d1fd4b2951d2f41c7ead3b8c72e6e4e632c89542c0e6d5b3d1f365be4d3b33fb

Sharing

Copy URL Twitter E-mail

General

Target
bdcamsetup.exe
Size 9.2MB
Sample260728-j4v9aasxes
SHA256 d1fd4b2951d2f41c7ead3b8c72e6e4e632c89542c0e6d5b3d1f365be4d3b33fb
MD5 e52a5276e5fd8a42297713673baf65f2
SHA1 fd017acfc4d0d586fb5cab4167f7109596cff943
SHA512 96b8cb80bb4b3e85bee6748b7f4ddf686f04b860d62aed2b69f57f30776af52e1dc37fd803abb11ed02370c9655fe3d8dd767e801a298f75eb3f8d1ae3955906
SSDEEP 196608:vUgkGCntdCNSQnd/ZxSsXBtDRs75Q1TFy1UX/snjGhibQxP0NxJLw:vfkGaun/dRs7e1ThPeuiU10NU
TLSH
T181A63309E3F9046AFDB5C33062B2CAC6DE74BF1C9538115EA7C0251E6892E44FF2569B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  bdcamsetup.exe
- Size 9.2MB
- SHA256 d1fd4b2951d2f41c7ead3b8c72e6e4e632c89542c0e6d5b3d1f365be4d3b33fb
- MD5 e52a5276e5fd8a42297713673baf65f2
- SHA1 fd017acfc4d0d586fb5cab4167f7109596cff943
- SHA512 96b8cb80bb4b3e85bee6748b7f4ddf686f04b860d62aed2b69f57f30776af52e1dc37fd803abb11ed02370c9655fe3d8dd767e801a298f75eb3f8d1ae3955906
- SSDEEP 196608:vUgkGCntdCNSQnd/ZxSsXBtDRs75Q1TFy1UX/snjGhibQxP0NxJLw:vfkGaun/dRs7e1ThPeuiU10NU
- TLSH
  T181A63309E3F9046AFDB5C33062B2CAC6DE74BF1C9538115EA7C0251E6892E44FF2569B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery persistence privilege_escalation spyware trojan
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1
- Target
  $PLUGINSDIR/InstallOptions.dll
- Size 15KB
- SHA256 fa8de036b1d9bb06be383a82041966c73473fc8382d041fb5c1758f991afeae7
- MD5 67d8f4d5acdb722e9cb7a99570b3ded1
- SHA1 f4a729ba77332325ea4dbdeea98b579f501fd26f
- SHA512 03999cc26a76b0de6f7e4e8a45137ee4d9c250366ac5a458110f00f7962158311eea5f22d3ee4f32f85aa6969eb143bdb8f03ca989568764ed2bc488c89b4b7f
- SSDEEP 192:CsIZHdT9uwYX94kYd2iCzHR+yK7imphLAykycpKPd5m78ozxGUWumle:CsUHd9GN2d2iwl0impATIPdA78Ov6
- TLSH
  T15862192077C650B3EF6226722AFF77179BA5B11414D29C0B4E732D472D39641EF392A2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral2
- Target
  $PLUGINSDIR/System.dll
- Size 11KB
- SHA256 03cd57ab00236c753e7ddeee8ee1c10839ace7c426769982365531042e1f6f8b
- MD5 959ea64598b9a3e494c00e8fa793be7e
- SHA1 40f284a3b92c2f04b1038def79579d4b3d066ee0
- SHA512 5e765e090f712beffce40c5264674f430b08719940d66e3a4d4a516fd4ade859f7853f614d9d6bbb602780de54e11110d66dbb0f9ca20ef6096ede531f9f6d64
- SSDEEP 192:sRer7uivwq1XpKs4FVWSjMd8tIg2cREbyCsZ8q2R4Sy+Xe:s67Xws4FVWig86/5eCBqSy+Xe
- TLSH
  T1B3322A2657B0D2F2E6A1827408A639336BBA762412B50D1BDFF74481FC15BC67E39327
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3
- Target
  $SYSDIR/vcomp90.dll
- Size 49KB
- SHA256 9140efe26252b6329da254201219fc2d17a3f651e1591e32ae04c86a27e35bb2
- MD5 cbf730a59a71b906517ba7c97528342a
