Overview

overview

5

Static

static

3

vlc-3.0.23-win64.exe

windows10-2004-x64

5

vlc-3.0.23-win64.exe

windows11-ltsc_2024-x64

5

$PLUGINSDI...LL.dll

windows10-2004-x64

3

$PLUGINSDI...LL.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...gs.dll

windows10-2004-x64

3

$PLUGINSDI...gs.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...ec.dll

windows10-2004-x64

3

$PLUGINSDI...ec.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...ss.dll

windows10-2004-x64

3

$PLUGINSDI...ss.dll

windows11-ltsc_2024-x64

3

NEWS.vbs

windows10-2004-x64

5

NEWS.vbs

windows11-ltsc_2024-x64

5

axvlc.dll

windows10-2004-x64

5

axvlc.dll

windows11-ltsc_2024-x64

5

libvlc.dll

windows10-2004-x64

1

libvlc.dll

windows11-ltsc_2024-x64

1

libvlccore.dll

windows10-2004-x64

1

libvlccore.dll

windows11-ltsc_2024-x64

1

lua/http/custom.js

windows10-2004-x64

3

lua/http/custom.js

windows11-ltsc_2024-x64

3

lua/http/d...w.html

windows10-2004-x64

3

lua/http/d...w.html

windows11-ltsc_2024-x64

3

lua/http/d...w.html

windows10-2004-x64

3

lua/http/d...w.html

windows11-ltsc_2024-x64

3

lua/http/d...m.html

windows10-2004-x64

3

lua/http/d...m.html

windows11-ltsc_2024-x64

3

lua/http/d...w.html

windows10-2004-x64

3

lua/http/d...w.html

windows11-ltsc_2024-x64

3

lua/http/d...w.html

windows10-2004-x64

3

lua/http/d...w.html

windows11-ltsc_2024-x64

3

Sharing

Copy URL Twitter E-mail

General

  • Target
    vlc-3.0.23-win64.exe
  • Size 43.8MB
  • Sample260730-w6y46sveph
  • SHA256 20ad191348684b470ddc4e05204316f3d8e39655f412b3e392a0eef97639daaf
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
discoveryexecutionpersistenceprivilege_escalation

Malware Config

Targets

    • Target
      vlc-3.0.23-win64.exe
    • Size 43.8MB
    • SHA256 20ad191348684b470ddc4e05204316f3d8e39655f412b3e392a0eef97639daaf
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    5/10
    discoverypersistenceprivilege_escalation

    • Event Triggered Execution: Component Object Model Hijacking

      Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

      persistenceprivilege_escalation
    behavioral1behavioral2
    • Target
      $PLUGINSDIR/LangDLL.dll
    • Size 8KB
    • SHA256 2e08e077a0800ec39c0596f4dd91cbbfa917eeef2d75a00767917b8d1f6884ac
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral3behavioral4
    • Target
      $PLUGINSDIR/System.dll
    • Size 28KB
    • SHA256 b89448b9fd7be5ef215cac6d973a57c0e75e1fffa25552afe174855c9b71fdf9
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral5behavioral6
    • Target
      $PLUGINSDIR/nsDialogs.dll
    • Size 14KB
    • SHA256 778b2bfbf3f4e641161f40c8174442a4d3865f097e3a2a383356dbfcac8005ab
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral7behavioral8
    • Target
      $PLUGINSDIR/nsExec.dll
    • Size 10KB
    • SHA256 0d7f702c518286a2d87db689af169c3857142324de4c9d76d51ebf639dced3df
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral10behavioral9
    • Target
      $PLUGINSDIR/nsProcess.dll
    • Size 39KB
    • SHA256 70b1ba04ab0663f1044b182090294e117fda3921fd498a731dea0d34db6a98d5
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral11behavioral12
    • Target
      NEWS.txt
    • Size 218KB
    • SHA256 fa20b133f79d6e56b108159f6a3394ecf6cd44cd09fa466a6483cdf4316a7695
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    5/10
    execution

    • Executes a VBScript file via the Windows Script Host.

