General
- Target Topaz.Video.Pro.v1.7.2.rar
- Size 210.3MB
- Sample260922-skddssxerc
- SHA256 23c99e4e0761f0249629067dd3cfdf67e5824838f410fc84ebb48fb4f18dbe4f
- MD5 290100b70f1e4db8dd413c8f9fca37b9
- SHA1 67a8fdb9b4b121e999423f3f8f99abbcb9faeb77
- SHA512 5f342e977d473e888654763cf10ae47599ba69b4be40a51f720667d7d2d06b1a41871121e13ae25fdfada02af48bb2c5b28cc815d7aa965e4da637fdbc9bf887
- SSDEEP 3145728:4vsMZyEhYHZifJ+a83aEuLhyd4hw+1TBs98V1xML5iGhQOQKaqLPpke3JAWQ83IX:4oEhYHMfJ9Vf9DcrnaWPpNdI
- TLSH T1ABB8331AB11E753EC72A9D32C822F31019377E76ED328D0F56FC3808DB6E5445A2676A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Behavioral task
behavioral1
Sample
Topaz Video Pro v1.7.2.exe
Resource
win10v2004-20260911-en
21 signatures
300 seconds
Behavioral task
behavioral2
Sample
Topaz Video Pro v1.7.2.exe
Resource
win11ltsc2024-20260911-en
15 signatures
300 seconds
Behavioral task
behavioral3
Sample
afterpatch.exe
Resource
win10v2004-20260911-en
4 signatures
300 seconds
Malware Config
Targets
-
- Target Topaz Video Pro v1.7.2.exe
- Size 205.4MB
- SHA256 925e9e5843cc82667a6c66090b4e32cc29c50a3b352fee0d809d091fe00cf1e3
- MD5 7c086379454b359c4267134485b03600
- SHA1 bf40f67587000cb1333c49d684fcc2e0e3b8b3dd
- SHA512 a77d1dc419a505a95e12b2eac2da73c302b8eeba1b251b26d35a2fe5efbb564b742e226c757755ebf4bc435dd5c236249ef0c1fd1eaeb2b681c658994dbc2160
- SSDEEP 3145728:nvsMZyEhYHZifJ+a83aEuLhyd4hw+1TBs98V1xML5iGhQOQKaqLPpke3JAWQ83H:noEhYHMfJ9Vf9DcrnaWPpNdD
- TLSH T12CA83306B01D3A3EC72B9D36C811B70529377EB6ED728E0F55FD3808EE5D5446A2236A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Writes to the Master Boot Record (MBR)
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Drops file in System32 directory
-
- Target afterpatch.exe
- Size 2.7MB
- SHA256 4efe70b475e5d9059c4e5ecfec321bddad066bc65833eba49116374b48b4f1fb
- MD5 b5f996ac080cdbc2935edb9dcc67a5dd
- SHA1 a37373d6c4c39f2f83e3559037c6c127e8ad265d
- SHA512 4d061d9e1f208e9b3385e39924bd8c7512ae198ca7b8cec37c32d46b1a895e34901e838460af66f3965b1d42f7018227a0d1b7bff26c8419ccf7b3709d6897c6
- SSDEEP 49152:Z7JlvtXezj5P9NikZNVM6o88/MgMz70bNY6zPtaHVq5O:Z7HhEP9g+TM582m0bO6zPtakO
- TLSH T1D4D5CE2AB25EB13DC7592E35C962F3505A377A71EC328D1F46FC7408CB2E4481A2B7A5
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Executes dropped EXE