ae2a1544b506f787609a67cfb35d98753f866015ff18298cc0e8ef6f00f15871

Sharing

Copy URL Twitter E-mail

General

Target
Douzy-Setup-0.11.5.exe
Size 147.0MB
Sample260910-zvpcdagq4v
SHA256 ae2a1544b506f787609a67cfb35d98753f866015ff18298cc0e8ef6f00f15871
MD5 e53bb99124f45faba63a89b2478b45ec
SHA1 2df9991a951e642f5c977e891517d23852b2ef51
SHA512 dc78520ec6b0a3b871e63084fb9e7f796d48f9f2b1035b323f96d6542ab59e8e9df1039a01a77c4bf8614a796a40ef49d38e3294e6bd34690e4a8f77a93d4a04
SSDEEP 3145728:klTiIgLWFsXrhooAm3msgohEgRG1VmhPdFXZB1Tm4Sir2/r:8uNL7rh3XxgQEgRG1wPnvZAir2z
TLSH
T1197833ED0217B9A9F23CB1FA51192BFB3F9DF48554176DE82B18E0C83A50E50EEA0574
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  Douzy-Setup-0.11.5.exe
- Size 147.0MB
- SHA256 ae2a1544b506f787609a67cfb35d98753f866015ff18298cc0e8ef6f00f15871
- MD5 e53bb99124f45faba63a89b2478b45ec
- SHA1 2df9991a951e642f5c977e891517d23852b2ef51
- SHA512 dc78520ec6b0a3b871e63084fb9e7f796d48f9f2b1035b323f96d6542ab59e8e9df1039a01a77c4bf8614a796a40ef49d38e3294e6bd34690e4a8f77a93d4a04
- SSDEEP 3145728:klTiIgLWFsXrhooAm3msgohEgRG1VmhPdFXZB1Tm4Sir2/r:8uNL7rh3XxgQEgRG1wPnvZAir2z
- TLSH
  T1197833ED0217B9A9F23CB1FA51192BFB3F9DF48554176DE82B18E0C83A50E50EEA0574
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery execution pyinstaller
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH
  T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/UAC.dll
- Size 14KB
- SHA256 2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
- MD5 adb29e6b186daa765dc750128649b63d
- SHA1 160cbdc4cb0ac2c142d361df138c537aa7e708c9
- SHA512 b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada
- SSDEEP 192:DiF6v2imI36Op/tGZGfWxdyWHD0I53vLl7WVl8e04IpDlPjs:DGVY6ClGoWxXH75T1WVl83lLs
- TLSH
  T10F623AAA62E847BEE2221636B96723130BFDB5203DA1D01F4D531E596C30BE3953D61A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $PLUGINSDIR/WinShell.dll
- Size 3KB
- SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
- MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
- SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
- SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
- TLSH
  T16A51365F13BED7A4C3071738A6FBDC85749B440012C659558BB2172ABF141E0BB3CD08
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  resources/elevate.exe
- Size 105KB
- SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
- MD5 792b92c8ad13c46f27c7ced0810694df
- SHA1 d8d449b92de20a57df722df46435ba4553ecc802
- SHA512 6c247254dc18ed81213a978cce2e321d6692848c64307097d2c43432a42f4f4f6d3cf22fb92610dfa8b7b16a5f1d94e9017cf64f88f2d08e79c0fe71a9121e40
- SSDEEP 3072:1bLnrwQoRDtdMMgSXiFJWcIgUVCfRjV/GrWl:1PrwRhte1XsE1l
- TLSH
  T1EBB37C1274C0C471E5732A361974CAB14AADFD700E759FAF6398127A4FA01D09A3AFB7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  resources/sidecar/win32-x64/douyin-dl-sidecar/_internal/Cryptodome/Cipher/_ARC4.pyd
- Size 10KB
- SHA256 e37da2a2140eb18fb84065d4138ad1072539c82464475a94f5a87a049e601f7e
- MD5 41851aa1dd56679c1f5ec9853b9cc616
- SHA1 4e8e9b4798e6275c0213bb0189f80b52d2f72ca7
