a83c39d39f70b50decaca1365ee59520ef0b54f07785ada5c05695975760c2f5

General

Target
wondershare_filmora_10.1.20.15.zip
Size 251.5MB
Sample260813-tathpsbh76
SHA256 a83c39d39f70b50decaca1365ee59520ef0b54f07785ada5c05695975760c2f5
MD5 26392e28386bfe70d80edbbdc03c66dd
SHA1 e09678d537c0eb0fdeb829c68c0a9d74fe003b23
SHA512 037bafecf10034135468ebc6e4b4dcda32d57539445d4c5bf6fe1d1928fb6c8c221f127c903d5e34acb3a06a4dca0fa1b688dc41ea4fa48a535f2cb494103e62
SSDEEP 6291456:WT0zgIU895KoX/VfsO2V9/L9dciQnN+ihwZ4PkVKF:WToU8+igV5L9dOEAwykVKF
TLSH
T15EC833DAACFF1126A897355054AF1830DA7E2161FB66D4371F818640AD6FFB3BAF0244
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  wondershare_filmora_10.1.20.15.zip
- Size 251.5MB
- SHA256 a83c39d39f70b50decaca1365ee59520ef0b54f07785ada5c05695975760c2f5
- MD5 26392e28386bfe70d80edbbdc03c66dd
- SHA1 e09678d537c0eb0fdeb829c68c0a9d74fe003b23
- SHA512 037bafecf10034135468ebc6e4b4dcda32d57539445d4c5bf6fe1d1928fb6c8c221f127c903d5e34acb3a06a4dca0fa1b688dc41ea4fa48a535f2cb494103e62
- SSDEEP 6291456:WT0zgIU895KoX/VfsO2V9/L9dciQnN+ihwZ4PkVKF:WToU8+igV5L9dOEAwykVKF
- TLSH
  T15EC833DAACFF1126A897355054AF1830DA7E2161FB66D4371F818640AD6FFB3BAF0244
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1
- Target
  Wondershare Filmora 10.1.20.15.exe
- Size 251.6MB
- SHA256 a6e28c4e283d15bd2e11d1046e25c249a3549bfe6886eedf08b5ada30a5ce697
- MD5 696caf4860073f1b009e1674c5d9b05a
- SHA1 08452732807223263f36a0169d9169311aef1122
- SHA512 7acc235a790618024cb18e5ff0c2a93ea2691988b7aea07cb324d55052764bf393337dd93bc5caff95f11687be2511f40ea971bc2ac5562b5d6d247914239a79
- SSDEEP 6291456:lS+rV48M5Zm2TNl3cqUqBWBPFkMKnNn/WoRx+tPXkQ:lSL8MqEOqBePFaR/5RqPXkQ
- TLSH
  T184C833AAFCFF1177D4A3353C549F1834DBA62951F962D4AB0A41E180687FFB26AF0640
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery installer
- Executes dropped EXE
- Loads dropped DLL
behavioral2
- Target
  _Readme.txt
- Size 2KB
- SHA256 a2cc4e1a1055da8b0c48207d1bd1e082b2986608c89828f4462c5b19bb5e2e76
- MD5 c10ab4038591820074ad1e94a421f796
- SHA1 d3b0cb982238cb30fc68fdcac24627b7a2265bb5
- SHA512 39d1b37ba86fccec583e3613b6e74bd09c028c9de67eff5b6477330c1c99cd468232823d04f452dcde2ffdb5c1b9b218943ef36383a834df3f73a3a13a4982e5
- TLSH
  T106511257C36E6C6D4240B00BE90EBECAF66B55BD7B6993623028387D37DD424962811C
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3
- Target
  _Silent Install.cmd
- Size 1KB
- SHA256 a19250af28c4a5af8a46e11131461656dabaa49794fc1c365736f0d2afe1131d
- MD5 b62a83838e9f673b0f540aea563feb92
- SHA1 ee3f65ee1b808f1d8d93ac7ae2a407f94e2831d7
- SHA512 0886bd567e18b23b75341cb370c3442558c34866949b65a43e19d1e9cd9b24c29965116fbd9768fec9d8aacd71d0b8ad78c65d7710c33ce0100778409b978786
- TLSH
  T18F115A373670E54C93B00F842D749922742122DB2DB20E60B47F403B87A46C878BCF9B
- MD5 SHA1 SHA512 TLSH
Score

7^/10

adware discovery execution installer persistence privilege_escalation spyware
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops file in System32 directory
behavioral4
- Target
  _Unpack Portable.cmd
- Size 1KB
- SHA256 03cb1a099cfbd03ff470c17fc583a4fd0a6471f6bf9fd911257d3c69fc7e2ddf
- MD5 be0541b5f90e79aa8a564391a7ae604a
- SHA1 0668b8161a40c2304b19cd60bec660e49116bd0f
- SHA512 dc733f891286d17b141f8974bb1fca674181faea7638e69b76c3d8b5d98ce4852b8fbcf3b74380723b9779e774eb87a8d438563f437c28eb93e6822e3ba0b1a6
- TLSH
  T1CC115A277670E54C93B01F842D759922B47122DB2DF20E10B07F443B87A56C8786CB9F
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware discovery execution installer persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral5