57469fb10952aab5dd23df2807329eec4c407a589384147cb180fb89469c55b7

Sharing

Copy URL Twitter E-mail

General

Target
CapCut.7z
Size 555.8MB
Sample260727-sgspbawsgx
SHA256 57469fb10952aab5dd23df2807329eec4c407a589384147cb180fb89469c55b7
MD5 0e27fd0382cd2fa3749a088dc34fdb61
SHA1 09d5c1577fafbf45d205860cfceb3f70f1c87623
SHA512 03c3c5677bc1ad5733d0c977fe9074a39d6e0733421b7d5ceb5ca0a66fe80aff88b6bc7e0c55bf21cbd5b893a087d732352959bfdd5fa585dc4626812437d407
SSDEEP 12582912:SQG+/S8loIe2g6c5e8KmzU+r8kOnB6Gq49pR4U+BTovENaq:SQsv6cM8rrKBNq0ksbq
TLSH
T19D5933FD06A1622AFB87627F4E02D9B22A24D49F0258370C1DEDB5B467747C0CB673A5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  CapCut.7z
- Size 555.8MB
- SHA256 57469fb10952aab5dd23df2807329eec4c407a589384147cb180fb89469c55b7
- MD5 0e27fd0382cd2fa3749a088dc34fdb61
- SHA1 09d5c1577fafbf45d205860cfceb3f70f1c87623
- SHA512 03c3c5677bc1ad5733d0c977fe9074a39d6e0733421b7d5ceb5ca0a66fe80aff88b6bc7e0c55bf21cbd5b893a087d732352959bfdd5fa585dc4626812437d407
- SSDEEP 12582912:SQG+/S8loIe2g6c5e8KmzU+r8kOnB6Gq49pR4U+BTovENaq:SQsv6cM8rrKBNq0ksbq
- TLSH
  T19D5933FD06A1622AFB87627F4E02D9B22A24D49F0258370C1DEDB5B467747C0CB673A5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion discovery execution spyware trojan
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  defense_evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Drops desktop.ini file(s)
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Drops file in System32 directory
- Suspicious use of NtCreateThreadExHideFromDebugger
behavioral1
- Target
  CapCut/App/CapCut/4.3.0.1694/push_detect.exe
- Size 68KB
- SHA256 0db8d878236c853500ede17b08edf99f640d6227087770cca3d20019da255812
- MD5 5e5e5374277fc5ad894ea03a5ce4b19c
- SHA1 307dcc23540bac88bdd26f6a4ba8928f36bcd4ea
- SHA512 e1bbe1cb1f79f56ca127a01987b6e763c45bc573cc7a733357abe4e129a8aedba92c19124b9b34a9d2efc22d147333069323e0e6dc52eaed3db62b501fc32a09
- SSDEEP 1536:ocHEKfV552y1OXeaXk+z5xo9v/7M2aeXxFx:od2X1OOv/3xrx
- TLSH
  T1E1636B9B776804C4E02AC17DDA928529EAB3B4515B60C7CB2314C36B0FB77D1ADFE660
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral2
- Target
  CapCut/App/CapCut/4.3.0.1694/raw_r.dll
- Size 1.4MB
- SHA256 ed946fef1c589db47e85cc9ade5a78e3494642eaec61be7cecbc67c2bc1db802
- MD5 d1df14789c75d63a8dc3aec27ebacf32
- SHA1 1e10aae5029a62f5461ceb1c6abe82686be96e85
- SHA512 abd8f9358fa15abcbf26828d61317867958cb2c811cf65e0879bf15ae0f472c73eb09f9a76062c6384ba95dd8468c14d666c41a30a7c3d4db3d50b9b6440cb20
- SSDEEP 24576:5ql/SiB4wEcOh4GKLPS6nkwVLg9uP1+74/LgHmPr9qvZqhLanLTLzLfqeqwLwAiI:USpwE+GKDCaW
- TLSH
  T10B658D42B66502F8E06BC139C5A7910BE7F5799503208EEB66E09F6D2F13BD11B3B346
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3
- Target
