Overview

overview

7

Static

static

7

Annelids O...11.apk

android-9-x86

1

2D.map

windows7-x64

3

2D.map

windows10-2004-x64

3

2D.mapinfo

windows7-x64

3

2D.mapinfo

windows10-2004-x64

3

2D.webp

windows7-x64

3

2D.webp

windows10-2004-x64

4

Play-Bold.ttf

windows7-x64

3

Play-Bold.ttf

windows10-2004-x64

7

Play-Regular.ttf

windows7-x64

3

Play-Regular.ttf

windows10-2004-x64

7

annelids.rcss

windows7-x64

3

annelids.rcss

windows10-2004-x64

3

ask_for_rating.rml

windows7-x64

3

ask_for_rating.rml

windows10-2004-x64

3

background.frag

windows7-x64

3

background.frag

windows10-2004-x64

3

background.vert

windows7-x64

3

background.vert

windows10-2004-x64

3

background.webp

windows7-x64

3

background.webp

windows10-2004-x64

4

background_2d.frag

windows7-x64

3

background_2d.frag

windows10-2004-x64

3

background...r.frag

windows7-x64

3

background...r.frag

windows10-2004-x64

3

background...r.vert

windows7-x64

3

background...r.vert

windows10-2004-x64

3

background_city.frag

windows7-x64

3

background_city.frag

windows10-2004-x64

3

background_decal.frag

windows7-x64

3

background_decal.frag

windows10-2004-x64

3

background_decal.vert

windows7-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Annelids Online battle_v1.115.11.apk

  • Size

    16.2MB

  • Sample

    230609-3fs9kaee2z

  • MD5

    ff9c5c34e37585a23164d5ef9823bb10

  • SHA1

    9404c752c06290fa1664b1b8c72f821699308393

  • SHA256

    a60b7a2ef406fd853f59afb392ba91901e059cb256ae7f09de38344c55de4fa0

  • SHA512

    4b8b2dd31c5295f3fc68ca562dc9b57c596b83542e9ef956c9359b546909823cc322f6de07fa492c22a21cb7020d826ff1f372f9f8bddf339837ef6aa76acc16

  • SSDEEP

    196608:fc2dFACDFJu6vgZjFxHPgS/VC0DTo/4vjPHwaPoE9j5GfxiExn1WUuHHPT3VA1M/:02dyCDFJAVnpp8ADQwoPsExnM7ZH8U7Z

Score
7/10
android

Malware Config

Targets

    • Target

      Annelids Online battle_v1.115.11.apk

    • Size

      16.2MB

    • MD5

      ff9c5c34e37585a23164d5ef9823bb10

    • SHA1

      9404c752c06290fa1664b1b8c72f821699308393

    • SHA256

      a60b7a2ef406fd853f59afb392ba91901e059cb256ae7f09de38344c55de4fa0

    • SHA512

      4b8b2dd31c5295f3fc68ca562dc9b57c596b83542e9ef956c9359b546909823cc322f6de07fa492c22a21cb7020d826ff1f372f9f8bddf339837ef6aa76acc16

    • SSDEEP

      196608:fc2dFACDFJu6vgZjFxHPgS/VC0DTo/4vjPHwaPoE9j5GfxiExn1WUuHHPT3VA1M/:02dyCDFJAVnpp8ADQwoPsExnM7ZH8U7Z

    Score
    1/10
    behavioral1

    • Target

      2D.map

    • Size

      1.3MB

    • MD5

      e89b617e708b4519283d9961cc4a1b58

    • SHA1

      2c488e806c84e6beba8af211fc549971b9d08c92

    • SHA256

      0f92a994b96ec919aa972eaa364bad3c0cf834dc189186f2b144880bf46376b2

    • SHA512

      0138b96079373aa1aa9e6ad13d125724827dfb4538d3ed501cb70b03da2a9d1d8b3a69e09fb2aa100c1d91187c85b823a8a43114725f39b233163114d7ae4aa3

    • SSDEEP

      1536:yacsKlaacraK3aaj+aHlacuDuaacPaKsaaj3aKpaaeHalSaacxaKPaaFiaKqaajS:N5Za9XGM

    Score
    3/10
    behavioral2behavioral3

    • Target

      2D.mapinfo

    • Size

      37B

    • MD5

      7a5e2d4503d5506530af0104adeb3a86

    • SHA1

      79eef819cfe8e88840b1cb2cd8bd4a367b911e91

    • SHA256

      3213670ea4cd6cfa127648af1cccd293e53949cfd7ed4dbefe9352fb6c3e7fe1

    • SHA512

      566b1257d0cdf050539cac4702ab4fa623ed83c70f6d007a509f48a095e3b9f312bda8bee6af8058d4dbb09a3fca5a064bf30350f7e5268cfc533189830f9caf

    Score
    3/10
    behavioral4behavioral5

    • Target

      2D.webp

    • Size

      9KB

    • MD5

      ae2ba07dd60248547a43c8f8536d17ec

    • SHA1

      6531b5dc5ca16ce1623583a45243f4155e3cc3a7

    • SHA256

      e9936ee8c40bb1e82fa6f5fbe271b65522649b1caaead30f12c5f3e6f9d33c31

    • SHA512

      399830feb3e3655ab59a9b86e67060b052f5ca866363904b732d37c66cb29c28a9ff81354216f61ab0fcaa98aee4cc4a9d0e1e3a8e4ec3ec7337a9cd4ccf2821

    • SSDEEP

      192:IU0KYEjcArIDynZAnsMYDwnc/DCLt6gsMlbZI0wm4LwXL3gn5GcQS+U4:IKjfkDeGTnc4sMoxwXa5GcQH

    Score
    4/10
    behavioral6behavioral7

    • Target

      Play-Bold.ttf

    • Size

      213KB

    • MD5

      b49c4452371f07f848dcff78ede105bc

    • SHA1

      c3cb83242769ccd756da5c83d2a6fd717b89708d

    • SHA256

      b0811265d994ebf38ecf28f9a634a3ccf575b68f10d367cdf6105577ee01a4e7

    • SHA512

      13ce6821cc816a90f59cc35fe453219c32e391299bfdcfa83e1602214626c490da471aacf359cb9ec95cbe7371bae01ff6ee5eccd2041a5c6796c4adbdaeec43

    • SSDEEP

      6144:XZnzgg/JeHd4E/iMdSEKZbPrZJrtOwSegXIb+1oJA:pnG/MERHmy

    Score
    7/10

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    behavioral8behavioral9

    • Target

      Play-Regular.ttf

    • Size

      214KB

    • MD5

      d90e0a0e734eb3816dec96b3e69cb6a8

    • SHA1

      438e8cb85e38a298fe8227203dea6840b435f848

    • SHA256

      6fb240521cfe3fe9983b590fdf0fac15e891b19b261ae382517066029eec46b3

    • SHA512

      a5d09ce52c70215c45f11f8f87c16c8d6df731a2706361d8450d90b30e7ef8e4b3a98f03caf7357cf618c55fb8ed24a51d3e6f7fffd767ee353017aaf56b5d5b

    • SSDEEP

      3072:vJYNPKh4rZSllDxYTW+PzyWjPyKvtgLA7me79mLUO2Rc98d2E8H7O1j7LA:vmpm4QlRxUVzyWjPyKvSLA7my9mb2RXA

    Score
    7/10

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    behavioral10behavioral11

    • