bbb95e52b96ad9b7ccd5abd13121379d29774d6cc5fdbef82ffa249e8a24a289

Sharing

Copy URL Twitter E-mail

General

Target
OBS-Studio-32.2.1-Windows-x64-Installer.exe
Size 152.4MB
Sample260804-nn2hksyfnb
SHA256 bbb95e52b96ad9b7ccd5abd13121379d29774d6cc5fdbef82ffa249e8a24a289
MD5 943c2053a758b087d9bded31fe311dfe
SHA1 627e8d613c35d87148ed6d4d6e7b5c387910498f
SHA512 0f85e03962b291f1e6463c281c43390655a8ba25aa06353b83c801492b9486de988f78dbf421377772956fd297aa0f3ca5ca98383df767fa30dc4b1299b6e2b9
SSDEEP 3145728:HwjgUwo8GkNL8UkaK8zQxziSQYmldjf33RtLgdNCMJZkCojTPNsGMF2uU/:02o8GkdDkaK8zQx7ozTLgdNbHZojTPSg
TLSH
T1BB783380F942680ADF48C572B5016DE1371E66F37DC06684B3F8E9B7B5E39F596B2880
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  OBS-Studio-32.2.1-Windows-x64-Installer.exe
- Size 152.4MB
- SHA256 bbb95e52b96ad9b7ccd5abd13121379d29774d6cc5fdbef82ffa249e8a24a289
- MD5 943c2053a758b087d9bded31fe311dfe
- SHA1 627e8d613c35d87148ed6d4d6e7b5c387910498f
- SHA512 0f85e03962b291f1e6463c281c43390655a8ba25aa06353b83c801492b9486de988f78dbf421377772956fd297aa0f3ca5ca98383df767fa30dc4b1299b6e2b9
- SSDEEP 3145728:HwjgUwo8GkNL8UkaK8zQxziSQYmldjf33RtLgdNCMJZkCojTPNsGMF2uU/:02o8GkdDkaK8zQx7ozTLgdNbHZojTPSg
- TLSH
  T1BB783380F942680ADF48C572B5016DE1371E66F37DC06684B3F8E9B7B5E39F596B2880
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery persistence privilege_escalation ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2
- Target
  $APPDATA/obs-studio-hook/graphics-hook32.dll
- Size 252KB
- SHA256 566b095dd1de495a3f0233cb08d75ab3e7d7b184c80e2fc23f23f22ca8558632
- MD5 0e4b22681276d0689464b2316ecea03e
- SHA1 2ce5b94fccc9e5aafd2df63f3bf1d0180fbfc096
- SHA512 ccf9090c89f9359e18e04d38def47a1910967c9517409b2d56a7e0f53856121700de9184ede1e64e8f63b88b12dca485ad99dfbb1fef8805453a1af9a6ac194d
- SSDEEP 6144:hv4YK6e+8zVYbDhVuWUpcILrLCI6kNYrtprwndOsfI:hwVrxWh+ruhkNYrtprwdFfI
- TLSH
  T1DB44AE40B440D931D9BF043124ABBBB78A6CA42517B4DADB67944CFCEE200D1797DABB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $APPDATA/obs-studio-hook/graphics-hook64.dll
- Size 303KB
- SHA256 49c0ddeac72b130d4f8ae90510219949022c1f992adb48d81a4972f2cd6c2585
- MD5 e4c5156a083153e5e64fc5dc520cc1f6
- SHA1 38bb85692db27748deb2ca998391067dbdcd5095
- SHA512 225f733da3bb3f399220986225403012301660bf15a4ca7ce8d97d499cb88d6d95c6c6d8930dd41142d2766cff10411ca9a82c0182c8df520cb9d2fc19f0ba24
- SSDEEP 3072:RNzufIkXQuNEuKSP8MC53fsGsrmj+ueiE4kPquCpx1Q6rRSN3+rkNYrtprw+eFmc:FhuNnCZy/dhFqvic6ukNYrtprwyh40s
- TLSH
  T1C1647D16A3A448A6F837927DC483A606F7F378561774D7EB032185996F233E0AE3DB41
