142be3e08f4e5f84c5d506da3b58f6f0f287d5a9788803c7c7c77b3c4b140aa2

Sharing

Copy URL Twitter E-mail

General

Target
iPlay.exe
Size 44.0MB
Sample260626-t54bdsdv8m
SHA256 142be3e08f4e5f84c5d506da3b58f6f0f287d5a9788803c7c7c77b3c4b140aa2
MD5 859f0523bbdcadee8c64ad2f03aee100
SHA1 29ac2e38d226b22711ced7e586ffe18cf2fd1976
SHA512 f48374d0bf59d695a774564e8a5c8db33df7025cea66a66796badf5e71061901a5f3457f261163b7121f601c69b5b7f8d1d623e34e49a7371901be2f940483b5
SSDEEP 786432:SNV0PjNky/2h310h48coW0IU8qfVfoEegH1tjdLUk21L6ITUTSXGMVOjyFP13tl6:SNV0hkRL0hj3W0IU8StoEL1B1Uk21L6Z
TLSH
T190A733FCE5E98AB1C0D7A4BEB0E75461826EC610506617B1546693E3DCA3CBEFE87043
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  iPlay.exe
- Size 44.0MB
- SHA256 142be3e08f4e5f84c5d506da3b58f6f0f287d5a9788803c7c7c77b3c4b140aa2
- MD5 859f0523bbdcadee8c64ad2f03aee100
- SHA1 29ac2e38d226b22711ced7e586ffe18cf2fd1976
- SHA512 f48374d0bf59d695a774564e8a5c8db33df7025cea66a66796badf5e71061901a5f3457f261163b7121f601c69b5b7f8d1d623e34e49a7371901be2f940483b5
- SSDEEP 786432:SNV0PjNky/2h310h48coW0IU8qfVfoEegH1tjdLUk21L6ITUTSXGMVOjyFP13tl6:SNV0hkRL0hj3W0IU8StoEL1B1Uk21L6Z
- TLSH
  T190A733FCE5E98AB1C0D7A4BEB0E75461826EC610506617B1546693E3DCA3CBEFE87043
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Executes dropped EXE
- Loads dropped DLL
behavioral1 behavioral2
- Target
  $PLUGINSDIR/data/icudtl.dat
- Size 842KB
- SHA256 998367809a821d595928089c197b3f7959f0420f81f79d4d0daee53378492ed5
- MD5 018361032ba13dfeab636138ab6b9831
- SHA1 8f9c259d3a330786ab8bbd49e7e79abfa1d552ed
- SHA512 d7d3fffb41576cf2c90cd260727cc0ea23c5a4c458f84b01426c2a4578004b94168047c7282222e9ffade2f082e189cf167146cc3303bd7dbbb252a593236967
- SSDEEP 12288:8Mlhw771h0jM7ykPG07rr4c8w0P4N48Rkjt3dPHz982VYhq:Zhw3zVtjLbGu4RjTPHzMhq
- TLSH
  T199056A17B0435E6FE0C48277C652E7B65637838DEB3317EAB698B5593E8A1C20241BCD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral3 behavioral4
- Target
  $PLUGINSDIR/ffmpeg-8.dll
- Size 10.6MB
- SHA256 c55cda7dfab054a354cc5d2e36617c0c896b5b720c17128c883291fad5d4ed20
- MD5 0be61da7388cf3488db78617e89c0c96
- SHA1 6d5a7358693b0239e100b55d69494d2e2bb984e3
- SHA512 3ec0ac12b16cbdc47e311573c0a48f4829d165d606f9d58d37982546971085c59e052d68232373fe5668edac73e7c17a2c0702a9649e35f74629163e98baf801
- SSDEEP 196608:BgrPhldisSoeE1KrCvQgnXi8W4H4vX+pVnGjZi:Wrdi9oH1KrCvQgnXTW4HCWnai
- TLSH
  T163B6AE49F3E201E8D96BC074C5A79707FFB0781D1350A6E79A918AA97F237E05A3E701
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral5 behavioral6
- Target
  $PLUGINSDIR/firebase_core_plugin.lib
- Size 915KB
- SHA256 b0d58909326ba6415b65d4d883745da670588a3ec3560ba8ed542b7704495ecc
- MD5 4f27466156f28a8efff5289d9b1fead6
