c8d945e600325d31ac6a87d53e40b479c55ff62053f0da1ab352e8a89453a6df

Sharing

Copy URL Twitter E-mail

General

Target
MagicChatbox-0.9.210.zip
Size 13.0MB
Sample260718-2b1bmsg16x
SHA256 c8d945e600325d31ac6a87d53e40b479c55ff62053f0da1ab352e8a89453a6df
MD5 38894d6e6518b04eeaaec79969246733
SHA1 f75aff5f940407641d9f20413480b25e6be2f9a0
SHA512 78e0a62c93dd8dbcd49e23828bead5baf937eaf0c895df953ea73170119bca509893191f8bea3bad7ab0b6b793d0890066bae0c019dfd597439ffd3649c8f0f0
SSDEEP 393216:9Gmi4MdTW5jQJLQyb3TZSCA0lguo6iXN1pWI9FbFXK:Hi4MdTSjQJL57oZNuo6iXN199va
TLSH
T1DAD633E765BC0625DB543039D08C44778FD7829A884F8CEDB908A5A1E7F37ACE341A5B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery persistence

Malware Config

Targets

- Target
  CommunityToolkit.Mvvm.dll
- Size 179KB
- SHA256 000b7031687712c9738efbdb1cf6b852fea366282d32ea1ad4eef8ec8a2542f7
- MD5 d4a61328f8567e243ae0161a6898c077
- SHA1 43b11f92563da0a5de202ec70be72b2509a50f16
- SHA512 1f798434a3d49948379c25fc7b0ae96f72173ed640b77b30cc9a4b0b048761052d7127630eb2450cc373bd5dafee57c92223640307733b54d35fe876dc16688f
- SSDEEP 3072:eaw6XkY384nXSzSGICS+zQXy7GYEFl+wecF6ACrxLzL9y40J8Thyul3si2QGVTpQ:Dwym4XSfFnwyFL9yh2ThFlJ2QGpptG
- TLSH
  T141048D4263EC5715E5FF1B7AA47180099B73FA27FAA3D39D2389529601033C16990FBB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  CoreOSC.dll
- Size 22KB
- SHA256 5f948b2718d9b2ff38a27a9af60f546b9ef9ceeb1ff53dfb183d997fbc6ca92f
- MD5 50575f9c71603d1bc90ab74eaf300341
- SHA1 9257848d6186bb885666bdab7dec77334cd8fd17
- SHA512 3340555dfdf4f299aadb75776114ef1c7900e0e23a03c39fa0ab28ce9c2ecac55737d485e4492a77d4e58e7f42476d739fcb60549570b33aff02c8b2377a168a
- SSDEEP 384:p+bWYhphQU++zs8i2QrGjhntgXYWu9+T7Uz9mqXjDXA/Nesld:f6hQasW/goz0T7UZmqXHXWv
- TLSH
  T13BA2290CE7E44725C9BE0A7DA8F242418331A16BA453FB0B1F8D94BE1C337555A52FAB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  DiscordRPC.dll
- Size 92KB
- SHA256 81ea8dba7c9724aaebd0bd2b690c8adddce1cf7c4b389700cac4145fd0793250
- MD5 6edfe3c06109f818a3e662bc4ce0703e
- SHA1 a488f67252ae529a284d1dbd7054df889349e18b
- SHA512 1dcc892c7798ccb107036946d4311811b0d21f30fdf6bc30fabd44a3b3d9930817551c361af091e8a7d852bff7d962cd40cb5cfa195a7399d84e7a1cc001d7c3
- SSDEEP 1536:hvwFGm0SC0cQS2F80/hTdQf/Kgdle1qw+g1pBDM94Uwt7zJs+mzx2ZSS5:hvPfSC0jSuhAaRB+Yta+mK5
- TLSH
  T1C493E67023EC466AD6BE2F34F17456110BB5B94A3931E7AF8A4860CE1E53BC14D627B3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  MagicChatbox.dll
- Size 2.7MB
- SHA256 dd102b36706fef66f39f557e2176a3b139a8f572ae8130662034b3f3df3e40e5
- MD5 32060a475f440d838c83d391c179456e
- SHA1 df8488fe96162d63da962c78ec1550c1fc286c02
- SHA512 0cb86590fe235c7bf5b72ca294cb6c9a5e28efd1b8ebe5f2878b0e4bf528de5a949a7b1a5972bc78e14fd687701ef222bc912ca57669264154d40965f2255916
- SSDEEP 49152:8Z3ZrUFJtQwTd2DWZuGUnj5bh0cDSPbA30/iZ01eqCxLY03o0H:8URNsE/iCeqCxLYVE
- TLSH
  T1EBD58C513BB8892AF0BF2B76E8B44200DB76F942B361C7DC5A99A86D1CD37508F15393
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  MagicChatbox.exe
- Size 307KB
- SHA256 65e5faf771279015c11a2955b6d623c5fab971535a4ffca78e9812aa43767ee6
- MD5 134b51b641832d0b7f38b9460308d1f4
- SHA1 00b7ceae6230f34fed5502f185a12f5d53b64148
- SHA512 92f98cbe5c7b9f06d4896d185f88300ffe855e7e32de1b06ffefb8360f89b4d379c73b03c57a42d38448244d66bd0ee7c3ec9e72467e5df352d413a63c36f742
- SSDEEP 6144:eifl++Sb9fR6bgBkZXI39QVG1j1Nj7yeNM0urXKSXoa:/fI+S3DNQ0meirXxY
- TLSH
  T1E864D01833D8531EE2BEBB3AB8B1E2785334F952F866DB5A4870629C19723C45E407D7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery persistence
- Downloads MZ/PE file
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral10 behavioral9
- Target
  MagicChatboxAPI.dll
- Size 16KB
- SHA256 aec5f2fe8a3694cdefdd7606fdb9350ee259d5272568966f6075d0b9beaaf7c9
- MD5 9ba69cd5c8b3b7288ed642d5b9c8745e
- SHA1 c678d2c365ad9776fcf0c586c59b2bdcce4d45c7
- SHA512 bcc3f3eb13d27c666765e4000dc0fd42b49e7331785cc2f08a43480949c6a6979be0043dad498a2c223bae11bb1962b7a6a451e44e273dc03314cf62d69b8182
- SSDEEP 384:K21cHYGl642DmUT6e6+8ffIQCtKS0+wAEyf8CEwwM:xhw642DWHbCA9JCEd
- TLSH
  T11F723C08A34CC737DDAF1FBF2EA186524EF5D294E206FF6989CC99C92C57312085476A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  Microsoft.Extensions.Configuration.Abstractions.dll
- Size 27KB
- SHA256 a7ae16937ad2931ec036cefde5bc230f6a29e4bcb4a0aca10a29a699a0a51b33
- MD5 9474eea055c1f7889b7d3565333c5afe
- SHA1 1f0318bd166eb78d83d1e9ed9504aab51a792d34
- SHA512 2b35cf7178248c3cdd2fedfac378bc36f8c4ca055b385d71900627b04ab4f9fc5b0cff8d1574eaebe3ec8f65889d36d1b30149fbaf62ce60b91372d027890c40
- SSDEEP 384:MJ5rtAUhkfuUIh0cUarO9vaTG/dwSzRjz67MVTFge5WsjINW4lNlawlcUthXBnRx:i5KUhFFh0cU6QpbwAtCf9zXaUD
- TLSH
  T16CD24B5683AC9323CCBB2E71EDA4C4552E39C3A76801EE1958DDF0094E637C45762B3E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  Microsoft.Extensions.Configuration.Binder.dll
- Size 42KB
- SHA256 e74c683b76e3f9bfdb9ea136e139244aca2361d7dba9b9c4505db40f2d140cdf
- MD5 8a970b0e4ff4c276de657960846f80bd
- SHA1 b07dbd34886fe42e30ba6deb9023f7a16ec33908
- SHA512 16446af6d80eac94171280c8fdf2db4e5166e23b1f7e7ce2537c641c7c038068db4744bfec0aa1e222d9f87f52b12a93c46276422b68887a21d5f13afe8861c4
