1d6c53902811ed36bcfd38fe95e45de69a5aa22b5c19157b5dcd3e407bd820c2

Sharing

Copy URL Twitter E-mail

General

Target
New folder.rar
Size 168.1MB
Sample260621-fbtm7scv3z
SHA256 1d6c53902811ed36bcfd38fe95e45de69a5aa22b5c19157b5dcd3e407bd820c2
MD5 78333d572133b4104760781a87353a96
SHA1 ba685b33fda496335c409e7f79cae2a87d1414d4
SHA512 bc5ffa3d0efd60cdbfc9c434d52944fdfcd52fb7cbaa341da0b7867153a972383d927a4e188d185e63eb21d27d4aabda4ad39dd0f6a9f23b69b1ccd9f95df645
SSDEEP 3145728:dA8668UHjR5+sIirgY68FS/cJLyel4odljzk1t/TOw4SLC8:jD8yR5GjF3/cJ+el4aNkrAN8
TLSH
T1368833E4538C1F07F8720EB107E09D299CD6ABC93472B00F546DC663BB21AA7BD1E599
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  New folder/OBS-Studio-32.1.2-Windows-x64-Installer.exe
- Size 150.5MB
- SHA256 94d180c1fc481ccc307b95513f795d088d63ac4f61ad3253c2ac0d94d0844110
- MD5 eefd85d1629d34be99ccebee8ce2c6fc
- SHA1 7b47f36093d47e4bb0ddc342d71c657980de7fcc
- SHA512 8b17123afae4d766580fc1afc0271ca9c33bc16f135e2e40a08606a71952dd87f97972864b1084ce12ab3b5f5b57e8516adccf8277288efc0baadc90ba6a274c
- SSDEEP 3145728:9A8668UHjR5+sIirgY68FS/cJLyel4odljzk1t/TOwk:DD8yR5GjF3/cJ+el4aNkr8
- TLSH
  T1067833E543DC1F17FDA21E7113E1992D9CD5BACD24B2B04F986DC623B7219A3380E5A8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery persistence privilege_escalation ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2
- Target
  data/obs-studio/themes/Dark/alert.svg
- Size 826B
- SHA256 fe9aeb13685757cd8c65f28fab5cf44d4b200f587ef069de99450fd787ed143e
- MD5 2e0f5e9e3f249fb0064623e96c7a6db8
- SHA1 23b4af7065cb6f28d9b88a364fc4096eedbb06c4
- SHA512 634ee619c2d8f5091497ccb5dd2488bbe2dc68162cd35cd3768ab946217508c656b04072a39752c946727acb4e8927ac15b346ef4da8b003c9fa00dbfe7d950d
- TLSH
  T1AB01ABB473489268B6CC55F16DF30C692563A2F60B80B049629D7490CCF7F935FA8DD9
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral3 behavioral4
- Target
  data/obs-studio/themes/Dark/close.svg
- Size 435B
- SHA256 5d362245c0a00c31a91d7a149340775832bdcb7049e5a6b4c8d9cbd6126cc42f
- MD5 6062cf437093b82a0bec8b8fe0388692
- SHA1 b669c434eb353d8e6ec627ed6608c3bad8947393
- SHA512 136fddd495491463b6ee0d2b02396fdbdf11cdf607616291499a80f0c1fe8ec2f7f8f19500f908d53f8534076272e66c2b1a39ad1520ecdbc6db9e69e2a60198
- TLSH
  T161E02B79C7CD6D19711B45D4EE200191D38F41F341CC7260B5E5ED25F191CE4389C968
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral5 behavioral6
- Target
  data/obs-studio/themes/Dark/cogs.svg
- Size 3KB
- SHA256 82562c4a4089d4f3f7e8fb33a2d0b12f8cbf7455bcb94fb11d99a84426dae800
- MD5 f105b9c010c0d55df4d1ba4b63579e0d
- SHA1 17b9d56617b4db1362f85770213f6a928cc7d659
- SHA512 100f89b52e7630d325c17658154d47accea7d0355e136653e5e899061a454cdee8e14085930152a9b79fdbf719546cc9d8fcef512d46be39a0668724fc6f9151
