212d6c4489711b1ff80677fd1166afd38e7201374e61894ba08abc556b118e9d

Sharing

Copy URL Twitter E-mail

General

Target
win_02.08.02.60.zip
Size 42.1MB
Sample261104-wthlnaev5k
SHA256 212d6c4489711b1ff80677fd1166afd38e7201374e61894ba08abc556b118e9d
MD5 877288be22f1d824423fa324053ef973
SHA1 cb4389a7dac1c0314a1cd93d939f5042324ec838
SHA512 7715a694bdfb739a723c6f122796afb10c397ae69ce4ff0afe9e8c0474260a699f92b23071d2fcf5b8394529434a919792cf6e2be54909bcbb6306306b689491
SSDEEP 786432:VceTaY8DT9bxxxx4DMljXxpsI0KY43qRiMjPz2sVjUQiVgzaYrd:XeNtxeMxhmx4iiMjr2sVoQOFYrd
TLSH
T146A733916D4557C8211783EF3A37CCE934BBBBA9D195AFB86C2067F060991981CCD32E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Targets

- Target
  BambuSource.dll
- Size 5.3MB
- SHA256 47cfa5e896644522379325726fecbe7966ce3d8ed84fc4c9822fb87332b4333d
- MD5 fb3218e73f55334b3b75d641743edf69
- SHA1 66d4992fb076e12e40b50f16c88a934adecb6af9
- SHA512 adcd4ba7c12a3ac07ea3adefee6f42c474868f2ee97452e1968e980d9e8e60972c59858c079ac45a6ab9267f639b01783e65090e27ad0e0ca78a6a77ce6f9b6e
- SSDEEP 49152:cadkeTq5IhMTUFOjwgGyLz5cAh5HHsbC+s6Aszd9Ls0wbXChCCRcfWDxhk2wLqs4:RF1ST2PbCGAAda0bWUKs7DJHXU8K2
- TLSH
  T148466B5AB7A80198E477C13CCA835613E6F2F819477097CF0AA9467A4F33BD46A3E744
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

persistence privilege_escalation
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral1 behavioral2
- Target
  agora_rtc_sdk.dll
- Size 33.1MB
- SHA256 8c787c971b19ba66c840c9abf88ad2a6a4c50d171152d035f8bea0bab77a8c16
- MD5 d07f91e918f507824cb350cfb72fd6c4
- SHA1 0c6f34a4aeeacb41f964d1993ca2dbbfbf20b1a8
- SHA512 3f7981a2c1d2fe6cfc4eaed286e9d77611f79292aa1a000b7d4f1f303927d7ea52e1fe2e59bd7ea8612bb0dc6701b29d1ae9a4548492d0d23c64261c6034a2fb
- SSDEEP 393216:g2kfzysUxpo0kj71VyUcbNsRQ2FCIZ+xqf67BKEy6himp7q0ur:gnoxbNTFmup5i
- TLSH
  T14D775B47927500D9C0BEE078DA5BAE13FBB1344903759BDB069086A62F63BF4B97E710
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  bambu_networking.dll
- Size 22.3MB
- SHA256 1c93940d68fc603fc7b823fafb3f3209cde18e58d529983cd7f207d6b29ffb98
- MD5 848d740af1c71881aa4731988b8d118f
- SHA1 fbe233a065b6d5970d1b40c9537382a9fcb89c4e
- SHA512 e3ea8093dea190894ff30808ca8a1ab2e5e5d59ce737565ea001fb8b8f2f10f921fb604568d37f827fb90f156b41f401398bd0355950311ba0acd8d2de732e3d
- SSDEEP 393216:T7PbyrErFVI+OCO9G2FVHNL0ClnwwqZ8MW3hJPlAnJ:nPb9e59dVtTlnwqr3LlEJ
- TLSH
  T13C3723C129FA816DC502C730DA966AFCF18E39894CB9982F7FC645063A35D55CCFA13A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

