f1f0461b066322c30598631950004915df4c145fb2733e52b00b21707368bf8c

Sharing

Copy URL Twitter E-mail

General

Target
win_02.04.00.81.zip
Size 25.7MB
Sample260722-pm82pshp5s
SHA256 f1f0461b066322c30598631950004915df4c145fb2733e52b00b21707368bf8c
MD5 95d00227c9b240107be77699a3a60e67
SHA1 8ae91e1e3a6cd080d3272b63be9d519d99c50db1
SHA512 941925b30df0073152d6c9df7a3c2ce3c4c05ddc7245d45ca7d309263d5f2e76b49c380dc3b33562e581acc0560612796a30a708e73c8c472a74fd0fa91cb977
SSDEEP 393216:9ONXSlTMNOX4bJE8YHxRG3PEbCpmnMErUbnMjPnZV2syua3M3oEYOd8HZQ90VUdx:96XSx3Ib73YRiMjPz2sVjUQiVgzaYr1
TLSH
T1F64733C138ADB7D45148A39B746B4CAD38F5ED7C91844DCFF81A92F0C5466183E8B2AE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

persistence privilege_escalation

Malware Config

Targets

- Target
  BambuSource.dll
- Size 5.3MB
- SHA256 eb7ca58fa618db7bc0a830c531691c7d0edca3e2c18c6ff8bd66fb13e5304b1e
- MD5 e0a399893f13b29ff3413f184f0ad431
- SHA1 b57dd5b827ed4250e198b7571a90712bda91d347
- SHA512 bd097fec9f010922959105b2a995ced1bc899580233cfdc11386749f273b2fc98e79df4f7e2b52210c6e84fe3c70bf066f9273834fa25ae2d9607c8b4efc667b
- SSDEEP 49152:DPKrhEX/4DDjVWatd3tghWooTbA2X2ugPRPTcunLXDbsr7mYw0V34jRIzv4A2DJo:DySP+DDbAKMRPD/4PYMczeKEBvvKG
- TLSH
  T157467B5AB7A80198E47BC13CC6435617E6F2F85A477097CF0AA9467A0F33BD46A3E344
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

