ca3d34377b2948cee52eb2cdbac1071e206b100b5c75cd92aaae043c4dd59066

Sharing

Copy URL Twitter E-mail

General

Target
mp3tag-v3.35-x64-setup.exe
Size 5.7MB
Sample260625-2hblvsgs4m
SHA256 ca3d34377b2948cee52eb2cdbac1071e206b100b5c75cd92aaae043c4dd59066
MD5 5a7e64fa9f57d353cd58928b81949451
SHA1 33cd0d0a5bb5551c96a55abbfd381c3d94cb5418
SHA512 6b478a5ceb9c32165d258e98ec89c38d37654bdf566dd19a6ca1f3e7fefccdda265da9b4cbe18d704a7c9ed21695169eefe55ff4d7025c9d42d409fbfd1f27c9
SSDEEP 98304:frPQ9crlJ+RRsd9ccqVinrPQYMfheGE45akjmVTxKE3R+MbEXrtjsKBgpk:fDQ4l8bsccqViroYE8bkiVLMMwXrPIk
TLSH
T161563358F741EAD3C8360F3680EC229727F1FA10486446DB7BD9F3AAF860D41DA65297
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  mp3tag-v3.35-x64-setup.exe
- Size 5.7MB
- SHA256 ca3d34377b2948cee52eb2cdbac1071e206b100b5c75cd92aaae043c4dd59066
- MD5 5a7e64fa9f57d353cd58928b81949451
- SHA1 33cd0d0a5bb5551c96a55abbfd381c3d94cb5418
- SHA512 6b478a5ceb9c32165d258e98ec89c38d37654bdf566dd19a6ca1f3e7fefccdda265da9b4cbe18d704a7c9ed21695169eefe55ff4d7025c9d42d409fbfd1f27c9
- SSDEEP 98304:frPQ9crlJ+RRsd9ccqVinrPQYMfheGE45akjmVTxKE3R+MbEXrtjsKBgpk:fDQ4l8bsccqViroYE8bkiVLMMwXrPIk
- TLSH
  T161563358F741EAD3C8360F3680EC229727F1FA10486446DB7BD9F3AAF860D41DA65297
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2
- Target
  $PLUGINSDIR/StartMenu.dll
- Size 7KB
- SHA256 e74f442771f034a24b77d3a849b343551bdef69ef151c622cb9fd5f34dccda81
- MD5 dc91f181f9cb870fff0c58bc0ea63eda
- SHA1 cc37e24f6071dea801d0eb59bcc2a9221cf1c74b
- SHA512 714605cad60dca30da96172b5ca1a1d8838d27f0a9979aa0db125d373cd3e015ae6b39c7b7d2b3fc9a4b5433ff1d7d2427caf3a2b5d1ae321e218d3c8fe8f9a4
- SSDEEP 96:FxIt3J2Gl0eVe0+Cfo0UkXt6+o69UiGdPh5/utta/t3lkCTcaqHCI:4hE+A0+sF6piUFkAxlncviI
- TLSH
  T186F1C876F3D20673F9AB437428632F231B2AF521576981A6490316CEBA61DE3FD34B11
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 23d618a0293c78ce00f7c6e6dd8b8923621da7dd1f63a070163ef4c0ec3033d6
- MD5 192639861e3dc2dc5c08bb8f8c7260d5
- SHA1 58d30e460609e22fa0098bc27d928b689ef9af78
- SHA512 6e573d8b2ef6ed719e271fd0b2fd9cd451f61fc9a9459330108d6d7a65a0f64016303318cad787aa1d5334ba670d8f1c7c13074e1be550b4a316963ecc465cdc
- SSDEEP 192:ljHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZqE0QPi:R/Qlt7wiij/lMRv/9V4bfr
- TLSH
  T1B1427C1297B089F2F551493419667F2A6FBEAC5C13F405A3CFE304C63D212CB9839243
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral5 behavioral6
- Target
  $PLUGINSDIR/UAC.dll
- Size 14KB
- SHA256 2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
- MD5 adb29e6b186daa765dc750128649b63d
- SHA1 160cbdc4cb0ac2c142d361df138c537aa7e708c9
- SHA512 b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada
- SSDEEP 192:DiF6v2imI36Op/tGZGfWxdyWHD0I53vLl7WVl8e04IpDlPjs:DGVY6ClGoWxXH75T1WVl83lLs
- TLSH
  T10F623AAA62E847BEE2221636B96723130BFDB5203DA1D01F4D531E596C30BE3953D61A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 89a82c4849c21dfe765052681e1fad02d2d7b13c8b5075880c52423dca72a912
- MD5 b7d61f3f56abf7b7ff0d4e7da3ad783d
- SHA1 15ab5219c0e77fd9652bc62ff390b8e6846c8e3e
- SHA512 6467c0de680fadb8078bdaa0d560d2b228f5a22d4d8358a1c7d564c6ebceface5d377b870eaf8985fbee727001da569867554154d568e3b37f674096bbafafb8
- SSDEEP 96:ooEv02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3YMNqkzfFc:ooEvCu5e81785qHFcU0PuAw0uyyIFc
- TLSH
  T16A12F992E2A454B3C5D6523B35AA2F2DCBBD5329B0927C01C7738E4D393957A6E38343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  Mp3tag.exe
