Overview

overview

10

Static

static

10

publish/OpenAL32.dll

windows7-x64

1

publish/OpenAL32.dll

windows10-2004-x64

1

publish/Ry...ll.xml

windows7-x64

1

publish/Ry...ll.xml

windows10-2004-x64

1

publish/Ryujinx.exe

windows7-x64

1

publish/Ryujinx.exe

windows10-2004-x64

7

publish/SDL2.dll

windows7-x64

1

publish/SDL2.dll

windows10-2004-x64

1

publish/av...59.dll

windows7-x64

1

publish/av...59.dll

windows10-2004-x64

1

publish/avutil-57.dll

windows7-x64

3

publish/avutil-57.dll

windows10-2004-x64

3

publish/bi...-0.dll

windows7-x64

3

publish/bi...-0.dll

windows10-2004-x64

3

publish/bi...-1.dll

windows7-x64

3

publish/bi...-1.dll

windows10-2004-x64

3

publish/bi...-2.dll

windows7-x64

3

publish/bi...-2.dll

windows10-2004-x64

3

publish/bi...-2.dll

windows7-x64

1

publish/bi...-2.dll

windows10-2004-x64

1

publish/bi...-3.dll

windows7-x64

3

publish/bi...-3.dll

windows10-2004-x64

3

publish/sh...ic.xml

windows7-x64

1

publish/sh...ic.xml

windows10-2004-x64

1

publish/sh...ic.xml

windows7-x64

1

publish/sh...ic.xml

windows10-2004-x64

1

publish/sh...ic.xml

windows7-x64

1

publish/sh...ic.xml

windows10-2004-x64

1

publish/sh...ic.xml

windows7-x64

1

publish/sh...ic.xml

windows10-2004-x64

1

publish/sh...tl.xml

windows7-x64

1

publish/sh...tl.xml

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ryujinx-1.1.493-win_x64.zip

  • Size

    44.0MB

  • Sample

    221228-w2w41sbb53

  • MD5

    a52311a741695e9c9dcd2f8a5c9a075e

  • SHA1

    826d854a388432a6fdb71dc17ca72e2b977bc85a

  • SHA256

    a9b9048832b9f5f9460abce2bebb86060f20b211cdd055f36fabee936033cf68

  • SHA512

    e3439c156490cd5144ce5f0d754b155c72aaf687aad9d249772700e7059993aa296e09aabc4154f31bfe1cfa264d1091a490cc8cfb848dbdee91e1231551ae1b

  • SSDEEP

    786432:1NhmwdGxmw0NvOhscpGqeLGuGwp0pXn21Ls4F1uaNU:DhdOqNW+4uip321w5

Score
10/10
plugx

Malware Config

Targets

    • Target

      publish/OpenAL32.dll

    • Size

      1.7MB

    • MD5

      ff08ba3a9dfe6bd0b26f9055094c9550

    • SHA1

      2dd9130b6dd4c49864635b1b7cc4a93ebcdd5e17

    • SHA256

      5a42440a18a75ce588659158d74d26ab1850eabd34f3b25abd969a56d871db42

    • SHA512

      db7eba84f7545740bc267298fbdcb70bcc820e5b7f1b2a38a5e0396d2c5da62715f5338f52025477a5bd0160389f1e27e12370a7829c8070d430d7838494b9dc

    • SSDEEP

      24576:Vp4Z+cv92VrcRfw5K89ISay/D1IkYl57p+KGoq9gHvfnj/pC:VDARY5t9gy/D1ItHaiPP

    Score
    1/10
    behavioral1behavioral2

    • Target

      publish/Ryujinx.SDL2.Common.dll.config

    • Size

      244B

    • MD5

      2d175f1dad5afd5ff46691db53d9459a

    • SHA1

      1b220dfd4badb4fe6d0f0cf839c76cced2f6e47e

    • SHA256

      ccb8d75668d09da1d56153fef48e62de2ef3c6248cfb1b98169c4d94eac77ceb

    • SHA512

      757e52f3badec151f3abc3da15ef446d6731fff62d2686b5e0f6455c6a823693a011bbd50b5fae35dc70e076ab7db908689778b94dcd1566c4f007001cb29c0b