- TLSH
  T1C97132DA1A30E2E8ABE3BB99FF3B3EC88206E07E0BA78194861887D516C3D45D105D54
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral7 behavioral8
- Target
  data/obs-studio/themes/Dark/collapse.svg
- Size 220B
- SHA256 a3d64ef3a1023611bfd2e5697f55d36e90c30ccacb711f6c17ac3da4e3908245
- MD5 4686645ace74404900d440adb360135d
- SHA1 80ac2ca1526c56c6acf3b595f93e2a25ee9f92b9
- SHA512 c0afbdd9560b3ea40a270e517eb1bfad2994b26c81dbcb8a473a1f5a66c1ae52b9cf37be944940fa6311d0e674ba54a65714e27da925bdbbab12d2a2a941d23d
- TLSH
  T120D0236871D5CD3DA0154F31057CD406E2B7B0FA41817016D4DD305365B7DD227D5259
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral10 behavioral9
- Target
  data/obs-studio/themes/Dark/dots-vert.svg
- Size 503B
- SHA256 23e31d028ad4e5aff11e891188f5762fd710c9e9a8daad64d07bd673d232c1bd
- MD5 01706c1d4df65d1dcac688d4dc06abbc
- SHA1 628e9078271fd8d91f759fe900045fb79cc6db75
- SHA512 74aa09ee48d79dff83ac0f8ebb24d99f80d8221a15c8037caa4ecccd83dec2074517dc84171eba7baf61d9768c99d32e03b984f1d3394890549e82409f228f5f
- TLSH
  T1F4F0BE2C1FE167BC195888F0B87B8900079273F0054CF0605ADC2C810C31EC628BF99A
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral11 behavioral12
- Target
  data/obs-studio/themes/Dark/dots.svg
- Size 539B
- SHA256 648c09a0ccde5d680e6e9675bf53964e69fb8e50ac13348499e3d80901cadb8c
- MD5 9ab524b71fef90c65e436556cd96c8cf
- SHA1 d664efd9af50e42704823e3ae0f5b1e416bdfda1
- SHA512 0e5172a5994ef9f0312e58f4644bf5117a505fa6cf4f8e9c8599975dfe05149faba369dc11023fedfff9634467519fa9185d587a8edd76d8b0d5dee1bebcce37
- TLSH
  T1C2F062281FB656BC555A48F06876AA00178373F0060CF0B46AEC2C515A32ACA98FF999
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral13 behavioral14
- Target
  data/obs-studio/themes/Dark/down.svg
- Size 595B
- SHA256 245150f58fa9d225b5754da1864dc49bb64ed949cd3b208124febcdcd04071b9
- MD5 6d3b31cb981216cb0b51764b2a7f7c84
- SHA1 799354b5d104941e7b3772c5c1bda9e5627dc8fa
- SHA512 9430dcc8fe1b3876946d71ebf73c23ee47ac61eb64391277d65995318ded1deab89c13437fd596754e59fc97a530eabae2db98690d4a2719eabfd36993a4b367
- TLSH
  T117F0C836A344C8E4FFA86B7D15A68803BE4B607B46C390189A4F7D11E7B7BC31D45C98
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral15 behavioral16
- Target
  data/obs-studio/themes/Dark/entry-clear.svg
- Size 898B
- SHA256 3dc8abd8ea04f502bcfcde0a4844f481f84c592cb16c7f13598df13e2135b761
- MD5 7f3273422fb34d8d06b81d2c8d4d3eda
- SHA1 384dd987387a2c6170b07d03789339b7fd1eda23
- SHA512 9ad630576ca9a30920f780c29b33943a274877e6bba796054c617537fcdffdf61d17f40b9fa06bb018806ead126201accc52af992b16a919fb7e2a16febcdaa8
- TLSH
  T11711CA60B328F294F6C834F29CF24D0BA85F68111C42B0604E7D2440CEB7E850BA0E99
- MD5 SHA1 SHA512 TLSH
Score

