0ee7b759281cd6f9158a60f3379e5be4f0de54a959388e8fae0a9a510a6e6bdd

Sharing

Copy URL Twitter E-mail

General

Target
VoiceChanger64f(2.05).exe
Size 1.3MB
Sample260825-2v6mrszemb
SHA256 0ee7b759281cd6f9158a60f3379e5be4f0de54a959388e8fae0a9a510a6e6bdd
MD5 cff7f369730e0075970510da603ff32d
SHA1 a66aa15d2838cf68ef8c5acb09d5b7b79c517466
SHA512 9ec61a4b22cad798b725d6abf43d8be10c50b5694496f479d1b76b86cfc1d9c6f17b255917c3fa7ce7c1f983e4e699df6cbb34d7ef14c04f3dd5c619529c06be
SSDEEP 24576:cYDZBrabd6i5Rf35kxnNxgAqbED5wXBB38X+AbaVppzcLFfXBDtAHCCx5GG:V2J6iXPqrWAqwwqdaPp+XBDtAH0G
TLSH
T1675533A0FB68F598CB22E932DA1824E39DE2A4F51445914F3704EB95B74F2D74D3E309
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Targets

- Target
  VoiceChanger64f(2.05).exe
- Size 1.3MB
- SHA256 0ee7b759281cd6f9158a60f3379e5be4f0de54a959388e8fae0a9a510a6e6bdd
- MD5 cff7f369730e0075970510da603ff32d
- SHA1 a66aa15d2838cf68ef8c5acb09d5b7b79c517466
- SHA512 9ec61a4b22cad798b725d6abf43d8be10c50b5694496f479d1b76b86cfc1d9c6f17b255917c3fa7ce7c1f983e4e699df6cbb34d7ef14c04f3dd5c619529c06be
- SSDEEP 24576:cYDZBrabd6i5Rf35kxnNxgAqbED5wXBB38X+AbaVppzcLFfXBDtAHCCx5GG:V2J6iXPqrWAqwwqdaPp+XBDtAH0G
- TLSH
  T1675533A0FB68F598CB22E932DA1824E39DE2A4F51445914F3704EB95B74F2D74D3E309
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

discovery execution persistence privilege_escalation
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral1 behavioral2
- Target
  $8/$8/uninstall.exe.nsis
- Size 32KB
- SHA256 3ff8b9757b854e3d38b45e5ea1a5026d3af133bd013e7537ac96cc80e56765d8
- MD5 e09c0610096c5e5e4fe9a476f177dd80
- SHA1 9a1269db3678cbb20595486efe1cb09dcbdfc84c
- SHA512 35726017ec52a958e104776530d52221df61b9f0792b2b46738f6624dbd5f3dbb6d03178b526abe0334d74b9cbc9447c7900b032d712efb910cf7948c7254972
- SSDEEP 768:md1X32bLt5rBazZOAcvWJNmrIOeIbJccFz6ZQ3xts8UsqTfdu7v:mHiXBc0ZQAHpbJccFz6ZqDs881u7v
- TLSH
  T17DE2F19CE3B06194BC52944D0ABDFCA81537A93F8AACC81495C649F24F7703F1E11367
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral3 behavioral4
- Target
  $8/APOConfig.exe
- Size 196KB
- SHA256 d0666f91e134e6522150a46dbe521479993cd708492f090b72940ba050d1a68a
- MD5 6dea0364646c299c12239e7402c28e7c
- SHA1 a801c2b7c49dcd6e2f8c33b59a2e1ca8c70adb21
- SHA512 b3030b301e571649892aa2c081c254eb293520e0bbe3a4df1522d70cbe35661485e1bc7688d8413d88e298ef3463e3542e4bede73ab1b3adfbfc4b76bdd99b21
- SSDEEP 6144:lXtzpxJqoyk6H9APPQZLFlejj85JL7guX:PpPK9A8LH5N7gM
- TLSH
  T11A146D25BDC2D073E666093069E8CA759A29F8B10F609CDB73840FFA4D346D19735B3A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

