General
- Target CapCut_7643017417702047760_installer.exe
- Size 2.7MB
- Sample260903-py9glsxcmf
- SHA256 69dbc6f939bf4ac63a90dc56e1e9600b4d4284848a99c4190423c3f856c5961e
Score
8/10
Malware Config
Targets
-
- Target CapCut_7643017417702047760_installer.exe
- Size 2.7MB
- SHA256 69dbc6f939bf4ac63a90dc56e1e9600b4d4284848a99c4190423c3f856c5961e
Score6/10-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of NtCreateThreadExHideFromDebugger
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
- Target $PLUGINSDIR/BgWorker.dll
- Size 2KB
- SHA256 50f735ab8f3473423e6873d628150bbc0777be7b4f6405247cddf22bb00fb6be
Score3/10 -
- Target $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target $PLUGINSDIR/downloader_nsis_plugin.dll
- Size 1.4MB
- SHA256 e5f5627134d9792e63cbc3867a0ab47fd02bdb86fe39d91c826bc669da8dfd34
Score3/10 -
- Target $PLUGINSDIR/shell_downloader.dll
- Size 2.3MB
- SHA256 685e9f64a1915f3663f7ebd26cc2e23621e82e5bea94c04cc9037b039e30bbf9
Score3/10