d4e1d3f62a1db904d3ab5c776ddcbb39ac74469e5ca3ed723e3dcef89ebcefeb

Sharing

Copy URL Twitter E-mail

General

Target
Install_Xfer_OTT_137.exe
Size 8.0MB
Sample260823-ntyzmsgk6w
SHA256 d4e1d3f62a1db904d3ab5c776ddcbb39ac74469e5ca3ed723e3dcef89ebcefeb
MD5 d37e8c8e92d55af5d4eb031d07544238
SHA1 1b8a72704a8a6b871cc90ac6c72155a9f7779c6a
SHA512 6a3236fb58dfe8fd502e44910f202323c319f12a6f3dca9f0d67b001a70c58a1838efff58c2f48455b6b09084a2aab12bcc523a5837dbbf4f566de9afc118a67
SSDEEP 196608:+E2a9qG01Uk3Go9DT9+ovDJC21i0hVynPu89M+xkKzl:+doR0173GYDT9+mJC21iMVyPmAdzl
TLSH
T1748633877B15A8CAC4DC16F01BCEC836B6964DF2171013E356D0AE2FB4EA9C744C6B56
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Targets

- Target
  Install_Xfer_OTT_137.exe
- Size 8.0MB
- SHA256 d4e1d3f62a1db904d3ab5c776ddcbb39ac74469e5ca3ed723e3dcef89ebcefeb
- MD5 d37e8c8e92d55af5d4eb031d07544238
- SHA1 1b8a72704a8a6b871cc90ac6c72155a9f7779c6a
- SHA512 6a3236fb58dfe8fd502e44910f202323c319f12a6f3dca9f0d67b001a70c58a1838efff58c2f48455b6b09084a2aab12bcc523a5837dbbf4f566de9afc118a67
- SSDEEP 196608:+E2a9qG01Uk3Go9DT9+ovDJC21i0hVynPu89M+xkKzl:+doR0173GYDT9+mJC21iMVyPmAdzl
- TLSH
  T1748633877B15A8CAC4DC16F01BCEC836B6964DF2171013E356D0AE2FB4EA9C744C6B56
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Loads dropped DLL
behavioral1
- Target
  $LOCALAPPDATA/Xfer/Uninstall_OTT.exe
- Size 99KB
- SHA256 f27718f1350b9f46eb26905645a50fa806802c85b49f8d5dbb13b47a78008613
- MD5 9a2c647d8deda681b0e5e97f2d7a86d1
- SHA1 6601a2625824f4a25861606f8acd42a400c14cc2
- SHA512 4018e2493ea6b39e1770ecca3e4d60514abcccea689b5c46f95997d715d1ef71d7bc96295f5a0cc42ac88f68c50d3c90ca73884076fc5ffafec1a47eed4f37f0
- SSDEEP 3072:fNRCywDw1DiJku/Zx+5kqWHK37YFOFv6h:fT4DtbEkzOZU
- TLSH
  T179A3BF017720EC53CEB306B02579D77B5FB2BE7616A1CB4713E0ED0BBC92A926D09285
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Executes dropped EXE
- Loads dropped DLL
behavioral2
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 7a9ddee34562cd3703f1502b5c70e99cd5bba15de2b6845a3555033d7f6cb2a5
- MD5 564bb0373067e1785cba7e4c24aab4bf
- SHA1 7c9416a01d821b10b2eef97b80899d24014d6fc1
- SHA512 22c61a323cb9293d7ec5c7e7e60674d0e2f7b29d55be25eb3c128ea2cd7440a1400cee17c43896b996278007c0d247f331a9b8964e3a40a0eb1404a9596c4472
- SSDEEP 192:nenY0qWTlt70IAj/lQ0sEWc/wtYbBH2aDybC7y+XBDIwL:n8+Qlt70Fj/lQRY/9VjjfL
- TLSH
  T1F6427D1193B089F2F590593805A67F2A6FBEAC5C27E44963CFE345853D702DFA47A243
