0bc4ce9d34b8ee1a67fc3a24c7b4b90ddcb59912ba59ee6f24ae9532dc0e8ba9

Sharing

Copy URL Twitter E-mail

General

Target
Soundpad_.rar
Size 7.4MB
Sample260728-mcaeaathrh
SHA256 0bc4ce9d34b8ee1a67fc3a24c7b4b90ddcb59912ba59ee6f24ae9532dc0e8ba9
MD5 08fee2ec50dde18417f1b91a904f107a
SHA1 d4c4e7d2382d0c1b4d5166745a163eae01f5c453
SHA512 fae7457d7a449690cc7f5cb155ddca02c88dfad7b7f4471c3835c7d76495ab34fa534f8c3dfd6530f6e865aac7226eb036e8690a5d0c19cb1b3c21334e5b8e72
SSDEEP 196608:pgR95NJznFht1VpDjUTJ4g9FzsqcxvbCtxQZxJyufHd8M6o3Cy/mo:pgR9vJrFhXjDjUTLFzTcxjCtmZyufHqy
TLSH
T12E7633FE4EFFD9E5C67209775CA93C8D656993C06E5F4F0C930819A0382270B686E9E4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  Soundpad_.rar
- Size 7.4MB
- SHA256 0bc4ce9d34b8ee1a67fc3a24c7b4b90ddcb59912ba59ee6f24ae9532dc0e8ba9
- MD5 08fee2ec50dde18417f1b91a904f107a
- SHA1 d4c4e7d2382d0c1b4d5166745a163eae01f5c453
- SHA512 fae7457d7a449690cc7f5cb155ddca02c88dfad7b7f4471c3835c7d76495ab34fa534f8c3dfd6530f6e865aac7226eb036e8690a5d0c19cb1b3c21334e5b8e72
- SSDEEP 196608:pgR95NJznFht1VpDjUTJ4g9FzsqcxvbCtxQZxJyufHd8M6o3Cy/mo:pgR9vJrFhXjDjUTLFzTcxjCtmZyufHqy
- TLSH
  T12E7633FE4EFFD9E5C67209775CA93C8D656993C06E5F4F0C930819A0382270B686E9E4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

persistence privilege_escalation upx
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2
- Target
  Soundpad_/Profile/CRACKED BY Ray_Black/SteamUserID.cfg
- Size 61B
- SHA256 02c7413b980f8e9830ba00aadc16d82ba15961080c1d65fef7e0435a0056fe14
- MD5 b1322b44de77778e3f12048c4a58ba64
- SHA1 f4143b4700b2dafbebeb848b575bd0d743a098a1
- SHA512 0c8070bb23cb9c0705772fef4a53f1c326aa7e6aa38e6078242874ec1767590c978d90928f60426a20ba15c947fa7959b5d799233c843bcd5a85dddb3745256a
- TLSH
  T1F7A002208445F3385715A17405C0E58FD6D468C380455E0F07748D401E52D3130C5C43
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral3 behavioral4
- Target
  Soundpad_/Profile/CRACKED_BY_RICEPOT/SteamUserID.cfg
- Size 61B
- SHA256 2c2f3f8d579f9d0703fe251d162456572c9d4c07408493a512b0f069bb892a98
- MD5 153727cf7c0c2dcba555e2cafb579e98
- SHA1 4ff945c2feff28ac936994aeed626caf17a37f45
- SHA512 412af8e396b5eb13f33bb7d3c23591daf09e28abf131547299ba5c30c6935ca6620771b44fbea12050d1264cb91591f00a1bdedb4a51a9182ff81123f9ea8974
- TLSH
  T13BA002648800E33A5305A13014C074CF9DE468C381445D0F1A788E611E41D2175D4C03
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral5 behavioral6
- Target
  Soundpad_/Soundpad.exe
- Size 11.7MB
- SHA256 52dc2fd4102cfcb49e04400db09a246c70b202d889550b912cf8001ae1b3e55a
- MD5 186dd6db5675edc1a5c70dfd1f48e205
- SHA1 c76f15edfb347c94f7e01d011ad27ecf5e204550
- SHA512 062198a0e2f86f82ebb9afa5dfd728423f898f9ac32ebf0cb2282a6d145c0941eef85a6ca8a800f581dcfef44dcf2ffc5788486936926528a2611d00aace117b
- SSDEEP 196608:rpJkp7F4hGz2YDJl9CxGgSt/pj8Ezyonu567mm:rpJo7+42YtDCxGgej8S1mm
- TLSH
  T1BFC67D5A72A915DCE473D07C9F4B8403E2B238890B3257F70151496B6F7ABF48EBA712
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