- SSDEEP 768:n8jjMQ8GmgbV64b6PSnwR+gX5JsPxGk9+OH6JyAv1rbg3MVe9zB:nNQpGk91H6Jykbg3GazB
- TLSH
  T1E7133B42A3FC8622EAFF1F70647194524F76BA82B926D7094D9DA05C1D337C09A3237B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  Microsoft.Extensions.Configuration.dll
- Size 43KB
- SHA256 997b6440cff60fc5e4cc38fa7bddff453937b6f1c9bb349c923c08f278f8b121
- MD5 4da103f61f6fc70111c9c1956b4dfa67
- SHA1 c35cee34bb5807053ad3efa8ba28013708da51df
- SHA512 0f7cd8c92f1dac7c764e150bfa313d47f8680b7353ee11e917705e0d4402fccf35d1d63b088b1ac5ab6ad19566db83583cff16309edff3786c447fbe97b43167
- SSDEEP 768:4yZ0/5t5A1ec4rhRdWNcr3JnY3rJOAZ7wc2Nn/9zJ:4yZ0/5t5A1j4rwKGtOAJ2NnFzJ
- TLSH
  T1CD135A96A3AC472BCA6F0FB2B8F085061F74D647B412F7499D9EF095096B7C11F1222B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  Microsoft.Extensions.DependencyInjection.Abstractions.dll
- Size 64KB
- SHA256 621f220163119dfb08c8d1dd5bc0df6c038bd9baab0662050042acd7f906b7b7
- MD5 692cf47a5efeeca716c5a1f78550ce17
- SHA1 f884774e7ff7084a544680c84fe33fa49682e673
- SHA512 05f9de66ae57a2db5f1af38aa85d56f3afdae26b3a77109f39bd3f537bd6ce05225d0797626fd5dc98bcccc6bd7cb5f9049cecd9f7a0c8d1efded0c5b4b91e03
- SSDEEP 1536:Tuu+NbA5+iU5t53Ueb4I+MkT/sE+WzC/aHozzM:74ttkDsn69HoXM
- TLSH
  T18A532A6833F9E613DBBE4A7137E64281AB78AF037101FB0F254A92F50457BC948909B7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  Microsoft.Extensions.DependencyInjection.dll
- Size 93KB
- SHA256 660201ba6898f047c273a611306e4ea6750f5bbe1f6d6c4702ab301dbb16a869
- MD5 140756f4312ef34345235b171339fadb
- SHA1 e67f7e3c19b63b844baa26b356e751f8604bad5e
- SHA512 fdeb6f4662417f74bb6e58bd4a9ece85d324af37c0f89d3b64a8b04e06985ccf8ba2e78e84f81bd1ba85559231c505003d3de5c99194a0c8cc9dbe025978e48e
- SSDEEP 1536:cxemzdEwSsliCvUFoN93dJrutI95nrcyvzB:cxqsl2FoNBrutiQsN
- TLSH
  T1A0935C7913FC9B2AEADF0A74A87541004B75F68A3442E75D0EC4E06D1EA3FC54B6226F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  Microsoft.Extensions.Diagnostics.Abstractions.dll
- Size 30KB
- SHA256 d1c04cf42e58d5fe52a61e8e547c9365795fa4c464aaa91cbc115d3c43da0c63
- MD5 a41416699cdc4a9b6f9e65b1d2b924c0
- SHA1 28357e166e17005fcf82826cfa66cb95ddd5e5e0
- SHA512 2d21e03d4bd4a51515504f8822b483b02bf67aee32a2773b8136ca12eea60546649ae0e96591580c001a878fba3f87686401bade75553cc8d1cebeefa28bd7a4
- SSDEEP 384:3XPhgj3ahLs7j3eeIuK2rSEmYTHBDWOXcRW03lNVjR9zGGLaQg:nPhMSAnIuF34jv9zrY
- TLSH
  T1B7D26E44976C8365CEBA4E34BDE0C50217BAD78B6822F7764DCC90490DB3BD4A522B7E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  Microsoft.Extensions.Diagnostics.dll