  CapCut/App/CapCut/4.3.0.1694/renderkit_windows.dll
- Size 13.8MB
- SHA256 ed3a45ed824e93a9e42c3c24663caf429ccf433858735f6a65ca9bbae2c1e371
- MD5 1334078e769e72def5ead9721ddfe548
- SHA1 fe689de7984dfaba97d4191a0173fbaf2f23bcd1
- SHA512 9b74b58973cddbf3b0de3ddffb5bd71cb4487ff3448973044b24307cc563e14e8258c3fee05773ed1d2f019e2b98ade7cbbc80819e30fa8af6976b879463f5a0
- SSDEEP 98304:iHKErb0WHpLCHNgl1jQ7Lhcxb5kb6XnHtNYGKomKf27ete:V0pocOchTYb0e
- TLSH
  T127E68D03F1A640FDC08DC2B89B5BA927E771BC4905A4F1DF278467613FA6B602B6E750
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral4
- Target
  CapCut/App/CapCut/4.3.0.1694/res_pool.dll
- Size 7.2MB
- SHA256 ab0d998ca4aa42ea927e8ae59e4f63e657b338464665147854cf245f468ffc4f
- MD5 77df6e30974d6de74e18fcdb4d8e9386
- SHA1 eccebab9e125ab3de3270013f509445de622f3aa
- SHA512 330dd2f3a1d538b2ae7b37575059cf72f7447811dd791004e408a57cdce18cae28fe418135f309c0005450d2cbea72eeb2e9b6f91dbb4a30efa50fe0e8fb4971
- SSDEEP 98304:sopBh9XPwtL08ytJHIGsy/nS41Ht1VnAHXkYRcUVgRmpjrE1YVrRGpnfaHO+xmcX:sopj9LGmcX
- TLSH
  T1BB764B67726901E4D0DAC2B98B5B8E16EB7130920730D7CB15D0DA975FA3BE0AEFD211
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5
- Target
  CapCut/App/CapCut/4.3.0.1694/smart_cut.ofx.bundle/Contents/Win64/smart_cut.ofx
- Size 310KB
- SHA256 e98fc548ac3148932645de1f3c4e6fc1246aea66bfd6ef2f856300ccbe882621
- MD5 1e683086cb2bd698521d4f185a0bd15a
- SHA1 f0b48e71cfea0ad3dd869b48cad3f6e84e0c319d
- SHA512 fcc7f484653e410a28938974e3c30cdf3e0e4208061432522df2467873d4b66f6a50ddf3f111006578bea0b2c18add9b2313423eb029e1281649302ec33f2c64
- SSDEEP 6144:0SWt4t63mFhk5kH18ksUnSOeEOZl5yjS3MtG2Fp4wLk5:0SmiMmFh5H17pfFNk5
- TLSH
  T196645C7765980CE9D1B7E27C9657CD03F6B538560351CADF03A04A2A2F1BAE4EE3E610
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral6
- Target
  CapCut/App/CapCut/4.3.0.1694/speechsdk.dll
- Size 7.4MB
- SHA256 9cb0a6466d105226e8eb31dc91c052fac2eda8ade89c2fabf0f095f87374ce13
- MD5 bcdf6a62edd09f9f66dd869b886d362b
- SHA1 528d4ffa692a24d05ab0f2bf98a5cf828475fea9
- SHA512 cc26c37245281c8906bbcf863748eabb44c7b341dab77622622e3a141b91a2519e83cf16b07865c8f9d27b060287931fb7a8df781e1d771fba07a65666a29897
- SSDEEP 98304:jVRO8D1VX1L2AzBbWq60ViIWojjIviaDQN5Iv:jjr7h2MVndjjIviaDe5Iv
- TLSH
  T1FB764B03765A40FDD19AD4B4630B8B53DB6174CB077AA8EF42D211662FAE3B58F3E211
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7
- Target
  CapCut/App/CapCut/4.3.0.1694/sscronet.dll
- Size 7.2MB
- SHA256 1c4a664d3906c64b506e4fb439e4f32932271892c6f572889dd7d5bd1db47a4d
- MD5 3126ff295ea694dd30e5c80248b2e5ba
- SHA1 feda23b540403720a3a437363899c0f05d7cce53
- SHA512 f0eaecd3bbfc41888408c278f122357db0607ad3e625803ccc022ac689a725ce9b825138b800d156319bab78e5f67ef28a65f7a3669a753696fb1c1f8e40bd23
