Overview

overview

5

Static

static

3

VLC Media Player.exe

windows10-2004-x64

5

VLC Media Player.exe

windows11-ltsc_2024-x64

5

$PLUGINSDI...LL.dll

windows10-2004-x64

3

$PLUGINSDI...LL.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...gs.dll

windows10-2004-x64

3

$PLUGINSDI...gs.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...ec.dll

windows10-2004-x64

3

$PLUGINSDI...ec.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...ss.dll

windows10-2004-x64

3

$PLUGINSDI...ss.dll

windows11-ltsc_2024-x64

3

NEWS.vbs

windows10-2004-x64

5

NEWS.vbs

windows11-ltsc_2024-x64

5

axvlc.dll

windows10-2004-x64

5

axvlc.dll

windows11-ltsc_2024-x64

5

libvlc.dll

windows10-2004-x64

1

libvlc.dll

windows11-ltsc_2024-x64

1

libvlccore.dll

windows10-2004-x64

1

libvlccore.dll

windows11-ltsc_2024-x64

1

lua/http/custom.js

windows10-2004-x64

3

lua/http/custom.js

windows11-ltsc_2024-x64

3

lua/http/d...w.html

windows10-2004-x64

3

lua/http/d...w.html

windows11-ltsc_2024-x64

3

lua/http/d...w.html

windows10-2004-x64

3

lua/http/d...w.html

windows11-ltsc_2024-x64

3

lua/http/d...m.html

windows10-2004-x64

3

lua/http/d...m.html

windows11-ltsc_2024-x64

3

lua/http/d...w.html

windows10-2004-x64

3

lua/http/d...w.html

windows11-ltsc_2024-x64

3

lua/http/d...w.html

windows10-2004-x64

3

lua/http/d...w.html

windows11-ltsc_2024-x64

3

Sharing

Copy URL Twitter E-mail

General

  • Target
    VLC Media Player.rar
  • Size 42.9MB
  • Sample260810-wsbrqavbqc
  • SHA256 7fe9bb8fdc084a1b698eca1c1133c83123acafabe6727d4bae82a97c022cdd0b
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
discoveryexecutionpersistenceprivilege_escalation

Malware Config

Targets

    • Target
      VLC Media Player.exe
    • Size 42.9MB
    • SHA256 9742689a50e96ddc04d80ceff046b28da2beefd617be18166f8c5e715ec60c59
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    5/10
    discoverypersistenceprivilege_escalation

    • Event Triggered Execution: Component Object Model Hijacking

      Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

      persistenceprivilege_escalation
    behavioral1behavioral2
    • Target
      $PLUGINSDIR/LangDLL.dll
    • Size 8KB
    • SHA256 42c46cde21b03935314697ef444b01d85e319fc443519bde35fec90c8b21fc98
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral3behavioral4
    • Target
      $PLUGINSDIR/System.dll
    • Size 28KB
    • SHA256 b07a12c5ced6a1ece5e7dc4103f8b3e15bf77f5edb70daef115b9a77bcf55885
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral5behavioral6
    • Target
      $PLUGINSDIR/nsDialogs.dll
    • Size 14KB
    • SHA256 47a1976b7736371b9b2e073ef0dd49db3bdbe604ec9ee77e50621e5f19d9ae7b
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral7behavioral8
    • Target
      $PLUGINSDIR/nsExec.dll
    • Size 10KB
    • SHA256 2790ae9ffc256e0c1b8f9570858920ffa5a224c15939c84ee01918102e1dfd0a
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral10behavioral9
    • Target
      $PLUGINSDIR/nsProcess.dll
    • Size 38KB
    • SHA256 72d4ec8a496c7057f676bb6c0d3ae872f22fa88efe2aaced163ee1f429534dde
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral11behavioral12
    • Target
      NEWS.txt
    • Size 214KB
    • SHA256 310a9ccb2ff5dfc4f9bf7d5e971708b8d7af93d7c864fededfa104a4c97bbc31
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    5/10
    execution

    • Executes a VBScript file via the Windows Script Host.