persistence privilege_escalation upx
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Loads dropped DLL
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral7 behavioral8
- Target
  Soundpad_/SoundpadService.exe
- Size 299KB
- SHA256 1b15187efca20081dd8a746a7dff73e7c9c970989639f6fd4083fc53afa9e204
- MD5 b684849f377d67a5334524a01b4d6f9b
- SHA1 1bc72eb5dc8b323a6835e491f3166576a670481f
- SHA512 34bdbce5089a62322af81a51b4c752fc23e398eb6f3f83a062d7fa2cb1352de33e7df192ee4fda3e0a67c86f111e8ee1064b4560aae15b3c8c059c6122dc0b73
- SSDEEP 3072:JrFlpWbX08QkKwwMC1UHH4rh9mf2myjmgzZYk52iARgNoY46kOYlIDltzWSlyUBX:tpWJlKNbUHYrifpy9qGohxlIiSkqlB
- TLSH
  T1A3547C19B3A410F9ED77813D89529507FB7278560770D6EF03A0866A3F27AD09E3EB21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  Soundpad_/SteamConfig.ini
- Size 135B
- SHA256 c2702d244e84cb0abc4f964062b9ecf51b1697712ad4c03b37d345f93d045bba
- MD5 8aaae6e65f734e7f90b2d11966c76a16
- SHA1 f910a899891026e6d22305d176a73d2588b99715
- SHA512 96f0c7cd0b8e2ce8365f907a03c8229ed733fdcd07a826d82aa242c870f5994d04b1987263ba2a8e0a314ab281d5cf9905cc562177e09b499a99fe3e8d3cfb5e
- TLSH
  T1C4C02B487466830C000BE0289C1208B838DFB520972D4008F230D72C1D06F7D8705822
- MD5 SHA1 SHA512 TLSH
Score