- SHA512 eadb1acc224c40cecb8e273fe3523c97c69aa934baa79876e38592df50a8bb4bb1bfbb25033c9064a208947b1db824ac758a0f7c56cf04695f0970ca2b9d7ab2
- SSDEEP 96:1jZuck7BNymq3UtFfZAn401wlKsQ9AfJkSRsP64Cz6Tq2c5n1kBRcX6goyOazh:XkNNyatvAn40q9WE6W2YORcqgola
- TLSH
  T1BC22188CFA564CEDEA6540B58A270B4FB075B711575273CF03B0917A1E637C6363A706
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  resources/sidecar/win32-x64/douyin-dl-sidecar/_internal/Cryptodome/Cipher/_Salsa20.pyd
- Size 13KB
- SHA256 59ee075ecb9877bc24f5c27fa2d590bae0f6aa30a6e02432e1eb25cb459abc0e
- MD5 73d2494c8bcd6738b2767fe7819df72a
- SHA1 7f3f3de2eebe1aca142aeb181d6bf5ea7e7084cc
- SHA512 c694e0db7b3eb2935abbde06935c52a0c3d95e18ad415eae36b607fafdb6a656c37b7c0854d387c1a37581703493951a76563d89d5d6ce36beaaf6d1313d4e7b
- SSDEEP 192:nBeCWznuR5zIzpshfrQ0ZFqdeofnLjcqg542:nBOCMpqVDqdge2
- TLSH
  T1D9521796F32701E9E42B9175CD734A4BAABCBA00635167DB1320D1578C62BE1323E7A6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  resources/sidecar/win32-x64/douyin-dl-sidecar/_internal/Cryptodome/Cipher/_chacha20.pyd
- Size 13KB
- SHA256 5736506ad6dc2f3d893b978c8727d74c2f0ae87bbc2fcfcfe8c7e982ea5e86e2
- MD5 ae0d9cbaf7463843e438dbccef1b27fe
- SHA1 87889089322bcbd79fcad0453667f577216597ef
- SHA512 566a28152ce33e185f8990d55408e4f36eb51b4c9970e12bfdd47462a9e2ca5e17cda61f5f5dba6f6177f3b6937efe04cc337af08525c41228e79ff4781dfb68
- SSDEEP 192:v30Y+Ne3erKrgMntNGWCL6qT043ZJPsBne9lkNEcqg2:v3ko1KLK2J19i4g
- TLSH
  T1FB523A89FB7054EDE56240B5C433070EEAF1BB20E711ABCB4360959A1EA3BD1313FA55
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  resources/sidecar/win32-x64/douyin-dl-sidecar/_internal/Cryptodome/Cipher/_pkcs1_decode.pyd
- Size 13KB
- SHA256 ed12c3d512e5e0b4245fdc5a83fd46497bb2df31e49199b6265ace5142fe5021
- MD5 0900e8e081214b321e38c80670be196e
- SHA1 6919c2e76572c16c75b04393102318ddc04c23e1
- SHA512 75732fd2ba3d25b5c17279ba69adb1da008daf309397d267cf5304d8ff835a3bfc688f9ad8b0cc669480a427f393e10cd56fd20885e8bb4fff9b4d309d8d6e36
- SSDEEP 192:hc6XJdfr7i0iNWGO6z0x+/TOn/cqgvVJWC:nJxC0e+QKRg
- TLSH
  T1E052E846F66AEAA8E9674174C62B4B1FB9FCF500636073DB0351C99A1DB33C1327EA40
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  resources/sidecar/win32-x64/douyin-dl-sidecar/_internal/Cryptodome/Cipher/_raw_aes.pyd
- Size 34KB
- SHA256 889f9b558a47a4333bfd3e3814eaec2328ac8648722d912c7873fdea62fcf886
- MD5 4c869a3047220f0b344536ca22b2987e
- SHA1 5812d84fa35514c9cfce57bbc36242f930386158
- SHA512 84e6c817b3b860c538e04698e90aa0ea82e21a19ef70066e5fba7a1203baf5ef6c12990ea8c27db8180620f3dce6bd81ad4b24b4132af94684f191c326d4e2ee
- SSDEEP 384:UnqX8MxMEzllvxL/7v/iKBt5ByU0xGitqzSEkxGG7+tpKHb/LZ7fr5aPU4sqIiRX:Unqs3C75tCKaVS4j990th9VCbT
- TLSH
  T19CF2061465A92656DF850E7AFF03CC0BD6B17821B762F23625E9B30C201B3AE2B7B455
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  resources/sidecar/win32-x64/douyin-dl-sidecar/_internal/Cryptodome/Cipher/_raw_aesni.pyd
- Size 15KB
- SHA256 6c9a2bed5c1bd9acd8bcea7f5f20f7fa63e4465b0914ae70250bd59a8028333c