persistence privilege_escalation
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral1 behavioral2
- Target
  agora_rtc_sdk.dll
- Size 33.1MB
- SHA256 8c787c971b19ba66c840c9abf88ad2a6a4c50d171152d035f8bea0bab77a8c16
- MD5 d07f91e918f507824cb350cfb72fd6c4
- SHA1 0c6f34a4aeeacb41f964d1993ca2dbbfbf20b1a8
- SHA512 3f7981a2c1d2fe6cfc4eaed286e9d77611f79292aa1a000b7d4f1f303927d7ea52e1fe2e59bd7ea8612bb0dc6701b29d1ae9a4548492d0d23c64261c6034a2fb
- SSDEEP 393216:g2kfzysUxpo0kj71VyUcbNsRQ2FCIZ+xqf67BKEy6himp7q0ur:gnoxbNTFmup5i
- TLSH
  T14D775B47927500D9C0BEE078DA5BAE13FBB1344903759BDB069086A62F63BF4B97E710
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  bambu_networking.dll
- Size 4.1MB
- SHA256 75fc18c3e8c54c2c66f93a72e447fda76ec88ceab576981fa957dcaf5f03f2ef
- MD5 b7e487d77d250244230d3f7bab80165d
- SHA1 22cf4f10b84ff7c1787106e07724a151371ddc33
- SHA512 1b87f61d4aa25ea0fa23db3045316bf4afe95c4f5351b3b707be8def1c0d9f11ff910fa5aec6033b25d26350440fada96b2b594a75ca220429b51ed273065e7d
- SSDEEP 98304:VzRNtmnk5VAWPlbA7bMgD63MnDqmkBPf+s6lR3grJn+Bu35Wx:bNtoOJqbljDqmSPf+E+tx
- TLSH
  T186162342F3BE01E5E367DB36C863212BF5A13471A6A4C74FA3919B412B53365CAAF311
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral5 behavioral6
- Target
  libagora-ffmpeg.dll
- Size 7.4MB
- SHA256 992087ab4b5156363feb10a15f7e1b3bec76742888ca088afbb9d498aed58aee
- MD5 ac46c3b91fdb1128c6ef2527695ce27c
- SHA1 969ff65656871e02d5efb598eca2ebcc05d1ba3d
- SHA512 5e08efea47817f16bc798a67d7da07dd3b0b07b631b0088c131796c9d152cd698a909033eb5a9078bdc6683fef641040d562f0035bade31b90fb6a6036565f7b
- SSDEEP 98304:zv6YTJ9MJdJjMUqRYnPyZ2SeB0Gtn87mJsyRvXezW1VHmrTnNtS7:kPyZ2SeB0GbC4fvmrTnNtu
- TLSH
  T181768D4BF1A311ECC456C57487ABA633FA30384D43246AEB27D4E6652E27BD0A739F05
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  libagora-soundtouch.dll
- Size 155KB
- SHA256 424307be3ac37e42dac6731914b110cb4ff1e5219ec72f18d9d708afef52d38c
- MD5 1ea4df2a4b90a076bbd06efe253e4c3c
- SHA1 82e1d3c91f80745fee08a8d05b73f4ade28f9d36
- SHA512 b7c881d85a271a60aaac817317ccdb7aa85784382726c8b622d8e0b2e983ba8bbf97dfa97b867e3931aaab17c747c9dbc51f09c313058332a0d2cb72c78d4322
- SSDEEP 3072:PzoDwBZpjHCegd6MHvp1VrwZMO5oY4pzDotpU6CfLPXgn8kj:Pze8hCegjPpXOdohLsnl
- TLSH
  T1F6F36D1B72A504BBE1739134C9A36E16F772B81113719AFF03A442795E273C1AE7BB21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  libaosl.dll
- Size 1.2MB
- SHA256 b75e70f4829a4fc0ee7a5dd73934b135f76e0ce2f0142f505db51562eb9e4abe
- MD5 5b4420daa464520cbab3ea7dec8bccd9
- SHA1 c30a7656f800821f9e21ef4cd4b591739f52d101
- SHA512 251928fc8d70ab7ec74a78b47d30d2fc815f3e7ec1389014c1f2f43128374cdcc259d5c8bd5ff3d088a0364602f6a4a33eb5c37857e8fadba24781b9dd17ce3f
- SSDEEP 12288:X6j/cnYz3/1i4MLcWtNE3suivyiddqCIsLx01vRY03AJia5pUy7pg9tVN4iUVPS1:X6QnG31rLyLIY03AJibyVetD4izRzKnc
- TLSH
  T1A1558D6673A812A5D5BFC13DC6978B4ADAB274150730A7CF02E482992F23BE55E3F710
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  live555.dll
- Size 4.2MB
- SHA256 c3b1f1216c4949a1011a26a1795edf9d4838eae6c31be69c288abd5215a392f1
- MD5 63fccba5c23ad69bbbbbe51c808bc848
- SHA1 7bd14d62bf8b2b88430524e76148c463ad9a67e1
- SHA512 4886e78e7564d7ec012c976ff782b8dc7a26395390435bea64ece5fbadfa59276dc12164ead983fdde71a3f3fd764071278ba795ac7430c51a2b0bf9887ed892
- SSDEEP 49152:L19kl1HPHRQfXWd/OMfswL8uWW0cCoovxy07BqtLQjJglFCRWAtheGZRxSPOVzrd:L1fYc6P05q9QmG1d9JL
- TLSH
  T1D4166A1ABBA80198E87BD13CC6A74617E3B1F816477097CF1AA956791F33BD5223E304
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Event Triggered Execution: Component Object Model Hijacking

Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14