General
- Target HandBrake-1.11.2-x86_64-Win_GUI.exe
- Size 24.2MB
- Sample260727-2c8peaseje
- SHA256 6becb8e5a041941d5f2fd6fe83c66fc15b2b16190e2e79f5ad47eb4cd18df8cd
Score
8/10
Malware Config
Targets
-
- Target HandBrake-1.11.2-x86_64-Win_GUI.exe
- Size 24.2MB
- SHA256 6becb8e5a041941d5f2fd6fe83c66fc15b2b16190e2e79f5ad47eb4cd18df8cd
Score4/10 -
- Target $PLUGINSDIR/InstallOptions.dll
- Size 15KB
- SHA256 44b1d70219f88564d94da9fc8a7ca4d25d103575519c84a44df3057b8af98f71
Score3/10 -
- Target $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target $PLUGINSDIR/ioSpecial.ini
- Size 211B
- SHA256 d95aed234f932a1c48a2b1b0d98c60ca31f962310c03158e2884ab4ddd3ea1e0
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target $PLUGINSDIR/modern-wizard.bmp
- Size 51KB
- SHA256 e668f52179d72316ce77862e42708927c5deee34e37ce83ad883cd0e0b3d44ef
Score1/10 -
- Target HandBrake.Worker.exe
- Size 737KB
- SHA256 25c03cecd756b5f7c7440c0371405744fa4ad821c4a3aff882aa0bff1d5d6dfa
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target HandBrake.exe
- Size 32.5MB
- SHA256 d346e161f2cbaccccae0a2861c4e9baf888d6aa1bfcfba4ba6ded922a65f8c75
Score7/10-
Loads dropped DLL
-
- Target doc/COPYING
- Size 17KB
- SHA256 f9c375a1be4a41f7b70301dd83c91cb89e41567478859b77eef375a52d782505
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target hb.dll
- Size 72.8MB
- SHA256 f98cac3d941c48ee7ae1b7fff1134e101929b51695f41eaa987ec1851e705094
Score1/10 -
- Target portable.ini.template
- Size 1KB
- SHA256 d1db25bfe772a56c21cc9307a525e207ae6b0691deb1d7019197ece99ffd0f13
Score3/10