4fcdfd902be78052a07153a0e0b194475626abe9716a2d9df2ccec70fe777d8e

Sharing

Copy URL Twitter E-mail

General

Target
Songr.zip
Size 5.7MB
Sample260912-ywph4aterf
SHA256 4fcdfd902be78052a07153a0e0b194475626abe9716a2d9df2ccec70fe777d8e
MD5 157bf03b5746a1decf9f668b21db6ba7
SHA1 0a1236284f76c64ca9737dd48671bbbdec2de4de
SHA512 c0c1b5a1a4ba00582d54d8d1fb1a4621aced80388e1c77defcf8f0d01b5f9755c040f69f785d9c3a2286e9e1495f633a2129a7d115e44ab0546566c9106805ad
SSDEEP 98304:lF66pVLAYyuz1VqFAON20URkbTJ05vRW5UlRUcbrXBURHWOd2W:P7NyuJVqFAOc0URgTJ0NoevbrRLOd2W
TLSH
T1985633E9C78C23FAB76AC9DD6B3A044975C43087768CEDE6EF244C4176096E7248B439
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  Songr_2_0_2349_Setup.exe
- Size 5.7MB
- SHA256 a9aa8e6f926cb239694a58a2609578a3bbb6bfec37776b16b6ab6031d6c8057e
- MD5 0066b41e511842bf54e104034d8f0275
- SHA1 c6db9a956aa622bd5f71b8144eaca606352f459e
- SHA512 a392b61dcd46ef8ae233b6b561976c3502f58c39e37db7f70e397cc4a3b8e24b22a68bac71335b0d9395b7ac697421532302a261cc2cab0801d93dc3b809ee42
- SSDEEP 98304:3RE8hvtYYewfNlMHUsNs+GdsJDB0VllydUdxew3BpZMBhqm32b:BNbewFlMHUsi+GdcDB0jwMH3B7bm32b
- TLSH
  T10C5633E9C3CC637BF77AC9B92A3B4155B6E020835688DEE7EF148D0579052D7288B139
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

adware defense_evasion discovery persistence privilege_escalation spyware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Indicator Removal: File Deletion
  Adversaries may delete files left behind by the actions of their intrusion activity.
  defense_evasion
behavioral1 behavioral2
- Target
  $PLUGINSDIR/NSISdl.dll
- Size 14KB
- SHA256 dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9
- MD5 a5f8399a743ab7f9c88c645c35b1ebb5
- SHA1 168f3c158913b0367bf79fa413357fbe97018191
- SHA512 824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977
- SSDEEP 192:tUZTobBDJ68r67wmsvJI5ad9cXzFOVu+mZ/P3p+57CvpVqDxVp01Dwn2GRPgsfA:6Bo/680dCI5adOjFOg9//p27uNw2Go
- TLSH
  T1D6624C15AA2008F6C761127470E73BBE2BB34E72471485C39BE3595FBD25603AB72AC7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/System.dll
- Size 11KB
- SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
- MD5 c17103ae9072a06da581dec998343fc1
- SHA1 b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
- SHA512 d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
- SSDEEP 192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
- TLSH
  T1CA325C5993A0C1F3D5A0823C0D973A7B1779722016B14FA3CFA35842AE196D7AC7D227
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/UAC.dll
- Size 17KB
- SHA256 e58884695378cf02715373928bb8ade270baf03144369463f505c3b3808cbc42
- MD5 88ad3fd90fc52ac3ee0441a38400a384
- SHA1 08bc9e1f5951b54126b5c3c769e3eaed42f3d10b
- SHA512 359496f571e6fa2ec4c5ab5bd1d35d1330586f624228713ae55c65a69e07d8623022ef54337c22c3aab558a9b74d9977c8436f5fea4194899d9ef3ffd74e7dbb
- SSDEEP 384:59TzaeW+WyB8c7LX+OGkrwWvVrkUiEMAWm5nskAvXkq:5ZaB+W62Mr5vGUiEum5sk
- TLSH
  T16F724B25ABA083FFC5500571A6E1672217FA98301979586F8E73EEC62FB59436C3E703
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 e31ad6c6e82e603378cb6b80e67d0e0dcd9cf384e1199ac5a65cb4935680021a
- MD5 c10e04dd4ad4277d5adc951bb331c777
- SHA1 b1e30808198a3ae6d6d1cca62df8893dc2a7ad43
- SHA512 853a5564bf751d40484ea482444c6958457cb4a17fb973cf870f03f201b8b2643be41bccde00f6b2026dc0c3d113e6481b0dc4c7b0f3ae7966d38c92c6b5862e
- SSDEEP 96:hBABCcnl5TKhkfLxSslykcxM2DjDf3GE+Xv8Xav+Yx4VndY7ndS27gA:h6n+0SAfRE+/8ZYxMdqn420
- TLSH
  T17F12F8675A4041B3E9A3223D306A3E3F8B7C9325D0927C03C677AE566AB031A7D3A354
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  $PLUGINSDIR/nsProcess.dll
- Size 4KB
- SHA256 95fe9d92512ff2318cc2520311ef9145b2cee01209ab0e1b6e45c7ce1d4d0e89
- MD5 05450face243b3a7472407b999b03a72
- SHA1 ffd88af2e338ae606c444390f7eaaf5f4aef2cd9
- SHA512 f4cbe30166aff20a226a7150d93a876873ba699d80d7e9f46f32a9b4753fa7966c3113a3124340b39ca67a13205463a413e740e541e742903e3f89af5a53ad3b
- TLSH
  T12881947683E424F1C08F0D33B02A04DB6B76C9321326850D9B536F82A9A5AFBE03C311
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  Interop.WMPLib.dll
- Size 332KB
- SHA256 34ed13c6845745746ee9e55abb89b59970226750ab7df7c8fa2b6b18c18c9084
- MD5 c44664d4587d3b5efaae29ec12d8df5a
- SHA1 43dca511cc8ef373ec112e3f35f2ebed97254d39
- SHA512 07fa65c71ba8b155193effaceee03ccfdad6371d46f3bc4ac8a660822943a8e14e4250748dfcda4008b6c8d03ed965207c1789c56b2fa831b869d63c3bf82ec1
- SSDEEP 6144:MZ4fGV0LyxwnbEpxGpeU5ynY9mbMhq/QF+zEpC3otWL8R6Pg1uj0ZSH4dG7sBKfU:MZ4fGV0LyxwnbEpxGpeU5ynY9mbMhq/o
- TLSH
  T12D74A352321C8039D9AD837FC3BB0B74477186013965EF0B399D3AA9DF8224A9D67376
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral13 behavioral14
- Target
  Songr.V1.14a592d177f8.dll
- Size 880KB
- SHA256 01266eaf40c67a0ae07d8885f00aab4de5041ddb0dc37f968e88a2cc75450dd6
- MD5 5ea67ee2719e8c4f200289b8e6054b25
- SHA1 36a8e097192b50b2e9a02b7642713218e1798641
- SHA512 95e4245ffed0c53fcb09acf8bf92fa5da7c9f7ba876b9d1feb39a68bdbda4945f2bed15caef262b1740c61e59c1e6987e72f04d73e6e3c38299e309d66ad9d91
- SSDEEP 12288:ZGZn6wPv6stRH1wYrqq6D6/2ZNsgIVj7ArEO+EhCaVVdT:89TvOq6D6zBO5IaVV
- TLSH
  T117151A213AAB6209D87E17701C3595D413FABE27BF04CB1E2855135C9DB6623CB227BB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral15 behavioral16
- Target
  Songr.exe
- Size 1.9MB
- SHA256 435aebcddee962c660006cf273e9b0ba8842131055139ae744399fc60af0c207
- MD5 0cf28f92f076fb3fb280dbd2354f7dd4
- SHA1 b2435c01439efd04cc8f0336e7b25b59f07a5c43
- SHA512 1179d39435c8d0a079e1e7866f675525c4e2965af4b59666399ab47d054f61e7de16157377608558416bde1539cca52e8d40443eb1cfb22edcebc7e36f2d25c2
- SSDEEP 24576:sAdelRP/xwO+Vbj6qU1usjS9OJAUZCrX+6PaVV:sA4DwO+VqqsjS9O5ZMu1V
- TLSH
  T1C1959D0217D4C119E07F5376E4322A2ECBBDE62FDA22D31DB19D31A82FA77108991797
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral17 behavioral18
- Target
  SongrJumplistLauncher.exe
- Size 10KB
- SHA256 549e24a27e5b443c1044afdfbe9654bdd3308c5f3cb6d88e791e06361d76438a
- MD5 83b075f3caa529701faf275a3abb2d84
- SHA1 ff63d1c8544880192ae77fea673b704d300f8c57
- SHA512 9125619faa48c92d07c82e986fba903cf2c0565bc047eaf551eb247800d89f06b3509f448d581c46c47f266f81af3ff7ce9054f3015419b400e83b557e04a1e5
- SSDEEP 192:DIA+Xp+lWIGQXjWFoQehBer9BCEUTUshX6CLAu4:DbA+lWIGQXjWFfr9BUKCLAb
- TLSH
  T14222B84AF542B877E921A67804DAD96FC3BAF412CC235D4DEB002518742E464F92971B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral19 behavioral20
- Target
  System.Data.SQLite.dll
- Size 941KB
- SHA256 b956c6060dcd59abb4f2cbc6ca173d12ee37c160624fecc58c40aabc3a546952
- MD5 9ee30c23ce06e6b68b51d2a0c047433a
- SHA1 de51dd4e8efa656407ff2946e1396c3788d004a3
- SHA512 fc4b04fa85707eb90c401d40c2f5407c34732b23e8a5b99a9994cb418946ad832a1c651cabd366eb1094f1b7707d19af41342e20cd533b661e16481897b0601a
- SSDEEP 12288:nwlUiCz2THoX58DX9rlPP+r3b/dFDaM2+jFPdwmws98FNFGFOFwcGF6cmFWc0FWG:wesTc5CNRPP+rr//Vjv37u
- TLSH
  T15425BFD1EBD6C5B1E5EA21FD51BA1B374E3085124322C6D7FAC038859D612E1BA3F392
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral21 behavioral22
- Target
  Uninstall.exe
- Size 76KB
- SHA256 3449953a746a0f04630b9d2369433b4f428180428901900ad80a946380f619a9
- MD5 3299a16c4f30fe7ba3ebbe8f3f1743e8
- SHA1 f0b2b82df145773842baaea78fd3d66f4ce5f576
- SHA512 4cb2fa192d020776c672f891a7bfa5cb3cf8e5dcdac76d841f1cb3b5ea55d466e44a756093a0279210c0d6c771dc0210573ffbe96d681539b1e2401dae28332e
- SSDEEP 1536:LQpQ5EP0ijnRTXJwgdLeAyNL20b9KDPmABIFbDFoP9PZd4Enf:LQIURTXJwceAqKDPhI92Xdtf
- TLSH
  T11D73CF1636D4C877E07A473166B7D3A7E7B6F70111104B6BBF445FAF2921242EE22287
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

adware discovery installer spyware defense_evasion
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Indicator Removal: File Deletion
  Adversaries may delete files left behind by the actions of their intrusion activity.
  defense_evasion
behavioral23 behavioral24
- Target
  $PLUGINSDIR/System.dll
- Size 11KB
- SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
- MD5 c17103ae9072a06da581dec998343fc1
- SHA1 b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
- SHA512 d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
- SSDEEP 192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
- TLSH
  T1CA325C5993A0C1F3D5A0823C0D973A7B1779722016B14FA3CFA35842AE196D7AC7D227
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral25 behavioral26
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 e31ad6c6e82e603378cb6b80e67d0e0dcd9cf384e1199ac5a65cb4935680021a
- MD5 c10e04dd4ad4277d5adc951bb331c777
- SHA1 b1e30808198a3ae6d6d1cca62df8893dc2a7ad43
- SHA512 853a5564bf751d40484ea482444c6958457cb4a17fb973cf870f03f201b8b2643be41bccde00f6b2026dc0c3d113e6481b0dc4c7b0f3ae7966d38c92c6b5862e
- SSDEEP 96:hBABCcnl5TKhkfLxSslykcxM2DjDf3GE+Xv8Xav+Yx4VndY7ndS27gA:h6n+0SAfRE+/8ZYxMdqn420
- TLSH
  T17F12F8675A4041B3E9A3223D306A3E3F8B7C9325D0927C03C677AE566AB031A7D3A354
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral27 behavioral28
- Target
  $PLUGINSDIR/nsProcess.dll
- Size 4KB
- SHA256 95fe9d92512ff2318cc2520311ef9145b2cee01209ab0e1b6e45c7ce1d4d0e89
- MD5 05450face243b3a7472407b999b03a72
- SHA1 ffd88af2e338ae606c444390f7eaaf5f4aef2cd9
- SHA512 f4cbe30166aff20a226a7150d93a876873ba699d80d7e9f46f32a9b4753fa7966c3113a3124340b39ca67a13205463a413e740e541e742903e3f89af5a53ad3b
- TLSH
  T12881947683E424F1C08F0D33B02A04DB6B76C9321326850D9B536F82A9A5AFBE03C311
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral29 behavioral30
- Target
  bg/Songr.V1.resources.dll
- Size 97KB
- SHA256 3a9ec19e00f1ec3705a87abdad81faa5b69f46ba0b7f5691849026bc6f4e9199
- MD5 2b9fd2cacff0ec8953faa955cf544a4c
- SHA1 70e3209374c0da6ad6cdf2883a1d381ca7ec6ca8
- SHA512 734a6bac098316e7286e36c428e3eb53b7075a66dc6266160dad5697bd56f57957a1e579dd4bc51a5b38f2b22c63eaecfc71c36814afc717fb14d1064b4911bf
- SSDEEP 3072:FVM7/wknWn5bIUkn8FsYYzUU882Ab192aiXx2kaWXW6:1n5FsYYzUU882Ab190k
- TLSH
  T17FA3A2133E976008D471B9726C30AAF529777EBD3F25C62E2054271C39FA1668731BAE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

Event Triggered Execution: Component Object Model Hijacking

Executes dropped EXE

Loads dropped DLL

Checks installed software on the system

Indicator Removal: File Deletion

Deletes itself

Executes dropped EXE

Loads dropped DLL

Indicator Removal: File Deletion

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32