- SHA1 06e3e0c18baf96b286e2b4b949411d070024a751
- SHA512 0e40609fa0f3552a59bed758a1bbd239de11d658bd6e7a5f587b404b8c0bd01896111dbc88c9cb6c1fbf41c42807f6d1643dbbd2fc7a9419acecfbc361b16dae
- SSDEEP 24576:3+gaYg664FF9RSohWpWp796X66o66d66DgaYv662FzFGtoDWcWS7oLyk66o66d6y:3+gaYg664FF9RSohWpWp796X66o66d6Y
- TLSH
  T18F157345EBCAE683EA61D7F2C89D11B26238D961BB12F707565921311E532CF3FE7880
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral7 behavioral8
- Target
  $PLUGINSDIR/flutter_windows.dll
- Size 19.8MB
- SHA256 92e7aa320afe026e90780e4049dc6f6a480696400a269c179b1cca0ef751d175
- MD5 c0d0fdd1a9dd3b9ab518003d87c47c32
- SHA1 7307224532c5d2e088d1d7389188e2ea75191220
- SHA512 32b659ab92e3c45872ad43995e2c05f1ce3135924cdf8f3f886c5b5e4bde4b285427f2dc8c7dc561438062113ba9dabe8c6a0b760ea3b1948ddc65652da55ac6
- SSDEEP 98304:+77d81nBOcRm2PKMU0PCgYB74H6tTlNGKy2Qz7nUVuIEIa/t1XNxF2Imy+khVNGO:+St9PC38k+NxXmbkh7kUF/+25Nl
- TLSH
  T1AD276B03F29680EDC459E178971BAA23F6B1B8490724B5DF27584B223F66FE05B3E750
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral9
- Target
  $PLUGINSDIR/fvp.dll
- Size 128KB
- SHA256 512213b378212b7337450d468b7244f112fab3f4c5fbb7dba8cea60b06db8eaa
- MD5 dff19ab204be5996fb7d2c502903450f
- SHA1 b4ac0d440b8051559455581ecc32731ed20bdc00
- SHA512 d74061aecbe19dfaa909b9b7edde981da48b9facacd91c5d994865eb101460de0fe9471b9d624529a7b4127a0bab79a87b310460452da0e3ebb2d77606325e2f
- SSDEEP 3072:akWq0If1anGeoMgem6HsTG7w+9dAsMDWCkn9/a:vWqlfQGeoMgem6Hs2Z9dfMDWCkn9
- TLSH
  T1A8D33C2FB66540BBD15AC179CA539D0ADB72B8854BA097CF07901BD70F27AE05E3E311
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral10 behavioral11
- Target
  $PLUGINSDIR/iplay.exe
- Size 736KB
- SHA256 d3a3c225e532fa3652184b6b9df9c0aaed4962acd58e557d0754ffcd072d68d6
- MD5 5fef9800c6c46fdf62a01f71e6cc88c9
- SHA1 f446b3a20faf282d62a356f3be4f15d914d26fe3
- SHA512 8a935fa1c1447a09d7cf9be9e31398b7faa94e5d67c72cbf473455f66cf576533ba8c20dc770719e8249557fa8469a59a69adc395358d7662384f5cad45ea717
- SSDEEP 12288:Id6kBqeYQZyosz5N2Rb3Whzr8LSC0HR6DdTj8inIAt4LM8UdexBjoq:Id6x1T2Rb3Wlr8LS7HcRTjtIAt4LM8U4
- TLSH
  T10DF45B5B666402ECD1BBD2B8C65B5D62F776B8060361DBCF17E08A632F436A44F3A311
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral12 behavioral13
- Target
  $PLUGINSDIR/iplay.exp
- Size 963B
- SHA256 329a71c2adc749b6a991558f0a596d868140f774256a327cd40983181dc44597
- MD5 dc9045434fdbf83ffb2bd42e5b5bdf99
- SHA1 1c023b11c37fe0a5062a70df7f2472c7cf0b7438
- SHA512 7c29025da9bdfa0bd2058efdc4b110e46ea07d71d3eee7118a32a6e6ebc17d3f621b65ac60736669f556172cbbf7a766b12be0682e104d925bfdcba7da3fbbdb
- TLSH
  T17711AB88E7D1AD43F164583C880D0B6072DBFF6189C6DB1613A403AB0CC7AA8A43D07A