defense_evasion
- Suspicious use of NtSetInformationThreadHideFromDebugger
  defense_evasion
behavioral5 behavioral6
- Target
  libagora-ffmpeg.dll
- Size 7.4MB
- SHA256 992087ab4b5156363feb10a15f7e1b3bec76742888ca088afbb9d498aed58aee
- MD5 ac46c3b91fdb1128c6ef2527695ce27c
- SHA1 969ff65656871e02d5efb598eca2ebcc05d1ba3d
- SHA512 5e08efea47817f16bc798a67d7da07dd3b0b07b631b0088c131796c9d152cd698a909033eb5a9078bdc6683fef641040d562f0035bade31b90fb6a6036565f7b
- SSDEEP 98304:zv6YTJ9MJdJjMUqRYnPyZ2SeB0Gtn87mJsyRvXezW1VHmrTnNtS7:kPyZ2SeB0GbC4fvmrTnNtu
- TLSH
  T181768D4BF1A311ECC456C57487ABA633FA30384D43246AEB27D4E6652E27BD0A739F05
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  libagora-soundtouch.dll
- Size 155KB
- SHA256 424307be3ac37e42dac6731914b110cb4ff1e5219ec72f18d9d708afef52d38c
- MD5 1ea4df2a4b90a076bbd06efe253e4c3c
- SHA1 82e1d3c91f80745fee08a8d05b73f4ade28f9d36
- SHA512 b7c881d85a271a60aaac817317ccdb7aa85784382726c8b622d8e0b2e983ba8bbf97dfa97b867e3931aaab17c747c9dbc51f09c313058332a0d2cb72c78d4322
- SSDEEP 3072:PzoDwBZpjHCegd6MHvp1VrwZMO5oY4pzDotpU6CfLPXgn8kj:Pze8hCegjPpXOdohLsnl
- TLSH
  T1F6F36D1B72A504BBE1739134C9A36E16F772B81113719AFF03A442795E273C1AE7BB21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  libaosl.dll
- Size 1.2MB
- SHA256 b75e70f4829a4fc0ee7a5dd73934b135f76e0ce2f0142f505db51562eb9e4abe
- MD5 5b4420daa464520cbab3ea7dec8bccd9
- SHA1 c30a7656f800821f9e21ef4cd4b591739f52d101
- SHA512 251928fc8d70ab7ec74a78b47d30d2fc815f3e7ec1389014c1f2f43128374cdcc259d5c8bd5ff3d088a0364602f6a4a33eb5c37857e8fadba24781b9dd17ce3f
- SSDEEP 12288:X6j/cnYz3/1i4MLcWtNE3suivyiddqCIsLx01vRY03AJia5pUy7pg9tVN4iUVPS1:X6QnG31rLyLIY03AJibyVetD4izRzKnc
- TLSH
  T1A1558D6673A812A5D5BFC13DC6978B4ADAB274150730A7CF02E482992F23BE55E3F710
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  live555.dll
- Size 4.2MB
- SHA256 c6c61134c896e07b8261b502d5329b2022604ce09d8caace85190befea1c2d31
- MD5 5a7e1fbf4166b38da87d16c1bea24091
- SHA1 16c20bf11ad6bf1aacedfa4695ce45df9ffc6451
- SHA512 2c2187f73a08ae14ac0a7e59bcca724eb0ea04d0638f6028a28835a89afbd41105cf1239792bce27a0f435adfeefff16ed8d87444e4c08c94cf297afddd76292
- SSDEEP 49152:+Vp+kx65/Bg6leFjvxGvONldHK/heX4xmzsVKZyZDt8iLB0LVCJhKsGv9PvPrVz5:+Thj/H8PQRZyFDGVrbifSD
- TLSH
  T101166A1ABB680298E87BD13CC6A74717E3B1B816477097CF1AA952791F33BD5263E304
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Debugger Evasion

T1622

Credential Access

Discovery

Debugger Evasion

T1622

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Event Triggered Execution: Component Object Model Hijacking

Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14