0e1fc9e92438590405adafee1942246c936d4c574003b8d32003996e12b8cbcc

General

Target
MAGIX.VEGAS.Pro.v23.0.xxx._-VR.rar
Size 4.0MB
Sample260803-pb5vxahb98
SHA256 0e1fc9e92438590405adafee1942246c936d4c574003b8d32003996e12b8cbcc
MD5 25546acbb51b5f121f55b6fddc7a37ae
SHA1 ba44b3ff6b87fb542fcc4e3aa4cecabf3c68197c
SHA512 6933c38abe4a92c2bd3a764387328d25b95d75e7b66e7c77e82126f7931a0f1e65a28b7bbc720e7c63af8bb2c02cf012e29f9f66b4d305f668c635922c119432
SSDEEP 98304:3FUL6bz3/IVxXjkp288UaF4tN0ObFQyFBnFmzk7sSVKW03TNTic3:VWCz3Uh8aFKhQ+lH03Ic3
TLSH
T17A1633BA6FCA70DA020505CEE385CBD1B57BC671F26F841958938761A0B1AD4C478EFE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  Download More.url
- Size 122B
- SHA256 45eacd3e6cb034cc63b8c23a5d430ce2fc096e584dde6d85edef9e8bbf6b07b2
- MD5 850a1ecd29f3438c5d77474d4b04c6db
- SHA1 20e5f8db6226fbddfcb1f29d0668dbf454e55bab
- SHA512 592c5a4154c3dbdbb4c6918f5b1b689bf470e37186d1677dff49c0c536852c9467f68439643b22980db741ec78bccb56167b386b428ff64cba71182aed4ab7aa
- TLSH
  T1A1B012AE8246828BD351950AB0F0F9099E0FBDA40CD2D09CBA58DEDB0C880D3C948B36
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  Join Telegram for more.url
- Size 130B
- SHA256 970dfdac6e4da786167be4432834ecda2c81ef8182529c2325dbeb9caf31bf2e
- MD5 cb33842079e21618d7f4fa3cc09f9cd1
- SHA1 fea3d2fd206edf20ebdb7147464a269911d01a68
- SHA512 9b9086ae12313ab898f2947513167158988a52e823b86b986e8b1608bf05635ddfeeee1df1a2034b29c71523e9de7bd2df9167ebe22271d610317faceddc7dc7
- TLSH
  T14BC09B5F4505434ED241E44550B0F904948E75A56CD2D05C5248DEC71CD90D6C845B36
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  MAGIX VEGAS Pro v23.0.xxx patch.exe
- Size 5.0MB
- SHA256 e73056bd1d1ef44ece0e8bc3a0ec51914a793552315df0e1e1577d6c8ed4980c
- MD5 8b928cec3cd7ac732db5781397ef2032
- SHA1 9e779c56135bf86013b67cb1c45ddedd96c328b2
- SHA512 8f3da7b5923259f87a35a955551e67cc127ac088e3caeb2378254280e2ed2687fe6d67e2f5c40b7445c85768def0778bb761d6243513fcaf7d062007a68b479f
- SSDEEP 98304:J7nDM57bzHRaNPzwhtE0tFZPEz3uMOfe7qFwGP86M32Aj:J7DM57bzxCk30up1Puv
- TLSH
  T15236F12ABE5E613DC05A5AF54523C3105A377E6164FE8D1A42F0FB08CB33448DEEB666
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

discovery execution installer persistence
- Detected Nirsoft tools
  Free utilities often used by attackers which can steal passwords, product keys, etc.
- NirSoft NirCmd
  NirCmd is a lightweight Windows command-line tool for automating system tasks
- Event Triggered Execution: Image File Execution Options Injection
  persistence
- Executes dropped EXE
behavioral5 behavioral6