d4e1d3f62a1db904d3ab5c776ddcbb39ac74469e5ca3ed723e3dcef89ebcefeb

Sharing

Copy URL Twitter E-mail

General

Target
Install_Xfer_OTT_137.exe
Size 8.0MB
Sample260823-lpj9ksvgph
SHA256 d4e1d3f62a1db904d3ab5c776ddcbb39ac74469e5ca3ed723e3dcef89ebcefeb
MD5 d37e8c8e92d55af5d4eb031d07544238
SHA1 1b8a72704a8a6b871cc90ac6c72155a9f7779c6a
SHA512 6a3236fb58dfe8fd502e44910f202323c319f12a6f3dca9f0d67b001a70c58a1838efff58c2f48455b6b09084a2aab12bcc523a5837dbbf4f566de9afc118a67
SSDEEP 196608:+E2a9qG01Uk3Go9DT9+ovDJC21i0hVynPu89M+xkKzl:+doR0173GYDT9+mJC21iMVyPmAdzl
TLSH
T1748633877B15A8CAC4DC16F01BCEC836B6964DF2171013E356D0AE2FB4EA9C744C6B56
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution

Malware Config

Targets

- Target
  Install_Xfer_OTT_137.exe
- Size 8.0MB
- SHA256 d4e1d3f62a1db904d3ab5c776ddcbb39ac74469e5ca3ed723e3dcef89ebcefeb
- MD5 d37e8c8e92d55af5d4eb031d07544238
- SHA1 1b8a72704a8a6b871cc90ac6c72155a9f7779c6a
- SHA512 6a3236fb58dfe8fd502e44910f202323c319f12a6f3dca9f0d67b001a70c58a1838efff58c2f48455b6b09084a2aab12bcc523a5837dbbf4f566de9afc118a67
- SSDEEP 196608:+E2a9qG01Uk3Go9DT9+ovDJC21i0hVynPu89M+xkKzl:+doR0173GYDT9+mJC21iMVyPmAdzl
- TLSH
  T1748633877B15A8CAC4DC16F01BCEC836B6964DF2171013E356D0AE2FB4EA9C744C6B56
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Loads dropped DLL
behavioral1
- Target
  $LOCALAPPDATA/Xfer/Uninstall_OTT.exe
- Size 99KB
- SHA256 f27718f1350b9f46eb26905645a50fa806802c85b49f8d5dbb13b47a78008613
- MD5 9a2c647d8deda681b0e5e97f2d7a86d1
- SHA1 6601a2625824f4a25861606f8acd42a400c14cc2
- SHA512 4018e2493ea6b39e1770ecca3e4d60514abcccea689b5c46f95997d715d1ef71d7bc96295f5a0cc42ac88f68c50d3c90ca73884076fc5ffafec1a47eed4f37f0
- SSDEEP 3072:fNRCywDw1DiJku/Zx+5kqWHK37YFOFv6h:fT4DtbEkzOZU
- TLSH
  T179A3BF017720EC53CEB306B02579D77B5FB2BE7616A1CB4713E0ED0BBC92A926D09285
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Executes dropped EXE
- Loads dropped DLL
behavioral2
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 7a9ddee34562cd3703f1502b5c70e99cd5bba15de2b6845a3555033d7f6cb2a5
- MD5 564bb0373067e1785cba7e4c24aab4bf
- SHA1 7c9416a01d821b10b2eef97b80899d24014d6fc1
- SHA512 22c61a323cb9293d7ec5c7e7e60674d0e2f7b29d55be25eb3c128ea2cd7440a1400cee17c43896b996278007c0d247f331a9b8964e3a40a0eb1404a9596c4472
- SSDEEP 192:nenY0qWTlt70IAj/lQ0sEWc/wtYbBH2aDybC7y+XBDIwL:n8+Qlt70Fj/lQRY/9VjjfL
- TLSH
  T1F6427D1193B089F2F590593805A67F2A6FBEAC5C27E44963CFE345853D702DFA47A243
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 6bf9cccd8a600f4d442efe201e8c07b49605ba35f49a4b3ab22fa2641748e156
- MD5 48f3e7860e1de2b4e63ec744a5e9582a
- SHA1 420c64d802a637c75a53efc8f748e1aede3d6dc6
- SHA512 28716ddea580eeb23d93d1ff6ea0cf79a725e13c8f8a17ec9dfacb1fe29c7981ad84c03aed05663adc52365d63d19ec2f366762d1c685e3a9d93037570c3c583
- SSDEEP 96:oFsvUu3Uy+sytcS8176b+XR8pCHFcMcxSgB5PKtAtgt+Nt+rnt3DVEB3YuNqkzfS:oFsvWyNO81b8pCHFcM0PuAgkOywIFc
- TLSH
  T19112F992E5A450B3C5D6533A35AA2F2DCBBD5329B0926C00C7738E4D39355B66E38343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral4
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 7a9ddee34562cd3703f1502b5c70e99cd5bba15de2b6845a3555033d7f6cb2a5
- MD5 564bb0373067e1785cba7e4c24aab4bf
- SHA1 7c9416a01d821b10b2eef97b80899d24014d6fc1
- SHA512 22c61a323cb9293d7ec5c7e7e60674d0e2f7b29d55be25eb3c128ea2cd7440a1400cee17c43896b996278007c0d247f331a9b8964e3a40a0eb1404a9596c4472
