General
- Target MicroSIP-3.22.12.exe
- Size 9.0MB
- Sample260826-2cd5ssbq6v
- SHA256 505021a4561934d634afd533e7b27611094800b6668a5bfa795afbe858fe736f
Malware Config
Targets
-
- Target MicroSIP-3.22.12.exe
- Size 9.0MB
- SHA256 505021a4561934d634afd533e7b27611094800b6668a5bfa795afbe858fe736f
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Loads dropped DLL
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target $PLUGINSDIR/LangDLL.dll
- Size 5KB
- SHA256 131aa0df90c08dce2eecee46cce8759e9afff04bf15b7b0002c2a53ae5e92c36
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target $PLUGINSDIR/StartMenu.dll
- Size 7KB
- SHA256 e74f442771f034a24b77d3a849b343551bdef69ef151c622cb9fd5f34dccda81
Score3/10 -
- Target $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 23d618a0293c78ce00f7c6e6dd8b8923621da7dd1f63a070163ef4c0ec3033d6
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 89a82c4849c21dfe765052681e1fad02d2d7b13c8b5075880c52423dca72a912
Score3/10 -
- Target MicroSIP.exe
- Size 12.6MB
- SHA256 132e749f6d4f5d6a90c45be2ed2ff993a96c8f9094d35ff3164a0ea882d7fe1a
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
- Target MicroSIP.url
- Size 49B
- SHA256 a1fd9933a55fa8e665e9422997387dd68ce15ad0b71be92074945a99412afe26
Score7/10-
Loads dropped DLL
-
- Target SDL2.dll
- Size 1.1MB
- SHA256 0983e4f6aeece71702f42b10ad537b2d9fe0d6872810171cbb1a6babbb99752f
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target Uninstall.exe
- Size 492KB
- SHA256 75cebccbd1be9d8317e3627f4303797c13b9d56a17032158623e758254b309c6
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Deletes itself
-
Executes dropped EXE
-
Loads dropped DLL
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target avcodec-60.dll
- Size 3.1MB
- SHA256 d24bfcd6db823ff1b9781a1de5fb3997366f954ff12868f9a915b8dcee0995d2
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target avformat-60.dll
- Size 271KB
- SHA256 775df36c687a931f56d7ff59c95ada6d620a9d73e219b3df8953dd1d96057aa6
Score3/10 -
- Target avutil-58.dll
- Size 812KB
- SHA256 647da18b39629dc9c5fd37ed4145a5d4033da8d40decf0e45c9e139d483ddf62
Score3/10 -
- Target lame_enc.dll
- Size 351KB
- SHA256 3f3f5de3086492cb4dcdb69b318e99a2ba67b6cfa294ab58dd5a5e21c50e25a4
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target swscale-7.dll
- Size 466KB
- SHA256 b92ece4b059d8fd788a5d289c36655176e74b8f61b037ba6c290eba82fa5452f
Score3/10