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral14 behavioral15
- Target
  $PLUGINSDIR/iplay.lib
- Size 2KB
- SHA256 16f53a73246e21ea0c4a476fcffd38f9e63eefb5985e33ce3a5e75dc07884aef
- MD5 b57f04cade68ac13e105d6ee77b7b8f4
- SHA1 63e4aa0c6e9099885d82800b419b99a726a512e0
- SHA512 124cbe35173b913fcdb083f60c4c4786d3dc1d3691e8b661e931e966a9535fca5f1767fc39a17db3e341ec8c301fee87f15a1847381b139fb8a174872e25af1c
- TLSH
  T1B9411198DED6A8A3C47CD138985E496436BF3E401796EF7B35BC03F103C2D48B0A6856
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral16 behavioral17
- Target
  $PLUGINSDIR/libEGL.dll
- Size 461KB
- SHA256 b2590bd0692f0381fc45c20bf1c7f7f713c9ea19c7ea6bab62efdd1fadc4eaac
- MD5 0f61da7cea39e89861117f3cb4620dae
- SHA1 9ca286bf6d5617eb38101d5e166edac29497c9c5
- SHA512 7dc2bbce9808e00122ae0d960ad6b0156d201494aedf4c4c9e261f50986b72dd19b41d443138ffdf1b2e5b8e29614f0a1e909e4c867262eab311f6675618369d
- SSDEEP 6144:bAJGuTlLMP/jvtG0uMgvgZS+U85p+2uEA3sB9KeZTyT/tSOaj0yPepA9YK9f:oTaP/jvtG0urvgZS724sBbj0ZS7
- TLSH
  T156A48D15B79448A9D02AC074CA538643EA72B8960F64FADF13A0D37D1F777E85B3A324
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral18 behavioral19
- Target
  $PLUGINSDIR/libGLESv2.dll
- Size 7.1MB
- SHA256 620bb6e38d7ed6c760a0cf4a8eb6a8f64b259b96ff286551cd32cefc6c35ca39
- MD5 d22c92bee4e7a14d6c74e7376eca7605
- SHA1 0592d72d5e0e38e5cfd9a090309260962bf8c4d9
- SHA512 2aeec8ccf9db442a2b1e3b391e6c3e899de1266199e6ee6040aceeaf8931e1d10c55ea1ab9ebbd3cc662bf56aea698c09e38f75c7b3e8b0b27c02af63d36993f
- SSDEEP 49152:fR1vq8X1ZxC721Mr+IqizQ0LQj7KxKT1wvIOCaDCmvWI2YQkGk6jouaLlbpx/fur:b/xO21eqnoIw+vknAYYszpuSxxZi8Y1
- TLSH
  T142765A03F69141EAD05DD2B98B5B9622F231BC861371B6DF229473153F76BE0AB3A314
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral20 behavioral21
- Target
  $PLUGINSDIR/libass.dll
- Size 1.5MB
- SHA256 8129e76d3ba718ace1752db78ebbd15f667e60011a3b983aaa7fa602d1301071
- MD5 66678cb007c54d3df4ef50708095d613
- SHA1 259df78384048f29a965b75d5b0fc44222e361cc
- SHA512 d11c363005e54568b7279cad4934cc4196f9231e776633aefaf950f1a88608a96794ad8dd6904c806b367bfa3501c71119bd4d916080684256157f5d700c4ad3
- SSDEEP 49152:K5WnjH0kNblSlMTTt08A4LMFPGSX5K+s09C04:5u
- TLSH
  T17D759D47F2868598D63A81748663C70BEB71B50D13169AFB16B0895DFF237F20A3E2D4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral22 behavioral23
- Target
  $PLUGINSDIR/libmpv-2.dll
- Size 28.4MB
- SHA256 d5f0694b08c124e785d858d00082f3e3b158dd9138bfc48c0382bf1eb443a5fc
- MD5 3a6bd0dc9ab32d7b450f06bca2359274
- SHA1 b2be6a73be23b60f1d23543363ea559438218c72
- SHA512 4c8133321833bc94c8a2f1ddc83523fd554d9699efa09d8dea6ef4aa9bbca0a4f041a10e4793b6424c8cffc4583e36c2a96039017f29465458a9a2e5510631ef
