d6a53bdfaf4016cc91ee5b844004893c700f4e270563311d0d41555cd40a4e83

Sharing

Copy URL Twitter E-mail

General

Target
VoiceChanger64f(2.04).exe
Size 1.3MB
Sample260722-3sf5rssydw
SHA256 d6a53bdfaf4016cc91ee5b844004893c700f4e270563311d0d41555cd40a4e83
MD5 a39ffabbc2bea08cf3306082cacde23a
SHA1 98aba3f5dcc0020eb38dd7f57ab08123dd8f36ec
SHA512 c2a960f0189d2272773ae5833b98ee0da571e78f7fde9c9dee6bb9d2f50e6a8a088757aa394e5a171e16583514001697f7d49992e991b45964b3e84fbece066d
SSDEEP 24576:pYD9YJJU0TUtLtvvKukmEZm8pDJVkj8uXqRIU+RonxU8f3gdu0430baa:WaJJUVLtahmEZJpQgu6/88U8fZybaa
TLSH
T1B7552331B4ACC559D892C631BEBFA06A8E7DAF4B1217864F23108FD4AD75B117D0B683
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  VoiceChanger64f(2.04).exe
- Size 1.3MB
- SHA256 d6a53bdfaf4016cc91ee5b844004893c700f4e270563311d0d41555cd40a4e83
- MD5 a39ffabbc2bea08cf3306082cacde23a
- SHA1 98aba3f5dcc0020eb38dd7f57ab08123dd8f36ec
- SHA512 c2a960f0189d2272773ae5833b98ee0da571e78f7fde9c9dee6bb9d2f50e6a8a088757aa394e5a171e16583514001697f7d49992e991b45964b3e84fbece066d
- SSDEEP 24576:pYD9YJJU0TUtLtvvKukmEZm8pDJVkj8uXqRIU+RonxU8f3gdu0430baa:WaJJUVLtahmEZJpQgu6/88U8fZybaa
- TLSH
  T1B7552331B4ACC559D892C631BEBFA06A8E7DAF4B1217864F23108FD4AD75B117D0B683
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral1
- Target
  $8/$8/uninstall.exe.nsis
- Size 32KB
- SHA256 bc9870d70f3e21a2ee59f8bc503579e1e67853d1d1c4f2c4056dcac572d1766d
- MD5 e73253ed0dcf2f71aeb710ef1c58ed4d
- SHA1 8b67ed55cd2b4f61295113971d8f2f07d06c6d26
- SHA512 32b91867b7f9c50da77a8cbf92f9cccc6894e835220bfeaa294ddeec49d3f690bcb4dff598d73247f01e0d33181046e3cb47cee3c5dc040c2c843f12f207e9bf
- SSDEEP 768:md1X32bLt5rBazZOAcvWJNmrIOeIbJccFz6ZQ3xts8UsqTfdu7y:mHiXBc0ZQAHpbJccFz6ZqDs881u7y
- TLSH
  T169E2F19CE3B06194BC52944D0ABDFCA81537A93F8AACC81495C649F24F7703F1E11367
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral2
- Target
  $8/APOConfig.exe
- Size 196KB
- SHA256 51d70cde3987044a44ebc852a58471bbdec07134724fba3df4747b32687eaa0e
- MD5 f04c8bbfb8d2252ccab3f1d56438b038
- SHA1 bef233a4a22eb3b5e651a5f061375cec92652742
- SHA512 17c2be26245a5dfca67400f381a33180ebcde8815cc6497263a564d05dc1dbbc34b34370dc1277dab146bccafafe39e2ae14f00d4ca6317d6087fc980024ed30
- SSDEEP 6144:hXtzpxJqoyk6H9APPQZLFlejj85JL7gfq:TpPK9A8LH5N7gi
- TLSH
  T127146D25BDC2D073E666097069E8CA759A2DF8B10F609CDB63840FFA4D346D19734B3A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

discovery execution persistence privilege_escalation
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral3
- Target
  $8/AudioChanger.exe
- Size 161KB
- SHA256 4650d9d765d696247f3ee5e8e46a50df7eaa6fb8c4c787f29725b3ddec14e4f8
- MD5 f387eab3029c382e51af4298b7798ee2
- SHA1 477116da32d279f868c0f609183d4cb4a0ed5639
- SHA512 d74427414ac544b0ab7576ab78f27acfa6952e9a2310e5385bd28dc14977f893485022a9fdbe767b0c1dcbbf37603eedc3a3f89972a9e37b738c593982fb8c0e
