877841bdda4457d4f9d5c3d051c724c2aa363e15229bdf8b2dc955971b8cd24e

Sharing

Copy URL Twitter E-mail

General

Target
YouTube-Music-3.12.0.exe
Size 274.0MB
Sample260708-3shctsbv9t
SHA256 877841bdda4457d4f9d5c3d051c724c2aa363e15229bdf8b2dc955971b8cd24e
MD5 115fc3f147c54a98bb092217589f5a26
SHA1 7b35ec4a4180b85732557f80aa6f8cef89686d2a
SHA512 0c0c02c029535dd43460ffd8b25da1c4da6d06bed2ad9db09c355f01c51d95edd3ad858e5fd0396bb88be776864028be833c2ba761c505dfe008f69af4b82d59
SSDEEP 6291456:WgbpkLYxKyHsrsbFqaw4W0gbpkLYxKyTKKkf0CsOYYc4gbpkLYxKygB+ZATMj94/:WgdksxlVBqawd0gdksxAKgfsOYYc4gdc
TLSH
T1EED833DD9F97821EFB435C748F8AC5A017D8AC2940128946449953013E2E6AF36FDEBF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  YouTube-Music-3.12.0.exe
- Size 274.0MB
- SHA256 877841bdda4457d4f9d5c3d051c724c2aa363e15229bdf8b2dc955971b8cd24e
- MD5 115fc3f147c54a98bb092217589f5a26
- SHA1 7b35ec4a4180b85732557f80aa6f8cef89686d2a
- SHA512 0c0c02c029535dd43460ffd8b25da1c4da6d06bed2ad9db09c355f01c51d95edd3ad858e5fd0396bb88be776864028be833c2ba761c505dfe008f69af4b82d59
- SSDEEP 6291456:WgbpkLYxKyHsrsbFqaw4W0gbpkLYxKyTKKkf0CsOYYc4gbpkLYxKygB+ZATMj94/:WgdksxlVBqawd0gdksxAKgfsOYYc4gdc
- TLSH
  T1EED833DD9F97821EFB435C748F8AC5A017D8AC2940128946449953013E2E6AF36FDEBF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery spyware stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads ssh keys stored on the system
  Tries to access SSH used by SSH programs.
  spyware stealer
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
behavioral1 behavioral2
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH
  T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  LICENSES.chromium.html
- Size 19.4MB
- SHA256 e3c8a6093358521d4512d68945e16338755e687619196e63948d46c9267537b6
- MD5 f18ed9a25df7c7951cb7f936ca9feeea
- SHA1 3ba65e050dbc1e365c6397d41edebeb8a4322794
- SHA512 8eccd9eceb7032504437cc95e01e5e040872db5951ed1f7f11f86c26f244c2ff2516d792b32ed3941a2a3170048725112005877bd76637a9d1b3fec548cc19f8
- SSDEEP 49152:52SFkMZThUZLQTYp281vCmh3r8xsJQfiFTuoYQdVi2Hxj37D4h:v
- TLSH
  T17127B46BBB49037316F242626B47A5CAF31EA13F375A1654309CC1182B7BD2483FB69D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral7 behavioral8
- Target
  YouTube Music.exe
- Size 185.6MB
- SHA256 cacc47819e40f8ccbdcf609e8bdf8c342c213a33cdafe84d7b33716e38e7fc7d
- MD5 5acdf36acfa8b052d30c770961668a57
- SHA1 3bd13f9a1a64ef1d296334d29753790d90a2b5da
- SHA512 30a7d817a7e8a63a8e2814840728608b1a1e7eef38ee6c17857d6cbd12857af904b973ca0329492138155c9d5137b0448b81354889d2b5a7264e652e713c2005
- SSDEEP 1572864:dDYFnhtV5rbdaKQUGbyz4Yq2GKTOobJotEREqR60LuB7y9StD8qousYWkMCFElIN:QuT4EMFtt8USVmJgGVRb356LjLOHFG
- TLSH
  T1C198AE01A1615079D40633B3742DA73E59315263473A8BC7EBAA6CC2AFA47E132BF747
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery spyware stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Reads ssh keys stored on the system
  Tries to access SSH used by SSH programs.
  spyware stealer
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
behavioral9
- Target
  d3dcompiler_47.dll
- Size 4.0MB
- SHA256 0ae6e52072857c3acfde53b98f56c3c6d9bd0e7b09f247ae7f40bfd451593c4c
- MD5 74e766279b1f7c07b35b3eab356415f3
- SHA1 ac019f36f22d527b60773e380b473a764721d377
- SHA512 7d93e10068d64026e2de10fec530a50374d990c592a4f8b72a35df1e666f8d4cacaf15c70e69343b363c2af988ab0d01590bf2ca543bb3e505f49b46ff5da48f
- SSDEEP 49152:hXlJ9pAeB6roiiqkhNA0UNoChHZYe/ik/N2q0H01PdbHhu4UxwtYeQ2jSTSdrYWP:hXT9X1GiEimZhuoYkWSdrYWpNF7n0G
- TLSH
  T196169E21F6428072C8CA15F076EE776A947C9B301B3444C752D0BDA9ED711D3AF3AB9A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10
- Target
  ffmpeg.dll
- Size 2.7MB
- SHA256 8fe43f74d7eae9147c593642e76830410f6144e9d09fe9f69f8f1ed42eda1600
- MD5 502b0beed627e549596e69050b430bec
- SHA1 945ac6e99a01053a5c02f6e094d930f71be9b41f
- SHA512 a1145175fb46e3b1a4f8cdda24e1cf3e9bc94ef075e310fc78a9cfd8299eb790f1e573d3bca41bce5bdc8e448ee5f10619255824f6e8a335821453ef22a81196
- SSDEEP 49152:4Ov4klS78WFZBkn7uj5oFB+1JbEytMYuo7xli:4Ov4klS7M7uj5oO1dE+mo77i
- TLSH
  T198D5BE93781162EDD59A3231355EB73F9A381B6487128CD7D7802C6C6BAC6D089FB21F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11
- Target
  resources/app.asar.unpacked/assets/error.html
- Size 1KB
- SHA256 b44d4a61592ff69f8701c561a62a842c9f315f22b4d380c132f1e2c38c7856a9
- MD5 6653534aa6bcf2b83f9f5034b1105290
- SHA1 f8f54d7b8c035d3385bd7bc2d3a7dacee544b6c3
- SHA512 8f9cd8c2e2fcaa368af03ae2afc3bd2a6a1a27e394dafebe7eebe2954009d7ab476eb057bd82d8f524028a61f0e729897a1fc3ead760374dc4fd835ff21e931f
- TLSH
  T12E21CE9A89E30341F51394585BE363196B24E50B9887CD2C37CE72B5CFC55A592C37CD
- MD5 SHA1 SHA512 TLSH
Score