- SSDEEP 98304:3SVlnFQicRMilyt9F7hZkshoBuEQwEnfm7:3SVB6P3gZhZ+Bewi+7
- TLSH
  T163766B03E2A610EDD05EC3BD93579236EA7178890B35B5EF07905B212E67BE0AB3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral8
- Target
  CapCut/App/CapCut/4.3.0.1694/swresample-3.dll
- Size 194KB
- SHA256 518473e9e6fe51d4b8b2c883413d8c9cc449de668f8ffdac025388979157ef46
- MD5 b205b73f5629daa77fe4d42a02dbf8eb
- SHA1 734ef7ee1d913758dbbf9c9e801431a13982d47c
- SHA512 4460d3ebae1d4849e98bfc8a9da715abc37caa05a11031bad79ecab114d11cc12096fcc3a8379b1e8d26e62e91b80b75315072bc016448102c6fc1fcef2450d8
- SSDEEP 3072:A16yBfeeijtbNoWRVeQY7afO5SYTw+nZ/0:q6y9ezxbNlnyH5SwZ8
- TLSH
  T188146E86FAA51AACC957C07862BA6637F970307503842EEB09C1C6355E1FBD5EE37702
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral9
- Target
  CapCut/App/CapCut/4.3.0.1694/swscale-5.dll
- Size 741KB
- SHA256 ffa47f51cda13df086ac66f6e2517b6c3c0e1eb7a1cade4c554d0f8e4c336330
- MD5 913bf58aec6c134ab845cf722d93b6ab
- SHA1 89f6c3d2c75ba97cb6d05bc7a5eeb88790f41a9b
- SHA512 be17f491da795ba89e66860dc3115eb54a9343f289f498ed68ebf23dc56b2deae47ba9724d4c7aef52f475e75e022a19364c297bdfcff8cda37167462450bdd1
- SSDEEP 12288:ekUJfzmkQABSXPzRfqAAEuuj2oEnDVfEeEEFV7M/81HS:ekUJfzmkQEURfqAAEuuj2jVro+y
- TLSH
  T112F45CD3F2A617DDD8A28034919582A7B66871260704EFFB99C88F343643FD1B677B06
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10
- Target
  CapCut/App/CapCut/4.3.0.1694/sync-sdk.dll
- Size 4.3MB
- SHA256 cf7a3c461fbae570f8bdbf1700ac3afce40070b35a8ad13b2d66abdf59cbc3e7
- MD5 323e7009f1942794c98e7b5148181553
- SHA1 7d434faaf86e7124a1129e8f8a541fe9ee77567b
- SHA512 3d704712cba15847ac80566575665b6fd717166503c261edd753a183bd07a3d18db3038645b851bdf8affe5516ce789b4c13086d6198f1749ad4d5d0d432b6a8
- SSDEEP 49152:1CGtlqwVwASOcMIU6iTY+hZwinHl6bEnyogrSTGSubzKaGFKarlKKPd3E13FsHlI:kj+pBRiWq3F7svULcQ1KNNw
- TLSH
  T11D269E1BA2E801EDD4BBC17CCA575617E7B2B81613B09BDF02D086661F63BE15A3E710
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11
- Target
  CapCut/App/CapCut/4.3.0.1694/taskcontainer.exe
- Size 44KB
- SHA256 57fd5d407c56c40e77ca15bdac39583efdfebbf95279d72a7385a12a50b0119c
- MD5 e31dc6ef5b95f1a79f6db92915fd47a9
- SHA1 d43f8e054fbd010e01f8ac5ad33a6df269764437
- SHA512 632a09d9c4268eb1b0a41206300ed8f61a9c7d323d8be56a451e726b32970153956d35a7ebfb52e934a28c057376a40f96a28fd59f122e3976189e76888fd429
- SSDEEP 768:mwXyvBMhfZwHxZzfKEumGMUElym83yAi/YiMw+1AMxkEkC/:mF5AwHxtfi7ilbV/7MvxV
- TLSH
  T187135CA7621D0CB9C56BE336E1FAED67DA3A3842035587CB038182051F767D1A9BB4F1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral12
- Target
  CapCut/App/CapCut/4.3.0.1694/tbb12.dll
- Size 185KB
- SHA256 a7c52e1b10c24d2158bdd035b13359a84ad5dce0e71ae86fe4076037c72a8649