7^/10

adware discovery spyware
- Loads dropped DLL
behavioral17 behavioral18
- Target
  data/obs-studio/themes/Dark/expand.svg
- Size 220B
- SHA256 e1e7de43a65c26ff9e34b242a2b2d9df89b46c0e3221ed93f3cb16007bf40f97
- MD5 184eaefb41cbc04894bdeb54d0f0c5bc
- SHA1 ebea9f2edef6886012480e7fddbd82192079f74d
- SHA512 a8a7f9f2dfc3bf240d2f4f419078194632314394118e951c30e1f94a1b160494668bb2b09c243a31215ea2db139f6ba2ef527ab5b8122368655f7a73aed04e51
- TLSH
  T1CCD023AC71C54C3DA0164E200978D541A3F6F0FA40C21015E4ED31536DB7AC737D5558
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral19 behavioral20
- Target
  data/obs-studio/themes/Dark/filter.svg
- Size 1KB
- SHA256 f93137300c920e6e6564e76cc6f8ebc3632536aae9d648737ec2c702ac575d6b
- MD5 6e8ff4af306f71d61b0c850925af217b
- SHA1 60f66553381f742e939e56d4549caec3120482e5
- SHA512 03f031bc2b554ce3429bb0dcde986e1ed2d48b380182acf8fa8fde415f37dd404b0197233589666ac8435af2c29524d40c52b782852c8a5e33df567c234e3538
- TLSH
  T13611F8691ABF6AF91CDD0D7C2AA34454909ED4C2188231B2DF5C5B374332D8B9D98ED8
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral21 behavioral22
- Target
  data/obs-studio/themes/Dark/headphones-off.svg
- Size 716B
- SHA256 888701497f2fc58e7ad9c5254604a59c712fcc025b4880e1ff89d9f9b1a6148f
- MD5 c220922a16326b2301779322e6d4d5ed
- SHA1 5ad6e3e568f28a6a1dcbc8bfb9df4d6cac4cd152
- SHA512 10b97ef5f6b6efdf44228f38b56b724b209a25dc012855a0bf4f784704954e6a97cb428ce0abf97d5acb6d6b96a12b1366d4e6832c646c05ca1027d4e883a405
- TLSH
  T1C70124E6134062FA263F8351B72A2024B4AF159563D200A841ECDDB17EBADD9CAE50CC
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral23 behavioral24
- Target
  data/obs-studio/themes/Dark/headphones.svg
- Size 449B
- SHA256 0ca094cc4fa0463bcf1182ab3883b9146b91fc223205cbbf8013d1d479bbf213
- MD5 6a399c0d4178d521368694ad4df99cc1
- SHA1 b27ee5dd8330e00a182572a98ddb50d58dc56ca3
- SHA512 5359060a8a0f4e4c6a043811e7777b3755c58969179940daa97392e6571d4b8204988343f454d674317aaf1e2c70b2a2ccc11a9f1a35e9fbb562667f58e3e093
- TLSH
  T138F0A3378B0D96D9F819C55C5E310056D35DD297E0C40170F7E8E038D3034D3B50E918
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral25 behavioral26
- Target
  data/obs-studio/themes/Dark/interact.svg
- Size 2KB
- SHA256 1cebb176a4e215a6669d656cb003a46bf7fb8dcbab78ec9ea02c44d1b5a32f4a
- MD5 f230e228ecfd472ccad7e510230a258a
- SHA1 57e2ccee372c9fd20858c7a858aa5c469095b5e3
- SHA512 86a9ff1cd0a9280325670cada774eb9ad9141d9287d9deb66e40d0853acdc46ba57e1b70e52862d3e228139932e7da3a035721eba456528924308745517e9acf
- TLSH
  T1A05189F457408158795C25B85CFB49FA3A9739EB6DE4A04E12BA3495C2336870FBCBC4
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral27 behavioral28
- Target
  data/obs-studio/themes/Dark/layout-horizontal.svg
- Size 427B
- SHA256 bf3faf78d810970bbf643978d3fe6b295f7a5e34dfb0dc9d59ee2722832590e1
- MD5 ff4d59186a71f3f029da321010acd295
- SHA1 db4b3f5c81921c81fffea149de94e2d9e5ec6c2d
- SHA512 32a936ce45c6f912de846555f29e95afcc776844730a0fb7e3acae5f38e8fbf61b5b37e72a5a73adeb043b19b101e100241aec1383a69fbf228527b0b52237fb
- TLSH
  T13FE0551CB2550265BC45420A1B3589C471AE609853F1206CA32E3F7AC211FC2ED806F8
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral29 behavioral30
- Target
  data/obs-studio/themes/Dark/layout-vertical.svg
- Size 423B
- SHA256 21ae67a2d335ee185c152e0e8d11729305fea94ac2a53154c3b1dffd598b68aa
- MD5 d206528f4ad4f3ef6a63b2c09851d740
- SHA1 a7bb03cc46e0d2efbcaa3bbebbf7ed3de16c276a
- SHA512 4bceb97d468cee317d578dc213b3bdd21bbd767db552d42037f8d799d56e19b892f3e7685a69bc40120de8a8b3fbf78b7f7bcab55d68f1b169d3bd0621218570
- TLSH
  T10DE05C2CB1B80169F80982461F34495861AE60AC51F5102C231D3F7BC605EC2FE818BC
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

Event Triggered Execution: Component Object Model Hijacking

Executes dropped EXE

Loads dropped DLL

Checks installed software on the system

Loads dropped DLL

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32