69dbc6f939bf4ac63a90dc56e1e9600b4d4284848a99c4190423c3f856c5961e

Sharing

Copy URL Twitter E-mail

General

Target
CapCut_for_PC_v9.1.0.exe
Size 2.7MB
Sample260803-pfc1paxcle
SHA256 69dbc6f939bf4ac63a90dc56e1e9600b4d4284848a99c4190423c3f856c5961e
MD5 0569477873140b15f1330300e5b696a7
SHA1 46390c027e86d16c9dd8c3e1a46ce3e80898eac7
SHA512 0787089ae8b94b39e176789b7dde703a52aaf37f28a3b8585947577218c8a47ed81f47d072aa1314b5d4aa087b7fd195abe36fb590308162517239b94c0fbac0
SSDEEP 49152:ol74yWHEZDC82EG9jBR1mpJ1/5hNSzOyu6S+hBBvle/WnG/MmWT:ol85aDCtlhmpJ1bkhBBvQEG/MbT
TLSH
T1E1D5230371049299E2129AB316FAC9B114237EB79DD0891A71D8FF673AF2261531F72F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

Malware Config

Targets

- Target
  CapCut_for_PC_v9.1.0.exe
- Size 2.7MB
- SHA256 69dbc6f939bf4ac63a90dc56e1e9600b4d4284848a99c4190423c3f856c5961e
- MD5 0569477873140b15f1330300e5b696a7
- SHA1 46390c027e86d16c9dd8c3e1a46ce3e80898eac7
- SHA512 0787089ae8b94b39e176789b7dde703a52aaf37f28a3b8585947577218c8a47ed81f47d072aa1314b5d4aa087b7fd195abe36fb590308162517239b94c0fbac0
- SSDEEP 49152:ol74yWHEZDC82EG9jBR1mpJ1/5hNSzOyu6S+hBBvle/WnG/MmWT:ol85aDCtlhmpJ1bkhBBvQEG/MbT
- TLSH
  T1E1D5230371049299E2129AB316FAC9B114237EB79DD0891A71D8FF673AF2261531F72F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