- SSDEEP 196608:2E4MJL6OGzrpR79PnKPBv00IbW8p6NMA+31bGb34+1VVMjbCtuQ/OHAs4:CMMOap19/KPR0Zz50I+5Mjbou4Eb4
- TLSH
  T116676D07E29350ACC56BC170876AE733A631785D02B47A7F2695E7B02F22F90775EB18
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral24 behavioral25
- Target
  $PLUGINSDIR/mdk-braw.dll
- Size 106KB
- SHA256 6d5694c159ef209c45c263b1856707fb59833a54f553e25c55a5a83141107d35
- MD5 545373fedba34c99ec5f78da2e2cd76a
- SHA1 ba8b7a553421c34a43c035add5e04894a5eb3138
- SHA512 342d182885bb0a475336e8ac404e4cd2f7d34ac1579a87e75cb3f997c8e5baf789a1625dfc5ced4485f996ab521f119befc5a38167db9bbde531c00247ad1c1c
- SSDEEP 3072:vAEpic13rOPsmJjIyrz1DBnpwTjB/mnK8u:aI3rOPNjIyrz1DBneTjB/mnK8u
- TLSH
  T152B31A12AB15406FC557A6F8D6520E0ACB32BC9143B327CF83929D9E0F679D0AD7EE11
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral26 behavioral27
- Target
  $PLUGINSDIR/mdk-nvjp2k.dll
- Size 238KB
- SHA256 85eb0b897adc89c8b529d22c361defe97f42c041cd5e4d0df2d6ca7659c4a137
- MD5 d0b384e241b98b3ff5315ec3a0b3a2ff
- SHA1 f205a74bf2750fa05b041d40a956e0ca2ec8f743
- SHA512 798561c5e6f59f550fd73c336e811e7c11c4d633e00f382c16baa6d99a2dd21375467143b425bcea3394396edce8631da71a723d96f27ee841b997b9c1fba989
- SSDEEP 6144:KLZS3ZGph0lhSMXlBXBWnz7SojB/mGQsu:KdS3wph0lhSMXlize
- TLSH
  T1A334AF12FB91DCAEE51887F488A70F49EF337C844382D6CB579898914F676D26E3E601
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral28 behavioral29
- Target
  $PLUGINSDIR/mdk-r3d.dll
- Size 136KB
- SHA256 4a9e3ebe12c608b236ac560636b663ab23a36ad8b9d19c6fb1f3818cfa2a86e3
- MD5 99dbf20a335f48249ce81f0d1607655c
- SHA1 cad77cdf01862bd607a0043498f34bf3f58556af
- SHA512 244661aed88c792e0455d115f77dc9c8d9a78a0fd83ac1b47f41716c297676e1e3f8e86c5847a823d56eb353462fa1cfe4d61651feca55f823ba89cc92195555
- SSDEEP 1536:jTuuwIKMXw9wZSHGagPj7LUxp0dKFn6715MEih5l+R/sMiNktYOdU+mvjB/1klMj:jXblD7OpspRUMhdRejB/mpf/pHjj
- TLSH
  T19AD32B17BE1540AFC11AD6BCC6578A46EB337C891361B7CBCB914AA60F27BD06E3D610
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral30 behavioral31
- Target
  $PLUGINSDIR/mdk.dll
- Size 2.2MB
- SHA256 97bb4fb53f83195fd4a2b17b2455930546b3613417aa1cbf949b57d6fc29004d
- MD5 088dd8bcc3883493fc1028bfc2b19590
- SHA1 288e96fd1808ae8026c43e5740fd3b15778fb57d
- SHA512 4f5f8e56851997438bd00ca3108f706b55bd96e954d545e23a8df3cbabe7af665f48823908426882852b736c30b9acf7093313fe12da2841945d50d2b09c9c91
- SSDEEP 49152:odI/lxLsiW7Lcb689A87e+WNRPETGnXZZJPevcckA6Xlsj0851PYo2FI:x/FgU1SgZ
- TLSH
  T1CBB59D17635801ACC42FE1F8CA534E0BE771B8461372A6CB42A2D65D1F7BAE11A3EF51
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Executes dropped EXE

Loads dropped DLL

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32