51ddf585df3bb3e133d7fd9574cb9c4fd4b0b31630928e25953b02292801d925

Sharing

Copy URL Twitter E-mail

General

Target
win_02.08.02.54.zip
Size 40.4MB
Sample260825-pmh6aasbpd
SHA256 51ddf585df3bb3e133d7fd9574cb9c4fd4b0b31630928e25953b02292801d925
MD5 f9fd5be487775a3e8bf461702da12e16
SHA1 582182cf2752a98e19cd90757076d3c846ddc294
SHA512 801339402a13a732bfef3e6751746c9cfd4c81d459b31ddadb4bb3dd6d7ad3a054e54d32b61a2c2341614142b7c67bca027c0e089045b921d4608f7897942585
SSDEEP 786432:cMyDxNqveP3kvUh7NrFb4bwh0KYF30RiMjPz2sVjUQiVgzaYr9:AVm48EEZxFAiMjr2sVoQOFYr9
TLSH
T1749733C878E51191052AFBEFB676488A14F6E5AF30C8DFE89C3193F0E0A31951D19A5F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

persistence privilege_escalation

Malware Config

Targets

- Target
  BambuSource.dll
- Size 5.3MB
- SHA256 47cfa5e896644522379325726fecbe7966ce3d8ed84fc4c9822fb87332b4333d
- MD5 fb3218e73f55334b3b75d641743edf69
- SHA1 66d4992fb076e12e40b50f16c88a934adecb6af9
- SHA512 adcd4ba7c12a3ac07ea3adefee6f42c474868f2ee97452e1968e980d9e8e60972c59858c079ac45a6ab9267f639b01783e65090e27ad0e0ca78a6a77ce6f9b6e
- SSDEEP 49152:cadkeTq5IhMTUFOjwgGyLz5cAh5HHsbC+s6Aszd9Ls0wbXChCCRcfWDxhk2wLqs4:RF1ST2PbCGAAda0bWUKs7DJHXU8K2
- TLSH
  T148466B5AB7A80198E477C13CCA835613E6F2F819477097CF0AA9467A4F33BD46A3E744
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