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  $PLUGINSDIR/InstallOptions.dll
- Size 15KB
- SHA256 dd0d1a8c4511261333e90a94d9912000592c46731b615aa7a37cd2b3eb6a8d58
- MD5 7854290f8bc473fb9fad1917b0065731
- SHA1 27c0e4731e395dfe612d954bf8793c533c53ef8f
- SHA512 736030a5e1b744d0f96745f9933a57f5b52361288d33aeeaad12e054c47c4bb705cfc7d5cd4a5e3e667a6c6252e1c2a573b2707241d7b73b60c73daf2de52038
- SSDEEP 192:EJGQtZkTktEQUrJaZfuyCnSmUsv3sY7L7cW8Y6Q86QvoT2g11929WtshLAzgSrX8:EJNt+4t7uJalUnGesY7Lt8nC3/Yosa
- TLSH
  T1E9624D1137D598B3E2E62A797EF373138FA5FB22A4428E0BC7332E0638565805D78311
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $PLUGINSDIR/OBSInstallerUtils.dll
- Size 426KB
- SHA256 1d84aa191fbbd842d5eeed302195579de1256a9acb980308bf31a631ac01e530
- MD5 e1f825260e7224ef0526514754f7d0e8
- SHA1 553d67289b039ffea5d8b59f509b9265dca2ba19
- SHA512 b9453eb4ae6edbfd86e438ed0825725ab91100b8403a933bb0e359703be462f6d3d37f8bfb32eeae375a46512c619370f9802925ae0d8898f540f933b05b281f
- SSDEEP 6144:+fxKVpKLECSq5oMIMOfv6yZsA1eetlFnnI8+dATAxe97TGYKh:GxgpKLEBq5oMnOfv6yWaeetlxnpgh
- TLSH
  T18A946C1078818172DDFA20BD46ECB931056DA8F007345AC796DC0BFAEA645D2BB3669F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 996645d7f16a6294babb6da83478062aed7b72318d7a51b66e90ab5d3edc51a5
- MD5 6d08f0d5503bb100b8429fefaad163a6
- SHA1 2a79aac2d3b715326c3dcd3c5cf2e33de3632a0a
- SHA512 e259b1aff39c533e3e31cf4eb323c8eb22b2beeb5d8ce2c929de30702a6d8ab8076aeacc983d724b05d7d99a6de8c4d239bd159642c7e75fb86faef683360a1f
- SSDEEP 192:cjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZr0QPi:s/Qlt7wiij/lMRv/9V4brr
- TLSH
  T1A9427C1297B089F2F151093819667F2A6FBEAC5C23F405A3CFE304C63D212CB9879243
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  $PLUGINSDIR/VC_redist.x64.exe
- Size 24.2MB
- SHA256 3642e3f95d50cc193e4b5a0b0ffbf7fe2c08801517758b4c8aeb7105a091208a
- MD5 1d545507009cc4ec7409c1bc6e93b17b
- SHA1 84c61fadf8cd38016fb7632969b3ace9e54b763a
- SHA512 5935b69f5138ac3fbc33813c74da853269ba079f910936aefa95e230c6092b92f6225bffb594e5dd35ff29bf260e4b35f91adede90fdf5f062030d8666fd0104
- SSDEEP 786432:tSp+Ty2SfUfnbDDko5dFMYqlQbgAVLSElbmucMuZZxs6Sf:4p+Ty2SfWnHDk8FjVbfzPTq4
- TLSH
  T19F4733339648042AEBE34573AD99F5241D38A52C63024DF6EAECDD5E177829237FB702
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral13 behavioral14
- Target
  $PLUGINSDIR/check_for_64bit_visual_studio_2022_runtimes.exe
- Size 10KB
- SHA256 b324a6025986306656fc2a03d0a3e9ed5917dfa7cf14fbfca888d65b39822074
- MD5 9baff51bb8539498c81d0c2ed0034d9d
