0ee7b759281cd6f9158a60f3379e5be4f0de54a959388e8fae0a9a510a6e6bdd

Sharing

Copy URL Twitter E-mail

General

Target
VoiceChanger64f(2.05).exe
Size 1.3MB
Sample260826-antwva1bkb
SHA256 0ee7b759281cd6f9158a60f3379e5be4f0de54a959388e8fae0a9a510a6e6bdd
MD5 cff7f369730e0075970510da603ff32d
SHA1 a66aa15d2838cf68ef8c5acb09d5b7b79c517466
SHA512 9ec61a4b22cad798b725d6abf43d8be10c50b5694496f479d1b76b86cfc1d9c6f17b255917c3fa7ce7c1f983e4e699df6cbb34d7ef14c04f3dd5c619529c06be
SSDEEP 24576:cYDZBrabd6i5Rf35kxnNxgAqbED5wXBB38X+AbaVppzcLFfXBDtAHCCx5GG:V2J6iXPqrWAqwwqdaPp+XBDtAH0G
TLSH
T1675533A0FB68F598CB22E932DA1824E39DE2A4F51445914F3704EB95B74F2D74D3E309
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  VoiceChanger64f(2.05).exe
- Size 1.3MB
- SHA256 0ee7b759281cd6f9158a60f3379e5be4f0de54a959388e8fae0a9a510a6e6bdd
- MD5 cff7f369730e0075970510da603ff32d
- SHA1 a66aa15d2838cf68ef8c5acb09d5b7b79c517466
- SHA512 9ec61a4b22cad798b725d6abf43d8be10c50b5694496f479d1b76b86cfc1d9c6f17b255917c3fa7ce7c1f983e4e699df6cbb34d7ef14c04f3dd5c619529c06be
- SSDEEP 24576:cYDZBrabd6i5Rf35kxnNxgAqbED5wXBB38X+AbaVppzcLFfXBDtAHCCx5GG:V2J6iXPqrWAqwwqdaPp+XBDtAH0G
- TLSH
  T1675533A0FB68F598CB22E932DA1824E39DE2A4F51445914F3704EB95B74F2D74D3E309
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral1 behavioral2
- Target
  $8/APOConfig.exe
- Size 196KB
- SHA256 d0666f91e134e6522150a46dbe521479993cd708492f090b72940ba050d1a68a
- MD5 6dea0364646c299c12239e7402c28e7c
- SHA1 a801c2b7c49dcd6e2f8c33b59a2e1ca8c70adb21
- SHA512 b3030b301e571649892aa2c081c254eb293520e0bbe3a4df1522d70cbe35661485e1bc7688d8413d88e298ef3463e3542e4bede73ab1b3adfbfc4b76bdd99b21
- SSDEEP 6144:lXtzpxJqoyk6H9APPQZLFlejj85JL7guX:PpPK9A8LH5N7gM
- TLSH
  T11A146D25BDC2D073E666093069E8CA759A29F8B10F609CDB73840FFA4D346D19735B3A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

discovery execution persistence privilege_escalation
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral3 behavioral4
- Target
  $8/AudioChanger.exe
- Size 161KB
- SHA256 c925c8115c73e9851198d3db4c1c1864ca7c38189d9af724fc46a2fe857bda94
- MD5 49fbd834770de5e01937865824063bc5
- SHA1 7e3e16db4103502c4a6c3248fba850d69fd2016e
- SHA512 00846479da905bd9dfe47126fdde7062b39f29203feb38ccc0780ba90dc2bbc4928185965a3e2490e21c7c9b38f0746fb7dfb7f401066874484adfce13ab02bb
- SSDEEP 3072:e65PxKAHTGwJyEDsUIzw69Ms9R7aXVR6+KPEqHwfS1:e6SAHTGIxw7DasraKMqQe
- TLSH
  T194F37D5773A430F9E5278239C8A15A46F772B87217209B9F13A8477A1F133D09E3EB61
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  $8/ClownfishVoiceChanger.exe
- Size 985KB
- SHA256 9e1dd2a58061382da6d17b05d1b97f56063046538952de052aa0a523623c4d43
- MD5 c5f5ce5a750f79fb8c20157dbd71833a
- SHA1 7a8a06a183ba6465bb02984516beee6fdf5c3b85
- SHA512 e3fa60275dd6e19098b3d814eb21e8c3106ab6a6f7d2a74a4deb9bd2aaf7f3501869ed62d05565cfdb2244e65e10316fc90f0d550aa77a14f6f9177c66640d37
- SSDEEP 12288:LaSsnEVp1pFJq9hRIL8NOvsE6IVEXYD01b6aOffk5NI/r:Oqxp/IRILRkE6IV7Y4OST
- TLSH
  T13A255B1C6EE502B9E1F2C770C9A16506EA717C85873D99DF03C1C2994E729FACA39F21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