- SSDEEP 3072:t65PxKAHTGwJyEDsUIzw69Ms9R7aXVR6+KPEqH9fSSoV:t6SAHTGIxw7DasraKMqdpoV
- TLSH
  T15BF37D5773A430F9E5278239C8A15A46F772B87617209B9F13A8477A1F133D09E3EB60
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral4
- Target
  $8/ClownfishVoiceChanger.exe
- Size 976KB
- SHA256 257bea54a955cae08765505e09f1583151df29d534b052dc347ebb361ff80077
- MD5 a64d695c0409f23bd01d72c11d3e4c7f
- SHA1 d53d9c52691f9668356d6cec4177573be1c63e9c
- SHA512 6265359cd23ce96cc8924db1591d67eb6d220e4134a06b9d820c04970094bc511fa030532df6269bbd052e2c15924f15946711b89c3cd5ce5c04768baec07924
- SSDEEP 24576:u79tdN9tdN9tdN9tdmg/EILuSUfOkcbMpXJ99:u79tdN9tdN9tdN9tdd/JUf5zpZ99
- TLSH
  T1E3256B1D6EE502B9F1F7D770C9A16402D6717C86873D99EF02C182894E729FACA39F21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware discovery execution persistence privilege_escalation ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral5
- Target
  $8/res/Alien-Off.ico
- Size 16KB
- SHA256 9d68b4ce0995e03fa5a623c36ac00d2641697f9c2120b2d4acc24b371037a729
- MD5 3f7b046b32d33fa1db6d801326c84c92
- SHA1 f267a3236f46e5160fbda29bfc0e628ab24f2d35
- SHA512 e5e1f723e41c9f4ee324883b7d2746f89b8333b17172b1dcd05e8e070caa200e184d12382140986a0ab852312878e9c1d9e6253accc558af246f69f4598ae347
- SSDEEP 192:uD10D/av2EfZsnYlMNluw/l5K4kidr+QJWQ16Ti5Y:I10DSeEfZWgMNUmloi1Eiu
- TLSH
  T1C4722D3B0A2DE813DD8064B1AB62D4FB67306D5D0665890239F63E3BF7ACA17BC0C156
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware execution persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral6
- Target
  $8/res/Alien.ico
- Size 16KB
- SHA256 99d1d4618d0ac84f70b30334c94208c617c76f8f1604f665f8dc5c424e638f4d
- MD5 b4912b4e5ac58c1da8deb5834e3c366b
- SHA1 4d3470a065095f6498e45f7303a8630063eb658c
- SHA512 aaa10258b02e41eb13e45ad5746ef5dce249020a973a83e2532bc2d20de0cba6d92d3f4bb3716f871b9eb4db633863763a087769054f9b832cd308b1e7865139
- SSDEEP 384:9S7e222222222222Rw+2u8wexKUluUvaFPd7:9Ie222222222222W9ANa7vI5
- TLSH
  T14D727DB42601A1A9D6A48C718FD4C1310B203D6EA486ED963EF8BD1F79FE2674C064D7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral7
- Target
  $8/res/Atari-Off.ico
- Size 16KB
- SHA256 6df6a6464c72af219094cf3787cf0d1f858e2fd3b6c5cc213deecabd911769af
- MD5 6f984a4938ba524ba9657d3c63845790
- SHA1 0b1789655b8139fa9975aea26860674a5b4fd4de
- SHA512 f7c403fbf0e3436eae86e141078db563ca7b75ee157eaac4bfd239c5a42227680598a3cf76e4f30760232f71dc3b4fffe7a5bab8d6106854be9eabc7c43298b4
- SSDEEP 96:f08opGfmdCRtijpfChf2h5hTAOPcEmvV+WAiPgopg44ld:eCRtijpkuhvTAgxgVLRSld
- TLSH
  T1217215222639BC16D46225B97503F272BB02AF631647B1A676E3DC777463DE61FE0340
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral8
- Target
  $8/res/Atari.ico
- Size 16KB
- SHA256 3874c8be3dc907e0f26b658fec2a551e9651933a819bc15bf9f93b578e8b5284
- MD5 b5c428102274914255a1c7f4876e2dcd
- SHA1 03c76804698ac954d950b6a7dc334fa9ae6db45d
