cbe4d176fcd9517dd6feb6a383572d718490d827d24af14d291189a5d7fcb17c

Sharing

Copy URL Twitter E-mail

General

Target
Bandicam.zip
Size 19.9MB
Sample260825-xckv5adn7v
SHA256 cbe4d176fcd9517dd6feb6a383572d718490d827d24af14d291189a5d7fcb17c
MD5 f9135a91e5c712155c1e541c750c94f8
SHA1 fc9e4d98857ecbaea6687975a55ebcd46ad33d85
SHA512 460b527bcb0e9280227f262a809604df65a23837c1bd4e7f0bb81129dc64e2590bf335253745d8d7be2ea5260e824e09b9195b350b02607a8c0a23b887dd860f
SSDEEP 393216:la2yTD+md70IMGOhIaIXfsNGn+30xYBQUN+QFZI8QBL925P1OXg+8:laVvpdoIMGePefs0nO0eBQ1uVwQIg+8
TLSH
T16327333BA8E89CCFF15E28B31FD7F292F3E9165D5B86507D1921AA3150AD88C2D73112
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  Bandicam/App/Bandicam/D3DCompiler_47.dll
- Size 3.5MB
- SHA256 80b8f0435b379b18bbfd91f9e62e3797b3e9bf07d77bb8e5201a74f590cba37a
- MD5 7375633014ca3bcabf6d337abe399afc
- SHA1 bbaf4aa50ffc0d2bd363d5debe56d41121a1fec2
- SHA512 d81bfffb7b031f48e08ddf9d3f4862851ed87ce50d149c63eb74fa68d92e336c1da66a5bcceb55f22211c877441570111439d7383597ad6a2cecdbd5b7502990
- SSDEEP 49152:VtdNhilBx6wvXmPwJTtLgvUACN5m5fsRu9qLHyPQiC7:VTNUlBUwv5hdAGQfsRu2uk
- TLSH
  T101067D21F7018076E8CA02B3659D7B66A56C9731473401C36158AEE5FD707E33F3ABAA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral1
- Target
  Bandicam/App/Bandicam/bdcam.dll
- Size 920KB
- SHA256 589d0dadbf30e48af3949080278ac4ff7dfca81ab2676f96cf9ddf4014fb9ed9
- MD5 690b2e29ae69a87d46fa0fdb0724d6d6
- SHA1 b0851b6cf81ad410c049bc2818d7d72a7795149b
- SHA512 d8908c2fd248236acbdeb27afbee58740c3415fde75e91cad94baeb15e9bb01c970143c49cb97943790b4dd5af91e9fdc26242872429c07b7d423504e747e495
- SSDEEP 12288:urP3VTnEpAYWlCziXbHlk7XiA8xBKYRRraRAomEzpwB5tR2rFNKuCbHnkDgkJVGF:OPGpAYWAlCBKYR7BWuR2FgkJ9C42U0
- TLSH
  T11115C4876720BC51CACE86BD0A90AF62352755B90230E1AB11956B5F0BEC4C16FFCF97
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral2
- Target
  Bandicam/App/Bandicam/bdcam.exe
- Size 6.4MB
- SHA256 6b9a7d5a9f6a9cf2bf86efaa9c66c49e419b33cb95b66b905fa95d83b770bb55
- MD5 3a224d20e1ed136b4385873373ee78a0
- SHA1 953d0c6969fc07997d1ca7b99a6f10a91f02efd9
- SHA512 2a853bba768296fccad3b0b50222b4e5b5d5da351fa58f3f8627d0e15fe522d233a087be3ddb3a5f7163b1b7f10caf57b84b70492ff4da0d421275ce651102d5
- SSDEEP 98304:SgQZGqnTGddzJNiAxqcrEMbIAggpg3GjUdil6mtVI7TUJiTUdsGv:SgWGqnNKIAggputW68+iiTPC
- TLSH
  T10366AE1178859023E5A3C232DF99EBB9E5FCBE600775C0C762E47A1A3972AC31634B57
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

