3edc2ca4075824b3730df9ec169808328aa6eb34987d21b1968d8572f69669d9

Sharing

Copy URL Twitter E-mail

General

Target
CapCut_7542164145215373365_installer.exe
Size 2.8MB
Sample260823-j3mkrafm3w
SHA256 3edc2ca4075824b3730df9ec169808328aa6eb34987d21b1968d8572f69669d9
MD5 c74599f48386e857a8f49c530d4fb3fd
SHA1 b2a9a52329eb1c721540dbc84cec06f29a3c2577
SHA512 f4eebdad6f295865ba71e1cc441413a0b0de1e75e33e884020e67230f10e453e1d58a818ac23f0fd5618a7704470a77bd629c2f0e3a7393345b0eb161b319f57
SSDEEP 49152:cO9HDPEVrOuutETGH5BnBkZBh/5XNS/5RNrwdNsG87csIdRD655:csTMrOuoET8bkZBhB+RNcdNsB7csIjWv
TLSH
T165D52313B44C92C5D1238C3216EFE5B418636E7BDA91898B75C8FE6B35F3321521A72B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Targets

- Target
  CapCut_7542164145215373365_installer.exe
- Size 2.8MB
- SHA256 3edc2ca4075824b3730df9ec169808328aa6eb34987d21b1968d8572f69669d9
- MD5 c74599f48386e857a8f49c530d4fb3fd
- SHA1 b2a9a52329eb1c721540dbc84cec06f29a3c2577
- SHA512 f4eebdad6f295865ba71e1cc441413a0b0de1e75e33e884020e67230f10e453e1d58a818ac23f0fd5618a7704470a77bd629c2f0e3a7393345b0eb161b319f57
- SSDEEP 49152:cO9HDPEVrOuutETGH5BnBkZBh/5XNS/5RNrwdNsG87csIdRD655:csTMrOuoET8bkZBhB+RNcdNsB7csIjWv
- TLSH
  T165D52313B44C92C5D1238C3216EFE5B418636E7BDA91898B75C8FE6B35F3321521A72B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

discovery defense_evasion execution spyware trojan
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2
- Target
  $PLUGINSDIR/BgWorker.dll
- Size 2KB
- SHA256 50f735ab8f3473423e6873d628150bbc0777be7b4f6405247cddf22bb00fb6be
- MD5 33ec04738007e665059cf40bc0f0c22b
- SHA1 4196759a922e333d9b17bda5369f14c33cd5e3bc
- SHA512 2318b01f0c2f2f021a618ca3e6e5c24a94df5d00154766b77160203b8b0a177c8581c7b688ffe69be93a69bc7fd06b8a589844d42447f5060fb4bcf94d8a9aef
- TLSH
  T1C351B72E612C0BFFC2963C34BC96795B1B6FC060A39A6328813FC5853C141B4233DB2A
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH
  T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $PLUGINSDIR/downloader_nsis_plugin.dll
- Size 1.4MB
- SHA256 27d6d1e1c2ac402872b56c8c4707afbbbc43de5d7d11867735bb5a71a23c519b
- MD5 c395e079e8a264c840943874314f0532
- SHA1 b3cf58bccfe74d4813213eef1fb46d7bcd3099fa
- SHA512 2beac1305877d7b5c6fdeaf8b4afedc07e0b7917eafe5e9661a31bd60ab360362074f5aceb375bee68d9382e377fa003c23d6a1b82f760556ece0a2b61c4a41b
- SSDEEP 24576:gCWp5ZPAvtU0WQKylwLYqkT8c9HHk1RZ1zXqp:epfovflwtkoc9k1RZ1zW
- TLSH
  T190658E40F6D190B4C85B62317A2DF63C2E6D6B124F2189C7E3D5BDA829726D349313BE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  $PLUGINSDIR/shell_downloader.dll
- Size 2.2MB
- SHA256 66c1fc24e57c9c2ec3cb402a1bd726e1cd64b65594cf26a453667044f05cd147
- MD5 1edc2bde956d237c71172e2fdec2cd9e
- SHA1 4bc334d00628a9c5b66befcb7ca792c0d52c41cb
- SHA512 56dac50ef666f57c1cae193c5af97b196dedb77b032fa6bac388340fa3283facba20852cdb98d219f9dd017a680ec4da4040b020d74338eedf7db8a8bcd59ccd
- SSDEEP 49152:7GjH1+RJNU63iadSBUVjNu2GYut5zemWhqS:7GjHe3G+PVE2Duzzem
- TLSH
  T115B5AD42B46290B6C94A2172345DA77C9E380B484B64DDD7DBC06CE47BF16D32A3E39E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11 behavioral12

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Suspicious use of NtCreateThreadExHideFromDebugger

Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12