      execution
    behavioral13behavioral14
    • Target
      axvlc.dll
    • Size 1.3MB
    • SHA256 ee55b5ca4494dae67e5328128587829e1417e732d0f76858b473c834d5306419
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    5/10
    persistenceprivilege_escalation

    • Event Triggered Execution: Component Object Model Hijacking

      Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

      persistenceprivilege_escalation
    behavioral15behavioral16
    • Target
      libvlc.dll
    • Size 189KB
    • SHA256 095d164633af53ac015dcd76540e8523744f57d506db111f19b3fdd9d6180833
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral17behavioral18
    • Target
      libvlccore.dll
    • Size 2.7MB
    • SHA256 2ddb85b36650f85b5a09724c5b17428b1b1b76bd3e3dd85b643933659d5e333d
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral19behavioral20
    • Target
      lua/http/custom.lua
    • Size 474B
    • SHA256 a6623694797e67dc0f22e4f64570825e489d2730676e02db9d6911a04d2cb1ca
    • MD5 SHA1 SHA512 TLSH
    Score
    3/10
    execution
    behavioral21behavioral22
    • Target
      lua/http/dialogs/batch_window.html
    • Size 889B
    • SHA256 5189cdb57f5b2e8c3add7e6c4487f5cf8a018508c612f35c8e1305512f2176e8
    • MD5 SHA1 SHA512 TLSH
    Score
    3/10
    discovery
    behavioral23behavioral24
    • Target
      lua/http/dialogs/browse_window.html
    • Size 1KB
    • SHA256 d93c774a7aeb4594f56b37e81838ba03b6855c2bbd91eb8cb803dbd413c5e571
    • MD5 SHA1 SHA512 TLSH
    Score
    3/10
    discovery
    behavioral25behavioral26
    • Target
      lua/http/dialogs/create_stream.html
    • Size 14KB
    • SHA256 fdfc3417223b88d2e8f0421ced4711760ab11a3c18a50dc05b805a0f4f1a5134
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral27behavioral28
    • Target
      lua/http/dialogs/equalizer_window.html
    • Size 1KB
    • SHA256 62cac570011b9b07e0f421612571a1ce663e49dd3b90a16cf31d8855f1adddac
    • MD5 SHA1 SHA512 TLSH
    Score
    3/10
    discovery
    behavioral29behavioral30
    • Target
      lua/http/dialogs/error_window.html
    • Size 501B
    • SHA256 75d1a1ab807cd97801bc37ed547b26c7b357497e82d01221ac064497c9480304
    • MD5 SHA1 SHA512 TLSH
    Score
    3/10
    discovery
    behavioral31behavioral32

MITRE ATT&CK Enterprise v16

Tasks

static1

Score
3/10

behavioral1

discoverypersistenceprivilege_escalation
Score
5/10

behavioral2

discoverypersistenceprivilege_escalation
Score
5/10

behavioral3

discovery
Score
3/10

behavioral4

discovery
Score
3/10

behavioral5

discovery
Score
3/10

behavioral6

discovery
Score
3/10

behavioral7

discovery
Score
3/10

behavioral8

discovery
Score
3/10

behavioral9

discovery
Score
3/10

behavioral10

discovery
Score
3/10

behavioral11

discovery
Score
3/10

behavioral12

discovery
Score
3/10

behavioral13

execution
Score
5/10

behavioral14

execution
Score
5/10

behavioral15

persistenceprivilege_escalation
Score
5/10

behavioral16

persistenceprivilege_escalation
Score
5/10

behavioral17

Score
1/10

behavioral18

Score
1/10

behavioral19

Score
1/10

behavioral20

Score
1/10

behavioral21

execution
Score
3/10

behavioral22

execution
Score
3/10

behavioral23

discovery
Score
3/10

behavioral24

discovery
Score
3/10

behavioral25

discovery
Score
3/10

behavioral26

discovery
Score
3/10

behavioral27

discovery
Score
3/10

behavioral28

discovery
Score
3/10

behavioral29

discovery
Score
3/10

behavioral30

discovery
Score
3/10

behavioral31

discovery
Score
3/10

behavioral32

discovery
Score
3/10