discovery execution persistence privilege_escalation
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral5 behavioral6
- Target
  $8/AudioChanger.exe
- Size 161KB
- SHA256 c925c8115c73e9851198d3db4c1c1864ca7c38189d9af724fc46a2fe857bda94
- MD5 49fbd834770de5e01937865824063bc5
- SHA1 7e3e16db4103502c4a6c3248fba850d69fd2016e
- SHA512 00846479da905bd9dfe47126fdde7062b39f29203feb38ccc0780ba90dc2bbc4928185965a3e2490e21c7c9b38f0746fb7dfb7f401066874484adfce13ab02bb
- SSDEEP 3072:e65PxKAHTGwJyEDsUIzw69Ms9R7aXVR6+KPEqHwfS1:e6SAHTGIxw7DasraKMqQe
- TLSH
  T194F37D5773A430F9E5278239C8A15A46F772B87217209B9F13A8477A1F133D09E3EB61
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  $8/ClownfishVoiceChanger.exe
- Size 985KB
- SHA256 9e1dd2a58061382da6d17b05d1b97f56063046538952de052aa0a523623c4d43
- MD5 c5f5ce5a750f79fb8c20157dbd71833a
- SHA1 7a8a06a183ba6465bb02984516beee6fdf5c3b85
- SHA512 e3fa60275dd6e19098b3d814eb21e8c3106ab6a6f7d2a74a4deb9bd2aaf7f3501869ed62d05565cfdb2244e65e10316fc90f0d550aa77a14f6f9177c66640d37
- SSDEEP 12288:LaSsnEVp1pFJq9hRIL8NOvsE6IVEXYD01b6aOffk5NI/r:Oqxp/IRILRkE6IV7Y4OST
- TLSH
  T13A255B1C6EE502B9E1F2C770C9A16506EA717C85873D99DF03C1C2994E729FACA39F21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