- SHA1 52d6c2955075e244385c483c3f3a0656f5eb0364
- SHA512 17b58dd8b120bc2d6bf3b8eb1e3773ee9986b1f82a54f0ded0e23e3a8d6d02eddeea6275df684c0914fb36240519bf91801e7e631e799c86fbbb6c76786215f0
- SSDEEP 768:WPSfLA354st0Ha5FvLgUz/g0f47TsvyVkpJL2jmPG3Ly/zYgb6FjXHUElc:WqjAca5F1vOqLSdu/36FrHUE
- TLSH
  T11B335B5075868275FCE632F486BEBCB646FCEACD033081E7138845E98D607E2997529E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral4
- Target
  $TEMP/BDMPEG1SETUP.EXE
- Size 1.4MB
- SHA256 d6127b8e6a4dd1a028291378260e3c5a85b79bb45351cf8ab279d00317b3a963
- MD5 916bfd2422bca5b78d61a640f87c6295
- SHA1 a16f097cddcf9513ca81c124a40c0537291c30e1
- SHA512 e6e47704183730207b8770f3b8dd1f66acab285f74e4001d370fb73ec8c8ecda61af9df189714529b2a3c3425290bd200bf4e209061a3042a917b88bf1b0ad29
- SSDEEP 24576:smJWXdFFVnnafzcUw7ygmn0dlB/B6Y8rMO5sT7uVwjEOIdXK/rDjtrE35jUjBX4V:s5XtVnuw+gioZR8EIJs/rDj+qj272kP
- TLSH
  T18365331069B0E4B9FCF39A34CA21C75E6A37DB412D6D438F9BC02ACD68116A53D153BB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery persistence privilege_escalation
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops file in System32 directory
behavioral5
- Target
  $PLUGINSDIR/InstallOptions.dll
- Size 15KB
- SHA256 fa8de036b1d9bb06be383a82041966c73473fc8382d041fb5c1758f991afeae7
- MD5 67d8f4d5acdb722e9cb7a99570b3ded1
- SHA1 f4a729ba77332325ea4dbdeea98b579f501fd26f
- SHA512 03999cc26a76b0de6f7e4e8a45137ee4d9c250366ac5a458110f00f7962158311eea5f22d3ee4f32f85aa6969eb143bdb8f03ca989568764ed2bc488c89b4b7f
- SSDEEP 192:CsIZHdT9uwYX94kYd2iCzHR+yK7imphLAykycpKPd5m78ozxGUWumle:CsUHd9GN2d2iwl0impATIPdA78Ov6
- TLSH
  T15862192077C650B3EF6226722AFF77179BA5B11414D29C0B4E732D472D39641EF392A2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral6
- Target
  $PLUGINSDIR/System.dll
- Size 11KB
- SHA256 03cd57ab00236c753e7ddeee8ee1c10839ace7c426769982365531042e1f6f8b
- MD5 959ea64598b9a3e494c00e8fa793be7e
- SHA1 40f284a3b92c2f04b1038def79579d4b3d066ee0
- SHA512 5e765e090f712beffce40c5264674f430b08719940d66e3a4d4a516fd4ade859f7853f614d9d6bbb602780de54e11110d66dbb0f9ca20ef6096ede531f9f6d64
- SSDEEP 192:sRer7uivwq1XpKs4FVWSjMd8tIg2cREbyCsZ8q2R4Sy+Xe:s67Xws4FVWig86/5eCBqSy+Xe
- TLSH
  T1B3322A2657B0D2F2E6A1827408A639336BBA762412B50D1BDFF74481FC15BC67E39327
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7
- Target
  $PLUGINSDIR/UserInfo.dll
- Size 4KB
- SHA256 728472ba312ae8af7f30d758ab473e0772477a68fcd1d2d547dafe6d8800d531
- MD5 d16e06c5de8fb8213a0464568ed9852f
- SHA1 d063690dc0d2c824f714acb5c4bcede3aa193f03
- SHA512 60502bb65d91a1a895f38bd0f070738152af58ffa4ac80bac3954aa8aad9fda9666e773988cbd00ce4741d2454bf5f2e0474ce8ea18cfe863ec4c36d09d1e27a