- MD5 0b2596c23bd2792fa5cdb304417dd36d
- SHA1 c3dde92f4355aa8152e3b8794c5d44cd90665448
- SHA512 0716b03540f0d4a91d0aa2c9308e16158e166a62744294903181cfdd58c2299ba0d8cde1a4617df2ca63dfe4c813f14ae77e34bcdf2b57baceaf42a9ab5b2632
- SSDEEP 192:dqTHkhuSkYucCzCQ0T/jJCMRU0NumrrBkyYUtsXIIMQkcqgGTqc:dlhNkYjCXOJvNuarPYUtKkgI
- TLSH
  T103622A8EF65644BCF61502B2C463050AE4BA7520136277DF1320D1AE2FA3BC6766F7E8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  resources/sidecar/win32-x64/douyin-dl-sidecar/_internal/Cryptodome/Cipher/_raw_arc2.pyd
- Size 14KB
- SHA256 eda56aa3afb9d6adfd95ba950ad1247b5e2c6aedaa2db86af0c8fa79217359a4
- MD5 85f63e63df3607939b73a8dfd6e97378
- SHA1 deb83e94476794c9cf2ed39fd7952656a434ed58
- SHA512 08322adf4e0516aef6b9e42eab4e45066a20ef8a4bdb2d09354fcd4a282d9dce45f4a3d7645ab4f624e0700ba2fb9582b0ba51a7e84d57b99e1310e2118ca928
- SSDEEP 192:DG07obuccnuzHysARb0tWmn++0dmwjxs8tZcqgew3:Da6n643mo4CRJgH3
- TLSH
  T1DD621B46BA7909F4D92F8178C5F3D70CA2B87199230C9FDF0264961A2D13FE56A3E2D1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  resources/sidecar/win32-x64/douyin-dl-sidecar/_internal/Cryptodome/Cipher/_raw_blowfish.pyd
- Size 19KB
- SHA256 eea7e0597216ece6d23b351743fdc08d32a5bcde57b1efa724a3b6138b692ad9
- MD5 bcd7095ad7e4edc042d58d4ec72cea9f
- SHA1 f14b04129bf2546ffbf05cd019d59be7b644b576
- SHA512 cb36dfe191778ca41c29e14e54418dbb65b686d527049abfaebbf0d241e8cc6b3b59a9dc55d8e68aacae3d60e855f218afa7863380c7ff378070b04697b0a382
- SSDEEP 192:gXI2AcU5uMeFhK8YVfyc0u/yO0Bfx4RqI6HJAyZJg8D0KThxA+rAQE+tnJiO8qZE:/eS701RiMpJgLa0Mp8pgIO
- TLSH
  T1ED925C4DECA855BAEE200234C646CD9EE12FF534633DEBCF2770168E09166E60E747A1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  resources/sidecar/win32-x64/douyin-dl-sidecar/_internal/Cryptodome/Cipher/_raw_cast.pyd
- Size 23KB
- SHA256 90442d012d3f918cb0f78035680db6a373148b1de7e84545e5f3596c655cd6ab
- MD5 85ef185bc09402ab82f26d77119a8c94
- SHA1 e467d442b4d918d3b5600d58b48c54553b51b374
- SHA512 eda981161c3331315261efd4420acc2b10bc677e89be04e712f3c85c355d4d8d75df3047cb94d161b43499b710f846e785f392addefbc1eaa5a21870f023bd44
- SSDEEP 384:46quf9b7Dry3YcZXmrfXA+UA10ol31tuXuewg:v9y3YqXmrXA+NNxW+e1
- TLSH
  T15AB27C65F32588EDD667C435C4135E5FE039B861332543FB0762629A1E1B7E8A83D3E1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  resources/sidecar/win32-x64/douyin-dl-sidecar/_internal/Cryptodome/Cipher/_raw_cbc.pyd
- Size 11KB
- SHA256 6c6c5fac1b5933fb857fcc3e5a87765257b5484285de147e9bb5fc854223a707
- MD5 a8cd12651f1f241e6664e92f135072e1
- SHA1 68215631fec0e3166379e30d6a7ce269fb8051f4
- SHA512 5d6cbe4493432d727d41fedfb9f8d6e189e5b7623a6b80d763e020458be465e1ab8da4d278a5e2132d14838d7145d50733707d6bc41eeda3565265641a2d5bd3
- SSDEEP 96:X4T693BMwxTwu9B2GKLCReiEyqLsN59la1oC01VGlN5C5J2SlKsPViRDAnzdAqke:XJB3jD2hoeeqLO9I1oC07xlYm6tcqg9
- TLSH
  T10532184BEA258BF9D1134336C0770649AAB5BB10B38277CF0365916A2D337D2723E795
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Checks installed software on the system

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32