- Size 35KB
- SHA256 b3a0e7b1ad317276d98b62525b9f72a97d42c6f2f29d9e9b28e2358893f2c15f
- MD5 d973b6ee876ca59085fafbea3bbc30ea
- SHA1 3c2277898122e6a1696cfcb397be00faf842d3a9
- SHA512 109e5eeef467dda4b612fc599bfce75f483f9a991238dd1d6d999051cc89e4cbd9691ac1d872e6c4839acc81168fca40dcbb614a5904c547353defe5c09939e8
- SSDEEP 384:RA7cjKGDqo7zB4j9ndOQEPDjmGWDrFugmLhTqnzXGt0+P9hkkaCWPwrkWwlNVZcs:RAYuGZNcldtEvVWtqLHXagss9zg4dda
- TLSH
  T1ECF23A0A97AC9726CDBF1EB4ADF085411F7AC7D75401FB995DDCA0A90C73BC08B22269
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  Microsoft.Extensions.FileProviders.Abstractions.dll
- Size 23KB
- SHA256 39e7fcd41d10abeffcf2b224237bed64ae98f99d94e329bd19f447451eda3abc
- MD5 4dcedae1c277539a738086e0a0debc30
- SHA1 3e43503b007e7441d4aae3ab2acb4a951ac0ba00
- SHA512 741416d5151a2935f9625aa6db440c66734e4947ef9330a15b19b52c7f790361b5b7a8cea5c9b237a7eb610045983b2bab2e73d9135d4428af6a8b527206e315
- SSDEEP 384:cw9zHj23NcMaCH1JiMdG0H8gfWszhWdMPDHRN77UFbR9zUMkNKZp:BF46M/lNZvM9zOi
- TLSH
  T1FBB25B68DBA88352CDBF0E315AB5C8071E3897D75804BA2E569CF1451EB33C49A71B3E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  Microsoft.Extensions.Hosting.Abstractions.dll
- Size 53KB
- SHA256 fb21feb2c6aafe2607a8b1d500c2b86535cd1b48b67ef878139dc7818c70ce4d
- MD5 54a280fbb22301232257c97913b49a05
- SHA1 6787c22ab4a68af2c0453383b630f654d6194061
- SHA512 e16f45f0efee530706235ebae4732cc308fbc18b2831d8dec39c8d19af3fe1f63f916415229e2480c45fe7d86ba699da1f6b3d1ced68b70a178e8f84d0e73897
- SSDEEP 768:Am8T73KetcqxbPx6Om4e+X9CzJ65Mo7tKoV2nwsyQQZt164yCmi3FbFi/Up2cK5M:Am8/aucqxbPt1TbUcPMUeNuvz/
- TLSH
  T18833B34163F85215FAFB3F74A9F855254A3ABE67A934F62C064841DD09B3B80C970737
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  Microsoft.Extensions.Http.Polly.dll
- Size 31KB
- SHA256 576b7c216572f25b25e23e805d4dc96b83cdee6556582c0206ae8aeb0a8dd6a9
- MD5 3cc27d12608992ff492af0973a18177d
- SHA1 04c429a5f7edabdb2cc5e168ab449f449b6ebf7e
- SHA512 69ceea06b5d90f13a0c73d2920590ef03397a1b80acfc2861118511e325924a6460446c563e4236d8dcfbf1a7f7b7d40d17a2500d10cfdd1820adf47bd5a86b1
- SSDEEP 384:vuSYP3tDhJHKeOriLQv0by3TIXgRizw1ata3xZAX3IjF5LSTWckfJWRlN3jR9zGq:fYf19OcQcIRizq/LAXEF1S+q9z1
- TLSH
  T122E24B8157AC4321DEBB5BB4FC6495919E38F7867C21EA2D148CD24E0D637C58B2173B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Downloads MZ/PE file

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Adds Run key to start application

Checks installed software on the system

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32