4^/10

discovery
behavioral12 behavioral13
- Target
  resources/app.asar.unpacked/assets/generated/icons/mac/icon.icon/Assets/SVG Image.svg
- Size 2KB
- SHA256 f99d8df8a147b5ce734aa9407f470492e8468c8101deba90931409cfbfbb2cec
- MD5 9ba80426007530d19199dd791833da13
- SHA1 e92ed51f226cebb822e93752ef7364a6aa243b0b
- SHA512 ab5a1c0cef7fbbaa2cd615ef907494fd32ccc0c85f14b6eb375cfed7ba30b31c3da9648342e1559a6639131aae4a290ef7aecd757c39f77f3036f11741444a28
- TLSH
  T122410F69F669EC2DB168C25CEEA4D420127D81B3E4848625884DBF2B9027DC7AD2F3D4
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral14 behavioral15
- Target
  resources/app.asar.unpacked/assets/icon.svg
- Size 2KB
- SHA256 d97a66460e3c1f474cece1c34a37560328c9fef1fa4f3200fccb3250ec07eeb0
- MD5 7919514c1bc4642c854ce8fe6dee2ac7
- SHA1 4e1d539f918f49358a7c17cd05254dfc3d97e021
- SHA512 3124b283332f537b602b48d0c4bd1b70ef3bb2ede5b57ed4a20d8433043afb7449d5668fbb54380a64f7cea9460077bc161d97ae0a287aa93c21456bf9a14c21
- TLSH
  T10651DD74E5F6E81DF158C16CEE60D4101F7C81F3A2848619B84D6B2B9B27D878E5F3A4
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral16 behavioral17
- Target
  resources/elevate.exe
- Size 105KB
- SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
- MD5 792b92c8ad13c46f27c7ced0810694df
- SHA1 d8d449b92de20a57df722df46435ba4553ecc802
- SHA512 6c247254dc18ed81213a978cce2e321d6692848c64307097d2c43432a42f4f4f6d3cf22fb92610dfa8b7b16a5f1d94e9017cf64f88f2d08e79c0fe71a9121e40
- SSDEEP 3072:1bLnrwQoRDtdMMgSXiFJWcIgUVCfRjV/GrWl:1PrwRhte1XsE1l
- TLSH
  T1EBB37C1274C0C471E5732A361974CAB14AADFD700E759FAF6398127A4FA01D09A3AFB7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral18 behavioral19
- Target
  vk_swiftshader.dll
- Size 4.7MB
- SHA256 9cb84709981335d0dcdcb3bc471aed3c554593285dca9a9d956def975ce56e48
- MD5 79c9cd12b76ff966b881c88cc29fb063
- SHA1 97bc66fb927c1a7bb5456886c4dcf863ab27e7f4
- SHA512 dd19b5ea038ea5d223cdae177e8929d1aeb2e5cebb97d572cb00a7d4155f2d35f0569ccff47328440b04f462835dffce8e58a835e8d0f7c3f40730e0d13c246b
- SSDEEP 98304:E/FYNBq2rzEvVJPon+PlGYkEY5DRKOxeKMl2:E/qNBq2rYvVdlGYkEYZcOxVM
- TLSH
  T1F1369E01B110A074E44721B5392AAB79DFB0C7216B628ACBE6846DDCAFB45D3593F34F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral20
- Target
  vulkan-1.dll
- Size 811KB
- SHA256 17c020a5507edf61689461ae2e8cbea367a01a9970a074a2c227a1fab7569b59
- MD5 54e0c6a967cd78dd1123e52162ff3e5e
- SHA1 ce963b517fe9c83bd7459d527834772fefc03f19
- SHA512 dc0032c8b31449f09a139938a91d68fa00fc1cff90813f479d94f1e7863a97f7fe68fe569b1561a4d70910ca19b975e0ab82c05f02d500605d511e1133dc2ee8
- SSDEEP 24576:EJaNTUS0Y2lrrOeTeNqu6Z5WzcxDYsHkDE6g3P0zAk76oOHknzh:bbIlrrZ86Z5WzcxDYsHkDE6g3P0zAk75