discovery execution persistence privilege_escalation
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral10 behavioral9
- Target
  $8/res/Alien-Off.ico
- Size 16KB
- SHA256 9d68b4ce0995e03fa5a623c36ac00d2641697f9c2120b2d4acc24b371037a729
- MD5 3f7b046b32d33fa1db6d801326c84c92
- SHA1 f267a3236f46e5160fbda29bfc0e628ab24f2d35
- SHA512 e5e1f723e41c9f4ee324883b7d2746f89b8333b17172b1dcd05e8e070caa200e184d12382140986a0ab852312878e9c1d9e6253accc558af246f69f4598ae347
- SSDEEP 192:uD10D/av2EfZsnYlMNluw/l5K4kidr+QJWQ16Ti5Y:I10DSeEfZWgMNUmloi1Eiu
- TLSH
  T1C4722D3B0A2DE813DD8064B1AB62D4FB67306D5D0665890239F63E3BF7ACA17BC0C156
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  $8/res/Alien.ico
- Size 16KB
- SHA256 99d1d4618d0ac84f70b30334c94208c617c76f8f1604f665f8dc5c424e638f4d
- MD5 b4912b4e5ac58c1da8deb5834e3c366b
- SHA1 4d3470a065095f6498e45f7303a8630063eb658c
- SHA512 aaa10258b02e41eb13e45ad5746ef5dce249020a973a83e2532bc2d20de0cba6d92d3f4bb3716f871b9eb4db633863763a087769054f9b832cd308b1e7865139
- SSDEEP 384:9S7e222222222222Rw+2u8wexKUluUvaFPd7:9Ie222222222222W9ANa7vI5
- TLSH
  T14D727DB42601A1A9D6A48C718FD4C1310B203D6EA486ED963EF8BD1F79FE2674C064D7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral13 behavioral14
- Target
  $8/res/Atari-Off.ico
- Size 16KB
- SHA256 6df6a6464c72af219094cf3787cf0d1f858e2fd3b6c5cc213deecabd911769af
- MD5 6f984a4938ba524ba9657d3c63845790
- SHA1 0b1789655b8139fa9975aea26860674a5b4fd4de
- SHA512 f7c403fbf0e3436eae86e141078db563ca7b75ee157eaac4bfd239c5a42227680598a3cf76e4f30760232f71dc3b4fffe7a5bab8d6106854be9eabc7c43298b4
- SSDEEP 96:f08opGfmdCRtijpfChf2h5hTAOPcEmvV+WAiPgopg44ld:eCRtijpkuhvTAgxgVLRSld
- TLSH
  T1217215222639BC16D46225B97503F272BB02AF631647B1A676E3DC777463DE61FE0340
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral15 behavioral16
- Target
  $8/res/Atari.ico
- Size 16KB
- SHA256 3874c8be3dc907e0f26b658fec2a551e9651933a819bc15bf9f93b578e8b5284
- MD5 b5c428102274914255a1c7f4876e2dcd
- SHA1 03c76804698ac954d950b6a7dc334fa9ae6db45d
- SHA512 daabe89489aa3f6089e05a2d96f149211d4b4338d19e68497b5531d45a8580979dea303b95bdd93f14a349c743e18e120eedabcad7a472b9dd8032f5db42aeee
- SSDEEP 96:fF4MmcfBDUD3inWmrMuxutZu2uJOu6wzYgadpbcqe9Mwc2OAPuaY8E5rFbcnjXn4:yeRrGOYe9yYuaVLLAHdRI+ld
- TLSH
  T1F772EB1DA728AD42C5653AB9C463D3F04722EF1052E186CB2EE5BDF33D266636C3D058
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  $8/res/Cave-Off.ico
- Size 16KB
- SHA256 671d371f7b2f07fc7b1e8ea9f0ab1bdf2a9055e79f3c859b19b6f579fc17987f
- MD5 fc40dfade66ab7cf24962bca246834c0
- SHA1 9f5c5dae7824afd92ae3dacc9bd72f814bb5e776
- SHA512 e0bcd0d37c1b1a4db6dec33d9b3f6471612a7e266349b744bc1e3664e908cb737304af77f3d6f91c7e44ed561b86ff4e686625301fbef4a24919df765d105efc
- SSDEEP 48:SeeBxuMtMkqCvNbvaKFqhsA5OpFIVgi1V0KDBlYXtEwRwXtWAm78O3LoYk27fxYS:aDthq0NbZFUsA5OxtK8dDRmOFtzxYOt
- TLSH
  T15A725EB2EA675F4BF759F3B0FC1A40956F273A444808621AC97E648209A201FF4FF15C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral19 behavioral20
- Target
  $8/res/Cave.ico
- Size 16KB
- SHA256 716cc28267dcdafd13ca183d11fd74394f7e55063874d5c19a088ec40e225590
- MD5 f8b303268883f3500b9723c5f82843d2
- SHA1 805cd035ae00e0fb37f3afbac9cffdd5c3b12014
- SHA512 0d4b0873c42ff4da2b908bb458c59adba5765c48c4b2168ff7749fa58bd637b483001615532ca4a4158b9e43ac6881ccf4f372d9faf29f136bd473741a975e9a
- SSDEEP 96:wTdrWLDwKJdeQYXcq9LCqh8Y86k5KRmbARaj/8AN5tmgnUYLYtp2pcX5YOt:wTGD5J0QYs9yCLsI+aoCclbsaX5dt
