69dbc6f939bf4ac63a90dc56e1e9600b4d4284848a99c4190423c3f856c5961e

Sharing

Copy URL Twitter E-mail

General

Target
CapCut_7663998941033431061_installer.exe
Size 2.7MB
Sample260718-2e13cahs2v
SHA256 69dbc6f939bf4ac63a90dc56e1e9600b4d4284848a99c4190423c3f856c5961e
MD5 0569477873140b15f1330300e5b696a7
SHA1 46390c027e86d16c9dd8c3e1a46ce3e80898eac7
SHA512 0787089ae8b94b39e176789b7dde703a52aaf37f28a3b8585947577218c8a47ed81f47d072aa1314b5d4aa087b7fd195abe36fb590308162517239b94c0fbac0
SSDEEP 49152:ol74yWHEZDC82EG9jBR1mpJ1/5hNSzOyu6S+hBBvle/WnG/MmWT:ol85aDCtlhmpJ1bkhBBvQEG/MbT
TLSH
T1E1D5230371049299E2129AB316FAC9B114237EB79DD0891A71D8FF673AF2261531F72F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

Malware Config

Targets

- Target
  CapCut_7663998941033431061_installer.exe
- Size 2.7MB
- SHA256 69dbc6f939bf4ac63a90dc56e1e9600b4d4284848a99c4190423c3f856c5961e
- MD5 0569477873140b15f1330300e5b696a7
- SHA1 46390c027e86d16c9dd8c3e1a46ce3e80898eac7
- SHA512 0787089ae8b94b39e176789b7dde703a52aaf37f28a3b8585947577218c8a47ed81f47d072aa1314b5d4aa087b7fd195abe36fb590308162517239b94c0fbac0
- SSDEEP 49152:ol74yWHEZDC82EG9jBR1mpJ1/5hNSzOyu6S+hBBvle/WnG/MmWT:ol85aDCtlhmpJ1bkhBBvQEG/MbT
- TLSH
  T1E1D5230371049299E2129AB316FAC9B114237EB79DD0891A71D8FF673AF2261531F72F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

defense_evasion discovery execution trojan
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2
- Target
  $PLUGINSDIR/BgWorker.dll
- Size 2KB
- SHA256 50f735ab8f3473423e6873d628150bbc0777be7b4f6405247cddf22bb00fb6be
- MD5 33ec04738007e665059cf40bc0f0c22b
- SHA1 4196759a922e333d9b17bda5369f14c33cd5e3bc
- SHA512 2318b01f0c2f2f021a618ca3e6e5c24a94df5d00154766b77160203b8b0a177c8581c7b688ffe69be93a69bc7fd06b8a589844d42447f5060fb4bcf94d8a9aef
- TLSH
  T1C351B72E612C0BFFC2963C34BC96795B1B6FC060A39A6328813FC5853C141B4233DB2A
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/downloader_nsis_plugin.dll
- Size 1.4MB
- SHA256 e5f5627134d9792e63cbc3867a0ab47fd02bdb86fe39d91c826bc669da8dfd34
- MD5 42efe6b442f19f7fe20bdb024650ee6c
- SHA1 7f9230ae67114f39b061631759ae8a479b3578c5
- SHA512 8ed6004001adc1dd1eaf3a54b8f122ebdaa7d11d53212820d0d9e8fdbd32c8740212e08cff6b06191459b1490b43549ed07fc149f2379aeea848db6580fb78e3
- SSDEEP 24576:PN5WT6Ku6HIkxSPmHkJdWTtXA5IGUK+IUc8C67fZm:eGKrHIkbkJ8XA5IG7+IUch
- TLSH
  T1A9658D4072D180B5CE4B6231792DA73D3F6959028FA08DC7E2D6BDB52A722D35A3137E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $PLUGINSDIR/shell_downloader.dll
- Size 2.3MB
- SHA256 685e9f64a1915f3663f7ebd26cc2e23621e82e5bea94c04cc9037b039e30bbf9
- MD5 b4ac02a6364e814676c25106598daca4
- SHA1 8acfb449a630eed8e4bdf8a8f4fda6b9400dec01
- SHA512 f801766faac8d64ba7d44ffd3b02f14a54538316614a86e061a8757109e543a2ac150a56c6b1cf8b089987c34a472579fe2684ce3c3107078fb12daeaa79e787
- SSDEEP 49152:8KF9iNwZyljeOItpEUWqmFRxKwOgCjwqaezhwDUiCJ:8KPi9upEcm7x8g4wqaMiC
- TLSH
  T101B59D02B5A290B5CC4B3172749DA77D9A380A844B34CDD7CBD0ACE47BF15D2263E79A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10 behavioral9

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Enumerates connected drives

Looks up external IP address via web service

Checks computer location settings

Suspicious use of NtCreateThreadExHideFromDebugger

Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10