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 6bf9cccd8a600f4d442efe201e8c07b49605ba35f49a4b3ab22fa2641748e156
- MD5 48f3e7860e1de2b4e63ec744a5e9582a
- SHA1 420c64d802a637c75a53efc8f748e1aede3d6dc6
- SHA512 28716ddea580eeb23d93d1ff6ea0cf79a725e13c8f8a17ec9dfacb1fe29c7981ad84c03aed05663adc52365d63d19ec2f366762d1c685e3a9d93037570c3c583
- SSDEEP 96:oFsvUu3Uy+sytcS8176b+XR8pCHFcMcxSgB5PKtAtgt+Nt+rnt3DVEB3YuNqkzfS:oFsvWyNO81b8pCHFcM0PuAgkOywIFc
- TLSH
  T19112F992E5A450B3C5D6533A35AA2F2DCBBD5329B0926C00C7738E4D39355B66E38343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral4
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 7a9ddee34562cd3703f1502b5c70e99cd5bba15de2b6845a3555033d7f6cb2a5
- MD5 564bb0373067e1785cba7e4c24aab4bf
- SHA1 7c9416a01d821b10b2eef97b80899d24014d6fc1
- SHA512 22c61a323cb9293d7ec5c7e7e60674d0e2f7b29d55be25eb3c128ea2cd7440a1400cee17c43896b996278007c0d247f331a9b8964e3a40a0eb1404a9596c4472
- SSDEEP 192:nenY0qWTlt70IAj/lQ0sEWc/wtYbBH2aDybC7y+XBDIwL:n8+Qlt70Fj/lQRY/9VjjfL
- TLSH
  T1F6427D1193B089F2F590593805A67F2A6FBEAC5C27E44963CFE345853D702DFA47A243
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5
- Target
  $PLUGINSDIR/advsplash.dll
- Size 6KB
- SHA256 62b3db0446750ca9fd693733eec927acc1f50012a47785343286e63b650b7621
- MD5 1871af84805057b5ebc05ee46b56625d
- SHA1 50e1c315ad30f5f3f300c7cd9dd0d5d626fe0167
- SHA512 c1979ee98dfdb807776c439218528d80b4b244a87e692f1538e40f9c2c82db8b77485eb1429325b6f44419bf1f4cd454e43ff381eff077a8b4f4d9eb0d7e54d4
- SSDEEP 96:kIUNaXnnXyEIPtXvZhr5RwiULuxDtJz+wolpE:kIx3XyEwXvZh1RwnLUDth+I
- TLSH
  T16FC1B837A2C261F3D29B01B168467BA343A59871375259580DA3C9C9ED92DA7DC14743
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral6
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 6bf9cccd8a600f4d442efe201e8c07b49605ba35f49a4b3ab22fa2641748e156
- MD5 48f3e7860e1de2b4e63ec744a5e9582a
- SHA1 420c64d802a637c75a53efc8f748e1aede3d6dc6
- SHA512 28716ddea580eeb23d93d1ff6ea0cf79a725e13c8f8a17ec9dfacb1fe29c7981ad84c03aed05663adc52365d63d19ec2f366762d1c685e3a9d93037570c3c583
- SSDEEP 96:oFsvUu3Uy+sytcS8176b+XR8pCHFcMcxSgB5PKtAtgt+Nt+rnt3DVEB3YuNqkzfS:oFsvWyNO81b8pCHFcM0PuAgkOywIFc
- TLSH
  T19112F992E5A450B3C5D6533A35AA2F2DCBBD5329B0926C00C7738E4D39355B66E38343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7
- Target
  $_13_/OTT_x64.dll
- Size 3.0MB
- SHA256 ecd51e056860a37dbff4223c4dcab1a12f91e3f280161bec249fe8d97ab2378e
- MD5 4543efc047af424b8f8adc11c20c93c7
