1fe3beffe389832
- SHA1 46c8252bdc50a5a3e5ba69f9d17b73328755710c
- SHA512 944727a8ec976d3b5d79c1a3bbc540f0b4f08160910a89543ec2032de45862051fbe7d5b6cdb6c6f20dffa318fc4e57a2a4bb9824aad6b2961ed7133063b3de4
- SSDEEP 1536:ltzCZg4TJ/SwPVUtGvkLRONgnPBI8Pm3Y9OSmhXKmQ3FoHy:zePTJ6OO5I8Pm3Y90I53P
- TLSH
  T1CB93A477EA72C89EC1DB92F0BB86C8E0B5BAFD540571960903D616147B4F9206FEC8C9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral24 behavioral25
- Target
  resources/app.asar.unpacked/bin/win32-x64/tttt_v1.exe
- Size 720KB
- SHA256 4fa63f56e3f817cd70a7bcc8dfd22ab11bdd43a9c0b44b43b8b86028dc9fdb7b
- MD5 d3130f05773a12b390674292dbb85887
- SHA1 e90cdb7942faa221c90ad2e9a7dc6ecbed94a044
- SHA512 c07f99a8502abf4bd54eb848d55ad4bd22057d4210e19f89bf7e5ad5ebb61faee70ed4a7b50ed1ab869a860cba9c22fc75428ae9d21219b260225e1fbede703d
- SSDEEP 12288:mOu7UC81kf1CwntEx2kHBxLM52fYdw4G10sh:mOuv81kf1CwntEVHBxhSwT10sh
- TLSH
  T1EFF45B53E6D248FCD8BAC2B48B9BD333B679B8515235B307A76087211E12FD0EA5D385
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral26 behavioral27
- Target
  resources/app.asar.unpacked/bin/win32-x64/tttt_v3.exe
- Size 4.6MB
- SHA256 21c8087d4779a94080f12aab5a855933450b977034275be7a1505b299570c479
- MD5 0282ca716c7a2566166515db79750d19
- SHA1 8d7a927a57c5e8aee054a30500ead8f17b5d4ab9
- SHA512 dac4506d870cf02808944639275cc3848fe3ccbb634862009f01b7e52573c109dde4fdb968a9d62088978b46d143cce8d626ac9ad95361981f1f198344c0021b
- SSDEEP 49152:6PrUakw50eQCazIxyCwYUiJjV+WBWn8DCenE4h7NPJ72uKBuiFEBHBqdd7xm+x9z:Xz0kDBKGhtLbf0U
- TLSH
  T17126092396EF0CA9C9D393BC628397769738FC188A2D6B7B4598C1213B131D46E2F751
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral28 behavioral29
- Target
  resources/app.asar.unpacked/node_modules/robotjs/bin/win32-x64-135/robotjs.node
- Size 197KB
- SHA256 1d7d17a6beaccd25cde67cd181e6252fe2354e9aa532bb23e8d0b603670953aa
- MD5 8582cfb53c5535e72ac46a6349ecff20
- SHA1 7ace47a7dc3ae3280363e31fcbd6537411a0e7ca
- SHA512 d037e98270710da3a52c7eba1cc850834997a786deb12c18c902ffa6e0b4a631748dd1a1c8b1eb6d55898c41811b4ac977250e3ab883ab4c8f2c3ab3ba8186b3
- SSDEEP 3072:rOqUOyzjZXJbdq3Phez0yOWWr3UQlLNXTdFZpzGES5HzatkQdHo:KqULNZ04iEQJNXZpuHzatLI
- TLSH
  T181145A04B3E500F6FCA78278CA57C506E77278850360AADF13648779DF6B3D2593AB92
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral30 behavioral31
- Target
  resources/app.asar.unpacked/node_modules/robotjs/build/Release/robotjs.node
- Size 197KB
- SHA256 1d7d17a6beaccd25cde67cd181e6252fe2354e9aa532bb23e8d0b603670953aa
- MD5 8582cfb53c5535e72ac46a6349ecff20
- SHA1 7ace47a7dc3ae3280363e31fcbd6537411a0e7ca
- SHA512 d037e98270710da3a52c7eba1cc850834997a786deb12c18c902ffa6e0b4a631748dd1a1c8b1eb6d55898c41811b4ac977250e3ab883ab4c8f2c3ab3ba8186b3
- SSDEEP 3072:rOqUOyzjZXJbdq3Phez0yOWWr3UQlLNXTdFZpzGES5HzatkQdHo:KqULNZ04iEQJNXZpuHzatLI
- TLSH
  T181145A04B3E500F6FCA78278CA57C506E77278850360AADF13648779DF6B3D2593AB92
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Checks installed software on the system

Looks up external IP address via web service

Enumerates processes with tasklist

Checks computer location settings

Loads dropped DLL

Looks up external IP address via web service

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32