- SSDEEP 192:nenY0qWTlt70IAj/lQ0sEWc/wtYbBH2aDybC7y+XBDIwL:n8+Qlt70Fj/lQRY/9VjjfL
- TLSH
  T1F6427D1193B089F2F590593805A67F2A6FBEAC5C27E44963CFE345853D702DFA47A243
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5
- Target
  $PLUGINSDIR/advsplash.dll
- Size 6KB
- SHA256 62b3db0446750ca9fd693733eec927acc1f50012a47785343286e63b650b7621
- MD5 1871af84805057b5ebc05ee46b56625d
- SHA1 50e1c315ad30f5f3f300c7cd9dd0d5d626fe0167
- SHA512 c1979ee98dfdb807776c439218528d80b4b244a87e692f1538e40f9c2c82db8b77485eb1429325b6f44419bf1f4cd454e43ff381eff077a8b4f4d9eb0d7e54d4
- SSDEEP 96:kIUNaXnnXyEIPtXvZhr5RwiULuxDtJz+wolpE:kIx3XyEwXvZh1RwnLUDth+I
- TLSH
  T16FC1B837A2C261F3D29B01B168467BA343A59871375259580DA3C9C9ED92DA7DC14743
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral6
- Target
  $PLUGINSDIR/modern-header.bmp
- Size 25KB
- SHA256 12c8ee2d311771db4e2734f25fa2edec27f57829226dff796cd61bea01c90db8
- MD5 6a7dfbb00ffd72ef54b21f9664b67b53
- SHA1 336b2cea8f8d82028e3587b6bb10ef06a2197450
- SHA512 bf5b3d24339c9f91c8d4261e1457a8e5ad4a44a0d34032e8415d636a81695fd2e3c61647e00044d61e9379bda9d1c83514cbfb1a77666cbc918d38cfc4f18763
- SSDEEP 192:dh0nORlC5rJnWlfCEyP4moPg7aVLKYq07msvrdlN:jKysueBu6ArdH
- TLSH
  T1D9C26382171CCC03EA90EED58DB3C8EFC1537D699CA16487F464B3AA16BE7B1110EA74
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7
- Target
  $PLUGINSDIR/modern-wizard.bmp
- Size 150KB
- SHA256 54eec84988f8d5d5f1cdfefd74333dbcd85b1ff525b2b1f9cac6de9905cefe1d
- MD5 fd944873f187518849e6e3336c45f968
- SHA1 3ba4d7d455372a329eb44200ecdd2e3075869047
- SHA512 d2bbbc19e4114fc68c695664bf8c5ba4f04e96f24b002f4e37c8147f946c32c043a97723f6536c4a8895384a2c119fd2fb8042e3e27a16fdf55d4f779e0e1f3e
- SSDEEP 192:8tq4juZtJc621zAgTZoN5qxtCZiF46E5tOPfPq5hFziRZG:8tqvtW6tUinK
- TLSH
  T173E394EC7911C899DFB9367079A1258022A37CD30BC68207F0BB372D557B1A96B0FC96
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral8
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 6bf9cccd8a600f4d442efe201e8c07b49605ba35f49a4b3ab22fa2641748e156
- MD5 48f3e7860e1de2b4e63ec744a5e9582a
- SHA1 420c64d802a637c75a53efc8f748e1aede3d6dc6
- SHA512 28716ddea580eeb23d93d1ff6ea0cf79a725e13c8f8a17ec9dfacb1fe29c7981ad84c03aed05663adc52365d63d19ec2f366762d1c685e3a9d93037570c3c583
- SSDEEP 96:oFsvUu3Uy+sytcS8176b+XR8pCHFcMcxSgB5PKtAtgt+Nt+rnt3DVEB3YuNqkzfS:oFsvWyNO81b8pCHFcM0PuAgkOywIFc
- TLSH
  T19112F992E5A450B3C5D6533A35AA2F2DCBBD5329B0926C00C7738E4D39355B66E38343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral9
- Target
  $PLUGINSDIR/splash.bmp
- Size 900KB
- SHA256 ff1f661c015ff0cd9794f5b6cb81755f528c98c522203fcf69550f67d427ff4f
- MD5 237aa22aff8343665911c8615c4cbfdd
- SHA1 d35067296d0fe72cb55e01793846165a0c3b9750
- SHA512 6929a3230a4c3b9057ed6e3c5eac2ce9f6a2cf6c3b58bb980aed88006a014adcd591e6bccb5eacec26a016f3bf785d08527464d276d4ee314c3744f3754d3d38
- SSDEEP 384:Yk2ChD6QU4uYcCRUvMPTQys+WjZQXOPCGOQwNNCahMMgA8y+:5m4tcCy0VWl4G0HxMfS
- TLSH
  T15915C9DC7418E597DFE0BE78394622746A67A0D303C902A5F0332B4D6917BE5272FE4A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10
- Target
  $_13_/OTT_x64.dll
- Size 3.0MB
- SHA256 ecd51e056860a37dbff4223c4dcab1a12f91e3f280161bec249fe8d97ab2378e
- MD5 4543efc047af424b8f8adc11c20c93c7
- SHA1 c5a62c50fede0d85ba7e146d86b1f507c39fe8ae