- SHA1 e85ff796a54221f723ad36412329d8c650b7717f
- SHA512 cc4008bb5586840c1f031f09ce04904b22ae5ec43c3331586593fefffa22725c076835627253d6aa0468fd24124068603b82eb45490cf96e20a6c4f1d5472576
- SSDEEP 192:bFVKI1e9KOftazT6hmA5K+o/y2sE9jBF0NyeaBM:5Vr1ecQeT6hmAM+o/8E9VF0NyJe
- TLSH
  T1402208A3CA69AC41DD5F4E7670C4D82BAE7563C61A94C5E32215C010CB923477BF92F9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  bin/64bit/Qt6Core.dll
- Size 9.9MB
- SHA256 9fb890ddcd812ad721d2324071e8c7192f3bbf46b5e2cf5fe768579fa3279475
- MD5 0e0b60244e4c165279d0810699105156
- SHA1 48fb21338fe0a420d5adb2a3b9a716207a32db57
- SHA512 5f4601399fc48ae9cbfbf1016d4cc8b28e94185664b44b33533d020462125d6050cbf68b7e258efdbcd191f7ffa17a687bf18a5d4a6d646120d18658ad7aefac
- SSDEEP 98304:APK7l1N2ptIF4JkSrKFdu9CwJsv6t7YNJMAtiLR7e/3w3:l7l1N2D6aKFdu9CwJsv6t7KSAyy/36
- TLSH
  T1B2A6290766FA0141FAF7D634CAB65152DB737C866B3196DF025822291E337F09E3A326
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  bin/64bit/Qt6Gui.dll
- Size 7.9MB
- SHA256 be0fdb6528bae3aafda7ab4ce78a26d853e1ddfd155e0a89bb5ab1a0b37a7d69
- MD5 f8a9a641ac512a50d31a251cc3d16dc9
- SHA1 0af0f5d31f1febc81e223f630a64c89fc77b8952
- SHA512 339db23016447c97659bfd228e99f84120f93dfadad580938d66d58e90f46b8a63f27c30212f0dd6e4ed7a739fdddeb47a1728ff46215253786d9ff363c406e9
- SSDEEP 49152:XrH/65bbbE5ROyYC1lt1wmXVEVzuxWj3WFkG4ZJS6SJnV41agLs2d3wFG0kjdOiu:6QPrIaq4ZeAj+aNnEpWf
- TLSH
  T17F868C97A3E911C8C53BD13D8B9B9517E6B2701503629BDB02A18A592F33BE12F7F311
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  bin/64bit/Qt6Network.dll
- Size 1.7MB
- SHA256 ea147b27f6d6a64c54d9d9229e77cf6b4399601ce49ed698b4a3033ffc7f081d
- MD5 32054e21c6231772f3cbe8fd5ede827d
- SHA1 bd3fdeff1d7184c70dbffd9e78bfffeb1d6c89a5
- SHA512 27a15320025d59338274932159750c69d0236b444d6163dd636230ffbfe848e2489e069012e0ba7d69d8288ffe5e3b613ad7e7afa93c8a4985314a7648ebd316
- SSDEEP 24576:A+mbo76KOMwjiWzqnQkNmjGeokO5Ba4x6KDBoZPP:A+mboeKOLiWzqnbmSbkUcKDBSP
- TLSH
  T164857C57A3A542D6C96EC139CB4B8607EB72700583A29BDF02648F552F73BE22B7D350
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  bin/64bit/Qt6Svg.dll
- Size 621KB
- SHA256 e74fce7b487227e8d8cfb6efed3638158e900881f9fcb6076ed7d1e27d1a64b7
- MD5 21a3a58be957144d38fc81bd41b4a009
- SHA1 823ef6442a8f4d6109725cc8bf9ec36a2bd2413d
- SHA512 d7af12f84dc5d4e71b5d02b1763fd25cc941f74062146cd6c66537d9c6071dfdc15dbfd054bd0536d24e807f017327f0d021c6e1ea57494da12e17a65452e458
- SSDEEP 6144:T9A4kOKm1rJOcAC+n5WloaR8fayeje8qgYe++mLxzMs6Bx5iS3cg5ISYm8Mkeoyv:JALrm1rkLC+n5WSF/qeWDr+Is6B6yz
- TLSH