1^/10

ransomware
behavioral11 behavioral12
- Target
  Soundpad_/UniteFxControl.dll
- Size 1.1MB
- SHA256 afe6075ea7dd1bdcbc47b38385216d11cdd5ebc3f82eeedfa6d766e9249d6252
- MD5 6ac19cffc0c58ce35ae704c381c4f702
- SHA1 c43900c5d56d62311a337b04c9489afc1c75c175
- SHA512 61197228b9a1bb9810c68cc04928fd47e2bbe78d36f71c4a2ee498742fea8fd6c950cf43578fa20c6009f1ed6343bf8ca7bfb155512018aac88a4191fad4f939
- SSDEEP 24576:XBLW5gqPvbSfiCRcXw0qU6RmWByuAy5a/owH/1:ZqPvbv/Zwm4yi5aQwHN
- TLSH
  T112356C56A6A801BCD4AAD138859BA647E7B1740E17309FCB03A056FE2F23FD14D7E721
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  Soundpad_/UniteFxUpdate.dll
- Size 255KB
- SHA256 28e8cc63d50cd791de27dd00428351819eecffc5568ac06095ce471c9d3cf6e2
- MD5 43a3a04ef8c961e938640021fac6b5c5
- SHA1 b87b749b49c681a316086f25502af2ec6cf4df15
- SHA512 f846c7e254a5db585005a38b21a423115da23c4541aefe71377632de6aaa2a348d8b6b5f9ec69ec96e0998adfcd4edac330d16c041e66e4cda78902df817e9a2
- SSDEEP 3072:WPIAS8g6l1klvQj4ENDl59EvisOMGXoAWSEHnZTIj3doY46ER5tnHpwC0A0xBk9:CISUv4NDl59sisTG9a+ohLtnJwmsC9
- TLSH
  T1FD447D5677A50CB9E873817DC9634A06F7B27C1217B0C6BF0760826A5F277D0A93BB21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  Soundpad_/installscript.vdf
- Size 631B
- SHA256 270d2a3eef463b768ca4368e62444a7ccaff4e98c71f2ca05b721bfef2e03e05
- MD5 1a792aff29d6f07d1c3381634ba6baff
- SHA1 f2c7bb49ccaf63ffcd38d06dd2d51095b08d4344
- SHA512 3971dee038f1cd1aacf9151196a53e2bfbf4bc9a665f60ae79309b5544d81a733e3f7b9db422e17c5a95ba2930248be408e6fbf877f8eb12235277f46af5a4f1
- TLSH
  T1F8F0DD4FC80CE2AC05E8993F9537A8890E850765B5F000EA5DDA0B8A1F6A428042D526
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  Soundpad_/languages/cs/translation.mo
- Size 48KB
- SHA256 ca876dcfb11522ee63977c07e176cd3fdddc8bde374fde53a6a7367680638214
- MD5 5e8a5fee87f5795b0c3c8d02a6a83eff
- SHA1 6f86c686a7f29260d7d9b03180488fe668765c47
- SHA512 13fbd8912a361b59bd23b9ecb2ad4a80e0f6e32fc91fcf0befda5d31b182b1f492cd0ca6c095550383e2fb75258d6fc6230ac5f70e34d18e0a4c65e90262a5ec
- SSDEEP 768:4ZPGJavWhcadx7PW2DH3PdVvW/h7jUUhllX+XVSlngTvDpzWAAePn:4AJaehc6xDFDH3PW/hse+XVSlWpzWA9
- TLSH
  T198231C2E5F240032C5D3037B36A65A557B39C3EC136A177A888EE8A811B7B5B1F63C5C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral19 behavioral20
- Target
  Soundpad_/languages/da/translation.mo
- Size 46KB
- SHA256 c954cca2b32bab1cb5a8a8a578329c72c49368598126b90ea480340b7aacd524
- MD5 aee77e5514dadabfc575808e3e3b4cd6
- SHA1 a1518effa9c956e4048918f3c53a4b9b5ef11b26
- SHA512 0ea132359196b292d4de350172f5675baf1f1eaaee42e0075ff3d74362abff05214ed76f62da54d55817bca3c115699c6ba6f204b6a324809113760f0247e2e7
- SSDEEP 768:4ZPGJn6rW6U7PW2DH3PdVvW/h7jocsAP+AVvmocV/ZVrMrtbwQFc:4AJn2YDFDH3PW/hgdAP+Yv9cxmJXc
- TLSH
  T1A7233A8A89104637CB66027FF6520E669B7DC07DE6884B6B808CD4FC64D3A1916BF5B4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral21 behavioral22
- Target
  Soundpad_/languages/de/translation.mo
- Size 49KB
- SHA256 5220672f99b439b1db77479ab170a5a0f2b65b4b14416b72447ded6f1ebcd40e
- MD5 6ff1d323c51c2ed88f05ee7ff468900f
- SHA1 49c7d5042fc7644c094c3be52d7d0666c268accb