    Score
    1/10
    behavioral3behavioral4

    • Target

      publish/Ryujinx.exe

    • Size

      46.2MB

    • MD5

      e384c73b09cc6248ac75902c7d0988df

    • SHA1

      2a7ab954adb55a1e192826234bf036af11420bb8

    • SHA256

      8f955827ef7f101db4e206ba22a65483e31d9a567b4ec4c15e41e4c7ee6f48aa

    • SHA512

      2e77adff9cb383b594deb1f0323215d70767915c21b90df3f001fc06ff795b10f68eeb22d165a8390100b38f9dceccd0305d13f1732aa7a12ece376a84e7d96d

    • SSDEEP

      393216:fbO5HHxxQ5DP9Szla6MM/MJaeF3TTgzFfT9:fC5HA5hSzJeF3vgzFfT9

    Score
    7/10

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    behavioral5behavioral6

    • Target

      publish/SDL2.dll

    • Size

      1.6MB

    • MD5

      cca534488e13e852c851ca4a4fe3da39

    • SHA1

      0345c301ed65def530611349bef04f8de414c541

    • SHA256

      63ae677c3a55c3fd95d70cfa7793e8ee0f4f484a41eeeeefe402017aa1152851

    • SHA512

      152a32bd9c28607f63323530802c8e3a9cdc2693ef163edb46296683721287d6a19e1fb918e786d1482808f30b451b1418f9f2741d07afcd87ff023b283cce04

    • SSDEEP

      24576:afwctSMa2hd+Y4ByV85HaKRaQy5lcv4VXa2b/KXgx18u4iq9hzp2So:I1tNhd+HByV8563cv4Ram/KXgx18u4h

    Score
    1/10
    behavioral7behavioral8

    • Target

      publish/avcodec-59.dll

    • Size

      1.9MB

    • MD5

      45c29e06a2f9992dfce257697b6f42fd

    • SHA1

      808088be4e5bee66402db7840231059827a7fda4

    • SHA256

      42f2dfe59fe9bdf1e331e4b520fd7eeecd5c6b2f435703f2be471147f5ac40a0

    • SHA512

      9f78ab6884becc8f9539169dfc039b48b459a2a04bef9b89640d0a4de0bb8c82b109bcf93234a05ca20d04834a7391170c4abecb1de7c31e60ad5543f209a587

    • SSDEEP

      24576:gAzWTQGJKf13OpVCJTn+9nqIZ3ROGU8MUn3/2Sjt35KAZNIUR1++gz:gjTegVCw9qjSjpGURn

    Score
    1/10
    behavioral10behavioral9

    • Target

      publish/avutil-57.dll

    • Size

      753KB

    • MD5

      a7b21c4bd1a114eff24709d596bcfb20

    • SHA1

      1ec0fa4a1aa105bae5528b74bfe176b4b89791de

    • SHA256

      e46a6821db34a22c0f5a2c7bf43f16cc629c9bcdebfb3a93b4834b0a16815cef

    • SHA512

      7601b79c20367ba777abd7cf075bc7841ba0566b81a83533e543847103524de48de99a9cc1166c2b0759d6dab473515d82faef6efd87024e956a5a74cd32f8c9

    • SSDEEP

      12288:nSdWIND2FdjPMUb2rRE97Z71MJDe332EyFf9w9K29pnaO+iSX:nSdWI82rg9ue33/e4K2O

    Score
    3/10
    behavioral11behavioral12

    • Target

      publish/bin/libatk-1.0-0.dll

    • Size

      136KB

    • MD5

      ce9ab2defa6d7a584152a54108c30bfc

    • SHA1

      8b221ad2c5c428c0b73b30f9fbebd1a99186c8f1

    • SHA256

      2a80279b8dbeec1bb9b4121ccd4801034599184dab1c9166d5a29df1fd819df9

    • SHA512

      10a9d8e4ad9d120260273f70c2a820c10429cff86ba770ffe1cb0f57097175e1367c52b7f7a97ac29e62b09f08a2799f3c43faf9df25dd44d39fed44b25ecd89

