86afb30284b270e1844c1b2929a6e9302030d07017bea6cbd5bcc704d6cec620

Sharing

Copy URL Twitter E-mail

General

Target
CapCut_Pro_PC_v9.1.0.3879_Full_Español_G_Archive_x86_995988.zip
Size 727.9MB
Sample260724-f85rqsstdx
SHA256 86afb30284b270e1844c1b2929a6e9302030d07017bea6cbd5bcc704d6cec620
MD5 2c12c4d802a61596e22e57cb02bfcc1e
SHA1 d6098bd4d8e4a7d3acddb0c1dde567f3c24e091a
SHA512 2a1bfec43deca0e8dcadacedfc701e261b3dc7592cc3756875153534194ffdc1d7f11aa8aa9430841565390be0179c54408b1f12a8c6d462b9345fd96e9db38c
SSDEEP 393216:bZWf4BJJk45yHzrEqrgr7cPQkOtssPLYDYYX0RBt5jO57CUlJimQJWJQgYgOOiSm:dhkry7cIkOZsX0vXihnPYz5SQH0TZZoX
TLSH
T1CE893305C92CE4D3FB9772B4B471D05BC92E50B136DFA199F59632B4AD8BD006F2CA0A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  CapCut_Pro_PC_v9.1.0.3879_Full_Español_G_Archive_x86_995988.zip
- Size 727.9MB
- SHA256 86afb30284b270e1844c1b2929a6e9302030d07017bea6cbd5bcc704d6cec620
- MD5 2c12c4d802a61596e22e57cb02bfcc1e
- SHA1 d6098bd4d8e4a7d3acddb0c1dde567f3c24e091a
- SHA512 2a1bfec43deca0e8dcadacedfc701e261b3dc7592cc3756875153534194ffdc1d7f11aa8aa9430841565390be0179c54408b1f12a8c6d462b9345fd96e9db38c
- SSDEEP 393216:bZWf4BJJk45yHzrEqrgr7cPQkOtssPLYDYYX0RBt5jO57CUlJimQJWJQgYgOOiSm:dhkry7cIkOZsX0vXihnPYz5SQH0TZZoX
- TLSH
  T1CE893305C92CE4D3FB9772B4B471D05BC92E50B136DFA199F59632B4AD8BD006F2CA0A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  Setup.exe
- Size 102KB
- SHA256 7123e1514b939b165985560057fe3c761440a9fff9783a3b84e861fd2888d4ab
- MD5 0323998e0e85eca5fd90d9f8ecbbd6c2
- SHA1 56dc080f728d7a276495d6a4371670f9ea71519b
- SHA512 2b56c210d6c690cef89ca03563cec186576c50f6b1b60b287afd46a14cc5c9dfce31dd458066098951a79daf3b367fdb0787d3bdc74fbd8f69425877f263b0e5
- SSDEEP 3072:53Yj+8JlFCumUbyJlKP8HRvkduTK5Nrh2o9Dj0fmoQ:1Q+IFCumUGekHRvEuO3go9kfnQ
- TLSH
  T167A3F206BB1615BEE922803EEA970666D7B0FB6217514CC71211A2301FB7FC19E379E5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery execution
- Indirect Command Execution
  Adversaries may abuse utilities that allow for command execution to bypass security restrictions that limit the use of command-line interpreters.
  defense_evasion
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral3 behavioral4
- Target
  data/.mg9
- Size 328B
- SHA256 3bb7a6da626a0d07466e5e838d6a801a0b48f8c3648dad18efcf2b6b42198241
- MD5 5df2196a6e8be146f3a946794cb7d652
- SHA1 322f52a4c4687064c6ece412a4410544fe36f10c
- SHA512 2e482962f01f36db6638d40fac370edafae69eb7244474716aa4dde4cb10a9e3a0305f76e3cc2fec0d80559582154d4eb0c708cabdd2429c9d9cb9c4defb1a43
