a05adf55490000ced791ac535130e27bafe9cc766978e0c24db883e17622394f

Sharing

Copy URL Twitter E-mail

General

Target
MusicBeePortable_3_6.exe
Size 9.3MB
Sample260704-dd3yjsav9t
SHA256 a05adf55490000ced791ac535130e27bafe9cc766978e0c24db883e17622394f
MD5 27c7367c6ebfbf42b038e827c7605b92
SHA1 941d089e825843c2649ba49dedaa96f9873f508d
SHA512 53f39d14c8636350e31399db6be0c823f63b807a0d09f80e708ffe52da165aa5d5495bd8b8c77bed334fc38bf9dd93a041929f004f5c51e1284b739db3101a2a
SSDEEP 196608:V6uKCerkcsJ/Endl3isSREPI0xpiTERoicr0cJWjYEy:VRKCegcsCxisS2jxtmicr9JWK
TLSH
T125A63344345988ABDB71603D18A9F3B054EA5D7A3E8BE18BEEE53C473FBC1827624117
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  MusicBeePortable_3_6.exe
- Size 9.3MB
- SHA256 a05adf55490000ced791ac535130e27bafe9cc766978e0c24db883e17622394f
- MD5 27c7367c6ebfbf42b038e827c7605b92
- SHA1 941d089e825843c2649ba49dedaa96f9873f508d
- SHA512 53f39d14c8636350e31399db6be0c823f63b807a0d09f80e708ffe52da165aa5d5495bd8b8c77bed334fc38bf9dd93a041929f004f5c51e1284b739db3101a2a
- SSDEEP 196608:V6uKCerkcsJ/Endl3isSREPI0xpiTERoicr0cJWjYEy:VRKCegcsCxisS2jxtmicr9JWK
- TLSH
  T125A63344345988ABDB71603D18A9F3B054EA5D7A3E8BE18BEEE53C473FBC1827624117
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2
- Target
  $PLUGINSDIR/InstallOptions.dll
- Size 15KB
- SHA256 c7fef6457989d97fecc0616a69947927da9d8c493f7905dc8475c748f044f3cf
- MD5 ece25721125d55aa26cdfe019c871476
- SHA1 b87685ae482553823bf95e73e790de48dc0c11ba
- SHA512 4e384735d03c943f5eb3396bb3a9cb42c9d8a5479fe2871de5b8bc18db4bbd6e2c5f8fd71b6840512a7249e12a1c63e0e760417e4baa3dc30f51375588410480
- SSDEEP 384:EXsC43tPegZ3eBaRwCPOYY7nNYXC06/Yosa:EXJTgZ3eBTCmrnNA5p
- TLSH
  T1E1624D1137C558B3E2D62A797EE3B7138FA5F722A4438E0BC7332E06281A5956E7C311
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
- MD5 cff85c549d536f651d4fb8387f1976f2
- SHA1 d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e
- SHA512 531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88
- SSDEEP 192:Zjvco0qWTlt70m5Aj/lQ0sEWD/wtYbBHFNaDybC7y+XBz0QPi:FHQlt70mij/lQRv/9VMjzr
- TLSH
  T126426B129BB089F2F591583814667F2A6FBE9C5D27F50563CFE304D63D212CB983A283
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  BBplugin/Fahrenheit.dll
- Size 33KB
- SHA256 c46caaa760617fceb80124504a42be53c34a2bac3bca03623b8816c56bbe1a3b
- MD5 e195a24ae409b13a28f35e4616378a5e
- SHA1 fb9698b1290ff47c9cbe53e85382bd53013a7654
- SHA512 25ff65726506a3ebd87a141a60f26f73bd93ade521204a0fa381f84d9250d8eec96098b6bcef5a9fce5bf8ea6ef29b7242f972e16ad874942f94ff3fb8e0e8bd
- SSDEEP 768:Qlr3DgFcoQCEk4wKRbuYwSV4bJV6Qsp6j6E/yM1vMwa1:q/oQCEkRO4bJo5810wa
- TLSH
  T103E24B3D792250F1C91005FA2230E3A2D33ABF7D249B9BE7A7D4283A9971947060CF5B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  BBplugin/Flash.dll
- Size 34KB
- SHA256 03a4dc8eedba6ed50d7c6dfd3174553f6733598d2c6755dd6df514330783dac5
- MD5 2e462992a832b5a9d7c7eb8f5814f6d2
- SHA1 e6bccbfb6e06bd5ed7763302c8951387ed8b8bd9
- SHA512 7e300bf20e8d443cdb24b3bab73e731debfef587354ccc9ff20d15fc34f6f4e5c9f630fe37ea3eb8c6ba135e20fef3836ff2d7c82d10c5285ad90d28a4d39080
- SSDEEP 768:Q95sKA/1WyoWkJ8qm2RmyNVR3r61Zqpsrjd9/yM1zCw:UsKm1WTLJS2RmyNVR3Gegz12w
- TLSH