- SHA512 daabe89489aa3f6089e05a2d96f149211d4b4338d19e68497b5531d45a8580979dea303b95bdd93f14a349c743e18e120eedabcad7a472b9dd8032f5db42aeee
- SSDEEP 96:fF4MmcfBDUD3inWmrMuxutZu2uJOu6wzYgadpbcqe9Mwc2OAPuaY8E5rFbcnjXn4:yeRrGOYe9yYuaVLLAHdRI+ld
- TLSH
  T1F772EB1DA728AD42C5653AB9C463D3F04722EF1052E186CB2EE5BDF33D266636C3D058
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware execution persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral9
- Target
  $8/res/Cave-Off.ico
- Size 16KB
- SHA256 671d371f7b2f07fc7b1e8ea9f0ab1bdf2a9055e79f3c859b19b6f579fc17987f
- MD5 fc40dfade66ab7cf24962bca246834c0
- SHA1 9f5c5dae7824afd92ae3dacc9bd72f814bb5e776
- SHA512 e0bcd0d37c1b1a4db6dec33d9b3f6471612a7e266349b744bc1e3664e908cb737304af77f3d6f91c7e44ed561b86ff4e686625301fbef4a24919df765d105efc
- SSDEEP 48:SeeBxuMtMkqCvNbvaKFqhsA5OpFIVgi1V0KDBlYXtEwRwXtWAm78O3LoYk27fxYS:aDthq0NbZFUsA5OxtK8dDRmOFtzxYOt
- TLSH
  T15A725EB2EA675F4BF759F3B0FC1A40956F273A444808621AC97E648209A201FF4FF15C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware execution persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral10
- Target
  $8/res/Cave.ico
- Size 16KB
- SHA256 716cc28267dcdafd13ca183d11fd74394f7e55063874d5c19a088ec40e225590
- MD5 f8b303268883f3500b9723c5f82843d2
- SHA1 805cd035ae00e0fb37f3afbac9cffdd5c3b12014
- SHA512 0d4b0873c42ff4da2b908bb458c59adba5765c48c4b2168ff7749fa58bd637b483001615532ca4a4158b9e43ac6881ccf4f372d9faf29f136bd473741a975e9a
- SSDEEP 96:wTdrWLDwKJdeQYXcq9LCqh8Y86k5KRmbARaj/8AN5tmgnUYLYtp2pcX5YOt:wTGD5J0QYs9yCLsI+aoCclbsaX5dt
- TLSH
  T1CF72CAAC31044AC9EF503672D0E25386EAAC4C692864A067DFF63467367348F7EC5E31
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral11
- Target
  $8/res/Chorus-Off.ico
- Size 16KB
- SHA256 e472affc0a16978628ae05ddff151eb0e4fe2892989e55d3bc3e2715d9679448
- MD5 87eafaceec081d8d2bad823ec42d8372
- SHA1 515545777b7805a4ff74bfcdee79d9237a11c669
- SHA512 6957e54e9fd29ec607821ad451727cc76ab04e8ffb99b6b0fea8dcc821b4e579beb4ec4f7cad1f9e90fb638601a3752720931be1a0e3e287b5a12ac3e3d472d1
- SSDEEP 384:cNnoaGapKaVa1a3azPa6a8Fafamaxtk0XcGUa2aeWxrI:2EfBt4a2aeWE
- TLSH
  T15672F8262B68BC03D314A1B29191D6FF57343E545A4DE21334E6B9BFF914B2FE808318
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware execution persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral12
- Target
  $8/res/Chorus.ico
- Size 16KB
- SHA256 b6e3c53bb48c2898ea96955a8df633c78035cf071842e84e31a6b265f86ed49a
- MD5 afefd408c6dff3dbb1217c497aacd33d
- SHA1 ba1439c6d07e450b16ee1326d648ded9d3c8aec3
- SHA512 205c5c0d9b1b0f4f5e844c5abee168e7d3b64da0914b70f5470d7635f68f1d2bd5eee2343017a0c4961c2c78bd4ca2f70cd5594ef99b0ba91ce5250e0f3a4ca5
- SSDEEP 384:cNnoaGaDGKaNacabaGca4aOea/aVasdaQFpHwgrwxO3hTzRRLQ:2PCw5pQOR6
- TLSH
  T1C572F8B627A8DA87D202613081CDD2390B38AE492C9FF26339EA7D6FF5347671409375