- SHA1 c5a62c50fede0d85ba7e146d86b1f507c39fe8ae
- SHA512 3f4c764b27b24f05f3081b037bba1e92e18e4db416e3de71ab068460c01afb37fc5a354d02cb45f905e8b3c3dc1a0bc7f0e2ddcc5b0ca130a58ae78de2968db0
- SSDEEP 49152:VM5sWoj2Nh4euWYhB+9OSpkFCtxAP3ZZI1vl0P057TyBTwOnG1u4:65Hol+pBtxl08tlN
- TLSH
  T135E5AD5BB26800D8D07AD07CC61BA90BE772781107609BDF16E14BAE5F63BE01E7B761
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral8
- Target
  $_57_/rebyter.exe
- Size 80KB
- SHA256 412485f00da589aca33c9963f4cd4ac8202013fff298c8355c33fe32bf5b42e0
- MD5 24796de0cb33dfc35eb7dc3dec783441
- SHA1 d1e519a6a8a677eabdc84cf7c205195140047305
- SHA512 cfac8ae23ac304b750fed641a8e4e6b915193579785a372704aa059852755bf62367bb8e469a0caac02c5ea4f635d04e7924bebfecfbfa97d448c9be94953fc6
- SSDEEP 1536:VWKeT8mDIrjMiT4D8YcKCS2LQZ2opQp8QM/UC5dUIDlEcU0:0K0kP688CHLA2o+mQMv
- TLSH
  T187836B03F79601FCE35BA2BCC6925A46C372FC1B076597CF57908A2A0F227D16D7A225
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral9
- Target
  C:/Program Files (x86)/Common Files/Avid/Audio/Plug-Ins/OTT.aaxplugin/Contents/Win32/OTT.aaxplugin
- Size 2.7MB
- SHA256 802494be6b40d9abf1abc3374323b555807fd772f2a2243a982a923fe273b5da
- MD5 485ee79117f6f40665dd4ad0d955747c
- SHA1 fa008df2bba9d442357898aa5a88ec789ad28a59
- SHA512 266597dc5958be88cd854cb6dda382a67b7359eafad8bf4d246ecc6d6fa7063be35c4ff3284db0d432b18253c37609c972b33bff3911e10d46ed7bff32c7715d
- SSDEEP 49152:KBWO+3L2Sp+7uFsLnU1/62WKecJDVsNTi2TNM0OnG1u4jx+6:KB3uSSypbKecJD4M0lNL
- TLSH
  T180D5CE217412C079C5CE02B19A7DBBAF827D5F6A0B3805D757E4AEA84C341D22F7369B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10
- Target
  C:/Program Files (x86)/Common Files/Avid/Audio/Plug-Ins/OTT.aaxplugin/Contents/x64/OTT.aaxplugin
- Size 3.1MB
- SHA256 00794e3da4028f9827b92347576feaff16fbca361d3e7b84c2808bd103347e71
- MD5 e5e9e7ea97523b6efdd9f20a4054e030
- SHA1 ce7237bb8bcb0380a9081fa2867894a73f8a93e6
- SHA512 30ac69e70f90045e8d0812de9a63f548e6ee890210d811471107c782c8daa10725dc1ae172f6ad6f835a6446197b2b1c680cae9fb3f02fb7e8b19618880e27da
- SSDEEP 49152:mM7WA7M5ZpzDPz7ZU6He6O5tfXGPvZEnBa21C0xAlCuvnH28pVTDET10eIOnG1ui:NJMHz7ijtPtn1wn3LlNN
- TLSH
  T199E5AE4B726500D8D4AAD07CC65B990BD372744907609BDF16F08BAE1FA7BE05EBB360
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11
- Target
  C:/Program Files/Common Files/Avid/Audio/Plug-Ins/OTT.aaxplugin/Contents/Win32/OTT.aaxplugin
- Size 2.7MB
- SHA256 802494be6b40d9abf1abc3374323b555807fd772f2a2243a982a923fe273b5da