- SHA512 32c065115ea0ebca406fb0d5831c39c79acb7c8e45941df8f0074a3ebd4077a61e5b8b6661a3a001114269b085877f3cdb39a456f0db42c5d492adcb06aca97b
- SSDEEP 768:4ZPGJO77PW2DH3PdVvW/h7jCJrAWGNVu+6hI3uY11zxdHFXeZwxzU8d:4AJgDFDH3PW/hqJrbGNVKuLFywnd
- TLSH
  T197335B9B0E49016AC7D7337733426D673B35C2BE8341579F809CD9AA268B53B42BF864
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral23 behavioral24
- Target
  Soundpad_/languages/es_ES/translation.mo
- Size 50KB
- SHA256 d35905c669534e8770849dd51ba74071836f43e1047a7df7ef99c373ca185c73
- MD5 f0be4e99dca44e2aa70c3b32dccfa82a
- SHA1 61c49931b877f4af8ede44dd9e29d2ff4fb7d420
- SHA512 eb32e5c6360822eed54c0274bd365db19cc69c56aee083ba17d07777b302c69554c50e16cf12e155fb53d35b2e34e4efdf27d1c960f1ab6f558e0628b32b300a
- SSDEEP 768:4ZPGJC2pFxC07PW2DH3PdVvW/h7jdsSI6Nrc45OFHztG:4AJ5pFxFDFDH3PW/huFhG
- TLSH
  T143332B7E5BD80B73D1D3137BF6838257A7A0C09C650DC3D7807CD6A920CAE4E96279A8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral25 behavioral26
- Target
  Soundpad_/languages/fi/translation.mo
- Size 48KB
- SHA256 8dcf58474fc5ab1514461e1f9b8e336ef0c13b49f26f7bceb14d477da7a85b6a
- MD5 05561f37a16002c2ca8f65faef7d1749
- SHA1 260d64b7e458039316001eb15b09d844e909135c
- SHA512 7a3c4c8c11512383d9db9173caa4db6203bc21bc931c1bf3f5460296589cc41e71b30b20018e201c95ee7aeae34f0c4fb9016b8049d2142c927f091e30d2fa91
- SSDEEP 768:4ZPGJyWk2M6bi7PW2DH3PdVvW/h7jfYPko2FAvikYPMt7i7:4AJyP2M62DFDH3PW/h3yj2qikYPMte7
- TLSH
  T122235C4627518072D7E652BFEEA4423A7BB0C16D89A04F9BE25EE1D900D34982DF31BC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral27 behavioral28
- Target
  Soundpad_/languages/fr/translation.mo
- Size 51KB
- SHA256 bf44674158ed2dec81843c7bfd0dee6595bb36946bec92e09ecfb9943fd0e5a4
- MD5 9fd6ad7c6bc2b8fa3b155a97f0326fbe
- SHA1 862379e994419c9492b9f502cdbb3741f95fa54b
- SHA512 c030d773818b6c0d41c09ad1ef2d965656708f8c53a1b8e6012d70a8059e25a5652fcd65d18a6be3d7b6ec1c99403068a6497178a40ecd3c075ee403365ed919
- SSDEEP 768:4ZPGJS7PW2DH3PdVvW/h7jdfXRHVEzKDx0EyhtIRJl:4AJSDFDH3PW/hFwe7/
- TLSH
  T135332A5BAE900093C6CB127BBA536617FB31C25C6118D709C89E92DD32C78BE53A75F8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral29 behavioral30
- Target
  Soundpad_/languages/it/translation.mo
- Size 49KB
- SHA256 9e5fb77abbc5b636cca97637a07c9d40e03af74981afa2835900e3b65beeaf38
- MD5 896a7d5d126e4473cedf237b76dbfae6
- SHA1 9729f9fbbc1810b31ee86094d68edba2b4e1766b
- SHA512 052e16ffb72c3e9576fee2a2c4faf47fbfa443ceec7cae65f12312b56d998b4ea89ccd5bbd3e7993822812a3798892c31b429b4b4b6409dbc96e87719bd4870b
- SSDEEP 768:4ZPGJfdV5iOoUh7PW2DH3PdVvW/h7jngOgZAPdUlLfci:4AJfdV5i/ODFDH3PW/hfgOgZIi1fci
- TLSH
  T1A4332A3EDD950032CA6303FEA6597545EF39C0DCBD592B0E409E93AC21CBB1A726B46D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

Event Triggered Execution: Component Object Model Hijacking

Executes dropped EXE

Loads dropped DLL

Drops file in System32 directory

UPX packed file

Checks computer location settings

Event Triggered Execution: Component Object Model Hijacking

Loads dropped DLL

Drops file in System32 directory

UPX packed file

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32