  T145F25C2A652391F1C86049F63131D3A1D37EBE35289BCAE777D428395871A934A0CF6F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  BBplugin/Flashback.dll
- Size 35KB
- SHA256 9e8444b4a8fdb95a2540994ae5526cc605d1884418f146a998c44d744ef22268
- MD5 b32a37c92e1d3813856ec65526160a19
- SHA1 a398d13e19bbd965d45b60f1c065d98b172f41fe
- SHA512 5c077a26ac0532725281b399112c700aed49b2b577ab0e9bd2a196890215bd71e0aeec4a35dc26b12e5c18764584e70978d74300cfc5333239df59f4e4a8033a
- SSDEEP 768:QjSl890Qu+JbPZKdXHy4RpyrBh6/0poQ5/yM1vMwO17:V8tu+Jb+i4RpyrBMk1H10wON
- TLSH
  T10BF22A39793351F1C91026FA2635D3A1D33A7E7C249B9BE7A3C4287559B25430A0CFAB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  BBplugin/Interference.dll
- Size 40KB
- SHA256 b2de1a93ef4b3b32e9c9057071d5f62bf757c0c989e99ffd175460e796eed4db
- MD5 e1961444cce5b95e3fb84ab5d5f2bffe
- SHA1 51c6cab29bd947cfa72ae900100de00024f15dfe
- SHA512 84d0375d31aad53059d0bd27d10e601e737e464a9498c65cf63e523232142d5e1fd02d5eb27078dba056f794d1c623bf92cdb3e73d42f0ea90e3253074bbc108
- SSDEEP 768:Qguobb1tmX5SMUS1WZVrJmHRpyrBh6/0poAfRf/yMN8Mw8lgs:Ig1UXdUSwZaHRpyrBMkBRJNfw0
- TLSH
  T13A030826B84353B9DB640AF21172A351F2777630358A8F53E3EC54376D626134B88FAB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral13 behavioral14
- Target
  BBplugin/LightShow.dll
- Size 36KB
- SHA256 c891436faa0c95959857ed654578af8871213eeee2b782de682ac93e590cd067
- MD5 2121fcb9c89dcdbb9d1390979d06f819
- SHA1 69ba1d79b6b674c716de0a603890c745af200202
- SHA512 09b666bdf6a94dc2421d819174a9642173cc1df3634f8b464a186becadca46a60b45fb93e24a0c3f9af9aa8c372bd18e70d266ea0f4d77f86122ed87b5ea6e7a
- SSDEEP 768:QS2V+fjsVCAZ/W0YQQ9hObRpOrBh6/0po6XT/yM1vMwr1BT:2U7svZ/xYGbRpOrBMkX10wr
- TLSH
  T1F0F2F825395361B1C6101AF1167193A1EABBB630249BDAA7A7EC18373C722135BC8F97
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral15 behavioral16
- Target
  BBplugin/TheRing.dll
- Size 35KB
- SHA256 5d502acff0d0ebd54262a400a1137e22de10baa3609a1f783ad37ef814f2f4db
- MD5 8467d1e718f61cf0a6cf636d843601bb
- SHA1 5b1d85e6d2d61ef4966b30c309dc401b4de1536d
- SHA512 205daf692049418e10463287f533552d82f9c62a8c76f3bfe640df64ed7dd494536ae0a0eb47f3689ad6cc129feea6c9e4e6ee377b5f6de286e593245043d740
- SSDEEP 768:QXUVTEX+XnZ5oo0J2Q7jGO4cFyJRpurBh6/0poEJ/yMN8Mwh1A:jE+XZ53XQ7GtJRpurBMkh3Nfwhm
- TLSH
  T152F22B39B92752B1C91016FA1231D351D33B7F7828CA8BE3A7D5287A69725834B0CF97
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral17 behavioral18
- Target
  BBplugin/Vitruve.dll
- Size 33KB
- SHA256 64b203ff186bad2bd35dfdb705c9a0e6ffdd448910540beb4a7731b9cffeeee4
- MD5 946c63b8eacf322ffcfb923210bd28f8
- SHA1 d1c7a3496da91d9b98f2361b9a58d56d9353ca0f
- SHA512 92657c788cbfd58b971d018f9d31c71e21e81732ee82397beb1670bbcd411906ca0d5935269eed8c628e2d6bc4e199d0c9295db0e741206779732a709fb8e395
- SSDEEP 768:Q41yZUlF1Uz7h3G1gRtRr1h6napFx/yMNvMwl1f:hf1U0iRtRr1M+RN0wl
- TLSH
  T1B7F23B29246651F0C8202AF51631D3D2D73EBA7968DFDBABF3D4243A58715224B0CF87
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral19 behavioral20
- Target
  BBplugin/Vortex.dll
- Size 36KB
- SHA256 3cde94ac9961b75554ea2a54fd4f3ff107ef9a910c8368cf83823e9975b419a6
- MD5 5d2ae79db5642de898d0b6e187f276a7
- SHA1 954f208f1d103cbbee139555117424e030b02b6e
- SHA512 4c6c6dbe99f306608215f1ca9854e44909dfcdbab7026b73ee2bdb4982609931e6afcf0e4f3239e577e252a37bf4f26f4ee0c495834ecf7ff3ea0e6392355ba1
