f0bc5ea7846f15217d3a3b18b7ae5d21de7396d5cd32cef179142e57639f582e

Sharing

Copy URL Twitter E-mail

General

Target
VoiceEdgeSetup.exe
Size 80.1MB
Sample260810-2va6vs1amb
SHA256 f0bc5ea7846f15217d3a3b18b7ae5d21de7396d5cd32cef179142e57639f582e
MD5 16cbd2972a32d440bb66ed56d3216306
SHA1 bf15a776759419b550795bf7c12f916297399711
SHA512 45d1752464b66d87041bb69e1cdd6ea457ae5d71d6ab45690817d2423e579fae73b6fc193ab04a40284abfe3ae3ce4686fe4299b17fdd3f936715950811ae9d3
SSDEEP 1572864:EQ8WsHMeqsGgKAzalQrQUm9l4mKdsVqbpD6X7Y2pbSLSF9aYAIWrt:EQ8W+rqJg58UIl4TCVqURDaYDEt
TLSH
T1A80833D309E2E902F55D41B759C3E8BB3CD26D920A4465C9E4833FD97A32F8D038A976
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  VoiceEdgeSetup.exe
- Size 80.1MB
- SHA256 f0bc5ea7846f15217d3a3b18b7ae5d21de7396d5cd32cef179142e57639f582e
- MD5 16cbd2972a32d440bb66ed56d3216306
- SHA1 bf15a776759419b550795bf7c12f916297399711
- SHA512 45d1752464b66d87041bb69e1cdd6ea457ae5d71d6ab45690817d2423e579fae73b6fc193ab04a40284abfe3ae3ce4686fe4299b17fdd3f936715950811ae9d3
- SSDEEP 1572864:EQ8WsHMeqsGgKAzalQrQUm9l4mKdsVqbpD6X7Y2pbSLSF9aYAIWrt:EQ8W+rqJg58UIl4TCVqURDaYDEt
- TLSH
  T1A80833D309E2E902F55D41B759C3E8BB3CD26D920A4465C9E4833FD97A32F8D038A976
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2
- Target
  $PLUGINSDIR/SpiderBanner.dll
- Size 9KB
- SHA256 996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93
- MD5 17309e33b596ba3a5693b4d3e85cf8d7
- SHA1 7d361836cf53df42021c7f2b148aec9458818c01
- SHA512 1abac3ce4f2d5e4a635162e16cf9125e059ba1539f70086c2d71cd00d41a6e2a54d468e6f37792e55a822d7082fb388b8dfecc79b59226bbb047b7d28d44d298
- SSDEEP 192:5lkE3uqRI1y7/xcfK4PRef6gQzJyY1rpKlVrw:5lkMBI1y7UKcef6XzJrpKY
- TLSH
  T1FF12D6861F9044F7E510607CA896B7EF93177B2AA382ADCBCE73849429115E32F79347
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH
  T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $PLUGINSDIR/WinShell.dll
- Size 3KB
- SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
- MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
- SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
- SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
- TLSH
  T16A51365F13BED7A4C3071738A6FBDC85749B440012C659558BB2172ABF141E0BB3CD08
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  LICENSES.chromium.html
- Size 4.6MB
- SHA256 34cbc992a26037e2e57f948ab34cf0f65c2a50503580c54309ed63246681fbd7
- MD5 19a7200e2813cfa87d728205db3de87a
- SHA1 b24e2313e0ecbee03fc132f24fe54e84850513f2
- SHA512 94b54bef938aac9156ffcd9c83d75cc8564849c1c5042de060c31f190e406f29fdf046a961a72fb71f2a5b3b41eb13a65f90fada99ba34d83a2717edee102cc9
- SSDEEP 24576:5ueBpmnLiLOU5rUrPKThrkUAQwyfQlQue:U2pmLALFyyVEl+
- TLSH
  T14026D66BBF49037306F282626A4AA4CAF31E903F375A1514346CD15C2B7B92583FF69D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  VoiceEdge.exe
- Size 99.3MB
- SHA256 2005846f8530a2e2398340b965ba391fe99e332a3a2115a668aa23b6e32bcf95
- MD5 c40e8b43c653bc1529536e0671867961
- SHA1 c7de8343b858a0a49e704d9f3b7007919a39ea82
- SHA512 152070fa67ef4e63879e1de941d67fdc0b683216d1d08a4da55dcd7ed409dae00ebf968f08085d4f4d416b105f8c070432b039d094299df44640e52bbe2930f9
