General
- Target OBS-Studio-32.0.4-Windows-x64-Installer.exe
- Size 150.2MB
- Sample260824-vsazraap7v
- SHA256 46a18bce8e2ff662b700c91d340a519376e712fe0af0d335536e4f9fd253f10a
Malware Config
Targets
-
- Target OBS-Studio-32.0.4-Windows-x64-Installer.exe
- Size 150.2MB
- SHA256 46a18bce8e2ff662b700c91d340a519376e712fe0af0d335536e4f9fd253f10a
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Event Triggered Execution: Component Object Model Hijacking
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
Executes dropped EXE
-
Loads dropped DLL
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
- Target $APPDATA/obs-studio-hook/graphics-hook32.dll
- Size 242KB
- SHA256 64f1dc6b6562d838a240d1c21e74d4159d8e56d2a773b91d144e53da6c31530e
Score3/10 -
- Target $APPDATA/obs-studio-hook/graphics-hook64.dll
- Size 296KB
- SHA256 db8d7ea45c7d29d02740ef5ca8ec3d957dcbf8a0d4082c0e051f8165ac392e56
Score1/10 -
- Target $PLUGINSDIR/InstallOptions.dll
- Size 15KB
- SHA256 89dd7d646278d8bfc41d5446bdc348b9a9afaa832abf02c1396272bb7ac7262a
Score3/10 -
- Target $PLUGINSDIR/OBSInstallerUtils.dll
- Size 426KB
- SHA256 1d84aa191fbbd842d5eeed302195579de1256a9acb980308bf31a631ac01e530
Score3/10 -
- Target $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 23d618a0293c78ce00f7c6e6dd8b8923621da7dd1f63a070163ef4c0ec3033d6
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target $PLUGINSDIR/VC_redist.x64.exe
- Size 24.2MB
- SHA256 3642e3f95d50cc193e4b5a0b0ffbf7fe2c08801517758b4c8aeb7105a091208a
Score6/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target $PLUGINSDIR/check_for_64bit_visual_studio_2022_runtimes.exe
- Size 10KB
- SHA256 b324a6025986306656fc2a03d0a3e9ed5917dfa7cf14fbfca888d65b39822074
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target bin/64bit/Qt6Core.dll
- Size 5.8MB
- SHA256 9f850a87bed12a62dafb3ad837eb61079c81cae3e4530f667679414cb9d2f7bd
Score1/10 -
- Target bin/64bit/Qt6Gui.dll
- Size 7.6MB
- SHA256 65db7bf5688d47b11f70fd927fc04852ca6db1a1f40cd367efd970c997b2224d
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target bin/64bit/Qt6Network.dll
- Size 1.7MB
- SHA256 41a964c710ff710a0257800598f64c96d5c0547c22fb8c600864825bfe30fc33
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target bin/64bit/Qt6Svg.dll
- Size 506KB
- SHA256 b6ab980e3fef618ee44ae7604530b64920eeb7683d5e008ae57c94c4ecff5714
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target bin/64bit/Qt6Widgets.dll
- Size 6.2MB
- SHA256 1cf25d66dc32deeeb2d801e34d9d1320e09712bd1dd6ff5ca4f198a03e9f3f18
Score1/10 -
- Target bin/64bit/Qt6Xml.dll
- Size 147KB
- SHA256 142378bc2812718f55283dd2817045626aebbcb828d1de1a461a6bc08698652a
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target bin/64bit/avcodec-61.dll
- Size 36.1MB
- SHA256 fa26d83d428e6d54b63063dd87457a6325999db0ec96c485893ed2e67ec9924f
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target bin/64bit/avdevice-61.dll
- Size 81KB
- SHA256 e2c2c8ba1ccefb2c049b87338743055a5a154dcfd73c663533c1fe9cd02696fb
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Active Setup
1Event Triggered Execution
1Component Object Model Hijacking
1Privilege Escalation
Boot or Logon Autostart Execution
1Active Setup
1Event Triggered Execution
1Component Object Model Hijacking
1