      execution
    behavioral13behavioral14
    • Target
      axvlc.dll
    • Size 1.3MB
    • SHA256 93822008bc163b0538f67a143d3207cfbed19633671d60e6fad14853a0b44690
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    5/10
    persistenceprivilege_escalation

    • Event Triggered Execution: Component Object Model Hijacking

      Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

      persistenceprivilege_escalation
    behavioral15behavioral16
    • Target
      libvlc.dll
    • Size 187KB
    • SHA256 8ae9f16a72441f43fb4ae8f72c843736726e067ea4a8def2646748631cc4e872
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral17behavioral18
    • Target
      libvlccore.dll
    • Size 2.7MB
    • SHA256 d3475b834dd3eb77910f37f71b0341d358bcbdda5b9f04cc4a3a8e2be1bc8e35
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral19behavioral20
    • Target
      lua/http/custom.lua
    • Size 474B
    • SHA256 a6623694797e67dc0f22e4f64570825e489d2730676e02db9d6911a04d2cb1ca
    • MD5 SHA1 SHA512 TLSH
    Score
    3/10
    execution
    behavioral21behavioral22
    • Target
      lua/http/dialogs/batch_window.html
    • Size 889B
    • SHA256 5189cdb57f5b2e8c3add7e6c4487f5cf8a018508c612f35c8e1305512f2176e8
    • MD5 SHA1 SHA512 TLSH
    Score
    3/10
    discovery
    behavioral23behavioral24
    • Target
      lua/http/dialogs/browse_window.html
    • Size 1KB
    • SHA256 d93c774a7aeb4594f56b37e81838ba03b6855c2bbd91eb8cb803dbd413c5e571
    • MD5 SHA1 SHA512 TLSH
    Score
    3/10
    discovery
    behavioral25behavioral26
    • Target
      lua/http/dialogs/create_stream.html
    • Size 14KB
    • SHA256 fdfc3417223b88d2e8f0421ced4711760ab11a3c18a50dc05b805a0f4f1a5134
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral27behavioral28
    • Target
      lua/http/dialogs/equalizer_window.html
    • Size 1KB
    • SHA256 62cac570011b9b07e0f421612571a1ce663e49dd3b90a16cf31d8855f1adddac
    • MD5 SHA1 SHA512 TLSH
    Score
    3/10
    discovery
    behavioral29behavioral30
    • Target
      lua/http/dialogs/error_window.html
    • Size 501B
    • SHA256 75d1a1ab807cd97801bc37ed547b26c7b357497e82d01221ac064497c9480304
    • MD5 SHA1 SHA512 TLSH
    Score
    3/10
    discovery
    behavioral31behavioral32

MITRE ATT&CK Enterprise v16

Tasks

static1

Score
3/10

behavioral1

discoverypersistenceprivilege_escalation
Score
5/10

behavioral2

discoverypersistenceprivilege_escalation
Score
5/10

behavioral3

discovery
Score
3/10

behavioral4

discovery
Score
3/10

behavioral5

discovery
Score
3/10

behavioral6

discovery
Score
3/10

behavioral7

discovery
Score
3/10

behavioral8

discovery
Score
3/10

behavioral9

discovery
Score
3/10

behavioral10

discovery
Score
3/10

behavioral11

discovery
Score
3/10

behavioral12

discovery
Score
3/10

behavioral13

execution
Score
5/10

behavioral14

execution
Score
5/10

behavioral15

persistenceprivilege_escalation
Score
5/10

behavioral16

persistenceprivilege_escalation
Score
5/10

behavioral17

Score
1/10

behavioral18

Score
1/10

behavioral19

Score
1/10

behavioral20

Score
1/10

behavioral21

execution
Score
3/10

behavioral22

execution
Score
3/10

behavioral23

discovery
Score
3/10

behavioral24

discovery
Score
3/10

behavioral25

discovery
Score
3/10

behavioral26

discovery
Score
3/10

behavioral27

discovery
Score
3/10

behavioral28

discovery
Score
3/10

behavioral29

discovery
Score
3/10

behavioral30

discovery
Score
3/10

behavioral31

discovery
Score
3/10

behavioral32

discovery
Score
3/10