- MD5 56821aa463854067957563f06fa0d005
- SHA1 2e122ac2d0a8afc96999865f9143347b0b6ca8e6
- SHA512 509bdaffdd724598bae8f679e5b8aec74aaeff5a16609a2a278035fe033865352bfae66dddfa553b0d79a2b7465eb84a00b36dd2e8ffdee28905ef440b3a19cc
- SSDEEP 3072:U0WuTsihFJj8w0SjqWB5jNzgOISKrlLt/bZ:LWuTsihFJj8wag9aSK3TZ
- TLSH
  T1C504491A7698449BD12F837C9A838A99F3B6F0452B1187CF036483BD0F27BE56D79325
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13
- Target
  CapCut/App/CapCut/4.3.0.1694/ttdaemon.exe
- Size 373KB
- SHA256 15d2185b11164ce1bee3473dfbaf242a40883ad060f7e791f4418246572c9eb5
- MD5 7992c16a50202081764c13903739eca0
- SHA1 afef1d60d4ccb3727940f6837cdda81c925cf6d7
- SHA512 6840687c311db33a6efaafbde4c7da9089c409f2badc85bf8635b1ef4d25037c1e0c7a0442988af76bf635c3f1910a3a0a57cb8b6aaf19ed40c0d73256a7aa4f
- SSDEEP 6144:GAKEudabCKyOXRJEeqB+DPzlviYMUf6K2Nw2dbr4kzLHWvG3Ny9ug8I6APNS2wa+:Vl5vASix0AVJr4Pg0IEI7P3Wu
- TLSH
  T14B847E57E65D04F4E06B913C8ED7CC06E2B2385A03598BCB2AA446191F3BFE06D3D796
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral14
- Target
  CapCut/App/CapCut/4.3.0.1694/ttheif_dec.dll
- Size 986KB
- SHA256 3c2a55b26635a0cc676fea9433ddd48a07f5e25aad721efd10aff8dab74edf06
- MD5 6a5197e4e4bca2987ecb9315eaf7cfe5
- SHA1 78d464287bca4c163af2d901429864e811a91a7e
- SHA512 17094c4f60c6449ed9e2e0db00011ab5c43df364cee5bdf52b88e055a833c319639d3bf1d57ed0553d9a79005cd6b08e0ad93189c8bfca8adadcd20c07a9bef4
- SSDEEP 12288:7LPj/nogpZ2W21OyvRC6j4VfVvbCoxW0yUMLE9Dr4knuPbjNw1B:nj/ogpZ2j1RvRC6j4/vbCoxWtUMGuPbS
- TLSH
  T1FC25AE52E36221C8E26FC079D6538256EF643C5903646BE745C2EAA43A13FD46F3F326
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15
- Target
  CapCut/App/CapCut/4.3.0.1694/ttvideoeditor.dll
- Size 22.4MB
- SHA256 ba26c7e0c1178a36b9e0c396db733535df413e15b78a9c947d356b950de3117e
- MD5 50c9d5ff6585afdabf1a932083d090b7
- SHA1 3ee1a09643d68b3afc1da8b61174359d5dc18d3a
- SHA512 da60426068c6df61c8cd035819dcb7537ad4e5e90fd266daf9fa9d1c9a4ce8728a998715f460443a312dfd611017c78e92f7aa345822c14a26c3ce99be8c4b0d
- SSDEEP 196608:gVvlKRqMRStxc1qZQ3h3RJ8KRFnJRHZEa8IAg6FdrjEpClcPV4aprbFnj:0KRUc1Z3RBPJP8Na
- TLSH
  T198377D5661A400D4D1AAC0BCCF1B8D03EBB1385A1371DBEB15D0CAE65E6BBE07A7E711
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral16
- Target
  CapCut/App/CapCut/4.3.0.1694/ttwinrt.dll
- Size 84KB
- SHA256 c5f3e5030daf8a3e1085351bbd6ecb3c12bde5ddff79a41f104cce7169a932bc
- MD5 22563d2e810de321579972054c894c6f
- SHA1 322b7a01c6457d2db33673044b5b70d3f96b868e
- SHA512 8ca642bd404c666d31c4314e977ac098e933d96a234f1db59a55883b808d91c823405229130bef9149b271ef9482780a90e32402629e8d8168f933d240e0d53e
- SSDEEP 1536:ssqYayNZdJBZkgqYtdxkPynXmgfFNrRADxA92wApvZ3/7MfxVy:ssuMZdJBKJKvBXmmFNO/Z3/p
- TLSH