persistence privilege_escalation
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral1 behavioral2
- Target
  agora_rtc_sdk.dll
- Size 33.1MB
- SHA256 8c787c971b19ba66c840c9abf88ad2a6a4c50d171152d035f8bea0bab77a8c16
- MD5 d07f91e918f507824cb350cfb72fd6c4
- SHA1 0c6f34a4aeeacb41f964d1993ca2dbbfbf20b1a8
- SHA512 3f7981a2c1d2fe6cfc4eaed286e9d77611f79292aa1a000b7d4f1f303927d7ea52e1fe2e59bd7ea8612bb0dc6701b29d1ae9a4548492d0d23c64261c6034a2fb
- SSDEEP 393216:g2kfzysUxpo0kj71VyUcbNsRQ2FCIZ+xqf67BKEy6himp7q0ur:gnoxbNTFmup5i
- TLSH
  T14D775B47927500D9C0BEE078DA5BAE13FBB1344903759BDB069086A62F63BF4B97E710
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  bambu_networking.dll
- Size 20.4MB
- SHA256 0b235a3665ce28da0f0f01cbc27a2c3a64f40fbce26621f7424f8e10f98df087
- MD5 718694faaf2b4a1fb0e6f0b2b63d280a
- SHA1 1ad32ddf60c0796ec84457c68214efff81094c4b
- SHA512 8b13bb753b2459e3aee218f5dfd4a5e4e13fb2744851724baf277308c5e0ffb07291366daf5ccae1b7959ec1abd8c3028e5662ffa1c0c1984bd367b0f2e1337d
- SSDEEP 393216:nb7vQr+ty1Ll7imetDgu3oVZ5gvg+D5T7FkIR196kv:bWH7im2DXoVynZ7nRT60
- TLSH
  T1D12723C179E4816CC462C935D69917FCF1EA7A898DBA980F7FC709132E31D82CCA6935
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral5 behavioral6
- Target
  libagora-ffmpeg.dll
- Size 7.4MB
- SHA256 992087ab4b5156363feb10a15f7e1b3bec76742888ca088afbb9d498aed58aee
- MD5 ac46c3b91fdb1128c6ef2527695ce27c
- SHA1 969ff65656871e02d5efb598eca2ebcc05d1ba3d
- SHA512 5e08efea47817f16bc798a67d7da07dd3b0b07b631b0088c131796c9d152cd698a909033eb5a9078bdc6683fef641040d562f0035bade31b90fb6a6036565f7b
- SSDEEP 98304:zv6YTJ9MJdJjMUqRYnPyZ2SeB0Gtn87mJsyRvXezW1VHmrTnNtS7:kPyZ2SeB0GbC4fvmrTnNtu
- TLSH
  T181768D4BF1A311ECC456C57487ABA633FA30384D43246AEB27D4E6652E27BD0A739F05
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  libagora-soundtouch.dll
- Size 155KB
- SHA256 424307be3ac37e42dac6731914b110cb4ff1e5219ec72f18d9d708afef52d38c
- MD5 1ea4df2a4b90a076bbd06efe253e4c3c
- SHA1 82e1d3c91f80745fee08a8d05b73f4ade28f9d36
- SHA512 b7c881d85a271a60aaac817317ccdb7aa85784382726c8b622d8e0b2e983ba8bbf97dfa97b867e3931aaab17c747c9dbc51f09c313058332a0d2cb72c78d4322
- SSDEEP 3072:PzoDwBZpjHCegd6MHvp1VrwZMO5oY4pzDotpU6CfLPXgn8kj:Pze8hCegjPpXOdohLsnl
- TLSH
  T1F6F36D1B72A504BBE1739134C9A36E16F772B81113719AFF03A442795E273C1AE7BB21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  libaosl.dll
- Size 1.2MB
- SHA256 b75e70f4829a4fc0ee7a5dd73934b135f76e0ce2f0142f505db51562eb9e4abe
- MD5 5b4420daa464520cbab3ea7dec8bccd9
- SHA1 c30a7656f800821f9e21ef4cd4b591739f52d101
- SHA512 251928fc8d70ab7ec74a78b47d30d2fc815f3e7ec1389014c1f2f43128374cdcc259d5c8bd5ff3d088a0364602f6a4a33eb5c37857e8fadba24781b9dd17ce3f
- SSDEEP 12288:X6j/cnYz3/1i4MLcWtNE3suivyiddqCIsLx01vRY03AJia5pUy7pg9tVN4iUVPS1:X6QnG31rLyLIY03AJibyVetD4izRzKnc
- TLSH
  T1A1558D6673A812A5D5BFC13DC6978B4ADAB274150730A7CF02E482992F23BE55E3F710
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  live555.dll
- Size 4.2MB
- SHA256 c6c61134c896e07b8261b502d5329b2022604ce09d8caace85190befea1c2d31
- MD5 5a7e1fbf4166b38da87d16c1bea24091
- SHA1 16c20bf11ad6bf1aacedfa4695ce45df9ffc6451
- SHA512 2c2187f73a08ae14ac0a7e59bcca724eb0ea04d0638f6028a28835a89afbd41105cf1239792bce27a0f435adfeefff16ed8d87444e4c08c94cf297afddd76292
- SSDEEP 49152:+Vp+kx65/Bg6leFjvxGvONldHK/heX4xmzsVKZyZDt8iLB0LVCJhKsGv9PvPrVz5:+Thj/H8PQRZyFDGVrbifSD
- TLSH
  T101166A1ABB680298E87BD13CC6A74717E3B1B816477097CF1AA952791F33BD5263E304
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Event Triggered Execution: Component Object Model Hijacking

Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14