- SSDEEP 786432:8qh0dolUTzdlEn6hNDfdI+0Py/w7JAL6YR7UkquP7sSf:xCdVTbEn6h9fdIPPy/UAL6YJV
- TLSH
  T132388C03E3A710ECC09DC2B59B1A9526EEB2B8851734B6DF266553112F76FE06B3DB10
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion spyware trojan
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
behavioral13 behavioral14
- Target
  bin/ffmpeg.exe
- Size 58.7MB
- SHA256 7b925211a5b9a07d37951973b280e4b083f7505d06a633a204bc1d24860c5a6b
- MD5 f32dbc60b2d8dc20f97b986fabf00822
- SHA1 0bd92d048ddbe5dceaad7b1b6af85cc85d482e14
- SHA512 dab32ff0d0de4d9df2bb06b2f414e8cc135dba2d5224fe20ea2999073b4f5ebc7563449cfd8fe8edc63dae350a595f89e78c74c17e3924b0495e909167dce1f5
- SSDEEP 393216:QsUZbVv4XkvyrXXVbRi7CL2y8ERlevb0RwcSkpcsr/HdoOVMur:qZbenfN8ERkb0Th/doOVM
- TLSH
  T1EAD79EAEE2E3959CD57BC4F0076AE763BA64782C11309A6612C55A303E37FC05B5EF84
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  d3dcompiler_47.dll
- Size 4.3MB
- SHA256 4b074a3976399dc735484f5d43d04b519b7bdee8ac719d9ab8ed6bd4e6be0345
- MD5 fea40e5b591127ae3b065389d058a445
- SHA1 621fa52fb488271c25c10c646d67e7ce5f42d4f8
- SHA512 d2412b701d89e2762c72dd99a48283d601dd4311e3731d690cc2ab6cced20994fa67bf3fea4920291fc407cd946e20bdc85836e6786766a1b98a86febaa0e3d9
- SSDEEP 49152:cwBNwAqRvTvbehyCZ5xRmhErU6jFyU+dQZTHchy0eQago4I+oiP85+hA6+Se4QQU:SUZ5P7FwcAgLbz+3s0Bm
- TLSH
  T181267D5676A810E9C17BC178CA474317EBB1B81403349BEF1590C669EF73BE26E3A724
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17
- Target
  ffmpeg.dll
- Size 2.2MB
- SHA256 986eb7b4bd5c94328619164e06c099a9b1df9b3a87d2130b9c15ccb87d4c7e69
- MD5 cd984b487da3cee8c0a70d5b9a3b87e9
- SHA1 f622e69cf4cae7e6914e2b3b8877b339892dd088
- SHA512 e942ae27d7e193fed09265af7e132ed2dff3b92639d8479e892a7c27ba861cb075184dcf88f26d2db18684bdca7630106bb969c29af983eb24d1fc40cad1f4ff
- SSDEEP 49152:xspMRI28259LtbjsjdbVmofrZq/zPhmFyuPAfL1s2OwGNbHRtL:x4b2aux6LNbHD
- TLSH
  T1ABB5AF07F5FA00E9C02AC27487ABA633FA367C4A4521772F1690A6253F7BF905B5E705
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral18 behavioral19
- Target
  libEGL.dll
- Size 367KB
- SHA256 d8b13252dd926fc74b4af4a5f87e3da30d4188e5e7b4781affea16a34f24820b
- MD5 7684c2ff8e5bcd7e15dd3760ae0b7c6d
- SHA1 c3084466c04afc6ab81e9a159ba705f18f308313
- SHA512 a84fa16a94f6d1afe6d9b2a14482792e256e195f086e2db68d2d5f982f1b261f6b65933de7609ea5742552204cd44bf54465b36131e6bf6ba03a9b4e794c5c72
- SSDEEP 6144:Pj0Aq7pjRaVlgZrNJserEW848VvGy1+Gew8YUox9JctrO:Pj0F7p4lgZZJsmbk+Gew8SH
- TLSH
  T15A846C16F7A048BAD066D434CE338A02DA72BC8E0E65A75F3395425D2F77BA45E3D720
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral20 behavioral21
- Target
  libGLESv2.dll
- Size 7.6MB
- SHA256 cce4122453898e29be603bc4f67b93fee25e6320034249024d7ffc573e11e026
- MD5 c713af1d3ca92fcf957333ac2a8e7d30
- SHA1 0af8173c3662531b1ff7e47bcd8dbf6b9cb69d2c
- SHA512 e7e716eeb58a52eb0ca5963ef449d0a7a623cabc9532fbdbeb6814f304253b08cfb83982fedd3cc1ac631a2e57e8963a08f351c4d3b0fd1c27c958693d02b993
- SSDEEP 49152:hBEbTQTrGcTMRQd/XXZ273umaiFU/c8+tx2agOBqZ9dTpnVS4CepY/23LdIdBrDg:siXXZ27dU/DOUKz39/Z7CdnyEMqeSD
- TLSH
  T17E867C03E1A145D9C41EC278C717A622EB35BC891A61F39F229873213FB6FA15B2F754