  T16C834AB6BA6C04B5E4B6D1BE88C78618FAB37815136683CF1311431E4F37BE49E79A50
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17
- Target
  CapCut/App/CapCut/4.3.0.1694/ucrtbase.dll
- Size 998KB
- SHA256 6a64a7e230df6a92d71a66ff129584e2b05745816afef8e76fbea3ee7ffe530b
- MD5 f8a783b64c7d9d89fbe1bedd18d6fb0c
- SHA1 0579faf707db78081b69102c2f85b7013433c4e8
- SHA512 2faba2bdff0fc325db9cc3de4e00f549f405d4c3a9ed28d52522dfdf74c20ececf2ec0e6ff18a180cd2561a72b1bb1feab41cb2115cb8ee202b5c425e69169f8
- SSDEEP 24576:bLyubutYBWSlhrANUDk8ExrmxvSZX0ypFiR+8:nyubJvlhrVETiR+8
- TLSH
  T16F25AE64FA5C0AA6C57BE07CC95B550FD972340247708ACF02EA4BB96E3BBD9163B311
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral18
- Target
  CapCut/App/CapCut/4.3.0.1694/uploader.dll
- Size 2.7MB
- SHA256 07b48711d6a15ecb0a7d94310a6f737a02359f0da101b4b33bd1c227a6c01e50
- MD5 a8046b79acf987ec6e95b86ed696543a
- SHA1 8b43f8021779781d111451d7e061738c1d20a0f2
- SHA512 f891ce3efdd08fb2c98f66d037f8239bedda7535f09de56c4cfb1db3613ea3be43896cc0c4795561af1a58963aba700556e0ce1f7d73f1ea19576282a02c9c3d
- SSDEEP 49152:EGtlqFNVwASOpUIU6iacp0JDpPZyTeYK+ubJGufQl7AovstBiV5gbdPwQvcFe:27+aVjwzxv+byQvoe
- TLSH
  T152D5AE2762A600F9DCBBC138C557C937E7B1B41A03B09BCB12A0C5691F93BE5563DB68
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19
- Target
  CapCut/App/CapCut/4.3.0.1694/vcomp140.dll
- Size 180KB
- SHA256 0bd3976b382a9dad2fc43f82027426d37dd665a7f720ac9de46893f1bf4d7bbf
- MD5 efe46851b8097626d9bf3db8b893bec8
- SHA1 aa57189a575cc4999eab3cde7c9a0fcf5f24040c
- SHA512 d54aa98b53fe760740b645adb92523556e88bcbe46c6d8bea2f9b76dd6ce81d2937714dbef63c9511c9542110214532664bdf43846c857d306845ccad66ff303
- SSDEEP 3072:3Pr3XpMvAiR3LQpxELm3uFX1TfgZhPqCDwR9ZUza/I/6T:3znSvAiO+m3uFFOIZO2/IM
- TLSH
  T150047D4673A9007BF9778634C963091AE773B85207609BDF035443BA9F2B7C1AD3AB25
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral20
- Target
  CapCut/App/CapCut/4.3.0.1694/vcruntime140.dll
- Size 99KB
- SHA256 2031bc8c9e8d40dd6f9fe0418fce555709806fe59cb69a55d2713ccf5f086382
- MD5 6eb4e749886bf08e52100b06f2118221
- SHA1 4d824379c20e7354c7627052123a6a437c3bac55
- SHA512 80daa56d1e2774e92efedf3d4970b3571d4ea726c464073c66e7d6f92c4b4d68c1dc95e55505e5780e21aa48e08fdcf259edc0203d5cdbeba5e3bdd3b538c2d9
- SSDEEP 1536:y1HL+4KsAzAfadZw+1Hcx8uIYNU5UEH6Q4ecbjtwi/7Myxk:y1r/Z+jPYNVEH6Q4ecbjtwi/2
- TLSH
  T14CA36C5A76A442B7D06FC278C1E20A1AE771B8048B7093CF03B586668F67BE15E3D356
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21
- Target
  CapCut/App/CapCut/4.3.0.1694/vcruntime140_1.dll
- Size 40KB
- SHA256 e39a2a023ff082e8af4ddd84a8f12edf08384eb3a56e33a870349207d62e13cf
- MD5 ec776de9a2586bb635fce7452c77446c
- SHA1 b87f1e4fd41ffff235a4d5455804dfa9208b9aea