- TLSH
  T100E02DC268052FB8728648C312326092E710AC1F9D088E003F7C0BE931F22C3288BB9C
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral5 behavioral6
- Target
  data/cache/bytecode-39.rpyb
- Size 366KB
- SHA256 55b140795778a9475d2144907eb619c6309413b6f19e77a421fd3b207a1c56b2
- MD5 fab5e4d6a8627aa77b8947d7deb26741
- SHA1 785b419b41870c9a0dbba6994a5aef2c117a0e49
- SHA512 34da6537d46687103b1920ace5ba7894857cb63b5064bfd07835c17c6ea59e60bbf06dbde98cf62d531f5292915d43dd6ff7dd8a5e4bc16054329cf412a39320
- SSDEEP 6144:iad71GRb0EejU3yfiFE2DzbuJ014QsEel0Oyl0JewbTAboC/7esQvlpYseioW/Fh:ia4peoAyJzbuJ/RE+yUewQboCVQvlpY6
- TLSH
  T14E84230988C710040EBC87A97105FA7CF16C6629A3EA637965E7C6F5FD1EC662D62C0F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral7 behavioral8
- Target
  data/cache/py3analysis.rpyb
- Size 70KB
- SHA256 55d104fd740c6dd21803032d3a629f755bd109338fb0ea53be923b3455a8b936
- MD5 597157fdf43490b0012848d2a8e5cd81
- SHA1 24adcdf081397695ae06d9836ca2450595cdc781
- SHA512 eba0d2602f4d0a223b200948530242f27f6cd38f7aed5d965714ba4a189ba950e32dc45556785fd98e8d4056353e660316891754e3cbba19580ab0003fef649c
- SSDEEP 1536:Y6KDNSwqoiXumM8GEszg1CR24NjF7Z/hIkFMR22AsMNRSi6xEY3NR4r:fK4FJumM68gsjFliwugQikL3NR4r
- TLSH
  T12663025A814DBA3AB400FEBDBAD6DC44C124F6C03ECA43A39F59798853E5DA03652BD0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral10 behavioral9
- Target
  data/cache/screens.rpyb
- Size 125KB
- SHA256 def4a78f1f845cba1fd6ef08591e7b34423dc60f97e0158a32125e73d0e96d43
- MD5 246defb1765dd2c2f4db9efcaf8c8d4d
- SHA1 0f724d04aa275190ae3eedbb1158b61b80dd3b01
- SHA512 ee86e2a757906e65c4737e432885ff07296b3115fcd92f026fb224f654770e17c3af78978ad1b231b3161a2002ce3dbcd2e2b7ab4e4da39fb63c5e13a5de0b93
- SSDEEP 3072:Z2epl/0KH70Jp0soBzVtiE58qmgbIclyRldkm2wZ6EL/bb/qHaK7:Z77jHIL0vBzbiE54gbyDdkqL///qHaA
- TLSH
  T146C31327BD3D584858A47C5ACE81AFAA06E04C0ED68FBB4B42967C9C9C1F142FF50DD9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  data/cache/shaders.txt
- Size 303B
- SHA256 f53d587a2ac1ccdef412cc183d100c64200e2f63daa67a9f50f260f7416dedf5
- MD5 e1e846c38e67c6ca2132f0db35f2d1fc
- SHA1 c6bccfea9cb308812477fae9bddbb7fddd103f0e
- SHA512 d0dbcfba72eaff8f439ea477150e69566f3c7b2effc532d9507e143aa6b0368f55e9ac4c411ba0eed8be66a62ad2ccc511eb2924a90af0b7ca202d07bc387ac7
- TLSH
  T12EE02B62B238AB08D058F0BD06B01CDEA64FD55617EC88F9059178D1DFC4FA411AAC3F
- MD5 SHA1 SHA512 TLSH
Score