discovery
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral3
- Target
  Bandicam/App/Bandicam/bdcam64.bin
- Size 2.7MB
- SHA256 8a2699a10ef578704718aa9a0cda3bdbe5aa32ee38180cc58401cab3cef6c46e
- MD5 67a0381055bb13db40ebb053a86c9f62
- SHA1 370e02034f9cd51d6e1993d4419f972177afa35c
- SHA512 37839c917122eb7b73c19e773ef8136f01e3492726ad61c87e3eb114decec6d8a4e6c87cb440b9d5ccae36e2b89a7e832349f1f3d98807ac5965d38f56fe0230
- SSDEEP 49152:XX6bDfi/9BVNtIrjKTvjvkNsJd1TjAYD9Iwzq/dJlanh:HuJCkNsJ7jZD6wYdWh
- TLSH
  T1A3D59E8797FC40D4D5ABE178C5174A4BD7B2B8221A7187AF01648B4E9FB72720E1E336
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral4
- Target
  Bandicam/App/Bandicam/bdcam64.dll
- Size 1.1MB
- SHA256 196a83d0587d5e364ab46a2e7dd408e2ec038d934dbe765c8993977566d04514
- MD5 b085e3da6e64610bc0f8214fd47e4213
- SHA1 3571e9012d9cd31dc6fcc4b2959d795c33330279
- SHA512 26d142268e85427cc8e3a24fe25b23148832255d2d79f8201c95a5fa404b1372f05b4ba34c2f433c7bc3d7c3b1ef94ca3e0769137ea6ee7cf6762f1af0886602
- SSDEEP 12288:uWtey/fcEGLT0pbal0K6pjPiiedDEHiYQ/Y5RzTY8wp:n0lLD0K6oiedDEkMRqp
- TLSH
  T11235E88753707C51CADAC6BD0A925F11B53324BA0230A26B10915B1F6FEEAD05BFCF96
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5
- Target
  Bandicam/App/Bandicam/bdcamih.dll
- Size 90KB
- SHA256 6b057427a68b18db597db9b13008f221a6fbb45b411fadede1cc2816ad478c74
- MD5 e2bebc064a10bf7f5fa37b6500c8efb1
- SHA1 9e5edb03ef40fd908136a1c9975d4b0109543c22
- SHA512 993d4e1b28e9ecf98468e4b96ba5c0b8c7e96f49302e032274018d86b549f38b7f876909ab29966ef692229c73fda2faf2a1ad73f1dff1fdbee3c8355292da47
- SSDEEP 1536:BQpI1Sejio/nqu1zdkmfmDvSrRuF+cUcZZzsWMcdy0igm3VaDVB0B:BkejiynfzdkSuF+cUcrfy0igm3VaDVBY
- TLSH
  T121936C4036E19072E9FE0D3554A4E5618F7EB961DEE08D6B275A022D4F307E0AF35E3A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral6
- Target
  Bandicam/App/Bandicam/bdcamvk32.dll
- Size 128KB
- SHA256 e3fdd063d95b9aae0b2cf925fefe3eae5c5d986e380233011cbe92c993f30c8a
- MD5 1297c1c2e256f801c51f4b7b8f8335b7
- SHA1 1b492c33c5149c86e4666c4b123c8659a2f8b63e
- SHA512 bb33176dbbb8adf8fd0181594ebe3f9dacedc95f671520e6b042739d4fb08acacce2d736ab1db92bd867c4963ecaa2737f15bc06b093a4abd46febc3653a3728
- SSDEEP 3072:Xs+LvezfjwmCDB/AR12uwuLf4ZFo6WqkuMlVuzmPtpLEXyaXZ0VPVY0h:czfjZ6AD2uwuLf4ZF+K6VtLiZ8h
- TLSH
  T154D38E007991C432E9AE0A3844B4EA659B7EBD60DFB4DEDB376407691E343D09F34E1A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7
- Target
  Bandicam/App/Bandicam/bdcamvk64.dll
- Size 154KB
- SHA256 80cce48d3721b0d2b54b85a32150f479d200a167351405a0d462cb2ee8ef2c29
- MD5 9ca462566c5475977524c58e1f32613c
- SHA1 351b9a85e38a1f49365538c584a0e9c41e56988f