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral22 behavioral23
- Target
  resources/elevate.exe
- Size 105KB
- SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
- MD5 792b92c8ad13c46f27c7ced0810694df
- SHA1 d8d449b92de20a57df722df46435ba4553ecc802
- SHA512 6c247254dc18ed81213a978cce2e321d6692848c64307097d2c43432a42f4f4f6d3cf22fb92610dfa8b7b16a5f1d94e9017cf64f88f2d08e79c0fe71a9121e40
- SSDEEP 3072:1bLnrwQoRDtdMMgSXiFJWcIgUVCfRjV/GrWl:1PrwRhte1XsE1l
- TLSH
  T1EBB37C1274C0C471E5732A361974CAB14AADFD700E759FAF6398127A4FA01D09A3AFB7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral24 behavioral25
- Target
  swiftshader/libEGL.dll
- Size 392KB
- SHA256 2db0def105d9a68123a5685461c0aca947cffa17c6b04d4a5bc2fd6e12fbb64a
- MD5 5fbdce7cdf5e2d3f16e2b2ad49e177c9
- SHA1 f96a817f8b137792151bede9a592b5ae4b0243d8
- SHA512 b62d0cb6856c769e8ce265df9359f6616879528a20d1d3211cf16a1e3914580925a75f3982349436bc8a0e3a65a34235c6f9410879cda6a98662ab31a3074d80
- SSDEEP 6144:Z3lNvD9dUn+x5WiqCff0vDixSx9+6ipIJqH48rrAKaWL0W:Z3lNvxdUn9iqCfsFcIJqUKar
- TLSH
  T13C847D16F7A048B9D067C034C9238A42DA71BCDE0F65E29F2395425E2F77BE49E39720
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral26 behavioral27
- Target
  swiftshader/libGLESv2.dll
- Size 3.6MB
- SHA256 a33d4dd95f38df36f3e354dfd9a7afcb953df3b48be043d967f0dd7780d70985
- MD5 7f20edd230038aa67be6bb4369c89113
- SHA1 e03c5cf9fcecb04ddeff2e610f300c40d583525e
- SHA512 bad87b013a7a16955f20d7db2854fcdcfad12ffea1f41f1e6e48a92706d37bb43e892281925f222d77e3e2a22d13c4a15763d9342a7d58d7b1ef969aab7d5a19
- SSDEEP 49152:7E8gY3DuOpn+em8kINB/2xPkhDZ0SmDxcJtaRL96Om9MQ0xehKyRGZP+mt1G3eWE:L7GkhDpoWJtaPm9MQ3cA3
- TLSH
  T11706E803D66F90EFE056EA35971BB332D1B578C574387976676239112BE27202B3B388
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral28 behavioral29
- Target
  vk_swiftshader.dll
- Size 15.9MB
- SHA256 fcca28c9e3ef7e66bc2c35918f4b046795bc8d64fc30f5130dfacff3d6b3c63d
- MD5 b883a1ae0d9771c0d51ef8762c068a51
- SHA1 8ec9519130089b76aa36a241a0869810a52aeee8
- SHA512 c1b9cd17387c1736aa280084536adad5cb5598c76754c68756db35b456284179eab4f55c7403b0c81f78a1bfbe01cd0d6cdfdc9d2efae58302e0cefc34e32ccf
- SSDEEP 98304:6vdxnCXb79l+a0doAmuaZ3Wpzwd9OMof2F5BSYFICa3DZtqST0EWUXmIc/JS:6zW901tpzwblF5BS27a3DZmemIEJS
- TLSH
  T1B0F65A03F6A98099C05DD5799F17E332E670BC84592A7BAF77913B262F71B602B2D304
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral30 behavioral31
- Target
  $PLUGINSDIR/nsExec.dll
- Size 6KB
- SHA256 5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
- MD5 ec0504e6b8a11d5aad43b296beeb84b2
- SHA1 91b5ce085130c8c7194d66b2439ec9e1c206497c
- SHA512 3f918f1b47e8a919cbe51eb17dc30acc8cfc18e743a1bae5b787d0db7d26038dc1210be98bf5ba3be8d6ed896dbbd7ac3d13e66454a98b2a38c7e69dad30bb57
- SSDEEP 96:YjHFiKaoggCtJzTlKXb0tbo68qD853Ns7GgmkNq3m+s:JbogRtJzTlNR8qD85uGgmkNr
- TLSH
  T173D109B836C20CF3D54E46743E22381713FEE4761B7502A18B976ED61D92AE2FE20781
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Checks installed software on the system

Checks computer location settings

Loads dropped DLL

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32