- SHA512 3f49ca4ed9d50d2afb2d43e9ab06f369c33888ad79daa31fa6d30d0019301d1ef4aa209d554b3954eff86b2a7f0732c822d3c0472b05e3a3a1ee658a909a5622
- SSDEEP 768:PCm5KhUcwrHY/ntTxT6ovd7/li/YiMw+3AMxkEy:amHc16oh/Y/7MdxW
- TLSH
  T102135A5153684855E52BCAB8E8D31F3AEB39F8219790C2CF0768C1591F627C0F67E36A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral22
- Target
  CapCut/App/DefaultData/User Data/Config/Language
- Size 23B
- SHA256 d3e62d8492064f9886d551b7163387fded942d406c15ea1672a2a56093ea8d97
- MD5 7338368b1c16b22e9cdca9df2f6874a9
- SHA1 66b738a61575df2a7b2912411769ddd44a651dbf
- SHA512 e572f772c1ec1bf14b7feb73dd3a1eb79482e1325c60172db1c62ae7f16571ee1990177306c7aa2c1e2792ea6bad9938b4666bdfb1a2fae393f4a9d18425ed43
- MD5 SHA1 SHA512
Score

3^/10

execution
behavioral23
- Target
  CapCut/App/DefaultData/User Data/Config/globalSetting
- Size 335B
- SHA256 41484f5fc0e354d81798ff02148724c176bb06968ade60791957a2bc165f9fe8
- MD5 fec2e6c2518a17a05963825b266cada7
- SHA1 3ef092690284769dd6201725785b84ae5125dc2d
- SHA512 d9f5f37a15895101f0d767fe595a6ea1ea7a359e4cc5974d7ffa77738629fb3cb97896d73ed0986beff29b5eededc27f6cfa738304ac6570c175c7222fe8032a
- TLSH
  T1F8E04FEB8F5740347A6226EDA32287AC557BA2CF13DC422F0EA5080B11C98466A55D77
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral24
- Target
  CapCut/App/DefaultData/User Data/Config/updateInfo
- Size 60B
- SHA256 d0236f5b0f04bba7cfc1c29a8281aa6873e9198ca9f0ed5eee0e4cf862fb5423
- MD5 9e108d6f68bf9981ff13785d11a17a15
- SHA1 9ffb12d2f45f1cc75b9cf2137611f8aed90ac2bf
- SHA512 a400cfc80c3554ac3c1c3fbeef223a0b1c8f00e303227ba2e30b5fb31d75a560801a763bb92f15bc1afcdd39aaecb9bece6999a3c306c389749dd0873168474a
- TLSH
  T152A0029F6D46443D501112400C43F50781213097329F4590F25133877615740865B414
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral25
- Target
  CapCut/App/DefaultData/settings/CapCut.reg
- Size 1KB
- SHA256 1114dfc6600800c432ce321a74ecdc5503b14cf27b7938e47d5fe87880ecfe2d
- MD5 e98e0f80dc6f6f50d4d35f235b0047d8
- SHA1 ae6d994f75b68195d1284f159e1f55a3364f9151
- SHA512 750143e2c95d471715a9f40ac4b3847df8a8f3c6e693a4015e9516ccabcee7278ec2e21ec18cf4b22035bb5e359927a3fa651368cc1c23ea1b642ced6b5bbf2c
- TLSH
  T1B1114F9266E1904DBFB72AD16EF9D4B8DB3AF8F65508D8AE0095050F54F3E0188103FB
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral26
- Target
  CapCut/NITOKIN BOT EN IN TELEGRAM.url
- Size 129B
- SHA256 0d983d5b8b242d7cdb776971057a41c79bc4c3bbc1fcfad330097f7385463cc3
- MD5 81a3d409cf2e6431d9e8a0c3c143d607
- SHA1 02e10d2ae3b25bebf8c02340f8ab87d005b8796c
- SHA512 509e37c73b0416a0ec4278304a56a904cbd459728f7016d73258dddcb5f5fc7e634ff0a272132877c4a886cbaeff9e9c3e17ff8dbb3e03d5c815a6dfd02de545
- TLSH
  T1AFB02B5F4102824AC211D4051070F818844E34E108E5C44C7108CE8A0CC40D0C004A35
