8f3f69c3e7cd291c2927bf5c769682f5fbae353490dc88cd4f0872a2cc35a4df

Sharing

Copy URL Twitter E-mail

General

Target
VoiceChanger64(2.05).exe
Size 1.3MB
Sample260809-tkx9mstzet
SHA256 8f3f69c3e7cd291c2927bf5c769682f5fbae353490dc88cd4f0872a2cc35a4df
MD5 2ef3516c45baee2bb4af3d0592dc302a
SHA1 bc8676d1209c30e3046cfafb1ef3d9e749df2830
SHA512 60d4fdc002de093978a2903f5a95052c764c351f9221bd52e95deb1fcdaa3f531298a9237a511373ac71714ddd2a57f48e8130e5eb2583bf3e94d5e1ee52720a
SSDEEP 24576:YYDy0wgoUYwO2rrRILmzmbYfaF/PsCjM1vyOFKP/ytG3G2:JmPISwrRIAcn+tlKStG3N
TLSH
T1B655331CADE4D8A6FC320EF09EBC452D1AC6DBFC47C16A0217C15622FF61656929E387
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Targets

- Target
  VoiceChanger64(2.05).exe
- Size 1.3MB
- SHA256 8f3f69c3e7cd291c2927bf5c769682f5fbae353490dc88cd4f0872a2cc35a4df
- MD5 2ef3516c45baee2bb4af3d0592dc302a
- SHA1 bc8676d1209c30e3046cfafb1ef3d9e749df2830
- SHA512 60d4fdc002de093978a2903f5a95052c764c351f9221bd52e95deb1fcdaa3f531298a9237a511373ac71714ddd2a57f48e8130e5eb2583bf3e94d5e1ee52720a
- SSDEEP 24576:YYDy0wgoUYwO2rrRILmzmbYfaF/PsCjM1vyOFKP/ytG3G2:JmPISwrRIAcn+tlKStG3N
- TLSH
  T1B655331CADE4D8A6FC320EF09EBC452D1AC6DBFC47C16A0217C15622FF61656929E387
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

discovery execution persistence privilege_escalation
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral1 behavioral2
- Target
  $8/$8/uninstall.exe.nsis
- Size 32KB
- SHA256 3ff8b9757b854e3d38b45e5ea1a5026d3af133bd013e7537ac96cc80e56765d8
- MD5 e09c0610096c5e5e4fe9a476f177dd80
- SHA1 9a1269db3678cbb20595486efe1cb09dcbdfc84c
- SHA512 35726017ec52a958e104776530d52221df61b9f0792b2b46738f6624dbd5f3dbb6d03178b526abe0334d74b9cbc9447c7900b032d712efb910cf7948c7254972
- SSDEEP 768:md1X32bLt5rBazZOAcvWJNmrIOeIbJccFz6ZQ3xts8UsqTfdu7v:mHiXBc0ZQAHpbJccFz6ZqDs881u7v
- TLSH
  T17DE2F19CE3B06194BC52944D0ABDFCA81537A93F8AACC81495C649F24F7703F1E11367
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral3 behavioral4
- Target
  $8/APOConfig.exe
- Size 196KB
- SHA256 a2b7d8661f7a6022f625cbc74c4149e5cfc6bcaa6d164547f0e9198b126df5d6
- MD5 4860aa3d9fc91d274181dccd19b4ce02
- SHA1 92db2edbd4c153cf12788e86c3dac691d0f90aaf
- SHA512 3838951b2d13968300bd80bc617a7154f01ea7ca4d0e53520708366bf9c3dfa011482b1a73c8521a9d6eaa6cf1c5ca934a10a597a220a3bfef7cd14fe6deb901
- SSDEEP 6144:JXtzpxJqoyk6H9APPQZLFlejj85JL7g0d:bpPK9A8LH5N7gQ
- TLSH
  T1FB146D25BDC2D073E666093069E8CA759A2DF8B10F619CDB63840FFA4D346D19734B3A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

discovery execution persistence privilege_escalation
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral5 behavioral6
- Target
  $8/AudioChanger.exe
- Size 161KB
- SHA256 e661152c5140f1e6fcb21e117595e33c8252afdd429e1dba410adc6ed2ec6050
- MD5 477aee458f2096577cd21f5a44343c6c
- SHA1 c8113c63c149aa41e23bd625600d474b388c9936
- SHA512 920392401ce5b2c716b2c108281272636db817f9ad77d6b691a5f18ee227ebc95c549872bd5a5ea350418e91a25d4c5a480150254ef3a7fa885fbd91db72b376
- SSDEEP 3072:E65PxKAHTGwJyEDsUIzw69Ms9R7aXVR6+KPEqHrfSz:E6SAHTGIxw7DasraKMqLI
- TLSH
  T1F7F37D5773A030F9E5278239C8A11A46F772B87617209B9F13A8477A1F137D09E3EB61
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  $8/ClownfishVoiceChanger.exe
- Size 957KB
- SHA256 457ea92c0ba202fe562bc7801c2b59de1a55d6e76b4835a8973da2fb434baf23
- MD5 2f73974eb9d2a74cc684004dd171a132
- SHA1 c284ed40e9af18615cbf206841ab8909acd9c1b9
- SHA512 4765b79dcbf9b5650c28b0673e3bac5c6d0a8d8b3a26e22c00b5e41445eb589218c4890385e592967945cc9ad9f5e25f982d255e81e1308c5e1ab31f2ae534a9
- SSDEEP 24576:s2Uqb4KErZAcebSTOxy9Bk82HteuH+mWjK:s2H4KMO+TOxyPvuH+mWjK
- TLSH
  T19E256B903283E833E4715FB24CB9AB91DA3C7D72DFB0A8CB17D4499A49A42C15571F2B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

