General
- Target VoiceChanger64(1.98).exe
- Size 1.3MB
- Sample260708-byeekshy7k
- SHA256 c8f998559d896267f9ec6cc2a3a413c925ee40923e69515a5236cf2feebb383b
Malware Config
Targets
-
- Target VoiceChanger64(1.98).exe
- Size 1.3MB
- SHA256 c8f998559d896267f9ec6cc2a3a413c925ee40923e69515a5236cf2feebb383b
Score4/10 -
- Target $8/APOConfig.exe
- Size 179KB
- SHA256 fb6425eefee8b2d3fec513287345f7a9c4595b39713c4780bcb4b98beb36fcd0
Score5/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Event Triggered Execution: Component Object Model Hijacking
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
- Target $8/AudioChanger.exe
- Size 161KB
- SHA256 deb3dc4b4401a8cc164420e00085039d9491f88dc69db874e1c3bca43227d842
Score1/10 -
- Target $8/ClownfishVoiceChanger.exe
- Size 902KB
- SHA256 21ec909bda4293cc7c113c3a2af550ca203542299698946fccf31595777b5b97
Score5/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Event Triggered Execution: Component Object Model Hijacking
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
- Target $8/ClownfshAPO64.dll
- Size 353KB
- SHA256 0ee6fb51ae47a7f8149b16a44cc0c257a9c777227c8052e51ef1ab3356d9bc5f
Score6/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
Drops desktop.ini file(s)
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Event Triggered Execution: Component Object Model Hijacking
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
- Target $PLUGINSDIR/KillProcDLL.dll
- Size 14KB
- SHA256 0fe15b023e21b7054fabb3d47b6084d60f8e474d8f9ca3a0a25dcb2097d6f0b8
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target $PLUGINSDIR/LockedList.dll
- Size 28KB
- SHA256 671570118024c9132f12999e198cebc87b3bf1846695553bf478c5a42efec226
Score3/10 -
- Target $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 56b96add1978b1abba286f7f8982b0efbe007d4a48b3ded6a4d408e01d753fe2
Score3/10
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Active Setup
1Event Triggered Execution
1Component Object Model Hijacking
1Privilege Escalation
Boot or Logon Autostart Execution
1Active Setup
1Event Triggered Execution
1Component Object Model Hijacking
1