- TLSH
  T10281577B23F44473D09A4BBB01E60CD752A2D9309316442F498B4D6E14C1AA7FD6EB17
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral8
- Target
  $SYSDIR/bdmjpeg.dll
- Size 22KB
- SHA256 6c331c0a88ae15dccb2f463391e1d40d4b48a921f330776108c4c9b97253a260
- MD5 2fbd5126c7eecbad70090a37693ea51d
- SHA1 6b6c5036c99bf7d30d25548c989e35dd6e4defed
- SHA512 7b57082852e6522f0443c7d8c0b614d76598cf9521613208332f02343168c2981a7d407202de55c1d42d2c9e230837a10b89feb5cb7e545cb421722ea1f62d02
- SSDEEP 384:Jc7pqz4KQ6moXX3WaHQ2HbOtjoPzDnYPLk10eMpV8D:Jc7pqrtdX7OtkXrD
- TLSH
  T173A28D473B135072D6861D70A2A7F6375EBDA3421BD234DB7BB142950E927E02F7A00E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral9
- Target
  $SYSDIR/bdmjpeg64.dll
- Size 25KB
- SHA256 c8ae89bbe268c6aa50036da8ceab7bf9645cc71cec7d0b4ebd85dbc5cab00138
- MD5 5adea79e8f723c361ec5139e9f57e2b6
- SHA1 31d585657a1200959d62f18df475459730380691
- SHA512 abeb498d0c774c6e1d4e8c299734ca2ae27a7c2a47221c0106e53d63232bf696f9abf29f807cb58dedb8df87cf88d0dcd184f3502f316efff8b91d566cd696a0
- SSDEEP 384:kJdZG0KOr/dtPG+6/EbeTnf3B7ywentajfyOlCDynYPLk10eMiNHW:kvj5eTfVug2OlCWF2
- TLSH
  T1D8B26D8F662500AAF991C678D792CA1AF97172062F5652CFB5F042CE1FDBBD12338319
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10
- Target
  $SYSDIR/bdmpega.acm
- Size 64KB
- SHA256 99d50c2864bdbb0f5fdacd03856ab4f0f4dc93b01fb1390aab3d70f315e07a21
- MD5 4d2daf31a931480527531392e86ed0ae
- SHA1 7fe7852b3da5c68986f843497adab1d95f8f68f0
- SHA512 786f8489e37844dce3da5ab6835fd77703fded72eb1acf0d018e3801f61e2e850fdb8b341606c7cbc919f8fa8ca0696f0b0b01a1a9f393931eb532df84e98f3f
- SSDEEP 768:59OnI49PYUY9gpi00laScPILN0M7AoA6Obh0vaTxDgzFMOjmzc8R8a3q0m:TOnI0PYUuguZ707dBDgGOatR8a3/m
- TLSH
  T1D5537C11B150C0B3C58A6A346456D7619E7FAA911BE990877FBA037D2F623E0673E30F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11
- Target
  $SYSDIR/bdmpega64.acm
- Size 69KB
- SHA256 415ef586c238566dac1433002299fe3b0cb7c67321aea923c08ff6d0a17615e2
- MD5 03bc1e31e802542632e029a402fb01bf
- SHA1 ecf31ca913bf9ab8a8ccb4314f462ef557a79879
- SHA512 80e99ab668fcda82d79e4d9a83e6548cbb06b44b60179b5f42b2aaeb1135bd8aea9cacaf7d70cc2843061def34a920290f62ba805b82158679b342f69431aaac
- SSDEEP 1536:r2WopVs/uBbcwOTlZTd7wOtOofxrcaAvvEL:aWopC+bly7fOofxrcaAvS
- TLSH
  T123636B4A726400B6D15682B4C9E39F46FAB2F45617B1938F533982AF2F673C2673E311
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral12
- Target
  $SYSDIR/bdmpegv.dll
- Size 64KB
- SHA256 24f67e8b96b4590e42d1f63da734bbc0c8ab40011db1f37c083ec68bd9e26020
- MD5 7a6ecdb70c6a9012506f800caf795dc3
- SHA1 09b8ee9015351e5441334adaf913d0d3723f2d4c