- SHA512 fddf2710946721aa178bb49f9bc048bf84e8dadfb79899528acb3e1a3914c3391d7cc7090202d5e28163ada5f7e00aa4a8e45122cfaca6304fb94077e3b5ce08
- SSDEEP 3072:vwdVpQvbwSDkjojMfatUi1tzqwS1r4GMduCw0tVaquBV2Vg0c:vwdVpSbEgkKUi1KAuErXc
- TLSH
  T117F36C5776B51067E6228238C4A31606E772B8556BB49BDF0360436A2F337E17E3EF21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral8
- Target
  Bandicam/App/Bandicam/bdcap32.dll
- Size 10.8MB
- SHA256 f44811d1fcfc412cddf1f471f064c051b89310b04363cef25edc7f4a0f20a438
- MD5 508581b11edecf4be8dfa4884b98800a
- SHA1 ade1329b53b86af93556f5b45ae60cc7ae65feea
- SHA512 b325722f8681476e50b3b95c0c34fbfb6f32f6eec108f58f48dd314698e8bc12039f1af9b5088cfdd287cd719f15c6062ea8b1ded75d81cc10eb8031aeb5a5b5
- SSDEEP 196608:pHyOPeYRI3kt9xIlInRGAI636eaiKvvvvvg2fi:3I1CGAI6XaNi
- TLSH
  T1B8B68FC1F5E7A2A0D54A0870143FBB5B69342F19420CD9F3F6C0EE39EC7778166A2A56
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral9
- Target
  Bandicam/App/Bandicam/bdcap64.dll
- Size 15.3MB
- SHA256 fc7dc383bc2e4dc508f471ba5d004abdaef3f7bc20210ad7a288d4afee93dda1
- MD5 21914f004a7f554318b0035affdea44f
- SHA1 d57735fb35631f7a8aadeb263d89990c97d14abc
- SHA512 ec5c94865ba50cab9eead8eaa494c2d6e89b37499aaf2cad57527989f4d88827a00b40f76a3af08da80fde78cde4d3d8d2f5ffbaafac47de02a98c7cc872f39e
- SSDEEP 98304:qj7hoyoHTYjSAIXtuBidhpOQfTInTba0fGwZeBShEz+c3SL1omcl5qZoUnvvvvv9:qj4HVphpOQfcvf7eBULwnqZo0vvvvvvF
- TLSH
  T14BF68D87F0EA618CD11B843442AFB713F9353C2942045AB753D1EA746E7AB807B3AF56
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10
- Target
  Bandicam/App/Bandicam/bdfix.exe
- Size 2.8MB
- SHA256 d3c9295f6f86aa1c289e665781185efe2d225f86720281ca631824100961b6c6
- MD5 17ffe20853e21862015ae3dfb1114020
- SHA1 e8d6e2f43320526b0cb863432ca330725e6aaa45
- SHA512 2f7f20cd276b2e87d6075a28bcf440fde82ff5e5f96d865fc2f90a7560388e5d37dc4ad977e369ed9152c1402c2d3f049d96976469a040993d38aefbc5d38b0b
- SSDEEP 49152:EtBxTm0c1qDYYaPgZdJw9FFd4qmigwsfudv5qnU0WdFVt2krMnovpngeaPAd7Tho:EtncUYYUgZvqmigzWv+WFVt2krMnMpnC
- TLSH
  T104D59D337B504026D56322319E5DFB7AE07FBF74073581D75286AA192E31DC26E38A2B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11
- Target
  Bandicam/App/Bandicam/lang/Japanese.ini
- Size 91KB
- SHA256 46be837c16b46a9ca46e42f2ce4b1ae36ae0c14843e4e20004cccc7e80057b28
- MD5 ad0da64178ee55cf794055a208d92a81
- SHA1 d6d24d01f5c0f1454eef4bd246f5a64af06ff754
- SHA512 037fd55242d55ea0d439ef32193f4324c6c5df3d67668ffe192eeff9abf1c49e2b9521afec4c730d9d6a5a26dc138827628c263106e62e30ff82eb3c511384a7
- SSDEEP 1536:fvIRhbmXQKyWDtmSTK6J715bwOb8mryQXD+tnAo8X/tCRh:5T+2715b/b8mtvtsh
- TLSH
  T13B93B1513CED102A7166B6E68FCFE3658B6AF1E7829A8F2610DD510B63D2C5136233F1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral12