discovery execution persistence privilege_escalation
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral7 behavioral8
- Target
  $8/ClownfshAPO64.dll
- Size 371KB
- SHA256 e58a7d9e14ebe9ca894747913e36b559808bd5cab7d6a6cb7fb95f4a0d6725aa
- MD5 9de8fbab7f2421c02a37258debca29cc
- SHA1 ef16998beb341ab07f4e7cfb5b9bff5563cba369
- SHA512 ba21d63bc50f9a63a185d9e163e8295de07ab4d00cbc538fe01f0c97eb67e8781bb2e45b9fc6b16c825d9a0dd238ac176f15873c555086398f4c8dbb3c6c37aa
- SSDEEP 6144:QvbxZ1gPPNcOemnk+j8edhyQ7BsX4m9V5CIiRpKsVgWooz18ZU:CdgPFcFIR4gyksX78UCeoH
- TLSH
  T13084BF05FAA500F9E177917C85BBA607F3B2341D0370CAEB03A446696F277D45ABB722
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

persistence privilege_escalation
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral10 behavioral9
- Target
  $PLUGINSDIR/KillProcDLL.dll
- Size 14KB
- SHA256 0fe15b023e21b7054fabb3d47b6084d60f8e474d8f9ca3a0a25dcb2097d6f0b8
- MD5 586270250a1acce8126a0877fd5bb981
- SHA1 9f5645b37b3af04004697639855da5c99a41aca1
- SHA512 a1994b91337385ab153860a013912f9cacdf9c233395868bf8eedfbe6dd13841619a8048c1d8407ee4b77c466fd8f31fc5cac2c779a2ef58c3a2a02caeded055
- SSDEEP 192:/BZa4DYIcJ4nS1ejJThugw4LBs4TJjdjqJVQXS3p16ZGntrefncWCV:JZ8IcJ4nSkJlums4TJJjsVh3pwZs/
- TLSH
  T15852F79EF117F6F6D4CB46B045E2FF3B443E29028836A8B4DF50EA207D1789E6529047
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion discovery trojan
- Downloads MZ/PE file
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
  defense_evasion trojan
behavioral11 behavioral12
- Target
  $PLUGINSDIR/LockedList.dll
- Size 28KB
- SHA256 671570118024c9132f12999e198cebc87b3bf1846695553bf478c5a42efec226
- MD5 2ee096682cc84f5fd44fb5291c00596c
- SHA1 8dccebf054abe13e5b324dfdfbe6605553971396
- SHA512 1ffdc3a5256b8eb62aff82c6429dcdf582009a908d43ab30d3fad84770b012be59c972323b6ae2b8d7ea2ae29d8ab3a99913205a0b33582e95dc813c31507d3d
- SSDEEP 768:Mne3kAZoxbRX66y11T9vBD3fNUHeBuf6qW:MnnTZyX9vBDvNU+UZ
- TLSH
  T107D2194457E000F7F7BE1AB079A92B0A5ABEF91868F195AB4F3754CA1D61112F628343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral13 behavioral14
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
- MD5 cff85c549d536f651d4fb8387f1976f2
- SHA1 d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e
- SHA512 531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88
- SSDEEP 192:Zjvco0qWTlt70m5Aj/lQ0sEWD/wtYbBHFNaDybC7y+XBz0QPi:FHQlt70mij/lQRv/9VMjzr
- TLSH
  T126426B129BB089F2F591583814667F2A6FBE9C5D27F50563CFE304D63D212CB983A283
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral15 behavioral16
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 56b96add1978b1abba286f7f8982b0efbe007d4a48b3ded6a4d408e01d753fe2
- MD5 6c3f8c94d0727894d706940a8a980543
- SHA1 0d1bcad901be377f38d579aafc0c41c0ef8dcefd
- SHA512 2094f0e4bb7c806a5ff27f83a1d572a5512d979eefda3345baff27d2c89e828f68466d08c3ca250da11b01fc0407a21743037c25e94fbe688566dd7deaebd355
- SSDEEP 96:o0svUu3Uy+sytcS8176b+XR8pCHFcMcxSgB5PKtAtgt+Nt+rnt3DVEB3YcNqkzfS:o0svWyNO81b8pCHFcM0PuAgkOyuIFc
- TLSH
  T17012F992E6A450B3C5D6533B35AA2F2DCBBD5325B0926C00C7738E4D39395B66E38353
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral17 behavioral18

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

Event Triggered Execution: Component Object Model Hijacking

Checks computer location settings

Event Triggered Execution: Component Object Model Hijacking

Event Triggered Execution: Component Object Model Hijacking

Downloads MZ/PE file

Executes dropped EXE

Loads dropped DLL

Checks whether UAC is enabled

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18