- SHA512 30587356f18e91e6ac78c80f54c12c50118c88273ff449944c99bb6f78744dd1d334b5074e2612232cf694192129210349024a48c11518562f53332474ec8e46
- SSDEEP 768:Wb4aURgp+ksjhdgwxdlAdRpIPevJ9kIgKuAz9aEuG6dA+9uFMCtgc8RLRCvk:WQmp+kyjgKeemXkIh9FixvSaRLks
- TLSH
  T1BE537C117651D0B3C14A6A30A055E7619E7FAB411BE6908B7FBA07AE6F213D0A73D30F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral13
- Target
  $SYSDIR/bdmpegv64.dll
- Size 68KB
- SHA256 e9c9ff574e4ab8044050c0c9e6564288aa614531d61dab3d1a693863f2c942ab
- MD5 509bfbb117e326bd4486b9d355a46c1f
- SHA1 6c90419c9e3922480f9f64ea847943ca5f63eb9e
- SHA512 6b01a42cc55dca857c214ba22b34c6fb541dd17267dd97097943eb28f6c3ea97da5e22e8169d2bf3d1dd43bcebcd40d8c9b8f0afcff83b7a91ef6d28319c52dd
- SSDEEP 1536:yZzTbeX7e5dzSLO4ZXOx54a2OrQtg/ALvq:yNbCK5dzcQxKa2OrQtg/Ivq
- TLSH
  T1CC637C8A726400BAD5578278C9E38F46EA72F44A17B1438F5379839E2F237D2673E315
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral14
- Target
  $TEMP/bdfilters.dll
- Size 4.1MB
- SHA256 c637b7998918570850a2a9289eebf181943c597416ed09dcf222858e797bf050
- MD5 bfe905119a31034044438bb2060a7d7f
- SHA1 7c8f74da28666e15e32812d7288bf458815c46cd
- SHA512 50e983d13d31a94492ba4df4833701d54dbae3e2141c0ba2bb7a1a831b1f53e31640f658f6110fcaa56f9cf55199f53fedc0fbb15823879f77d7b4f7d1841791
- SSDEEP 98304:cl4qYuQxqYfHYosUiJovT7DBmmhjSF5og3Vk9O0KCnvvvvi/:cuqYuQxqYfHYosUiJoviVkvvvve
- TLSH
  T1DC167DC3E6FF52E0D4551874203FB92BA6346B0A810CE6A2F1D56F1AFC377825AA7345
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral15
- Target
  bdfilters.dll
- Size 4.1MB
- SHA256 c637b7998918570850a2a9289eebf181943c597416ed09dcf222858e797bf050
- MD5 bfe905119a31034044438bb2060a7d7f
- SHA1 7c8f74da28666e15e32812d7288bf458815c46cd
- SHA512 50e983d13d31a94492ba4df4833701d54dbae3e2141c0ba2bb7a1a831b1f53e31640f658f6110fcaa56f9cf55199f53fedc0fbb15823879f77d7b4f7d1841791
- SSDEEP 98304:cl4qYuQxqYfHYosUiJovT7DBmmhjSF5og3Vk9O0KCnvvvvi/:cuqYuQxqYfHYosUiJoviVkvvvve
- TLSH
  T1DC167DC3E6FF52E0D4551874203FB92BA6346B0A810CE6A2F1D56F1AFC377825AA7345
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral16
- Target
  bdfilters64.dll
- Size 4.6MB
- SHA256 61aa3f47c5fd773a7cfb9f850bc72d8d5677e2eeab6eb587586c6edd5efab1ae
- MD5 35ff166b5e0add4e6563efc43fc403e0
- SHA1 621cac74cd5d8001c62301002f735d6ee8e7d665
- SHA512 21a684eefbd5097d6d90bdac7d8baef05afd21d82eee788edcd089fab8fd3e22e202063c9328df65a70717f047f406001ecaf3efcbe76d815d6a1784489219a4
- SSDEEP 49152:RwQ/D3PQxTTvfwBvvfrsdBD3PQxTTvfwBvvfrsdBD3PQxTTvfwBvvfrsdVDYPdxx:WQTjWDdLhiapD88SiQZbvvvvJ
- TLSH
  T1F4267D47E1EF81DDC0178C3086FDF223F921385A4108969667D1FA647A6EB809F3B75A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