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral27
- Target
  CapCut/NITOKIN BOT RU IN TELEGRAM.url
- Size 127B
- SHA256 e138ab2d0c2559de7f0822e92b5f009a58aca0a680334777940714d6a39617c5
- MD5 77272d6b756f226fb0fef1a2fa3aedab
- SHA1 568cb51c7b972ef2aa63fe1a435a817635a73922
- SHA512 6cad35c5fd28ab27a79ccbc7fd6d89abd13a3c9a80a945dd9355b46b963d42a9fbffba1462b46dc477f4dfbb75be398ef96f4db607a3448edd56be1d5c680370
- TLSH
  T186B09B5F5106865ED25194555070F858844E75E558E2D45C614CDE8A0CD50D1C454A75
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral28
- Target
  CapCut/NITOKIN GAMES IN TELEGRAM.url
- Size 120B
- SHA256 ab4e7c9d1c3e6193b20b41e02b8e4533d6644459b04eff691f0d2621ce4496d5
- MD5 0be698ee58e9b53ee0ee67066f93fe6b
- SHA1 4e151916f71e7612049b6401105c69b78d3b51da
- SHA512 aca6070117eac6f8eea000b42afda70906a452eaa35f29b446b48478bde01a284b6018407c42b40e54a70c4458816a86460eb237464b915cc914f148199ad7cd
- TLSH
  T136B092AF5605838AD152980A40A0FC58885E79B05CE2E09D6248EFCA0C18091C989A36
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral29
- Target
  CapCut/desktop.ini
- Size 61B
- SHA256 8498e18455dc0cdb2be8fba34dbddf6021a2d17e590219e3644592cd3806a3eb
- MD5 1a83ddd9e4cbed3aec0cab25357c93f5
- SHA1 2c7ef4863499ebf64cf30de7f7658016f23cb840
- SHA512 51d155c09832f60f5edd5eea2d90a973695a8ab3200cdec57dcef3cde197d19e7aa8d91607bebe311636d13292c94cecd16d0295cf71539a8eff5af9b3de8e7e
- TLSH
  T14CA0024A566E42A0962EC04A28619450D1D04856DD6DED04CD65D9913AF1318294871D
- MD5 SHA1 SHA512 TLSH
Score

1^/10

ransomware
behavioral30
- Target
  CapCut/Внимание !!!.txt
- Size 67B
- SHA256 dc94380159e5618d2336626064c940aaa595ccfb2a7ee80747cbc7f9d297feda
- MD5 d32d2b7f68f5d8e394d2c413b39fef4b
- SHA1 7ca1897eacc3ad90349a3b87a97e4e75c62a8500
- SHA512 0945b4442f4077287b2d38ebb253b3f99dbe1a77d8659409c65143cbfdf0759ab43879a81839b6e34f3f65f2bd43814f875272a2d7d44bf68f04b1fd610e7205
- TLSH
  T162A02202030B38880383F820C80030AE0C0E00F8AA28CFCA8820020F0A8C2008FACB20
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral31
- Target
  CapCut/О обновлении.txt
- Size 300B
- SHA256 4fa542bce87b20b9cebccf7af35b0e8c632d15eca24e3279b4d6160784bf7be2
- MD5 e79f0e3b4d997283e84cac6d42162f95
- SHA1 30db3813c080691e7655456acee81918c36ce59e
- SHA512 d99e0c092fbb22163e4183213aa851553a52f9fd77617b1aa49aaea223b4535d3e73177b34abe0ed9b18ccf15731194e251a80e4c6668878a53c43ae0e98962e
- TLSH
  T15BE01251D78E3C680B106667EA046E4D399651FF766A836E08D09FBC31F6C66423BE44
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Drops desktop.ini file(s)

Looks up external IP address via web service

Drops file in System32 directory

Suspicious use of NtCreateThreadExHideFromDebugger

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32