General
- Target AutoSubs-windows-x86_64.exe
- Size 65.3MB
- Sample260701-e4lmmagt2x
- SHA256 fdce7226b0514c85697f51374afb355a00591cc91a11b96146585d2f05ecd771
Malware Config
Targets
-
- Target AutoSubs-windows-x86_64.exe
- Size 65.3MB
- SHA256 fdce7226b0514c85697f51374afb355a00591cc91a11b96146585d2f05ecd771
Score4/10 -
- Target $PLUGINSDIR/NSISdl.dll
- Size 15KB
- SHA256 419485a096bc7d95f872ed1b9b7b5c537231183d710363beee4d235bb79dbe04
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target $PLUGINSDIR/StartMenu.dll
- Size 7KB
- SHA256 42dd4dda3249a94e32e20f76eaffae784a5475ed00c60ef0197c8a2c1ccd2fb7
Score3/10 -
- Target $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
Score3/10 -
- Target $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 56b96add1978b1abba286f7f8982b0efbe007d4a48b3ded6a4d408e01d753fe2
Score3/10 -
- Target $PLUGINSDIR/nsis_tauri_utils.dll
- Size 33KB
- SHA256 3697d11bdbe1e34daa26b1e89d84276d9ff28148906943d0fe888354c3b13620
Score3/10 -
- Target autosubs.exe
- Size 123.6MB
- SHA256 ca76d1cdc9bc5bfccd96478b235a4bc6ef21e305596590a849787be33c043c37
Score6/10-
Network Share Discovery
Attempt to gather information on host network.
-
- Target ffmpeg.exe
- Size 96.4MB
- SHA256 87170ac0aa3a8f2401be7faf596ce9c19c273650221043b28f8ea504af6c6496
Score1/10 -
- Target resources/com.autosubs.adobe/assets/main-D2RE_pF2.cjs
- Size 213KB
- SHA256 85c6bd2526f2abdf3a48de243bbece9f5b6646a6320183ce1bd5f2e4355acd71
Score3/10 -
- Target resources/com.autosubs.adobe/jsx/index.js
- Size 42KB
- SHA256 857585ea91e23bfcdf96ed45a7ce7a68b552d8adfbdd0ecba74d3bf0d09a2fe2
Score3/10 -
- Target resources/com.autosubs.adobe/main/index.html
- Size 3KB
- SHA256 3c1f29db861ca4aade8047f12d93efe76d48ea8813cfec190bea6e159f24f5c6
Score4/10 -
- Target resources/modules/autosubs_core.lua
- Size 73KB
- SHA256 c66e507853d94f7e75827ce98b0e10207bde468090c2725ead3225b3af0b679f
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target resources/modules/dkjson.lua
- Size 22KB
- SHA256 dc7cda09424409e287ebe41bf583fddb0eec0e3849a0c34ab6cf6fd06d705746
Score1/10 -
- Target resources/modules/font_fallback.lua
- Size 9KB
- SHA256 52ebe5f570e56c7a6f079917219ac5aaa4a16eeff86cd467e3d0dc459b1e764d
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target resources/modules/libavutil.lua
- Size 9KB
- SHA256 d587cb637bab4fb4bed3ad1b84b0c3c1543efb359c5df8d2738a18e44b6e4946
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target resources/modules/ljsocket.lua
- Size 37KB
- SHA256 a50fffb195a4d911f3ca66f6396b64bed49c574ac4256c39ef6fd1e4df314b27
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
MITRE ATT&CK Enterprise v16
Defense Evasion
Modify Registry
3Subvert Trust Controls
2Install Root Certificate
2