persistence privilege_escalation
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral17
- Target
  bdcam.dll
- Size 305KB
- SHA256 76f4a453d36228e04c9643fab4514d93187b5a9901a29cbf20ac1a5ca634096d
- MD5 2e2eba4956f76b47fccf68d661d2e931
- SHA1 40ea0483d1cf065457e3477e4be56d78fbbdad2a
- SHA512 ef35db570d006dc36791bcc303880041a002f2db1668de8ce28492e2266979238692065a91c2a544e30ec7c7a276bff4f5a0593f05cbb4390a3cbb2e8c0a587e
- SSDEEP 6144:hU9Z86hb7kBJbAkoSiseN9k47p8yKcUtJxETlb8h:hU9Z86hbAB5AkoSiseN917h2xETlb8h
- TLSH
  T1A764C0407BD2C077C64B613484778B1EFA78D6628759CDC3BBA85A696E207C1BD3C34A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral18
- Target
  bdcam.exe
- Size 1.4MB
- SHA256 38eafcd61aaabee7a2fc45fd0df0605289f3658f2af44c17a47676a1dc25f9cd
- MD5 f452da6785cb7e93da4d753c05e3d3d1
- SHA1 79dd251546bf0ed9f5826dcacea520d63e1c468a
- SHA512 7d1e4189761784973f00bc887acdf11ee9aff308188215e46f12c87edd83e2ca165f3fa40aec4f27aee3e3d6f3242830db24464152d2275b2e6e19170954bf76
- SSDEEP 24576:0dyrErsMtqy2X7yWxMmac7synToQlvbJAG1eAcxYSPxx1peuEg:0mErsMtqy67/Pac7NTLdAWrnSH1px
- TLSH
  T11A6523629A2898B6C018037D663EFBBCE66DDC15426C9217F2D07CCFBD27653694D20B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