  T1C9D45C6BB3A60386E46AD23DC65B8432EBB3704403A2D7DF01658A542F67BE12F7D351
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  bin/64bit/Qt6Widgets.dll
- Size 6.3MB
- SHA256 ed2944f3ec41f7039de2f0b64de6c532b0456d448e5b824df52182d6bc6b4dc5
- MD5 acca4c7b85547ffec9f8e8f9458704b8
- SHA1 6f0bb21e4e629fd31cea389ffec90a3403c192e2
- SHA512 d5fe376201b9fbce6dcf85b99999e56f23a8c8345434949f936206c9211952d4eaf8e6550ef1d471cdae8f974f6d679f5eb21d5bbeb549bb1c55a20d6eca01e6
- SSDEEP 98304:VqxsGAmHHiDqWfWDs29ZmVAPnO4M8g02e312HTGVNvu8:msGAmniDqWfWDt2enO4Ml0V12zovR
- TLSH
  T14C667B57A3EA0189C56BD13DCB0B8A17EA72704543629BCB0169CE592F737F22E7E350
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  bin/64bit/Qt6Xml.dll
- Size 150KB
- SHA256 d77d9a8704a77e1b116058a8429435dc12fe5ed8a6b551f17df891bbf698174c
- MD5 d6e31b0e30bc0933190f078525710d66
- SHA1 77457baad7db5776b4c6e57366326b9304b4bfde
- SHA512 46e397c8479519a13f1014c46f440747ed1ecfc4f7a75e3a709c946767adb63012962e668c045b856bbfeebcacff523d29669cde53d71389475dc45af1568fa5
- SSDEEP 1536:iefadn8wJovNHTmSaD0ZTVhkFk3KuGhTOZD89HYgYZbYTQj92GpbkGhJEmGpF:liSvP/JVhyk6uGhWI94gYwGpbVCm6F
- TLSH
  T14DE32B8733694286E46AC278CA0B451EFB73B09057529BEF82598A391F23FD27D7D350
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  bin/64bit/avcodec-62.dll
- Size 36.2MB
- SHA256 fc92fdfab7b36d35adbe2670238e03da2fb640b4f84fb575baa3e5440168c1ff
- MD5 809895d6f14a48512482128c44c13ecc
- SHA1 5dfbf92bd0db2e6c6661af386e946e3d10132667
- SHA512 627ba3ad7fd899869e10e6945a4d247c04eea66e29e9e3e79771c4f4a4975e711f36a2f6ea742fc74e3b8ba7ed75ebed214df68a9be3782533606f795586bc10
- SSDEEP 393216:42NrZAqLyJNpQamdX8tI9AoqzQ23Knbxg2y76F1ikh9ON:6qLyLpQndX6JanCdl
- TLSH
  T1AC87AF4AF2A351E4C76BC874827A9E13FE24346E43141AF726D556652F63BF06B3AF00
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  bin/64bit/avdevice-62.dll
- Size 82KB
- SHA256 824ed5cdcd7512f3edab94d28f7fa072353b4e0afebb14e4e08a6793686890ac
- MD5 71d67492aadb7a27e447cab812eeac71
- SHA1 04ed3cfd35b52fc36d994a900af75a5b52e2d402
- SHA512 b388b8552d15463c56226e7a5fcf63ad089690764392ce9ec1c110c0fb9fe6d6d32a721008e90db1ca4fb2ac0ae51ab6196de83df1d9a116beb9e19915e7be70
- SSDEEP 1536:+jUqG2xqM8jg+y9ZPI9Nf7sS7xqUUvtlPr+:KzPI9NfXMUalPr+
- TLSH
  T10D836B07F2F4048CE1668075EAA35913E772F01E2341A7DF2768C36D2F236D16E7A699
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

Event Triggered Execution: Component Object Model Hijacking

Executes dropped EXE

Loads dropped DLL

Checks installed software on the system

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32