    • SSDEEP

      1536:lQ/IMw1Tk3vQeJEMq8iMjIV9WBmF/9yjr7YrDn8KBBIxpRu63GQsU9jDQn7BmCoU:6ETWvrEMq8iMjIfKjArDnP0EzUxDGMvU

    Score
    3/10
    behavioral13behavioral14

    • Target

      publish/bin/libbz2-1.dll

    • Size

      72KB

    • MD5

      ab0e3427ea209d61ab6b08617c99b47c

    • SHA1

      65002276e4e14ac067c78cd9fac498454fca2c02

    • SHA256

      cde82b78524ba83ba94743417883e03e3311713ac0af87b50f5bc0335c5b77b6

    • SHA512

      e45585c7945e30b8a3095e756652c0ab98367196d82f54d4384438bcad5b62b22b66a5f4f9ba246117cdd0d69b466aceb27873d7b44d55902e27cbebe898d016

    • SSDEEP

      768:4Vf3UyszRfpZwMVKC2AfFBqs65nZNcF3kFOh9Q8y4mWaIN23AVrQPxx5Ttx:euRfpCMVKBAfO5nQF3uyez4mVQ84ex

    Score
    3/10
    behavioral15behavioral16

    • Target

      publish/bin/libcairo-2.dll

    • Size

      991KB

    • MD5

      011adbf1bcf6ecf533b429ab3a06cb4f

    • SHA1

      cc3acdcec4103e3e9bb85c1814c17704b95862db

    • SHA256

      751c93bc9e36ee73f30d24c13729afa1e8ceb6527706b2bd23df363dd5830304

    • SHA512

      5fa08f6b4f276fadd1a0c3b95186a46ed57ddc9d1fc4f819fa4e3845d26c58b322943f8beabd11f118b6612a202857427499ac6469b491f2dd53541a0c117db2

    • SSDEEP

      24576:90614pb4CZNZuZ5uCkFnWXPiJ0iEmsCn3UxMTfzLz:90M4pUCTZubuIXe0iEmsCnNTfzLz

    Score
    3/10
    behavioral17behavioral18

    • Target

      publish/bin/libcairo-gobject-2.dll

    • Size

      36KB

    • MD5

      84ab5fe7810c4cd4666971dcc8f102ad

    • SHA1

      617720249bc7fa4c47ac849753d120c46b071ec5

    • SHA256

      d198fdf7ca71b5d14af6d2da04c28ced9228b5158d9136656a96958b675c852e

    • SHA512

      e844dfb7a5be66929514723e66844aa13221fa104489f2877349d099f7e38ba4290ffb1984a2db9a402e73162d8a279f2ba943fbbf73a3a73f38a902559f48ae

    • SSDEEP

      384:y+BjEb5uJt4qunsZrtiOvUOxxeBDLi5RPdfEq06EG/EAL6AaJ7:TAIJzun4dxeM1F0RG/EXV

    Score
    1/10
    behavioral19behavioral20

    • Target

      publish/bin/libcroco-0.6-3.dll

    • Size

      237KB

    • MD5

      b481ed028dc922313ae96606f4ac3d9c

    • SHA1

      32cf5c65bc3e67e05cd4ecd6579ba1cb6de4c728

    • SHA256

      736524dd0b26a566c60965850a82d341dc7af61c150fee3f9a4e73dd4ba96b66

    • SHA512

      9b5a779992263cf81680560dcc01a85c5e45a20faf8fdee3adff967e656ab84bdd033e539e1123745504855d4405cd0e0a06257f478c2acf6ce64c58b2db74d3

    • SSDEEP

      3072:aff7k9QBQWwMAnkk7SmddFP8rfHA8pYvNm7pN0A8fCcKni9GtzxiVAkfWLFMMKSz:affVVfJk7SyKfHOquYMFbzSiI