- TLSH
  T1E0056B06BA4880A4DB2F7030E461B6B74A79975363784CCB265CBF50FBA0DC425BD76B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral21
- Target
  LICENSES.chromium.html
- Size 19.4MB
- SHA256 e3c8a6093358521d4512d68945e16338755e687619196e63948d46c9267537b6
- MD5 f18ed9a25df7c7951cb7f936ca9feeea
- SHA1 3ba65e050dbc1e365c6397d41edebeb8a4322794
- SHA512 8eccd9eceb7032504437cc95e01e5e040872db5951ed1f7f11f86c26f244c2ff2516d792b32ed3941a2a3170048725112005877bd76637a9d1b3fec548cc19f8
- SSDEEP 49152:52SFkMZThUZLQTYp281vCmh3r8xsJQfiFTuoYQdVi2Hxj37D4h:v
- TLSH
  T17127B46BBB49037316F242626B47A5CAF31EA13F375A1654309CC1182B7BD2483FB69D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral22 behavioral23
- Target
  YouTube Music.exe
- Size 221.6MB
- SHA256 fee47573a60296a2ec793cac2cb2194eaf8e117df5016aa8888f56e021e2fad6
- MD5 1f76efa71df22c88c17147737fa407f4
- SHA1 53c7f62d93b5d68e027d0db89b380d1280b97cbc
- SHA512 a140b46230e521747aa1a1969b644a6be966dff1987a52beea6cac3dec04057b137423420973da9f38d64baae7e9a49c7e5be09093ae0ac13af6e3d8c657f693
- SSDEEP 1572864:XWxpsb1ZVbUZNPbMPSD4mJVz+xHbMk8eBpkmHcqdj/AWWceMVqfL5Hn371NMKlaI:SeZV6W86TmPy00p
- TLSH
  T1DBB88C03F29A41D9C01DD1798B5A9633FEB1B8454B24A3DF2B5447922F66EF82B3DB10
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery spyware stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Reads ssh keys stored on the system
  Tries to access SSH used by SSH programs.
  spyware stealer
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
behavioral24
- Target
  d3dcompiler_47.dll
- Size 4.5MB
- SHA256 a05f99734f7c4822fefc12b367af21fd0976ed6608752fb1e1e80b6ece7ecbbb
- MD5 19e527a35241c171d37dc1e6c530053c
- SHA1 b1567bada7a27ab78e65da440f21809f50b9d34c
- SHA512 23d38b55f5b17bf0228b16a85787d384da0a700190fc289281190272a0d2dd374be0f7f64d8b642836ccbe2351b72e9ef5c7e2b12d0a7495317e986fd5e3c886
- SSDEEP 49152:c6ntbdeqBH287v7cavvL4e0OgcmeNHyxsBSoYHXahOO5uBcLr7mbpJ3E/V:cUdeqt737jFm5wd
- TLSH
  T143268D56A7E840E9D1BBD138DA87821BEBF1B80413349BDF015086599F73BD26A3E734
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25
- Target
  dxcompiler.dll
- Size 24.4MB
- SHA256 34e36e7d0888e8c9653314d375297abf3f027dc179920102b9b8293f79555de4
- MD5 f3036e9973dfbf9ba882aeddde0c1f68
- SHA1 ce6146a6b210ca7935a2c18aafe5b091581f4d9d
- SHA512 621a3fc71944cd6badb50bb88e30e0495d4f2570482c4a089bab2561660f88a1df4a7ba3ce0129d8dc71f439c9320203c7c13b771e59459dccb19dbcf5a4268d
- SSDEEP 196608:ZKkG+l2tvb3nmgD131GYN7aPtAH+R4gQiUiV1gFould/5emO0r:Z5G+lkvb3nV1GYIP+H1gQoV1Ioul3el
- TLSH
  T105473A122646D49CC059C879C7678B26CA6C30E73FA7B9EBC0F451252B79EBC5B39234