defense_evasion discovery execution trojan
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2
- Target
  $PLUGINSDIR/BgWorker.dll
- Size 2KB
- SHA256 50f735ab8f3473423e6873d628150bbc0777be7b4f6405247cddf22bb00fb6be
- MD5 33ec04738007e665059cf40bc0f0c22b
- SHA1 4196759a922e333d9b17bda5369f14c33cd5e3bc
- SHA512 2318b01f0c2f2f021a618ca3e6e5c24a94df5d00154766b77160203b8b0a177c8581c7b688ffe69be93a69bc7fd06b8a589844d42447f5060fb4bcf94d8a9aef
- TLSH
  T1C351B72E612C0BFFC2963C34BC96795B1B6FC060A39A6328813FC5853C141B4233DB2A
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/downloader_nsis_plugin.dll
- Size 1.4MB
- SHA256 e5f5627134d9792e63cbc3867a0ab47fd02bdb86fe39d91c826bc669da8dfd34
- MD5 42efe6b442f19f7fe20bdb024650ee6c
- SHA1 7f9230ae67114f39b061631759ae8a479b3578c5
- SHA512 8ed6004001adc1dd1eaf3a54b8f122ebdaa7d11d53212820d0d9e8fdbd32c8740212e08cff6b06191459b1490b43549ed07fc149f2379aeea848db6580fb78e3
- SSDEEP 24576:PN5WT6Ku6HIkxSPmHkJdWTtXA5IGUK+IUc8C67fZm:eGKrHIkbkJ8XA5IG7+IUch
- TLSH
  T1A9658D4072D180B5CE4B6231792DA73D3F6959028FA08DC7E2D6BDB52A722D35A3137E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $PLUGINSDIR/res.zip
- Size 769KB
- SHA256 b0e00d3e7e22dbbbc5fbd5bfcb1d71034355beb950115b7197e0a0a11409c50e
- MD5 e6efba236990bdeb6f1146728ceeedd4
- SHA1 bdf68100763a0ec87a9d372084771eff9e7843e6
- SHA512 0e0e02c54e10bc7cbc33004cf202b96fbfb120d0c14e96da5632ee0b7bef3c8a084b5d3d122088c87a9fd02fb5080b2132148d1633cd001838a63f5dba5e467f
- SSDEEP 24576:9A7tJwrB3bbg883K3w99/XC25v/VSoNKAYamSB:97rBL1YL9v/5vNSBqmSB
- TLSH
  T1E8F42353BD1AC4EAD24E35BFB1546440952F37A34E68ACCAFA599C8F1DE07090B7683C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  app_warning_icon.png
- Size 10KB
- SHA256 2c8cdbdfa2a99200718901ed35bb56ea90f8fed9934aecd640d9507b677f7025
- MD5 ff33518be442da6232709553157e2418
- SHA1 a68eeced8fa5a2ab918e9d4c575ff09839624efb
- SHA512 02858ae7e65c33c21952e65eef49d74c4c4398e7b9a04eb9c7b50ad0fa24d3025f377ffadfc2e9b9e07d112efd3468bdce4f71a146608287827a65f2e057f83e
- SSDEEP 192:vDbpB1zqKLGqqeSaU18Ft/TCpZu2cphDjlVq4kw9oTrRpa1s:npB1ztG3D18FtLkDmhDxVahpss
- TLSH
  T16022B05752F4A0A353887DAE9AB2E0BD744330B63230FC6388A5F42D58477A53914E26
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  banner_bk.jpg
- Size 83KB
- SHA256 c4b98d49afd4beab5b0f549cb9674f61e2156d273626f17e8d84129c127684f5
- MD5 245b96c88020b408e92a4f3ff77d9ac7
- SHA1 eb04cd6411ac4fa24dd4248004e9521186206a9b
- SHA512 fd2f09c8a02d43d8ce8ca53959804cd3265d426cad6a40d3fad6cd7423c952f62ccfb1e46832af3dc66070c008c7812caa3bb9d2702dd55ab77da785cab05c79
- SSDEEP 1536:9uUUgVClmd0qp3Atu7wnmGrmMFcjYe9QK+uRNTFzTxBNeCBoygO:U8VCozwnmGrmvO+tpjeCfP
- TLSH
  T19683E0C8F4005C994EBF4AFA8493D213D425A930DFD7F8389C066EA9F299F6CD652316
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  btn_dark_1_disable.png
- Size 495B
- SHA256 1214f419b0f821daa6ee796b284662c25002f579d3045b50e82ab8a531925cf0
- MD5 653d579d6668c1431cac857b7efe5034
- SHA1 0a606960becc6b7b40f97b34bf4bcb46f679cd45
- SHA512 487b869f9933991c026708e8b47ca34bc268d2f0680a52dab50d99b39d62d669409d999274b3c193b0076a4e03d86b7843efe3ced41fb8a9fdc986c75032917e
- TLSH
  T142F00ED98EC0403CEC32460BD72B34D150032BC2209E85296C5640C04B5FA9423EFB43
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  btn_dark_1_hover.png
- Size 500B
- SHA256 361ca657c498b9762869f0561fb0e8346c1d7d511fa8351b704c2b6b67e8017d
- MD5 e2d1d028a247d172652fa902395da9a1
- SHA1 80098c9e5ff0e2d53cdd07a132564dc6b9bfe786
- SHA512 5abb58988d1b5072dee85878ba28bd75e2e2a59dc617fbf1fa9e6ca0c96695ff15aed275d6c5653f3e6a594f69d77ca73a5d0ab8488a67dacc7ed44fa32db0b7