- Size 23.8MB
- SHA256 2dc296d264a0e25e93f56e4001ed07eb914f260df1e4243328b8e6bd4838c211
- MD5 eedacf1883d820812867605c18479eef
- SHA1 0d999d76e7f24be5235594bbcbad51ee6981e0be
- SHA512 12a13d814f4b575fa4a84c2488d322102c2a5cd98c082980729bace92c753ce872149e8f246c07241aec2b55446795a6814969ed19954b86aeee3cffc9a8d11c
- SSDEEP 196608:JBCgcHEWWfwVZ1imxUfe5ww84aGJRNQ+ypJ7VhajZk6JQKg9+4:J2Wfwf1imx5DxFRadpJ7VhajZk6JQKGd
- TLSH
  T13A47F502A2504B98D0BFB379B6F6A55FC3617C326321B1D754ACF2562F3A6E54C2B207
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral11 behavioral12
- Target
  data/sources/Cover Art#Discogs Release ID.src
- Size 1KB
- SHA256 3e07aa33315da4a9abc32c3b2e657cde1e612daf4cdc0e54f093cffdf213515a
- MD5 3c14d2d39fbfcf22635470ed9fdfc2f8
- SHA1 ae2a522ea122166654415c2d4024be5f32eeb8bb
- SHA512 ed92685809fa40a21661cbea422d9838115e366511a5592b92d5d4fd5a03762ce14703f6cd9aa9b0e6b159a9188f95edb1c02e802d7fee906264eb674cc3c48b
- TLSH
  T1A13100393F627066177B4185E47A99C8424CF0706EBFCA846A7EC8393E6325B0A22453
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  data/sources/Cover Art#Discogs.inc
- Size 3KB
- SHA256 1c3c22be4b9465a1d4360be4377dcf74456cac44fda6ee2e706b02f1cdb2f901
- MD5 cef92705bc574e481f6cb9e2daab1e9c
- SHA1 2d4fdaf540052e3714a2c61b11f5b8e29916e32b
- SHA512 230d3b074c319b82c7d00997c7815723a0c85db32c447b25664ffaa0fd0484a4f65101d70b85a89ec67459ec8edad72249771cc6224e1d4c04f4b431ceb53bad
- TLSH
  T1718145243F2F3061A73E0103E8755C89576CE064BD9FC64BBA7DC9172AA35AED11608B
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  data/sources/Discogs Release ID.src
- Size 15KB
- SHA256 1b1feb2c78d1ee47ff9eaa0cb9251753ca1dad78a092afe4f98d1e0574162fd5
- MD5 86ecdf9f5659b2e4cdf571682471b881
- SHA1 a359875901c329341811e1d78bc30f6793ac0db0
- SHA512 b817d1a95993ef0d01c29b584966e5cce19a05ea8987bd0d373c11217e9d6c7d926764ff6054cf6aec7ebb7ae43f6b7bdb3f2dd2dd09542855e7dee956abc107
- SSDEEP 384:FKidDQ/0gdtAjhLjqZBcY2qCn7gIj/qOgehWEzKH4Q2gUyGhhaLApsIIsGJL7y8F:gi9gdtAjhLjqZBc/qCn7gIj/qOgSWEzE
- TLSH
  T1AB72BA303A1E2451E79F2243A67648DAE4ACD0311EAFDAC5BFADD5770B921DA431C047
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  data/sources/Discogs.inc
- Size 18KB
- SHA256 f79b8769e11324b60d49d85c3009f503df38ce1b818075332ddb516f08ca3229
- MD5 51eec83650bd19638fa957940dcfd7c1
- SHA1 7f4b5d18da71d769722b9e6cc6e1c391c5697281
- SHA512 a5c92eda7dc6bf7fba232c47d86aa43db36dfbee0231f7f034d2353c32983cc190c56adedbeffddc8df44ea80ffc075a464c80f7cc50bd3a248a7d3fc63d6a33
- SSDEEP 384:p9PD21JPgdtAjhLjqZBcY2qCn7gIj/qOgehWEzKH4Q2gUyGhhaLApsIIsGJL7y8F:by/gdtAjhLjqZBc/qCn7gIj/qOgSWEzE
- TLSH
  T18E82EC303A1E2451F7AE1243A67648DAE4BCD0716EAFCAC5BFADD5770B921DA431C087
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  data/sources/MusicBrainz.src
- Size 8KB
- SHA256 c21c7fc3c3033136528830d25d595086e2baa7f7f3ad84c4e1eabea0f44502cc
- MD5 b46fadcdafa2d9ead3f735438f65a111
- SHA1 f7c0dd3f2023862cc496f5bb01e01a0cb8b0cc70
- SHA512 5c3cf5436f8da9d595b07be924be1354bef32a67bb13712975b21cbee334db1b89c2734f6855a68147550cbd123231a6cea8d63e1c5bf277ce805529ed283073
- SSDEEP 192:z//fhThTB8Dt0sRJ++gQngalagngZl/1l8oDLiwrEpI1Krxi2wVQN5e3so538svP:rhThTBBydgQngVgngZl/1l8oDLiCYI1N
- TLSH
  T1F31270507A6F1015E36E128768B04CCDF1A9C8612F4FDE09FB9EE4AB1F6248CD71A087
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral21 behavioral22

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22