General
- Target CapCut_7267140873131950085_installer.exe
- Size 2.8MB
- Sample260620-wk2ceagt2p
- SHA256 0c708ea63136e4469977ee60bad01f0346a1f94a7b4e5bf44c0a927802969e88
Score
8/10
Malware Config
Targets
-
- Target CapCut_7267140873131950085_installer.exe
- Size 2.8MB
- SHA256 0c708ea63136e4469977ee60bad01f0346a1f94a7b4e5bf44c0a927802969e88
Score6/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Suspicious use of NtCreateThreadExHideFromDebugger
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
- Target $PLUGINSDIR/BgWorker.dll
- Size 2KB
- SHA256 50f735ab8f3473423e6873d628150bbc0777be7b4f6405247cddf22bb00fb6be
Score3/10 -
- Target $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
Score3/10 -
- Target $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
Score3/10 -
- Target $PLUGINSDIR/downloader_nsis_plugin.dll
- Size 1.4MB
- SHA256 bb3289a76e3040b62dc1b7191d2d93d64fc5508921092d74dc9c1be19f461837
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target $PLUGINSDIR/shell_downloader.dll
- Size 2.3MB
- SHA256 24d36e37eee786a0c2a739205452377c201d40cc45d20f580c894b5f7cad6c61
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.