7d514552f106558089be8abacc8aa7de247e7a6df93fe8bb16fdfd3ed5d61a40

Sharing

Copy URL Twitter E-mail

General

Target
VoiceChanger64f(2.03).exe
Size 1.3MB
Sample260624-jp3ptaaz3l
SHA256 7d514552f106558089be8abacc8aa7de247e7a6df93fe8bb16fdfd3ed5d61a40
MD5 0029917aff4ca46e29d9fe28ec6e2b29
SHA1 d02e97c00f5c76f89ebd0927948b04519e3e1d89
SHA512 3078acc459bdb42950f2e01f07864317d21e36768c947001a32df4d949cb61cff4a3c95c52594752a2a3c8e6c0c8ab952b5420b413aea30844451705876f5ca1
SSDEEP 24576:5Yjz+KnDJ+rn2Z42ZxuOJsEANbHmDnUbun0dBK6EuzJkxPQnPFceV/tp:Gv+aY2/ZxuOGEAhHUUbe6Eu+AV/tp
TLSH
T17E5523107610D2D3FE574DB09E752B632BFB7696183E8107232C0F892F6A9E5614EB26
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  VoiceChanger64f(2.03).exe
- Size 1.3MB
- SHA256 7d514552f106558089be8abacc8aa7de247e7a6df93fe8bb16fdfd3ed5d61a40
- MD5 0029917aff4ca46e29d9fe28ec6e2b29
- SHA1 d02e97c00f5c76f89ebd0927948b04519e3e1d89
- SHA512 3078acc459bdb42950f2e01f07864317d21e36768c947001a32df4d949cb61cff4a3c95c52594752a2a3c8e6c0c8ab952b5420b413aea30844451705876f5ca1
- SSDEEP 24576:5Yjz+KnDJ+rn2Z42ZxuOJsEANbHmDnUbun0dBK6EuzJkxPQnPFceV/tp:Gv+aY2/ZxuOGEAhHUUbe6Eu+AV/tp
- TLSH
  T17E5523107610D2D3FE574DB09E752B632BFB7696183E8107232C0F892F6A9E5614EB26
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

discovery persistence privilege_escalation
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral1 behavioral2
- Target
  $8/APOConfig.exe
- Size 196KB
- SHA256 e9181b2519a532b095a8be94fc72bce3be4af96ea2c8c694164bfbcd49c9fc31
- MD5 ae8a530e76fb3c4e92393ffd684e4d6e
- SHA1 3be5f17eea565d48c6806a8615698e87936efb97
- SHA512 959bac91ac2535e2d7f587ca10c3a7d8622dd4b6ad0382b15a32f70d161bc742b82be70ebf2e2d32d951046f4a3ccffb663ce9fe1d317cf0be094530552bd4d7
- SSDEEP 6144:yXtzpxJqoyk6H9APPQZLFlejj85JL7gyY:+pPK9A8LH5N7g3
- TLSH
  T1B0147D25BDC2D073E666093069E8CA759A2DF8B10F609CDB63840FFA4D346D19734B3A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

discovery persistence privilege_escalation
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral3 behavioral4
- Target
  $8/AudioChanger.exe
- Size 161KB
- SHA256 be756d5393552e0c7f027cf292463371494a4d6f008ddbd41c4738722f57a27a
- MD5 188b89401bcf1704ad97f2755c3884ac
- SHA1 cf8fe93005e5c3a5941b56a5ae0ae75a7daec006
- SHA512 7b7bb9c4bddc61de24eea01e6b5eeb3cdc230f4b1b75ba78fc34b72adb3bfa6c7343be4e37d70bb7c3689327fdf5006b89ea9c6542ec0bf9dc9517e0a0103274
- SSDEEP 3072:765PxKAHTGwJyEDsUIzw69Ms9R7aXVR6+KPEqHXfSB:76SAHTGIxw7DasraKMq32
- TLSH
  T117F37D5773A030F9E5678239C8A15A46F772B87217209B9F13A8477A1F133D09E3EB61
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  $8/ClownfishVoiceChanger.exe
- Size 985KB
- SHA256 5178d57461a84ce06001b84b042a659532c6d159e40f18dde74b2eeee3b7fd7f
- MD5 fcb302a65dde4060661f0585b24eab57
- SHA1 042f11befe0c9c753a103447b0c8ceeb32862bd7
- SHA512 b9bf92542ba561e30054bdc1f97d7675709991640681cd69f57f4d1cd7c82f5eca04bb2285003eb180236543aa44df801945669228f9127470c7228ab94aeb05
- SSDEEP 12288:Usk+H1AAiUmLcWutoEDjc9G0NELE6iMB6aOoloHfrYp:7kM1yLcWutoEHc9G0aGRL/k
- TLSH
  T112256A1D6EE003BDF0F2D770C9A15402D6327C4A877D99AF02D0C6994EB66B5DA39F22
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