discovery execution persistence privilege_escalation
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral10 behavioral9
- Target
  $8/res/Alien-Off.ico
- Size 16KB
- SHA256 9d68b4ce0995e03fa5a623c36ac00d2641697f9c2120b2d4acc24b371037a729
- MD5 3f7b046b32d33fa1db6d801326c84c92
- SHA1 f267a3236f46e5160fbda29bfc0e628ab24f2d35
- SHA512 e5e1f723e41c9f4ee324883b7d2746f89b8333b17172b1dcd05e8e070caa200e184d12382140986a0ab852312878e9c1d9e6253accc558af246f69f4598ae347
- SSDEEP 192:uD10D/av2EfZsnYlMNluw/l5K4kidr+QJWQ16Ti5Y:I10DSeEfZWgMNUmloi1Eiu
- TLSH
  T1C4722D3B0A2DE813DD8064B1AB62D4FB67306D5D0665890239F63E3BF7ACA17BC0C156
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  $8/res/Alien.ico
- Size 16KB
- SHA256 99d1d4618d0ac84f70b30334c94208c617c76f8f1604f665f8dc5c424e638f4d
- MD5 b4912b4e5ac58c1da8deb5834e3c366b
- SHA1 4d3470a065095f6498e45f7303a8630063eb658c
- SHA512 aaa10258b02e41eb13e45ad5746ef5dce249020a973a83e2532bc2d20de0cba6d92d3f4bb3716f871b9eb4db633863763a087769054f9b832cd308b1e7865139
- SSDEEP 384:9S7e222222222222Rw+2u8wexKUluUvaFPd7:9Ie222222222222W9ANa7vI5
- TLSH
  T14D727DB42601A1A9D6A48C718FD4C1310B203D6EA486ED963EF8BD1F79FE2674C064D7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral13 behavioral14
- Target
  $8/res/Atari-Off.ico
- Size 16KB
- SHA256 6df6a6464c72af219094cf3787cf0d1f858e2fd3b6c5cc213deecabd911769af
- MD5 6f984a4938ba524ba9657d3c63845790
- SHA1 0b1789655b8139fa9975aea26860674a5b4fd4de
- SHA512 f7c403fbf0e3436eae86e141078db563ca7b75ee157eaac4bfd239c5a42227680598a3cf76e4f30760232f71dc3b4fffe7a5bab8d6106854be9eabc7c43298b4
- SSDEEP 96:f08opGfmdCRtijpfChf2h5hTAOPcEmvV+WAiPgopg44ld:eCRtijpkuhvTAgxgVLRSld
- TLSH
  T1217215222639BC16D46225B97503F272BB02AF631647B1A676E3DC777463DE61FE0340
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral15 behavioral16
- Target
  $8/res/Atari.ico
- Size 16KB
- SHA256 3874c8be3dc907e0f26b658fec2a551e9651933a819bc15bf9f93b578e8b5284
- MD5 b5c428102274914255a1c7f4876e2dcd
- SHA1 03c76804698ac954d950b6a7dc334fa9ae6db45d
- SHA512 daabe89489aa3f6089e05a2d96f149211d4b4338d19e68497b5531d45a8580979dea303b95bdd93f14a349c743e18e120eedabcad7a472b9dd8032f5db42aeee
- SSDEEP 96:fF4MmcfBDUD3inWmrMuxutZu2uJOu6wzYgadpbcqe9Mwc2OAPuaY8E5rFbcnjXn4:yeRrGOYe9yYuaVLLAHdRI+ld
- TLSH
  T1F772EB1DA728AD42C5653AB9C463D3F04722EF1052E186CB2EE5BDF33D266636C3D058
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  $8/res/Cave-Off.ico
- Size 16KB
- SHA256 671d371f7b2f07fc7b1e8ea9f0ab1bdf2a9055e79f3c859b19b6f579fc17987f
- MD5 fc40dfade66ab7cf24962bca246834c0
- SHA1 9f5c5dae7824afd92ae3dacc9bd72f814bb5e776
- SHA512 e0bcd0d37c1b1a4db6dec33d9b3f6471612a7e266349b744bc1e3664e908cb737304af77f3d6f91c7e44ed561b86ff4e686625301fbef4a24919df765d105efc
- SSDEEP 48:SeeBxuMtMkqCvNbvaKFqhsA5OpFIVgi1V0KDBlYXtEwRwXtWAm78O3LoYk27fxYS:aDthq0NbZFUsA5OxtK8dDRmOFtzxYOt
- TLSH
  T15A725EB2EA675F4BF759F3B0FC1A40956F273A444808621AC97E648209A201FF4FF15C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral19 behavioral20
- Target
  $8/res/Cave.ico
- Size 16KB
- SHA256 716cc28267dcdafd13ca183d11fd74394f7e55063874d5c19a088ec40e225590
- MD5 f8b303268883f3500b9723c5f82843d2
- SHA1 805cd035ae00e0fb37f3afbac9cffdd5c3b12014
- SHA512 0d4b0873c42ff4da2b908bb458c59adba5765c48c4b2168ff7749fa58bd637b483001615532ca4a4158b9e43ac6881ccf4f372d9faf29f136bd473741a975e9a
- SSDEEP 96:wTdrWLDwKJdeQYXcq9LCqh8Y86k5KRmbARaj/8AN5tmgnUYLYtp2pcX5YOt:wTGD5J0QYs9yCLsI+aoCclbsaX5dt