    Score
    3/10
    behavioral21behavioral22

    • Target

      publish/share/icons/Adwaita/scalable/categories/emoji-nature-symbolic.svg

    • Size

      4KB

    • MD5

      3b4101d29834e754cbbecb45cc0bb1d6

    • SHA1

      8132e01c2fab9dd24242abbee05fc7cbb1e72935

    • SHA256

      0541d5c072534709da7546215f11b060a349cbfef983f2b29bdec8ae46757d0a

    • SHA512

      92f0bfb33400f215de4d1c257fdbff91cf78fcd2e7ca817c9b97139c1f59e8c1b3ae2ce798e21e4c2da1f622f0448bbe498898da171a9129dac5589c798e0c32

    • SSDEEP

      96:BkU0reOmaDBHxbyVSgu0vBalXXCzpWNvQamsWXj:BkY3alHxbyVJu0vBoXycQamsWXj

    Score
    1/10
    behavioral23behavioral24

    • Target

      publish/share/icons/Adwaita/scalable/devices/phone-old-symbolic.svg

    • Size

      3KB

    • MD5

      c590272a42d82da3ba71308e7797f858

    • SHA1

      c26a5aefb08445bce6dae45f1ed08616ef4e3288

    • SHA256

      9c6eb1e6a94abdeccb4aa3573e11676bcb58b0e9eb63e6862b4fed9d1b375300

    • SHA512

      569061e43ac1ab1df720d6a5e50d016735bb203622188673f036359215de5fc0980aa62c3ba1888db443841c103f4c0a55a99294d57a4900b95f6111d9647288

    Score
    1/10
    behavioral25behavioral26

    • Target

      publish/share/icons/Adwaita/scalable/mimetypes/inode-directory-symbolic.svg

    • Size

      3KB

    • MD5

      1a9526bce4500770dc9da3fac276de77

    • SHA1

      8e3be08d46567e15b0d7beb9c749ff361d61aedc

    • SHA256

      4698902117a08b3a216ec9187382b94d85d23ba1230497b823bc4f0398301b3d

    • SHA512

      2860804f3b03574b29679fc070f167cb7c4c5b69f7cd0352bc68f74c665e5075dcb543441bd424dac29b04205456f6d26ccab021b1bc879fd41a5819598e824d

    Score
    1/10
    behavioral27behavioral28

    • Target

      publish/share/icons/Adwaita/scalable/status/non-starred-symbolic.svg

    • Size

      6KB

    • MD5

      e27ddf9ac9d222009698c91755e91f37

    • SHA1

      df622a2877b04d698ad39b89f1e2591635c2db1b

    • SHA256

      c602b20c7b60b3b5aa554237bfa371ea484acf7b8a7ba64da23dbaafe5733e5f

    • SHA512

      5cc9cdfc2d20f9c850299cdb121e4986422e835a25350df09ae1a9cdd7b9b02f11f549e61c57a4a697f357f9523216c745a21ea347d1ea5370da9cffa445a01a

    • SSDEEP

      192:BkY3alv39nhwtVN6fF6Knqi3Ec+5ddWcQaVG2WWfIUjFaK:aYGtnitXKJUcC0xaV9V

    Score
    1/10
    behavioral29behavioral30

    • Target

      publish/share/icons/Adwaita/scalable/status/semi-starred-symbolic-rtl.svg

    • Size

      7KB

    • MD5

      436a6308d075793b72ba4d32e2ac59c0

    • SHA1

      4efaba46259016b32dad665b33697464cf0b7f6f

    • SHA256

      8b05daeba04927b256bc7222641265a22b400e43312ec910c797adda7429384b

    • SHA512

      3a75f731ddc5b7bc99fa9b97f9a992c940888ab13992203cbb19175fe3414f5b8a2ddc4c51ce5e72bbc3038422072d3bf9039a89ceb0db0beb885a40776222b2

    • SSDEEP

      192:BkY3alVUOkLcQaVG2DDYg5PzI2yDj39CV33qaOjzslduXgcbtyC:aYbtLxaV9/Y87ByDjwV33qa+zr

    Score
    1/10
    behavioral31behavioral32

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

6
T1112

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

3
T1082

Peripheral Device Discovery

1
T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks