d6a53bdfaf4016cc91ee5b844004893c700f4e270563311d0d41555cd40a4e83

Sharing

Copy URL Twitter E-mail

General

Target
VoiceChanger64f(2.04).exe
Size 1.3MB
Sample260722-jtm5xscd39
SHA256 d6a53bdfaf4016cc91ee5b844004893c700f4e270563311d0d41555cd40a4e83
MD5 a39ffabbc2bea08cf3306082cacde23a
SHA1 98aba3f5dcc0020eb38dd7f57ab08123dd8f36ec
SHA512 c2a960f0189d2272773ae5833b98ee0da571e78f7fde9c9dee6bb9d2f50e6a8a088757aa394e5a171e16583514001697f7d49992e991b45964b3e84fbece066d
SSDEEP 24576:pYD9YJJU0TUtLtvvKukmEZm8pDJVkj8uXqRIU+RonxU8f3gdu0430baa:WaJJUVLtahmEZJpQgu6/88U8fZybaa
TLSH
T1B7552331B4ACC559D892C631BEBFA06A8E7DAF4B1217864F23108FD4AD75B117D0B683
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Targets

- Target
  VoiceChanger64f(2.04).exe
- Size 1.3MB
- SHA256 d6a53bdfaf4016cc91ee5b844004893c700f4e270563311d0d41555cd40a4e83
- MD5 a39ffabbc2bea08cf3306082cacde23a
- SHA1 98aba3f5dcc0020eb38dd7f57ab08123dd8f36ec
- SHA512 c2a960f0189d2272773ae5833b98ee0da571e78f7fde9c9dee6bb9d2f50e6a8a088757aa394e5a171e16583514001697f7d49992e991b45964b3e84fbece066d
- SSDEEP 24576:pYD9YJJU0TUtLtvvKukmEZm8pDJVkj8uXqRIU+RonxU8f3gdu0430baa:WaJJUVLtahmEZJpQgu6/88U8fZybaa
- TLSH
  T1B7552331B4ACC559D892C631BEBFA06A8E7DAF4B1217864F23108FD4AD75B117D0B683
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

discovery execution persistence privilege_escalation
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral1 behavioral2
- Target
  $8/$8/uninstall.exe.nsis
- Size 32KB
- SHA256 bc9870d70f3e21a2ee59f8bc503579e1e67853d1d1c4f2c4056dcac572d1766d
- MD5 e73253ed0dcf2f71aeb710ef1c58ed4d
- SHA1 8b67ed55cd2b4f61295113971d8f2f07d06c6d26
- SHA512 32b91867b7f9c50da77a8cbf92f9cccc6894e835220bfeaa294ddeec49d3f690bcb4dff598d73247f01e0d33181046e3cb47cee3c5dc040c2c843f12f207e9bf
- SSDEEP 768:md1X32bLt5rBazZOAcvWJNmrIOeIbJccFz6ZQ3xts8UsqTfdu7y:mHiXBc0ZQAHpbJccFz6ZqDs881u7y
- TLSH
  T169E2F19CE3B06194BC52944D0ABDFCA81537A93F8AACC81495C649F24F7703F1E11367
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral3 behavioral4
- Target
  $8/APOConfig.exe
- Size 196KB
- SHA256 51d70cde3987044a44ebc852a58471bbdec07134724fba3df4747b32687eaa0e
- MD5 f04c8bbfb8d2252ccab3f1d56438b038
- SHA1 bef233a4a22eb3b5e651a5f061375cec92652742
- SHA512 17c2be26245a5dfca67400f381a33180ebcde8815cc6497263a564d05dc1dbbc34b34370dc1277dab146bccafafe39e2ae14f00d4ca6317d6087fc980024ed30
- SSDEEP 6144:hXtzpxJqoyk6H9APPQZLFlejj85JL7gfq:TpPK9A8LH5N7gi
- TLSH
  T127146D25BDC2D073E666097069E8CA759A2DF8B10F609CDB63840FFA4D346D19734B3A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

discovery execution persistence privilege_escalation
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral5 behavioral6
- Target
  $8/AudioChanger.exe
- Size 161KB
- SHA256 4650d9d765d696247f3ee5e8e46a50df7eaa6fb8c4c787f29725b3ddec14e4f8
- MD5 f387eab3029c382e51af4298b7798ee2
- SHA1 477116da32d279f868c0f609183d4cb4a0ed5639
- SHA512 d74427414ac544b0ab7576ab78f27acfa6952e9a2310e5385bd28dc14977f893485022a9fdbe767b0c1dcbbf37603eedc3a3f89972a9e37b738c593982fb8c0e
- SSDEEP 3072:t65PxKAHTGwJyEDsUIzw69Ms9R7aXVR6+KPEqH9fSSoV:t6SAHTGIxw7DasraKMqdpoV
- TLSH
  T15BF37D5773A430F9E5278239C8A15A46F772B87617209B9F13A8477A1F133D09E3EB60
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  $8/ClownfishVoiceChanger.exe
- Size 976KB
- SHA256 257bea54a955cae08765505e09f1583151df29d534b052dc347ebb361ff80077
- MD5 a64d695c0409f23bd01d72c11d3e4c7f
- SHA1 d53d9c52691f9668356d6cec4177573be1c63e9c
- SHA512 6265359cd23ce96cc8924db1591d67eb6d220e4134a06b9d820c04970094bc511fa030532df6269bbd052e2c15924f15946711b89c3cd5ce5c04768baec07924
- SSDEEP 24576:u79tdN9tdN9tdN9tdmg/EILuSUfOkcbMpXJ99:u79tdN9tdN9tdN9tdd/JUf5zpZ99
- TLSH
  T1E3256B1D6EE502B9F1F7D770C9A16402D6717C86873D99EF02C182894E729FACA39F21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

discovery execution persistence privilege_escalation
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral10 behavioral9
- Target
  $8/ClownfshAPO64.dll
- Size 371KB
- SHA256 2ee8484d4f7e33adbe93fc9cc4f19300adef13942aba7b2772efd8156ea12994
- MD5 fa307e9967a35faa6f6c44c9ae912cb6
- SHA1 c29198490611a37673ac74238a2039f1b2deb98b
- SHA512 91809cebe80a3d4af727d34f53b850efac16209d9ce07b483a0b26ba4b3e02334df090dd05ae4409349c008d1948be966d9bfd2eb1e8e90697ab54ad4e2ca4dd
- SSDEEP 6144:tvbxZ1gPPNcOemnk+j8edhyQ7BsX4m9V5CIiRpKsVgWooz188T:9dgPFcFIR4gyksX78UCeob
- TLSH
  T12C84BF05FAA500F9E177917C85BBA607F3B2385D0370CAEB03A446692F277D45ABB721
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

persistence privilege_escalation
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral11 behavioral12
- Target
  $PLUGINSDIR/KillProcDLL.dll
- Size 14KB
- SHA256 0fe15b023e21b7054fabb3d47b6084d60f8e474d8f9ca3a0a25dcb2097d6f0b8
- MD5 586270250a1acce8126a0877fd5bb981
- SHA1 9f5645b37b3af04004697639855da5c99a41aca1
- SHA512 a1994b91337385ab153860a013912f9cacdf9c233395868bf8eedfbe6dd13841619a8048c1d8407ee4b77c466fd8f31fc5cac2c779a2ef58c3a2a02caeded055
- SSDEEP 192:/BZa4DYIcJ4nS1ejJThugw4LBs4TJjdjqJVQXS3p16ZGntrefncWCV:JZ8IcJ4nSkJlums4TJJjsVh3pwZs/
- TLSH
  T15852F79EF117F6F6D4CB46B045E2FF3B443E29028836A8B4DF50EA207D1789E6529047
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral13 behavioral14
- Target
  $PLUGINSDIR/LockedList.dll
- Size 28KB
- SHA256 671570118024c9132f12999e198cebc87b3bf1846695553bf478c5a42efec226
- MD5 2ee096682cc84f5fd44fb5291c00596c
- SHA1 8dccebf054abe13e5b324dfdfbe6605553971396
- SHA512 1ffdc3a5256b8eb62aff82c6429dcdf582009a908d43ab30d3fad84770b012be59c972323b6ae2b8d7ea2ae29d8ab3a99913205a0b33582e95dc813c31507d3d
- SSDEEP 768:Mne3kAZoxbRX66y11T9vBD3fNUHeBuf6qW:MnnTZyX9vBDvNU+UZ
- TLSH
  T107D2194457E000F7F7BE1AB079A92B0A5ABEF91868F195AB4F3754CA1D61112F628343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral15 behavioral16
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
- MD5 cff85c549d536f651d4fb8387f1976f2
- SHA1 d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e
- SHA512 531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88
- SSDEEP 192:Zjvco0qWTlt70m5Aj/lQ0sEWD/wtYbBHFNaDybC7y+XBz0QPi:FHQlt70mij/lQRv/9VMjzr
- TLSH
  T126426B129BB089F2F591583814667F2A6FBE9C5D27F50563CFE304D63D212CB983A283
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral17 behavioral18
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 56b96add1978b1abba286f7f8982b0efbe007d4a48b3ded6a4d408e01d753fe2
- MD5 6c3f8c94d0727894d706940a8a980543
- SHA1 0d1bcad901be377f38d579aafc0c41c0ef8dcefd
- SHA512 2094f0e4bb7c806a5ff27f83a1d572a5512d979eefda3345baff27d2c89e828f68466d08c3ca250da11b01fc0407a21743037c25e94fbe688566dd7deaebd355
- SSDEEP 96:o0svUu3Uy+sytcS8176b+XR8pCHFcMcxSgB5PKtAtgt+Nt+rnt3DVEB3YcNqkzfS:o0svWyNO81b8pCHFcM0PuAgkOyuIFc
- TLSH
  T17012F992E6A450B3C5D6533B35AA2F2DCBBD5325B0926C00C7738E4D39395B66E38353
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral19 behavioral20

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Event Triggered Execution: Component Object Model Hijacking

Checks computer location settings

Event Triggered Execution: Component Object Model Hijacking

Checks computer location settings

Event Triggered Execution: Component Object Model Hijacking

Event Triggered Execution: Component Object Model Hijacking

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20