- TLSH
  T1CF72CAAC31044AC9EF503672D0E25386EAAC4C692864A067DFF63467367348F7EC5E31
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral21 behavioral22
- Target
  $8/res/Chorus-Off.ico
- Size 16KB
- SHA256 e472affc0a16978628ae05ddff151eb0e4fe2892989e55d3bc3e2715d9679448
- MD5 87eafaceec081d8d2bad823ec42d8372
- SHA1 515545777b7805a4ff74bfcdee79d9237a11c669
- SHA512 6957e54e9fd29ec607821ad451727cc76ab04e8ffb99b6b0fea8dcc821b4e579beb4ec4f7cad1f9e90fb638601a3752720931be1a0e3e287b5a12ac3e3d472d1
- SSDEEP 384:cNnoaGapKaVa1a3azPa6a8Fafamaxtk0XcGUa2aeWxrI:2EfBt4a2aeWE
- TLSH
  T15672F8262B68BC03D314A1B29191D6FF57343E545A4DE21334E6B9BFF914B2FE808318
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral23 behavioral24
- Target
  $8/res/Chorus.ico
- Size 16KB
- SHA256 b6e3c53bb48c2898ea96955a8df633c78035cf071842e84e31a6b265f86ed49a
- MD5 afefd408c6dff3dbb1217c497aacd33d
- SHA1 ba1439c6d07e450b16ee1326d648ded9d3c8aec3
- SHA512 205c5c0d9b1b0f4f5e844c5abee168e7d3b64da0914b70f5470d7635f68f1d2bd5eee2343017a0c4961c2c78bd4ca2f70cd5594ef99b0ba91ce5250e0f3a4ca5
- SSDEEP 384:cNnoaGaDGKaNacabaGca4aOea/aVasdaQFpHwgrwxO3hTzRRLQ:2PCw5pQOR6
- TLSH
  T1C572F8B627A8DA87D202613081CDD2390B38AE492C9FF26339EA7D6FF5347671409375
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral25 behavioral26
- Target
  $8/res/CityHall-Off.ico
- Size 16KB
- SHA256 2b04ea3f81189ce4a22abe6eb620dc65cf6bd44a2f152303096e3013068778ee
- MD5 822ce582243adb560d3a6f5b87884cf6
- SHA1 92fb5a5a4a81293cabba2b9e55fa03f0c51f0d1d
- SHA512 27208641135e35d100de11b2de6d7f808d35ede3cfad8630b7cbd366e0a750aeb634392f4905bb9c65f9477927e3ea6447bedbe59447ec24cf511cce16eb2b50
- SSDEEP 24:rnnnnnnnnGs0scsUHvel6HtY0cQMYKdkyI2fSHo6666666666666666alKPlV22K:wnKd3jS4T2
- TLSH
  T11A720AF36595B73CEA0734B24B9382F92E943848D774800DABB26F0A02273D158EB617
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral27 behavioral28
- Target
  $8/res/CityHall.ico
- Size 16KB
- SHA256 e1bca0ca6c4acc6b946d9486dea1ae89a8fa36715fc80f3a70d70d60689f0bff
- MD5 b8a844f428b535a1dfc17aac4a247041
- SHA1 c6ff6d1ddfaedf589cc0e541f159ca6e97b4d907
- SHA512 52655bfc21a68ca6e00dd21e2f5123707a7e0f51d318f86c6b33bd4ccd3d0a36f9f01123eeeaa23f48d232617919f88ff68b9b082852c0137bd27d32f2b9fd4a
- SSDEEP 48:5jjjjjjjjDNv/xUFPw+ahykOSwlka35Ukasaka4faka4akayaWakayaWakazUawI:UbOykOTpUT7TXTXTJdTJdTzDvAsTy2
- TLSH
  T1D8720CE67309EC60CD06A9F43F67A18CEC3A6CFC951BD4C9A6A1B71E153091C2AF44D6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral29 behavioral30
- Target
  $8/res/Clone-Off.ico
- Size 16KB
- SHA256 e899579042c65ee392700daf59d07252d9a4241fd70cc56a00075d2be5ce5609
- MD5 252a8304468aa4d67cdc654959f72ac5
- SHA1 4cdabf4f34cd8a27991ee08d7d0d366ce1060723
- SHA512 78854112f576c3ab88a43d1ded442361d32a4f3a5ccfe72f1317b6c0bc0b697cb6f492f5c18053667466eeb37f278c2aac9b54079ff04302c9a2862f704807ec
- SSDEEP 96:s+iN0u0u0u0u0u0u0uIXuku1hTed+Up4KgJ+/n5sss6hhhhhhhhhasChhhhhhJH:s+Q3333333IenjTed+w437D
- TLSH
  T11672EF7D7409902DD5B03038C7229AD7FEE93CAF5364B10122F66E4B95ADF42AB18287
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Event Triggered Execution: Component Object Model Hijacking

Checks computer location settings

Event Triggered Execution: Component Object Model Hijacking

Checks computer location settings

Event Triggered Execution: Component Object Model Hijacking

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32