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral13
- Target
  $8/res/CityHall-Off.ico
- Size 16KB
- SHA256 2b04ea3f81189ce4a22abe6eb620dc65cf6bd44a2f152303096e3013068778ee
- MD5 822ce582243adb560d3a6f5b87884cf6
- SHA1 92fb5a5a4a81293cabba2b9e55fa03f0c51f0d1d
- SHA512 27208641135e35d100de11b2de6d7f808d35ede3cfad8630b7cbd366e0a750aeb634392f4905bb9c65f9477927e3ea6447bedbe59447ec24cf511cce16eb2b50
- SSDEEP 24:rnnnnnnnnGs0scsUHvel6HtY0cQMYKdkyI2fSHo6666666666666666alKPlV22K:wnKd3jS4T2
- TLSH
  T11A720AF36595B73CEA0734B24B9382F92E943848D774800DABB26F0A02273D158EB617
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral14
- Target
  $8/res/CityHall.ico
- Size 16KB
- SHA256 e1bca0ca6c4acc6b946d9486dea1ae89a8fa36715fc80f3a70d70d60689f0bff
- MD5 b8a844f428b535a1dfc17aac4a247041
- SHA1 c6ff6d1ddfaedf589cc0e541f159ca6e97b4d907
- SHA512 52655bfc21a68ca6e00dd21e2f5123707a7e0f51d318f86c6b33bd4ccd3d0a36f9f01123eeeaa23f48d232617919f88ff68b9b082852c0137bd27d32f2b9fd4a
- SSDEEP 48:5jjjjjjjjDNv/xUFPw+ahykOSwlka35Ukasaka4faka4akayaWakayaWakazUawI:UbOykOTpUT7TXTXTJdTJdTzDvAsTy2
- TLSH
  T1D8720CE67309EC60CD06A9F43F67A18CEC3A6CFC951BD4C9A6A1B71E153091C2AF44D6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral15
- Target
  $8/res/Clone-Off.ico
- Size 16KB
- SHA256 e899579042c65ee392700daf59d07252d9a4241fd70cc56a00075d2be5ce5609
- MD5 252a8304468aa4d67cdc654959f72ac5
- SHA1 4cdabf4f34cd8a27991ee08d7d0d366ce1060723
- SHA512 78854112f576c3ab88a43d1ded442361d32a4f3a5ccfe72f1317b6c0bc0b697cb6f492f5c18053667466eeb37f278c2aac9b54079ff04302c9a2862f704807ec
- SSDEEP 96:s+iN0u0u0u0u0u0u0uIXuku1hTed+Up4KgJ+/n5sss6hhhhhhhhhasChhhhhhJH:s+Q3333333IenjTed+w437D
- TLSH
  T11672EF7D7409902DD5B03038C7229AD7FEE93CAF5364B10122F66E4B95ADF42AB18287
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware execution persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral16
- Target
  $8/res/Clone.ico
- Size 16KB
- SHA256 d5e17286741825c832a92ff8eca5aa1a11a3873cf825e76d549a06d7527cf437
- MD5 818e9c0e411979071778221ef3e64ecb
- SHA1 6e9f0e72c0d0dd8d4c6208cc65ce643464c2fc60
- SHA512 1cc1202620add273cd1e6eedd4cd01b01457725e2ff798107959f6c4f9dea9aafc068ed8a77e366b01ce2fa4bd92a8c6e8a52d86f5209eacb17924a25f7b3b1a
- SSDEEP 96:04eVYumijdVfw5PhI0PI7MS2/uvsss6hhhhhhhhhasChhhhhhJH:GVPJ0/jD
- TLSH
  T11E7298273116BC53ECB06834BB6682E8BEEE2FE97750F4267080794A557B00CA8737D4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral17
- Target
  $8/res/Denoise-Off.ico
- Size 16KB
- SHA256 bb153cd62ed62a09586261d70751c51d97df9fb767b877c00f0b8b2a881e9af6
- MD5 858d2eb360c027803b72b32c17039911
- SHA1 09918012226a356e715c7524cca18ec5a600f237
- SHA512 87e4999018393823615f616a9aef03d0328cbb43efe9c16f9769bd2a315a43907d6fcaa7a62ae054fc0ad426c05f5fb7db24bd3dd470cd4615721f1b62751e74
- SSDEEP 96:AQMy6xcKAhuixUaN1gS8Cgg+ggKggAKggptdmT/o:b6xcK413tdy/o
- TLSH
  T11B722CD1952AC28FFB7817387BB796E01A5D2DD28605C53631B0AA06DC6D1906CC2FBF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral18
- Target
  $8/res/Denoise.ico
- Size 16KB
- SHA256 7e2fdc9d5c24d1603c5e2a8df1451e69fad62a680bea9de6260a56ae460788bc
- MD5 8eb0b7285d65d173888513d0aa958889
- SHA1 15544cd856122a8db4b4da8a8bb95edcfa59dfc6
- SHA512 55f11314875ff9b8a4f65e005228fc41a637257f8808f1a62b33084d01ea8f3e8fddb0497a578f90060bd486636e0a49aa471a385cbe40d4993c084a3cc03e76
- SSDEEP 96:42E7Uxk5ZA/UWj+Yw192Lk1fw4mEFoIueyTPl/DjmI6dSliGh6o:V05e/rYULyfjZocsl/DjmLQOo
- TLSH
  T100723A94AD11E127C0FD507C3B6A8EC417682E6B708496E6A0C1FAF765AA6D13079F3C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral19
- Target
  $8/res/Ghost-Off.ico
- Size 16KB
- SHA256 bad408756d828fc4e22c57a121a75a8f9614991e83e97921610186216defcb9f
- MD5 643d096436c385792760aef98a89db20
- SHA1 0813ffab627cf8ab07bfdb62e7a9bc0a204e605c
- SHA512 4b954efb23200777ed9134daefc3d7ea76cd66c7ed18dcde769fb4df80e007c7dd5cd103409b5902c4b349958b193cd1a6b0f0ae35c4952a81f8c4a26bee23c3
- SSDEEP 96:zge8ckXmSuW6If2oibDfqIyS5Iqo/ztx3Oyox5+ThunnX:hRIknw0ho/PeyoxcVunX
- TLSH
  T17472DA793921E08BE76C5BF1F857C5F206603CDD859503BD7AEABE8B7CA721214C2609
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware execution persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral20
- Target
  $8/res/Ghost.ico
- Size 16KB
- SHA256 1802ac52cf0e1b406467b21680caf06d992311a242f4d6fc279d8b16c2f1ddb0
- MD5 c6d7ff48826361fb32b8009e0f627266
- SHA1 9b48a55738a712a7b7cb666457125436962c73e9
- SHA512 5b6402c6a259aa22a4d1740986f8468a312ed5bd96020f64ea29c9a017e309ea7c1d3ab2c5a5e53fac3bbd4acffd5a3a2231a4af62640b759fe9bcc9adf25715
- SSDEEP 192:ZvXzAoJ4MLkiPGtTp9Idi5Icy43n1pEtX4+dixMbZN2XbkYKex8X:ZvXxYBIdihXXEtI+di+lNgbZxx8X
- TLSH
  T1A272D989788152A4CC19C2347207C5FB833B6F3EAF312C6D26A7BE16B7936509CCA11D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware execution persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral21
- Target
  $8/res/Microphone-Off.bmp
- Size 822B
- SHA256 56014e25ab2a2e1ae0b3cdc5fbd899cb9571e89f97c0a1a6b66f3cfa9d93a525
- MD5 971940a0d1831de2f7108b117102d9fd
- SHA1 072eed33f8dec4e3318be35ef3232dbd6ed7b85c
- SHA512 a615e5cc1251d1c6f4c09ca5803488d54439b3c793d362e621a308eb892592e719f070b67e7c049d74453f11b066bed254ee27144faddd12f043eb89f7eee9a4
- TLSH
  T1DE0125B538F7A8D6CB634E316D77C1102505F4167FC94312580D43A1BA31D369C31F02
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral22
- Target
  $8/res/Microphone-Off.ico
- Size 4KB
- SHA256 0c39e36374122bec7f62f2008971630aab77acb842a8227414aa8efd41b875db
- MD5 7a4eae69fa8bbcecd7d1c5c26cbf0f57
- SHA1 d4bc72f9954fa58f624718d68dcfa8df4ef43867
- SHA512 a1edd33ffbb0cc97952dffbaf87cd813cf6f80fb4a1c27dfbf1e642c8b2ea17076af84fcb674a737fcd9ed7f5d62ae604a777ca10900a01fda7a85cbee5628be