- TLSH
  T1CF72CAAC31044AC9EF503672D0E25386EAAC4C692864A067DFF63467367348F7EC5E31
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral21 behavioral22
- Target
  $8/res/Chorus-Off.ico
- Size 16KB
- SHA256 e472affc0a16978628ae05ddff151eb0e4fe2892989e55d3bc3e2715d9679448
- MD5 87eafaceec081d8d2bad823ec42d8372
- SHA1 515545777b7805a4ff74bfcdee79d9237a11c669
- SHA512 6957e54e9fd29ec607821ad451727cc76ab04e8ffb99b6b0fea8dcc821b4e579beb4ec4f7cad1f9e90fb638601a3752720931be1a0e3e287b5a12ac3e3d472d1
- SSDEEP 384:cNnoaGapKaVa1a3azPa6a8Fafamaxtk0XcGUa2aeWxrI:2EfBt4a2aeWE
- TLSH
  T15672F8262B68BC03D314A1B29191D6FF57343E545A4DE21334E6B9BFF914B2FE808318
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral23 behavioral24
- Target
  $8/res/Chorus.ico
- Size 16KB
- SHA256 b6e3c53bb48c2898ea96955a8df633c78035cf071842e84e31a6b265f86ed49a
- MD5 afefd408c6dff3dbb1217c497aacd33d
- SHA1 ba1439c6d07e450b16ee1326d648ded9d3c8aec3
- SHA512 205c5c0d9b1b0f4f5e844c5abee168e7d3b64da0914b70f5470d7635f68f1d2bd5eee2343017a0c4961c2c78bd4ca2f70cd5594ef99b0ba91ce5250e0f3a4ca5
- SSDEEP 384:cNnoaGaDGKaNacabaGca4aOea/aVasdaQFpHwgrwxO3hTzRRLQ:2PCw5pQOR6
- TLSH
  T1C572F8B627A8DA87D202613081CDD2390B38AE492C9FF26339EA7D6FF5347671409375
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral25 behavioral26
- Target
  $8/res/CityHall-Off.ico
- Size 16KB
- SHA256 2b04ea3f81189ce4a22abe6eb620dc65cf6bd44a2f152303096e3013068778ee
- MD5 822ce582243adb560d3a6f5b87884cf6
- SHA1 92fb5a5a4a81293cabba2b9e55fa03f0c51f0d1d
- SHA512 27208641135e35d100de11b2de6d7f808d35ede3cfad8630b7cbd366e0a750aeb634392f4905bb9c65f9477927e3ea6447bedbe59447ec24cf511cce16eb2b50
- SSDEEP 24:rnnnnnnnnGs0scsUHvel6HtY0cQMYKdkyI2fSHo6666666666666666alKPlV22K:wnKd3jS4T2
- TLSH
  T11A720AF36595B73CEA0734B24B9382F92E943848D774800DABB26F0A02273D158EB617
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral27 behavioral28
- Target
  $8/res/CityHall.ico
- Size 16KB
- SHA256 e1bca0ca6c4acc6b946d9486dea1ae89a8fa36715fc80f3a70d70d60689f0bff
- MD5 b8a844f428b535a1dfc17aac4a247041
- SHA1 c6ff6d1ddfaedf589cc0e541f159ca6e97b4d907
- SHA512 52655bfc21a68ca6e00dd21e2f5123707a7e0f51d318f86c6b33bd4ccd3d0a36f9f01123eeeaa23f48d232617919f88ff68b9b082852c0137bd27d32f2b9fd4a
- SSDEEP 48:5jjjjjjjjDNv/xUFPw+ahykOSwlka35Ukasaka4faka4akayaWakayaWakazUawI:UbOykOTpUT7TXTXTJdTJdTzDvAsTy2
- TLSH
  T1D8720CE67309EC60CD06A9F43F67A18CEC3A6CFC951BD4C9A6A1B71E153091C2AF44D6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral29 behavioral30
- Target
  $8/res/Clone-Off.ico
- Size 16KB
- SHA256 e899579042c65ee392700daf59d07252d9a4241fd70cc56a00075d2be5ce5609
- MD5 252a8304468aa4d67cdc654959f72ac5
- SHA1 4cdabf4f34cd8a27991ee08d7d0d366ce1060723
- SHA512 78854112f576c3ab88a43d1ded442361d32a4f3a5ccfe72f1317b6c0bc0b697cb6f492f5c18053667466eeb37f278c2aac9b54079ff04302c9a2862f704807ec
- SSDEEP 96:s+iN0u0u0u0u0u0u0uIXuku1hTed+Up4KgJ+/n5sss6hhhhhhhhhasChhhhhhJH:s+Q3333333IenjTed+w437D
- TLSH
  T11672EF7D7409902DD5B03038C7229AD7FEE93CAF5364B10122F66E4B95ADF42AB18287
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Event Triggered Execution: Component Object Model Hijacking

Checks computer location settings

Event Triggered Execution: Component Object Model Hijacking

Checks computer location settings

Event Triggered Execution: Component Object Model Hijacking

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32