General
- Target IpTvPlayer-setup.exe
- Size 5.7MB
- Sample260623-gybataaw8m
- SHA256 fb5e2e58e2d2c726d87cb41aac2453a59b97f6365392b713421f948b1879da0a
Malware Config
Targets
-
- Target IpTvPlayer-setup.exe
- Size 5.7MB
- SHA256 fb5e2e58e2d2c726d87cb41aac2453a59b97f6365392b713421f948b1879da0a
Score7/10-
ACProtect 1.3x - 1.4x DLL software
Detects file using ACProtect software.
-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
-
- Target $PLUGINSDIR/InetC.dll
- Size 20KB
- SHA256 3bce87b66d9272c82421920c34b0216e12c57a437d1955c36f23c74c1a01d420
Score3/10 -
- Target $PLUGINSDIR/LangDLL.dll
- Size 5KB
- SHA256 ef0d7e2eba9e197c37e68b4fd1d79e8ac0bbd855846ebe506f858c73a1b296c0
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target $PLUGINSDIR/Md5Dll.dll
- Size 6KB
- SHA256 fbed2f1160469f42ce97c33ad558201b2b43e3020257f9b2259e3ce295317a70
Score7/10-
ACProtect 1.3x - 1.4x DLL software
Detects file using ACProtect software.
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
-
- Target $PLUGINSDIR/System.dll
- Size 11KB
- SHA256 dc4da2ccadb11099076926b02764b2b44ad8f97cd32337421a4cc21a3f5448f3
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 3d0060c5c9400a487dbefe4ac132dd96b07d3a4ba3badab46a7410a667c93457
Score3/10 -
- Target IpTvPlayer.7zS2.dll
- Size 48KB
- SHA256 368c87b2fb2679966e9814227a989b39075a029cfdf33dc6007fadb57b19f85f
Score3/10 -
- Target IpTvPlayer.Rtmp.dll
- Size 174KB
- SHA256 b55c475e764634a1e8361a806e173d5959c21109840e732cf01ede36cc77fa13
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
-
- Target IpTvPlayer.exe
- Size 843KB
- SHA256 7f5ee9f5dabf6355093caa5accd94a796e4cef81ff9d0ab1a96afbedc78e6689
Score6/10-
Adds Run key to start application
-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
- Target IpTvPlayer.html
- Size 86KB
- SHA256 1cb0b35f1b094674ffe09a82f6f09bf879ae9f437cb36ef4d777d78e71a2c190
Score4/10 -
- Target License.rtf
- Size 8KB
- SHA256 6eaa6de8b39e864c429e6e52726fcb94cb0b887fc90fd703d3b6ea275356ac2c
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target UdpProxy.exe
- Size 130KB
- SHA256 bca0cb565126e97cf87c18221a148f7ee922c35725c63bdaf5bce79c19475ed0
Score6/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target vlc-1.1.11/LibVlc.dll
- Size 99KB
- SHA256 1f520961ca5a1003eaf2d1d4823dcb75c2cc4cf9305b5db77599137a01080653
Score3/10 -
- Target vlc-1.1.11/LibVlcCore.dll
- Size 2.2MB
- SHA256 8dbbd2dd4561268e286a7ae468dccd7a0c045122191847ff15cf633ff7d984da
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target vlc-1.1.11/Plugins/liba52_plugin.dll
- Size 35KB
- SHA256 fb678b7f1e42d370f2bc5826487ca166d0cf36b2f1e883092339933ed7d8ab5f
Score3/10 -
- Target vlc-1.1.11/Plugins/liba52tofloat32_plugin.dll
- Size 64KB
- SHA256 1a719281d8d5828c85f4dce2c4761ae81db56128b8156f73c0e33958022fbd53
Score3/10
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Netsh Helper DLL
1