- SHA512 3f4c764b27b24f05f3081b037bba1e92e18e4db416e3de71ab068460c01afb37fc5a354d02cb45f905e8b3c3dc1a0bc7f0e2ddcc5b0ca130a58ae78de2968db0
- SSDEEP 49152:VM5sWoj2Nh4euWYhB+9OSpkFCtxAP3ZZI1vl0P057TyBTwOnG1u4:65Hol+pBtxl08tlN
- TLSH
  T135E5AD5BB26800D8D07AD07CC61BA90BE772781107609BDF16E14BAE5F63BE01E7B761
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11
- Target
  $_57_/rebyter.exe
- Size 80KB
- SHA256 412485f00da589aca33c9963f4cd4ac8202013fff298c8355c33fe32bf5b42e0
- MD5 24796de0cb33dfc35eb7dc3dec783441
- SHA1 d1e519a6a8a677eabdc84cf7c205195140047305
- SHA512 cfac8ae23ac304b750fed641a8e4e6b915193579785a372704aa059852755bf62367bb8e469a0caac02c5ea4f635d04e7924bebfecfbfa97d448c9be94953fc6
- SSDEEP 1536:VWKeT8mDIrjMiT4D8YcKCS2LQZ2opQp8QM/UC5dUIDlEcU0:0K0kP688CHLA2o+mQMv
- TLSH
  T187836B03F79601FCE35BA2BCC6925A46C372FC1B076597CF57908A2A0F227D16D7A225
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral12
- Target
  C:/Program Files (x86)/Common Files/Avid/Audio/Plug-Ins/OTT.aaxplugin/Contents/Win32/OTT.aaxplugin
- Size 2.7MB
- SHA256 802494be6b40d9abf1abc3374323b555807fd772f2a2243a982a923fe273b5da
- MD5 485ee79117f6f40665dd4ad0d955747c
- SHA1 fa008df2bba9d442357898aa5a88ec789ad28a59
- SHA512 266597dc5958be88cd854cb6dda382a67b7359eafad8bf4d246ecc6d6fa7063be35c4ff3284db0d432b18253c37609c972b33bff3911e10d46ed7bff32c7715d
- SSDEEP 49152:KBWO+3L2Sp+7uFsLnU1/62WKecJDVsNTi2TNM0OnG1u4jx+6:KB3uSSypbKecJD4M0lNL
- TLSH
  T180D5CE217412C079C5CE02B19A7DBBAF827D5F6A0B3805D757E4AEA84C341D22F7369B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral13
- Target
  C:/Program Files (x86)/Common Files/Avid/Audio/Plug-Ins/OTT.aaxplugin/Contents/x64/OTT.aaxplugin
- Size 3.1MB
- SHA256 00794e3da4028f9827b92347576feaff16fbca361d3e7b84c2808bd103347e71
- MD5 e5e9e7ea97523b6efdd9f20a4054e030
- SHA1 ce7237bb8bcb0380a9081fa2867894a73f8a93e6
- SHA512 30ac69e70f90045e8d0812de9a63f548e6ee890210d811471107c782c8daa10725dc1ae172f6ad6f835a6446197b2b1c680cae9fb3f02fb7e8b19618880e27da
- SSDEEP 49152:mM7WA7M5ZpzDPz7ZU6He6O5tfXGPvZEnBa21C0xAlCuvnH28pVTDET10eIOnG1ui:NJMHz7ijtPtn1wn3LlNN
- TLSH
  T199E5AE4B726500D8D4AAD07CC65B990BD372744907609BDF16F08BAE1FA7BE05EBB360
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral14
- Target
  C:/Program Files (x86)/Common Files/Avid/Audio/Plug-Ins/OTT.aaxplugin/PlugIn.ico
- Size 354KB
- SHA256 a7849a94cd1a1d4a9a59e8e1351449c726fc73a8ea1ee3aed3d9d5c200131807
- MD5 5592ec57ec7fd6c30d5d57af0461965c
- SHA1 d9fb4aa7b76f4dad1cbed20e3c94724949e50608
- SHA512 524d183bc4c6b7d93a5005de7707be59680a82ddf97d4a9fdc2601dc43b341666df348bef7ab1bfdf8d5b8faaa1cee5b1b536c453cea5d88500b61841ea47b0a
- SSDEEP 6144:oCT09tRJVXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXL+:o88tRK
- TLSH
  T14E7483767703980FD26B6AB09868F7F0185E4EA0FE4B611286F1796670B07F42F8D2D5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral15
- Target
  C:/Program Files (x86)/Common Files/Avid/Audio/Plug-Ins/OTT.aaxplugin/desktop.ini
- Size 126B
- SHA256 5526ef6345adee7c693e58354dd72b095df152be62ff7298b4c6f6d0f91e2f83
- MD5 798095cd31340606c8e81d0a5107d57e
- SHA1 39d058c4d45ef84b188f7ece620106124eb3d74e
- SHA512 9ca995c89d3f23cd2a977fb2826da1f75dc4caa4fe965f9aac3a6d486f6558429a44eaeea35217f85d94ba6d7c2c54ab520c9a1786133b2edd103e36159e53a1
- TLSH
  T190B09B15282F5020D57FC3071990BDCFF2041857985BE804C78287854EE17164FC855C
- MD5 SHA1 SHA512 TLSH
Score