- SSDEEP 768:Q6/vJrYVrW2RsK5GfsjWzRp466Rhr6sZup/1jvq6/yMNz2wpVp:rvpYVy2FAzRp466RhG3hFNCwpVp
- TLSH
  T1EEF24B7A791661F1CC2009F31232A3A2C77BB7301867CEA777D4587678B2663468CB5B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral21 behavioral22
- Target
  Codec/flac.exe
- Size 526KB
- SHA256 bc40922b374126b65f4b82f2fc83685421c7fcf409bd1598892df26a45e17075
- MD5 5e7eb27a3b9857c3bdbe57193d7eefd4
- SHA1 c84472a15355c149320830eef80d64b86f081bfe
- SHA512 1748b4acff6a2bc72dfa89cbaae7b1f7ab5c32532d5601d56936c7cbca1fb87f4b5e4a01d7c240f737105b9e9b6cf18258e4bbd396c4e38928215334e7519b2a
- SSDEEP 12288:TY6Yi7JdO9+yC7GnFhSkn7nW6D8YMHIdF:iil49+yC7CFUkn7nWa8YyIdF
- TLSH
  T119B48C01FE92D0B1D0B220B432BEE37A5E386661235959DB73AD05752F254E0B73FBA1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral23 behavioral24
- Target
  Codec/lame.exe
- Size 454KB
- SHA256 f49d5b74e0f4911b67afad335c9c54f488dc7ea0f6170ca8ee9aa04a16bc5387
- MD5 21a14b968997b6e87feed5a3b8a6c968
- SHA1 178fe5a0c4cc9c400d9c1ca6533f88ac32cd6433
- SHA512 14de3b9b412a16557890750b2424ab30357cf33248589beed784ab6e353502d355bba558b0d04f2b3b6688e712adcad9f9f3ff9d29b45d597d4dc7029d7b7260
- SSDEEP 6144:75UpSmPKc0z4PALRU4Q5qxw20ms0GDGFjrQseAOZHebsOvXau:7KvPr0UPORUJow2s0yGFjrQB3Hebsc
- TLSH
  T1BCA4A012F4C1C4B1C09318301565AA719B787B210666AF6F7FDC3B1E6F76390B2397AA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral25 behavioral26
- Target
  IPhoneConnector.dll
- Size 28KB
- SHA256 2ffc2a49fcc74403ec779c8462392154bb13844f08407450c0c555824c1fe9b3
- MD5 dddf03e49684a950027c212a99b5c9b7
- SHA1 c2757f2cdd934f979e49c53aae04354ac6d465ed
- SHA512 42e1a3c16d0b003725955293211192873d5935fd3d5e646c48680e01fd5a5f0bd373cdc06c9edbde006277c27fd37ed785c15d1c02ddc585cfac6f8b0e96532a
- SSDEEP 768:yQxCKTSTTTTTTTTTTNZSyPTTTT8JA8f2ASEzlcoTlMS:yQTSTTTTTTTTTTNZSyPTTTT8KVyHJMS
- TLSH
  T1D7D2D68167EC8626E2EF6BF5ADB30A1007B2BAD65D33D74E15A5402E08233905912FF7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral27 behavioral28
- Target
  Interop.PortableDeviceApiLib.dll
- Size 28KB
- SHA256 57407f1f87a13f81e0f2f1ddcf7fc62747be28d38bc9145acad2825e9d29b05a
- MD5 73788a095035d6079003427cc4d52068
- SHA1 abd1592a2b96686fcf771935dd7cf646206919b8
- SHA512 53a20e44236a02ce980b77e0b6fa67d3f89a6dd7daa65b76051680f81e0cc9e397c1e8750c8ee5a57ad66b1853028216f61d0f2bc7b1e7d9d91f71c8b6c0ca84
- SSDEEP 384:Y8tQQTCfOELzsmD6NsWPKvo4VBE+FGFjmaBWYOPwpzygit2Db3ha2n71FRarYQs6:hOi+ONXNsWPKvo4VBdGFj1QYxy56xv0
- TLSH
  T1C9D2E8237E6439B5C39A50FF9C6669202733E64092A2CF53201D43EA5F4953DB1E26FE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral29 behavioral30
- Target
  Interop.PortableDeviceTypesLib.dll
- Size 22KB
- SHA256 608968459c179b0378ba21d254f0ac996c1cedea3c08b247f1cd707a8be8051b
- MD5 88a77300456a1491d94899022411dc33
- SHA1 3385d62acc6f0c2911aa43801e17e8b89016462d
- SHA512 f5705698ac4a3ff6de8d463860b3ec113e3d486cd46c0537600c120bda2d5e85257a9a215bad6d8dde6570125aea74019c969031b7dbd377d6be012856aa225d
- SSDEEP 384:xq4oqnebIlPXC704JcuLIQWnLPUyOyWbAhanQdRanh2wuA3X:Y+VdXCsuLIQWno9yYe1O
- TLSH
  T190A2096376487A7EC8AA45BA48616C5037B3FA4077A3CE8F101E13C9EF2E136B690571
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32