discovery persistence privilege_escalation
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral7 behavioral8
- Target
  $8/ClownfshAPO64.dll
- Size 371KB
- SHA256 9fec7088819176ed6aea83c480bf2d432fdc8597a1a4f2a7984466249824e8d8
- MD5 5d2f02e15f466afb69ea6c46b7db2092
- SHA1 8b92cc3f729bc2d18cd1fbef75c7621012e01399
- SHA512 23b3c4728a672c43a59f21a5990217867f3906285081a6ccc44897bde93959a722bb6f79c7c9953328df9c96d9d76567e8f79ea4dcac6d7da31858153c6451b9
- SSDEEP 6144:0JqhzcardXLALmlYqrsqAA/iI7g3CsX4m9V5CIvRpKsVmfUoR0hV6:0INcaCLMYqrNpsX7ZUCJob
- TLSH
  T1EC84AE05FAA504F9E177803D89B7A54BF7B2385C0720CAEB03A44A792F677D05A7B721
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

persistence privilege_escalation
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral10 behavioral9
- Target
  $PLUGINSDIR/KillProcDLL.dll
- Size 14KB
- SHA256 0fe15b023e21b7054fabb3d47b6084d60f8e474d8f9ca3a0a25dcb2097d6f0b8
- MD5 586270250a1acce8126a0877fd5bb981
- SHA1 9f5645b37b3af04004697639855da5c99a41aca1
- SHA512 a1994b91337385ab153860a013912f9cacdf9c233395868bf8eedfbe6dd13841619a8048c1d8407ee4b77c466fd8f31fc5cac2c779a2ef58c3a2a02caeded055
- SSDEEP 192:/BZa4DYIcJ4nS1ejJThugw4LBs4TJjdjqJVQXS3p16ZGntrefncWCV:JZ8IcJ4nSkJlums4TJJjsVh3pwZs/
- TLSH
  T15852F79EF117F6F6D4CB46B045E2FF3B443E29028836A8B4DF50EA207D1789E6529047
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  $PLUGINSDIR/LockedList.dll
- Size 28KB
- SHA256 671570118024c9132f12999e198cebc87b3bf1846695553bf478c5a42efec226
- MD5 2ee096682cc84f5fd44fb5291c00596c
- SHA1 8dccebf054abe13e5b324dfdfbe6605553971396
- SHA512 1ffdc3a5256b8eb62aff82c6429dcdf582009a908d43ab30d3fad84770b012be59c972323b6ae2b8d7ea2ae29d8ab3a99913205a0b33582e95dc813c31507d3d
- SSDEEP 768:Mne3kAZoxbRX66y11T9vBD3fNUHeBuf6qW:MnnTZyX9vBDvNU+UZ
- TLSH
  T107D2194457E000F7F7BE1AB079A92B0A5ABEF91868F195AB4F3754CA1D61112F628343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral13 behavioral14
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
- MD5 cff85c549d536f651d4fb8387f1976f2
- SHA1 d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e
- SHA512 531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88
- SSDEEP 192:Zjvco0qWTlt70m5Aj/lQ0sEWD/wtYbBHFNaDybC7y+XBz0QPi:FHQlt70mij/lQRv/9VMjzr
- TLSH
  T126426B129BB089F2F591583814667F2A6FBE9C5D27F50563CFE304D63D212CB983A283
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral15 behavioral16
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 56b96add1978b1abba286f7f8982b0efbe007d4a48b3ded6a4d408e01d753fe2
- MD5 6c3f8c94d0727894d706940a8a980543
- SHA1 0d1bcad901be377f38d579aafc0c41c0ef8dcefd
- SHA512 2094f0e4bb7c806a5ff27f83a1d572a5512d979eefda3345baff27d2c89e828f68466d08c3ca250da11b01fc0407a21743037c25e94fbe688566dd7deaebd355
- SSDEEP 96:o0svUu3Uy+sytcS8176b+XR8pCHFcMcxSgB5PKtAtgt+Nt+rnt3DVEB3YcNqkzfS:o0svWyNO81b8pCHFcM0PuAgkOyuIFc
- TLSH
  T17012F992E6A450B3C5D6533B35AA2F2DCBBD5325B0926C00C7738E4D39395B66E38353
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral17 behavioral18