discovery
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral19
- Target
  bdcam64.bin
- Size 407KB
- SHA256 07e8fb57dd73bfde6d222be6a64c2dbc3e465239029aba75e3d2aba363b6c9ab
- MD5 7594e362b9853e91f99a0f7db8d03f86
- SHA1 48c78a9d0bc29289b92ded5c5e190f467336938e
- SHA512 aef0b4df8e00a876f54ebb90e03129dfe75467f95c5a89c8c75cbf3eedc5f5483a294f0d0e57be6c10c3732757e87ad2ceb0cc00e868ff004a8b369ab80406a5
- SSDEEP 12288:3xDl5TCf9XjH+PALLQ7NIk49pGHNu4R2UT:3xDlARGAtuI47T
- TLSH
  T1B0941267894806D2C12848379C97CA711B34BAA79845C74BF4E4382FFD87BACE74A75C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral20
- Target
  bdcam64.dll
- Size 424KB
- SHA256 32b592af3ecf5b03357495dc67cd9968b6fb3dcd4e954622fd043998d2c11d45
- MD5 548313e38bb853845129f164d1cc67ae
- SHA1 1166490ed8fc8f1c4f364a92799c6aff563c3d01
- SHA512 bde33146fa32051801437f562578a3e5a992ee50d0e62f2fd45dcdcce150e6bff6ec6efb5ae37d27fd9adc67bb463de4740e5655bd8c6931e7a4b7bdd2ce58fe
- SSDEEP 6144:AZU7/4v4O8gfbgzYUaUcjWbWqXMK1IM8m7WkHuTuGEN+pLo4Yuu2CR5XQDV25W6Z:A67qzgzKTWSqlS5TuDNAo4YuOXw4
- TLSH
  T11894BF067BB00CA5D857C47E86839746E6B278420B64D7CB136087AF6F337E1AD3A725
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21
- Target
  bdcamih.dll
- Size 52KB
- SHA256 ed7d5c554792f977e5860e0020462177c0a2399ca50524bc6c454c0533abdc48
- MD5 f21d67310f2a5f5c1fcd7e1121412ef3
- SHA1 f9f7777cd4bb5276476aa6addb6fc3b73dfe4660
- SHA512 8d821a78b08ec38b2325ecdae01b90a2bf63032e90fe73ba38dfe97a9a07bbc8ff111fcd2d2a51e57081bf11e012b4be7460c0288b1466ffd96aebdf62824e17
- SSDEEP 768:jW5iWnxhudTWfqhV3xosqu4SPMbRz72ORVNMgz:i55eos1KddRVBz
- TLSH
  T126337D017950C473C94A557C5056CB629DBEBA512BE4908B3FFE07AEAF227D0673A30B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral22
- Target
  bdcap32.dll
- Size 10.3MB
- SHA256 d2ad6f77c0ec12f26218177837ff3bd811310677c15a00befc69146f55eae257
- MD5 d2b9e92d794972cf8051e1a394edbcdd
- SHA1 09b18945693d99f257c4a824487b8d8d87bd32df
- SHA512 e0bd119861ebb3551487728d65a4ec01ae78fdd600b49b3c2b130e24c994428b5653c58aa819dd8c46a5d3edfb365902907b065b0dd4eb72d7dc69c3ceac6685
- SSDEEP 196608:L979Ops3t6zGtfBz+lwsNwM1pRkjkzPhA6Xvvvvqi:pJt6zGtpz+lwsNwM1pRqm
- TLSH
  T171B68DC1F2D781A0C4460DB0543FB56FAA342F19821CD6F6FBD0BE1AE877751AAB1681
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral23
- Target
  bdcap64.dll
- Size 12.6MB
- SHA256 fea38bf24d34003583e5dc4980573c93caeed0042ca34ca7a5a5d896b9aeb0aa
- MD5 89bb13bedf72891d0ed00f3f6155f3d6
- SHA1 2ee4ac8cfdb9e7362b496ac87651538fcb400559
- SHA512 a9d3bd41f1c4e14639f3589ff6073729aacce0b2aab844322e2f034f80acd9aeb05b465ca70bbc99bfee4efc2424539bede24eb453da8f221c6c66e6fd12cee7
- SSDEEP 98304:lKAF181uXfm7pyNYh39Hxv1KF8RT6kKQOy5BmkW88lhkavvvvvbcg:lKAFOJKFYKQOy5Mkx8vkavvvvvbcg
- TLSH
  T1DAD68E83F0E641DCD01B8C70867EF223F9213C1D521856A797D0FA647D6BB80AB75B6A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral24
- Target
  bdfix.exe
- Size 443KB
- SHA256 a880f78adfbf2b63cfccaed158ba66c13fd8092d89dfefb7b0cb62243ec6e46a
- MD5 35777f658b73ec59db0712a07365a93d
- SHA1 fdbd7ad7e85b25eded8d046034ed253b04659154
- SHA512 6f39d7681fac363b8247195197c71abd6ea6d02d2bd9ff06189dc8634d82c57e9644728d021154a027f899ed5a8b8dad53868d3d5885a2004f130d46b469b11f
- SSDEEP 6144:elIrsdOLIzAyTr4AcrOq1PTDfy7B94yOLGKY72XZrrDUVr95S4mOrOP86UhXu:QI2Tr4PT7yN94yOFY72prroMOr/9u
- TLSH
  T1EEA46B1177D0D03AC26236314A66D3756ABDAD219F25438B77903F7FBE303919A3872A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

adware discovery spyware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral25

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Event Triggered Execution: Component Object Model Hijacking

Executes dropped EXE

Loads dropped DLL

Checks installed software on the system

Drops file in System32 directory

Suspicious use of NtSetInformationThreadHideFromDebugger

Event Triggered Execution: Component Object Model Hijacking

Loads dropped DLL

Checks installed software on the system

Drops file in System32 directory

Event Triggered Execution: Component Object Model Hijacking

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of NtSetInformationThreadHideFromDebugger

Checks computer location settings

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25