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral26
- Target
  dxil.dll
- Size 1.4MB
- SHA256 77e039c905030a641e53658a008b74e90635a5ea9b6b79eabd0f2003bdfca59a
- MD5 c9a7241ce83437d54a82522aa0b54575
- SHA1 acff69399c4f17c4f20f70560fb89a9163d2b486
- SHA512 8ad8c77a2368e363ad16cc1f9b3a0e4ac15634722340bdebb0e4957e7e117faaf36db2d6e08cb49127849b64844a75ebdd7e19b3f8b7e1f4412fb0066dce1ad5
- SSDEEP 24576:YcuJxAR7BBPp6UMPzbOXh9/duHdFnXIqpfya8PNCdbyKE5vl5eZiE1/0Wy4r8H/2:YsHMPzbOxBduHdSCde8ZF1/0Wy4oV6bX
- TLSH
  T109656D6B66A800B9D4BFD174CA438E1BE7B2B45503B0EB8F16F402A61F577B15A3E311
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral27 behavioral28
- Target
  libEGL.dll
- Size 467KB
- SHA256 630401e4e008b80c4bfca28cf01b02e371698e855aa132a7a31f6248c0a5c32f
- MD5 04f48321f798b648d2012d05df785c41
- SHA1 b4a8c3cb50fe663dbf74a0ba0160339f2d54b5aa
- SHA512 94c06b38f48d90d025fe2dcc670ccec4eec38fbf58dbdd8f4dfc1d2c77761d812d560d7e720c93160ab2b837a5191707ffd79bb556d490365565dfa750644983
- SSDEEP 12288:66/vCrog5QZ9yJNe8DcQir3YB9ANZMBg:66/vCrovjLA94Mm
- TLSH
  T1C9A48D15B3E948A9E07BC1388A538643EB75B4520B61F6DF02A0D2793F77BE45A7E310
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29
- Target
  libGLESv2.dll
- Size 7.6MB
- SHA256 e9c1b0055ddd591fd33fa9a30a9adb262490f998b3c343b8225e14996aecbf77
- MD5 b60f635dbbdaa84199fb6e00131686c9
- SHA1 1f2e0f81d00f1e5cd9059130dbccb0feb966ffe7
- SHA512 3f7b105d93bcdab0243bdc36a17709944ab1af1f0fce3a1f14dbdc367e458891183ef5cd4bfebdd5e64279a0746f594ed02fb9f67c633a5b7fa44c67f095867f
- SSDEEP 98304:q28+0qrgWEefZGd0Txn5XUTMSEyGEEEE:u+0qcYfLctr
- TLSH
  T1D3866B03F69681D9C05DD278876BA223FA30B8550724B6CF2AA457152F6AFF0EB3D714
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral30
- Target
  resources/app.asar.unpacked/assets/error.html
- Size 1KB
- SHA256 b44d4a61592ff69f8701c561a62a842c9f315f22b4d380c132f1e2c38c7856a9
- MD5 6653534aa6bcf2b83f9f5034b1105290
- SHA1 f8f54d7b8c035d3385bd7bc2d3a7dacee544b6c3
- SHA512 8f9cd8c2e2fcaa368af03ae2afc3bd2a6a1a27e394dafebe7eebe2954009d7ab476eb057bd82d8f524028a61f0e729897a1fc3ead760374dc4fd835ff21e931f
- TLSH
  T12E21CE9A89E30341F51394585BE363196B24E50B9887CD2C37CE72B5CFC55A592C37CD
- MD5 SHA1 SHA512 TLSH
Score

4^/10

discovery
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Reads ssh keys stored on the system

Network Share Discovery

Checks computer location settings

Reads ssh keys stored on the system

Network Share Discovery

Checks computer location settings

Reads ssh keys stored on the system

Network Share Discovery

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32