- SSDEEP 96:+XDKha7Ozha7DbuzhbtajKEa1WHuY8Z//8dL:apOda7DbuzttamEEWHnm//A
- TLSH
  T1CC91C833292698D1EE1C5272B4974D92292138EECBD0AD4835AFF7778613233520BB79
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral23
- Target
  $8/res/Microphone.bmp
- Size 822B
- SHA256 a60621c95d5c0198b2b2f88614716832a46d4923b3ed8023bf136f5e3b4cdf75
- MD5 3ee0b594a2590956d5e495bab976e7a7
- SHA1 97a4de0930f7acbfcd1ac8363abfd7255b111971
- SHA512 ce43ae253eb5b777b0eb8d5f3d1d99485e7af1747dc93e2564fc42433ba3a0550f489e8d19d73d615446af53c81d5ed617c838f127b24a7b055b1174d62ae487
- TLSH
  T1EA01758B2F126A62CDB70838EFD9E51A44D488D64AF1BBB824E70D4C13125C33039DCB
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral24
- Target
  $8/res/Microphone.ico
- Size 4KB
- SHA256 a8992375ccda029017fb09cf9f404bb7c7364f6b226dd3c082ad30cfb0897e1f
- MD5 ac87badf42c18d9b85e9927553934a22
- SHA1 12c52083ceec0b8e02c7df852cd866ae902c5355
- SHA512 cd8541c9f9b76b0223e9b323fe0dc8b4d24b18779e876c558fc4d512a2e3807b813941d0033dd32f3b3e7941522b7e2c28e27e25a05a8186b6222065ab666062
- SSDEEP 48:h9PzuVTiHY1wUica2VAHonMkr17xG4I961BDkC4DkDMCEPiBCLZZgKI54MhskJI5:h9P5+VSHOy4I9GBQ32PykkL
- TLSH
  T14091E8516EFE16D9D1ABA43EC1DE5533842FEB942A2C1C2050A9190583F3A8771BA15F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral25
- Target
  $8/res/Mutation-Fast-Off.ico
- Size 16KB
- SHA256 9d5d274595493a116342d0773e33743f2c8b08dc4c5857fce3467b993428fd2e
- MD5 fbf41565033ad19d2248a78cc799f2f5
- SHA1 4c60e313038a57b86f2239c50ec7ccc99127ee88
- SHA512 3973cddef018e61ac8c25b5bd4af32ecaf12c2281dc452bca7c120a92ac769ab5ce45b123f26a679291a194a8292880affdd86ba35916792a0bcbc3d456530c2
- SSDEEP 96:0K4p5TZsT3iUrBF6L2+PIPxG+D6lVfuSSUJVrS+v7x/aMuYAssr6UpW2aNh2Et:H4p7YiUg2+J+elVfbN/u+vFWr6NNNhJ
- TLSH
  T1A472D76BB545D40BC90012FCDF75E9BEB2B1ED6029548B403AE2BE7FB67C3939916204
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware execution persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral26
- Target
  $8/res/Mutation-Fast.ico
- Size 16KB
- SHA256 253a04575aabec843f6f4ab9d0fdd874d526f7a0f8c45922bd7bfa9242f2bac9
- MD5 4c38f648467f86b0b76cb3bb9913270a
- SHA1 1c7abe04aed779f9932f1d518e65e6a24657cf56
- SHA512 a16efffddb1813f1fe599b3d7b93b13886640a4b18eaa6e08597c36c0a51aa376fd2587b4842ed3728b56bcfdd7bd1888424cc0f8655b9f83d29579907d76625
- SSDEEP 192:HJTxtRje9EmxqwR2fip95+s8YF36PSzbyh4gjRcSJAqG3k9:CWm5rT5DTUKfyhfsq19
- TLSH
  T132720A70F605D544E61F82F68FF9D6BE4B70AC1919101EDCA5ECBF9B3A792E2C600618
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral27
- Target
  $8/res/Mutation-Normal-Off.ico
- Size 16KB
- SHA256 e108093b0a2897652c3646c58be076fa0f6fea8099858429d4430cefeb2370ff
- MD5 68dfefeae93b257db46fcaf0f101c8c6
- SHA1 a4c9c364878bbf4192c222be65d0303ad6d13afd
- SHA512 e59c53ba2ac469f37ba6f39359d9f62418fc255876820cc0cbc75c6559abd7487c01fd6cb15c54e91622fa7bab5e040dd21b5ffac0d005f66bdc88c0dda62f3e