1^/10

ransomware
behavioral13 behavioral14
- Target
  data/gRgpKykvNlLl.on
- Size 9.3MB
- SHA256 2a496d5c35042d2c63f83d34998eb624f82c1edec52a55602007fc96edce821b
- MD5 7e0b025bbb32d9aa96ef9c3179ed3473
- SHA1 40dac7933bda59db4bb37248954cb7a516c50948
- SHA512 e3a09987803645a93746bc7c279206840b4c6b3f22c76460cc2a9e0024b76c8237703b193c3783e5b6b55a0f4b6a2aa87671b5aac1acd0ca56b91049401a3197
- SSDEEP 49152:dJXIseYcbpWSLmDB/242g2qHb85I8RM+c0oL5ZtpiOCU5HPo+2GOJCrNMhLtrRVS:b3P0Wmm93/eOaMKT8vp8VGRsj9Mh
- TLSH
  T1ACA6D72BDB9E48C20C66C6FED91957D97BBAC930101240C5C11EBD82972B3B9AD13FB5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral15 behavioral16
- Target
  data/gui/bar/bottom.png
- Size 1KB
- SHA256 039344e7fee4dae940e3b13e4ddd0da4f0da50462fb40d506ad2db997aeb1ae3
- MD5 ae4af64653e5c5821e83865b84aaf4cf
- SHA1 39eb45bed47924ea146e458a289c74efffd863b2
- SHA512 497254d3c7caa41b60135bcd5ea0e668bb14f12cd5aaf142848686d300d2fde34ad4c59ed2d9dbca33530d1986d4af77bbef2bb5624d073ebed1b746cb9b55ee
- TLSH
  T164313EEED33E6FA0A745D9A650307AF2CF0E2310F5FCB45C985B9B60068B5279056B70
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  data/gui/bar/left.png
- Size 1KB
- SHA256 e5eb4b479c1a0beea1968f3fc74898ed8a9fca28e7b4a415c34a7daee6580290
- MD5 d3fbfdf4ca9526cb8fb0ee73eb573c90
- SHA1 d691f0060336cef8fdb6a8a74e6f5edfb0fea9cb
- SHA512 5d85f5c68fc02aa3e8b1fe8dfe0a670101cff55558ccb0a3f841c93d3a8e698444d564b95a2a5097a69ca3a3b390946a0e04cc9426a96ec6569c8f31766d5bcd
- TLSH
  T186213D84E609E83A75255582A2410BB18C227D773438EEC816DB3E4F0A4BFB92C35CD2
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  data/gui/bar/right.png
- Size 1KB
- SHA256 43320978c9312cb381ecbed3801a0140a76a6ea26c3e15a5c0073d339230497d
- MD5 18da7d4895f3083552e9fddc67d52bca
- SHA1 ccdfb063e95009ddf7b9c50398e847c673548b30
- SHA512 9e39f9482223611b3d3ab90ab917f11b7a12e32fdfd41ddcb4974e52df1115c93ec706ba6f665e88dc7085aea1d11e50f72b58c5118dd6feaea2a632e1883830
- TLSH
  T1902123D0E195A63762946051730605F1C2165FB66C35DA3891C7368F1053FB01DB4FF1
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  data/gui/bar/top.png
- Size 1KB
- SHA256 bffda9275d303a3ec87155eeb7f7962807f3c60a2851b0d18140f4b8e31c340b
- MD5 75af48f8dd7c3e7c4ad665debe479737
- SHA1 f1790f149cb63cad32c7569b73e92df0072e9f41
- SHA512 0378a85222366ad069fe29ecf039979f0ba8d455af9a41941488d2ff31cf8f18eab77f390044ee0b7c3d118908d5dbacaad6c678f61d5975407d0acf068d28e2
- TLSH
  T1593129EA927A2FA0A341ECE65030B5F3CF0E1340F6FC646D594B6BB01A57573504A770
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  data/gui/bubble.png
- Size 7KB
- SHA256 803788566de3e5d7f9c4be02199e0b42210181e663bea628ed302a6a8c51bf6e
- MD5 89401129e5d5aaa6bbecb862be52b793
- SHA1 f4d8fe36c48844617093e2a5faa1e9647ddda060
- SHA512 73fdd9b5c6bce9fd29b01f74329dbc6172d593ebbe10c0e86fed835e1be9b34580954e9fc4bd862d7c8770337bfa6ff41ce3a7c37c01ff52d580394e97f8a5bb
- SSDEEP 192:vzR3KblGhHiG+WsElhnJ3mD3SNnt5udxsx:7R68hCedDtOSJugx
- TLSH
  T14DE1BE0699EDC226D7F940A148852B57EEB10A3D0AFD8FF19DCC0D52CAB0D078B498F5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  data/gui/button/check_foreground.png
- Size 975B
- SHA256 5d58963b49468115a784de7d0b229533cbc366f7ce40b38660afddc8597df457
- MD5 6cbe6c30627098fb05b403e8a8a2c0fc
- SHA1 711b2263ea3f6d1cf98560b0ef21ced2f653f31a
- SHA512 6e5f254128856ec614cd6bed323fe4032e30751dc8a8d9abcd593cf65df0ba3f3b9b8822dcd6d58753e385d8bfce47fe4a68267798d8c8fc61a8dcecda6c5efe
- TLSH
  T18611C8D448344139A88C2B3AEF4F150A7AF14414B35524BC8182C4310702036F05CFAE
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  data/gui/button/check_selected_foreground.png
- Size 289B
- SHA256 057b1fb70e3271e5370e842019ecafdbafffb2f09c3c22388523add220b17ab7
- MD5 dfd175e82742c6aae989b8ef2346ff0d
- SHA1 6b3e1113727dbb26345282192b212905111d448e
- SHA512 0de9dc15cc9cdd9a130458fffe5bd5628d902924bf5424607202dfe25aec3b31eacf533c7fef6064f5742753a8df7a627b62a4b88592ae0c60fd03b7c5b6c419
- TLSH
  T156D07DF1C533693152C51AD3EB790E109465E40C0A50960A053E706089024050DBA34B
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  data/gui/button/choice_hover_background.png
- Size 2KB
- SHA256 0740c9b73d918d7a477b3405a7368f0768127714b843190c55a2a6345cf93876
- MD5 e4d31f360f1c124412b31cac5ed4ea31
- SHA1 bcfa8f0a675f9961ea01a2c81c8c465efb138c40
- SHA512 902ed1e6f31c13b982f7dc7797b37d1ace6e2d677805d891e7c4c6594c72a1e97f407b7987f298a1dea3dd88d24c7ae534cc865c34ff0168c80132eda5e60343
- TLSH
  T16E41FCC1D320047735860142B099891301896CBBB939ED4854CBB43F8B7BF7A9DB0F43
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Indirect Command Execution

T1202

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Indirect Command Execution

Looks up external IP address via web service

Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32