- Target
  Bandicam/App/Bandicam/msvcp110.dll
- Size 522KB
- SHA256 c8d5572ca8d7624871188f0acabc3ae60d4c5a4f6782d952b9038de3bc28b39a
- MD5 3e29914113ec4b968ba5eb1f6d194a0a
- SHA1 557b67e372e85eb39989cb53cffd3ef1adabb9fe
- SHA512 75078c9eaa5a7ae39408e5db1ce7dbce5a3180d1c644bcb5e481b0810b07cb7d001d68d1b4f462cd5355e98951716f041ef570fcc866d289a68ea19b3f500c43
- SSDEEP 12288:FqULIc5nb9rywgfyhUgiW6QR7t5sA3Ooc8sHkC2eRxUH:PLHnhryLfBA3Ooc8sHkC2eRxUH
- TLSH
  T187B44A237B824CF5D19E53B231C5431587FAFC6181A1F353ABDEF1692FA6286E123A11
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral13
- Target
  Bandicam/App/Bandicam/msvcr110.dll
- Size 854KB
- SHA256 b30160e759115e24425b9bcdf606ef6ebce4657487525ede7f1ac40b90ff7e49
- MD5 4ba25d2cbe1587a841dcfb8c8c4a6ea6
- SHA1 52693d4b5e0b55a929099b680348c3932f2c3c62
- SHA512 82e86ec67a5c6cddf2230872f66560f4b0c3e4c1bb672507bbb8446a8d6f62512cbd0475fe23b619db3a67bb870f4f742761cf1f87d50db7f14076f54006f6c6
- SSDEEP 12288:TmCyHcMpK7QdgD+9Tr8r3FmJciMgLFWkA8qTWu+FVlofpJCjNdr12iqwZeq:TmCyHNIQdTryVmCipIkqTWu+Fr
- TLSH
  T19A15BE12B6D2C0B2C57200701628E772597FBA72547999BBAFD98E0E1DB06C0F71B772
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral14
- Target
  Bandicam/App/Bandicam/vcomp140.dll
- Size 178KB
- SHA256 dbc67dd65ef7d68bde9147c6244e7aaa8cb275ed6d0ef60301c7e4fbb95a5a42
- MD5 1cd23a0f3daf4210f86ba8eb60b2612b
- SHA1 979ab8d98d27fc0c8810822d80a4f1361657f21d
- SHA512 90941648d2cebf4bcd65e54c503a2ced7362fe2b5afa6772b0ecc8ca945d2e43ea14e90a17e64f3eab8ef76ecbb0ea3cc801dbcfeaa8a90ab8b1fe2e081c17c6
- SSDEEP 3072:KDGRbh7RozAcuolrdTl2E72uRcQnFCt+DVFf/w62dQ:HoTuIT73CG/SQ
- TLSH
  T1A3047D11B081C036E5FB093562BBD923163CB53037B498DB639956FAA9207D2BB38777
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral15
- Target
  Bandicam/BandicamPortable.exe
- Size 293KB
- SHA256 47d964171efcf6898474a3e2c5158ed282953a594202aea1c46c7e67b825bb84
- MD5 a5787e48dfd9253c070d8b064df06719
- SHA1 292c5a0071fb6dfa41460370193c330efa95a5da
- SHA512 7d909ded7fbb872e7d65c9480eed9654085f9d7fb09e63ae73664c89b7ac04c77258cfd3459ba0e7741a3195a40a488ea42a33ed61ec16fc36f23263e3ba1dfc
- SSDEEP 3072:cs77w1OlWUt1u98hBbXWoGoZpct53dN3CzGiZef9bjR8LbV4xKem1l6mg99Ctg2N:dmOPi8hxWo+3duGiEf9Xu3V44099eW36
- TLSH
  T19754CF762FD1D88BD4760D72097ACE76C66A2CF409139642CAF87F8FB470A0E6D19352
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

adware discovery spyware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral16

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Suspicious use of NtSetInformationThreadHideFromDebugger

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16