ebcaf56dfc29f499ba5aa3bb8659e16127e96fa9ea51950ecb042498038672b6

Sharing

Copy URL Twitter E-mail

General

Target
VoicemodProv1.2.6.8.x64.ins.taiwebs.com.rar
Size 42.5MB
Sample260807-h1bvssef25
SHA256 ebcaf56dfc29f499ba5aa3bb8659e16127e96fa9ea51950ecb042498038672b6
MD5 1e26e68884030491880f4224568662c2
SHA1 29f090ad6623086cd7321567aae425bdde668532
SHA512 dcd40b5e4bbc9866385d0952b3836279b5e07b118dc955dd544a42cf98a7a029c49d995a055fcd6d003a26af9bf10ca1ff93fcf0108b20581d02e70d0c12442d
SSDEEP 786432:SfNeoyjaUZtWTpM5a+DBF8pZVJYoudREPRsJVRtzxgZTGpRbjr4Ux7MqrMqQ:SFX+BEpTZNudR7V7xgZT+RbvnMUI
TLSH
T107A733823F8903CD3C3CDCB56296BC1B18D94E1D4946A6BEA160FC7164E2DEEE6493C5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  VoicemodProv1.2.6.8.x64.ins.taiwebs.com.rar
- Size 42.5MB
- SHA256 ebcaf56dfc29f499ba5aa3bb8659e16127e96fa9ea51950ecb042498038672b6
- MD5 1e26e68884030491880f4224568662c2
- SHA1 29f090ad6623086cd7321567aae425bdde668532
- SHA512 dcd40b5e4bbc9866385d0952b3836279b5e07b118dc955dd544a42cf98a7a029c49d995a055fcd6d003a26af9bf10ca1ff93fcf0108b20581d02e70d0c12442d
- SSDEEP 786432:SfNeoyjaUZtWTpM5a+DBF8pZVJYoudREPRsJVRtzxgZTGpRbjr4Ux7MqrMqQ:SFX+BEpTZNudR7V7xgZT+RbvnMUI
- TLSH
  T107A733823F8903CD3C3CDCB56296BC1B18D94E1D4946A6BEA160FC7164E2DEEE6493C5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion discovery execution installer persistence ransomware spyware trojan adware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Drops file in Drivers directory
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: File Deletion
  Adversaries may delete files left behind by the actions of their intrusion activity.
  defense_evasion
- ConfuserEx .NET packer
  Detects ConfuserEx .NET packer.
- Drops file in System32 directory
behavioral1 behavioral2
- Target
  Voicemod Pro v1.2.6.8 (x64)/Crack/VoicemodDesktop.exe
- Size 2.7MB
- SHA256 2a4176466f2a9cb6edfb74f04ecc737672363876b7df6b06fe5132533eaf0d05
- MD5 237551f6b806666f9c0c3f5669380195
- SHA1 5a7aa3c8460e1be4e4cd3d244a59b285a8dcdda6
- SHA512 87eaa33d93513f217d754acde0191ae0c7b73a9443602e8cbb44da09e66a33a19bcbb8a503fce7a08ed15174afe5f1dc708896fb415fca174a721b22bf969f69
- SSDEEP 49152:/3bKUlADq0GArjFFLqIHaLafIXYXpdwbSC:eUToFFL5HHfWwpdweC
- TLSH
  T188D5AD0137A0C908E46A1E768D30C5EC5332BC0AEF65E64F75DA3B6F2ABA7814D11767
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- ConfuserEx .NET packer
  Detects ConfuserEx .NET packer.
behavioral3 behavioral4
- Target
  Voicemod Pro v1.2.6.8 (x64)/Crack/lib/VoicemodSDKDotNET.dll
- Size 22.4MB
- SHA256 7e936df694ae0dcddf6ba8a154f88ec6b9c44a782322757112d594df2ebb3962
- MD5 387497039e5dd83a0d599df223b3a4f7
- SHA1 b3e42f1aa6eb776eeb42e398797e6ef7cdff257f
- SHA512 69604fe4ce014aaeefa310111b7cd7d424cf11537b080cfb6733ff43a53c66b32e662a4b73218d05b6e364900363a7145cea7f2bf1db4a7202a28e01ff781e21
- SSDEEP 393216:8m8S+7v/NOmhOM88xlLJApEC5L9Ln57Svnesezx5I+W0Y65NTBjAcs:8vv/Yme8xdCS2L9j5753KL095Nm
- TLSH
  T1F8372257F5849CAAD0A1507040E72E71BAB078AD833393D7C7A8567A7D337A00EB93B5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral5 behavioral6
- Target
  Voicemod Pro v1.2.6.8 (x64)/Readme.txt
- Size 767B
- SHA256 9b28a2e6ba7487dc60eff0830e14cb2acef4bccec5fd862fe887ab090ffc2aa7
- MD5 0bd66aa6b6af01652f1a1a00148b6c98
- SHA1 846b6b12f1025694f5796687a61e0e4ca819f958
- SHA512 0d61a96b65f098b7d08d684696db711eb1f641fe58cb598cecb1f36cd4d6ac48894c88f59682d1edc2cf479d06838268a0cdb7ad113ad9bc86e5f931b2d6120f
- TLSH
  T19F01DD9E7D32D3200922D30C70095168F717F968A281889570AFD0A136D57B5F5FC1CC
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral7 behavioral8
- Target
  Voicemod Pro v1.2.6.8 (x64)/VoicemodSetup.exe
- Size 22.2MB
- SHA256 afd7452c34570e409fc0c2bc8a22fb7429a3cc8f48e85fe6a154656ec020330d
- MD5 2c74a59f3a312c9003e3bdf2f458c87f
- SHA1 97b1ede9c186ea36a74bceb1bf5e5689aad99086
- SHA512 b5e8810733694aa773c4c3b8a4063e5fddd962b64d2ad697223ddeb7337f09e8c21fc1efdb2c13c854f2e6884940fac217338e0839fd21d2b4db3c2da031a392
- SSDEEP 393216:D2MvvQScyvXuaXVTwkBgoEMNBrDXLuzLYzCdcv8p5UPxaMQlBf4PrE:SMvVcysoEcLuzLig5p5UPxtyAP4
- TLSH
  T13037339EAD1202F1ED31F6384C4866A61B7BB2ED3B2C5C12A57D47E19B34C736487638
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware discovery installer persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral10 behavioral9