6^/10
- Drops desktop.ini file(s)
behavioral16
- Target
  C:/Program Files/Common Files/Avid/Audio/Plug-Ins/OTT.aaxplugin/Contents/Win32/OTT.aaxplugin
- Size 2.7MB
- SHA256 802494be6b40d9abf1abc3374323b555807fd772f2a2243a982a923fe273b5da
- MD5 485ee79117f6f40665dd4ad0d955747c
- SHA1 fa008df2bba9d442357898aa5a88ec789ad28a59
- SHA512 266597dc5958be88cd854cb6dda382a67b7359eafad8bf4d246ecc6d6fa7063be35c4ff3284db0d432b18253c37609c972b33bff3911e10d46ed7bff32c7715d
- SSDEEP 49152:KBWO+3L2Sp+7uFsLnU1/62WKecJDVsNTi2TNM0OnG1u4jx+6:KB3uSSypbKecJD4M0lNL
- TLSH
  T180D5CE217412C079C5CE02B19A7DBBAF827D5F6A0B3805D757E4AEA84C341D22F7369B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral17
- Target
  C:/Program Files/Common Files/Avid/Audio/Plug-Ins/OTT.aaxplugin/Contents/x64/OTT.aaxplugin
- Size 3.1MB
- SHA256 00794e3da4028f9827b92347576feaff16fbca361d3e7b84c2808bd103347e71
- MD5 e5e9e7ea97523b6efdd9f20a4054e030
- SHA1 ce7237bb8bcb0380a9081fa2867894a73f8a93e6
- SHA512 30ac69e70f90045e8d0812de9a63f548e6ee890210d811471107c782c8daa10725dc1ae172f6ad6f835a6446197b2b1c680cae9fb3f02fb7e8b19618880e27da
- SSDEEP 49152:mM7WA7M5ZpzDPz7ZU6He6O5tfXGPvZEnBa21C0xAlCuvnH28pVTDET10eIOnG1ui:NJMHz7ijtPtn1wn3LlNN
- TLSH
  T199E5AE4B726500D8D4AAD07CC65B990BD372744907609BDF16F08BAE1FA7BE05EBB360
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral18
- Target
  C:/Program Files/Common Files/Avid/Audio/Plug-Ins/OTT.aaxplugin/PlugIn.ico
- Size 354KB
- SHA256 a7849a94cd1a1d4a9a59e8e1351449c726fc73a8ea1ee3aed3d9d5c200131807
- MD5 5592ec57ec7fd6c30d5d57af0461965c
- SHA1 d9fb4aa7b76f4dad1cbed20e3c94724949e50608
- SHA512 524d183bc4c6b7d93a5005de7707be59680a82ddf97d4a9fdc2601dc43b341666df348bef7ab1bfdf8d5b8faaa1cee5b1b536c453cea5d88500b61841ea47b0a
- SSDEEP 6144:oCT09tRJVXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXL+:o88tRK
- TLSH
  T14E7483767703980FD26B6AB09868F7F0185E4EA0FE4B611286F1796670B07F42F8D2D5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral19
- Target
  C:/Program Files/Common Files/Avid/Audio/Plug-Ins/OTT.aaxplugin/desktop.ini
- Size 126B
- SHA256 5526ef6345adee7c693e58354dd72b095df152be62ff7298b4c6f6d0f91e2f83
- MD5 798095cd31340606c8e81d0a5107d57e
- SHA1 39d058c4d45ef84b188f7ece620106124eb3d74e
- SHA512 9ca995c89d3f23cd2a977fb2826da1f75dc4caa4fe965f9aac3a6d486f6558429a44eaeea35217f85d94ba6d7c2c54ab520c9a1786133b2edd103e36159e53a1
- TLSH
  T190B09B15282F5020D57FC3071990BDCFF2041857985BE804C78287854EE17164FC855C
- MD5 SHA1 SHA512 TLSH
Score

6^/10
- Drops desktop.ini file(s)
behavioral20
- Target
  C:/Program Files/Common Files/VST3/OTT.vst3
- Size 3.1MB
- SHA256 8965c7114506d7a74361233c418b0988ebbd0f7a59d602b9a469c83e31f6fd5a
- MD5 514568987e5730d6cde55513f2606cca
- SHA1 abd834f18877543178158ecd6bf1416e0979fe83
- SHA512 76c263a4ed2d2e37c7dbfeef30d61793599e1fea0f1c5d14afecfb575410c816c1e355bb54b10291fb74d4afa572fdf4e2e0ba703dcb307ed39c921f3227d400
- SSDEEP 49152:srEdCjsjS6LyO+n9Ng8HpJtT2YPgZxLeTMh1X4WkPwi8q/Th1T1ELL/gOnG1u4:UEdNyO+nX/fty4S12w3ug/glN
- TLSH
  T1C8E5AE4BB26400D9C07AD07CC65B9A0BD67178554BA097DF16F08BAE1FA7BE01EBB350
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral21
- Target
  OTT.dll
- Size 2.6MB
- SHA256 7d37a5e0932b5e1eec6591a591f5838227fb46c4dbb6e01c7d8292c05ba2ac6f
- MD5 75331d983b19109519faef7d75032e81
- SHA1 a8e85b2936cb497cb83255cd07e0a5f96ba9dd03
- SHA512 a4693b866c7bc00958102399e6cee0db4ced080e6d1c2c6cd64e056577436f549b3fcf06479e89356391524523dbf63ace7562f4ee4cfd524f5a5a896aca6864
- SSDEEP 49152:ThaqM9EqlKvUMAIzxcziL++50RGotksT++Tw0OnG1u4lSTmg:Thuyh4iL+40RGoto0lNlM
- TLSH
  T195D5BD11B502C239D5DD01B0997EBFAF41295E780B390AD79BD8AEAC58381C32F73697
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral22

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Loads dropped DLL

Executes dropped EXE

Loads dropped DLL

Drops desktop.ini file(s)

Drops desktop.ini file(s)

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22