- TLSH
  T17CF0C9C61719287C81095CAB0D2D01213AB9B29012BB70699C0CE42D2E2BD848D5B7C2
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  btn_dark_1_normal.png
- Size 465B
- SHA256 f7d278ca8bd08b29bd93c95cdc0232b23ba5bdce09ddc9ccf77a4570c5efc0b7
- MD5 0a6953548ea99f1f3c609f371680de1e
- SHA1 a43039665aa11953064c67535c6c0730e0d42715
- SHA512 27daee094b0c04d1967243881cf91128107735f7b378b3dc848eaf4ba7a3c658c7d95eb9f826514f47c82fea0f6a69a8af3a75f9887e009c03dc692e657993fb
- TLSH
  T1B8F0599B47919C1578D662E004421010B0E14E87329A78047D44CCE85A2DC4EEC23BA9
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  btn_dark_1_pushed.png
- Size 455B
- SHA256 835474b1387b98bd5837668661396fc7cfaa7c934d3422c923ebe9553e5d9552
- MD5 e9d2c7a7ae25969a0e166d51c921660d
- SHA1 4387b00f8c545a1b25156ddec6c98b3400e379dd
- SHA512 18da16fa24ce72f66331605e6f7938727373c06b8b97c1ef9789cdd5d4e3178623130a1fa01464211e9db33913c518a2aa1de0ee1eb8f09ab55f4e3082359efe
- TLSH
  T1EDF097C76B80882AA5C503DE0A975025B8A12D8677AB7880A48582FAD60DE0EE857B64
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  btn_dir_disable.png
- Size 634B
- SHA256 551e25a738681d1365e8853bea823ebb8bdfea8547e5843bf076173be4151689
- MD5 71e683c7fca17d19e59d536056cea81d
- SHA1 80196242b17fe96af99d4663b1bbb912b617fe26
- SHA512 e63f3f5ba9453687c7c07e2bf9c63974dbac1d916fa3a21f3882e12b60dcb361cb43ba00e9e390e8214347c5e9795021cb1612b7843ab0b18c5239ee865a1fc3
- TLSH
  T19AF062C827280E66689BE83EC5B25635602C12DF2ED495F148D85A680E0AE8E529FF46
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  btn_dir_hover.png
- Size 1KB
- SHA256 cf1abbf3c06ef18818272eeae0bf5197e9982385c0633a03e06caef2eea479cd
- MD5 f1446398846b2f7c7779b3a4e34c930a
- SHA1 2adf38f8a439f1e3ee666df91b20a0836e69a265
- SHA512 48e9f62011e6a780c267882613c3c3dedfed0340ac8fedf225d99772d62a8212e1da3d13edc182b924e36fec1f3bd9eab6a42a3360d85320fb38050a3a852534
- TLSH
  T17B11A8A01A2568E89ECE766D1057A66975156209B326BF0DBCFCF91C21A84C01AFCEC7
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  btn_dir_normal.png
- Size 599B
- SHA256 c3d4853cf097def877b54bd9f66ec2beff88d5210306959570e85c0a6b8e1eef
- MD5 69c49053991a8044a2a3e9330d56f650
- SHA1 e52b4c21b2616a23f4c534b52923fc8eddfca25a
- SHA512 66aba66ab169df7da16cf0a52bbb5fc8562ec04487cec6e2cb25892eb25be76d82f29ec17e6cc92640667f74c433d691b5ea83fb86385998baa44b5461b03643
- TLSH
  T1D9F0E1FD0A3C98BC9A5657AF795B438C443B00A94091FB09B84C957AB8AD85ADCE6381
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  btn_dir_pushed.png
- Size 577B
- SHA256 8e3cd0fff2a8dc5697b513b3164ff7dcffa30cc7deec7b104e29cede1ab71b0b
- MD5 34e768fe73d27f826589add661153ede
- SHA1 7d7d015b2f428e7bb77ce511b23d27567e086483
- SHA512 80db2b26f4a1af423ea9f16bba4d861cfac428e2f8a4b7772101c0e012c1447027b9057876c8bf2b2a74bb6dc3fa91893bbdf1fee559694af8815f4996bd8edb
- TLSH
  T19BF0415417C208E9E59509AF20E602ACEA7B6097005B88CA8CC0314E3F3720CF48C3A2
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  btn_light_1_disable.png
- Size 492B
- SHA256 ee1904409587a1e75faf9bfec6f6d2ce5413edec9116733835879d8b5d990197
- MD5 8fb53c31caed1d4e2e7aaa2151c3b545
- SHA1 f6282720b7c40ddf21428c706c4e012ccac1cc33
- SHA512 0c03a189facfe2b44538c5675be53818164d4c2355dbb56cae63f6bfe30e35a19b443213485b3e6643cb3a6732eb5dac89dc899c4ca3d1221d939054aea6541c
- TLSH
  T1ACF0C9CBDA101C3E1C22472BDA5E7158A2BD15D478AE505364A36CE0240699003FB3C2
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Enumerates connected drives

Checks computer location settings

Suspicious use of NtCreateThreadExHideFromDebugger

Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32