- MD5 485ee79117f6f40665dd4ad0d955747c
- SHA1 fa008df2bba9d442357898aa5a88ec789ad28a59
- SHA512 266597dc5958be88cd854cb6dda382a67b7359eafad8bf4d246ecc6d6fa7063be35c4ff3284db0d432b18253c37609c972b33bff3911e10d46ed7bff32c7715d
- SSDEEP 49152:KBWO+3L2Sp+7uFsLnU1/62WKecJDVsNTi2TNM0OnG1u4jx+6:KB3uSSypbKecJD4M0lNL
- TLSH
  T180D5CE217412C079C5CE02B19A7DBBAF827D5F6A0B3805D757E4AEA84C341D22F7369B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral12
- Target
  C:/Program Files/Common Files/Avid/Audio/Plug-Ins/OTT.aaxplugin/Contents/x64/OTT.aaxplugin
- Size 3.1MB
- SHA256 00794e3da4028f9827b92347576feaff16fbca361d3e7b84c2808bd103347e71
- MD5 e5e9e7ea97523b6efdd9f20a4054e030
- SHA1 ce7237bb8bcb0380a9081fa2867894a73f8a93e6
- SHA512 30ac69e70f90045e8d0812de9a63f548e6ee890210d811471107c782c8daa10725dc1ae172f6ad6f835a6446197b2b1c680cae9fb3f02fb7e8b19618880e27da
- SSDEEP 49152:mM7WA7M5ZpzDPz7ZU6He6O5tfXGPvZEnBa21C0xAlCuvnH28pVTDET10eIOnG1ui:NJMHz7ijtPtn1wn3LlNN
- TLSH
  T199E5AE4B726500D8D4AAD07CC65B990BD372744907609BDF16F08BAE1FA7BE05EBB360
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral13
- Target
  C:/Program Files/Common Files/VST3/OTT.vst3
- Size 3.1MB
- SHA256 8965c7114506d7a74361233c418b0988ebbd0f7a59d602b9a469c83e31f6fd5a
- MD5 514568987e5730d6cde55513f2606cca
- SHA1 abd834f18877543178158ecd6bf1416e0979fe83
- SHA512 76c263a4ed2d2e37c7dbfeef30d61793599e1fea0f1c5d14afecfb575410c816c1e355bb54b10291fb74d4afa572fdf4e2e0ba703dcb307ed39c921f3227d400
- SSDEEP 49152:srEdCjsjS6LyO+n9Ng8HpJtT2YPgZxLeTMh1X4WkPwi8q/Th1T1ELL/gOnG1u4:UEdNyO+nX/fty4S12w3ug/glN
- TLSH
  T1C8E5AE4BB26400D9C07AD07CC65B9A0BD67178554BA097DF16F08BAE1FA7BE01EBB350
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral14
- Target
  OTT.dll
- Size 2.6MB
- SHA256 7d37a5e0932b5e1eec6591a591f5838227fb46c4dbb6e01c7d8292c05ba2ac6f
- MD5 75331d983b19109519faef7d75032e81
- SHA1 a8e85b2936cb497cb83255cd07e0a5f96ba9dd03
- SHA512 a4693b866c7bc00958102399e6cee0db4ced080e6d1c2c6cd64e056577436f549b3fcf06479e89356391524523dbf63ace7562f4ee4cfd524f5a5a896aca6864
- SSDEEP 49152:ThaqM9EqlKvUMAIzxcziL++50RGotksT++Tw0OnG1u4lSTmg:Thuyh4iL+40RGoto0lNlM
- TLSH
  T195D5BD11B502C239D5DD01B0997EBFAF41295E780B390AD79BD8AEAC58381C32F73697
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral15

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Loads dropped DLL

Executes dropped EXE

Loads dropped DLL

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15