- SSDEEP 192:H2ztALUoI0ZUF9Ij2lk+KCMnLM5mnGEaldiZJdlhbfHbC:KtALTUF9zl6MjEazi3XVHbC
- TLSH
  T11C72FA6A266CF413C78090B97F53C5FBD734AD083909860279F27E37B5BC25B6A51219
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware execution persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral28
- Target
  $PLUGINSDIR/KillProcDLL.dll
- Size 14KB
- SHA256 0fe15b023e21b7054fabb3d47b6084d60f8e474d8f9ca3a0a25dcb2097d6f0b8
- MD5 586270250a1acce8126a0877fd5bb981
- SHA1 9f5645b37b3af04004697639855da5c99a41aca1
- SHA512 a1994b91337385ab153860a013912f9cacdf9c233395868bf8eedfbe6dd13841619a8048c1d8407ee4b77c466fd8f31fc5cac2c779a2ef58c3a2a02caeded055
- SSDEEP 192:/BZa4DYIcJ4nS1ejJThugw4LBs4TJjdjqJVQXS3p16ZGntrefncWCV:JZ8IcJ4nSkJlums4TJJjsVh3pwZs/
- TLSH
  T15852F79EF117F6F6D4CB46B045E2FF3B443E29028836A8B4DF50EA207D1789E6529047
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware discovery persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral29
- Target
  $PLUGINSDIR/LockedList.dll
- Size 28KB
- SHA256 671570118024c9132f12999e198cebc87b3bf1846695553bf478c5a42efec226
- MD5 2ee096682cc84f5fd44fb5291c00596c
- SHA1 8dccebf054abe13e5b324dfdfbe6605553971396
- SHA512 1ffdc3a5256b8eb62aff82c6429dcdf582009a908d43ab30d3fad84770b012be59c972323b6ae2b8d7ea2ae29d8ab3a99913205a0b33582e95dc813c31507d3d
- SSDEEP 768:Mne3kAZoxbRX66y11T9vBD3fNUHeBuf6qW:MnnTZyX9vBDvNU+UZ
- TLSH
  T107D2194457E000F7F7BE1AB079A92B0A5ABEF91868F195AB4F3754CA1D61112F628343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral30
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
- MD5 cff85c549d536f651d4fb8387f1976f2
- SHA1 d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e
- SHA512 531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88
- SSDEEP 192:Zjvco0qWTlt70m5Aj/lQ0sEWD/wtYbBHFNaDybC7y+XBz0QPi:FHQlt70mij/lQRv/9VMjzr
- TLSH
  T126426B129BB089F2F591583814667F2A6FBE9C5D27F50563CFE304D63D212CB983A283
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware discovery persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral31
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 56b96add1978b1abba286f7f8982b0efbe007d4a48b3ded6a4d408e01d753fe2
- MD5 6c3f8c94d0727894d706940a8a980543
- SHA1 0d1bcad901be377f38d579aafc0c41c0ef8dcefd
- SHA512 2094f0e4bb7c806a5ff27f83a1d572a5512d979eefda3345baff27d2c89e828f68466d08c3ca250da11b01fc0407a21743037c25e94fbe688566dd7deaebd355
- SSDEEP 96:o0svUu3Uy+sytcS8176b+XR8pCHFcMcxSgB5PKtAtgt+Nt+rnt3DVEB3YcNqkzfS:o0svWyNO81b8pCHFcM0PuAgkOyuIFc
- TLSH
  T17012F992E6A450B3C5D6533B35AA2F2DCBBD5325B0926C00C7738E4D39395B66E38353
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Event Triggered Execution: Component Object Model Hijacking

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Event Triggered Execution: Component Object Model Hijacking

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32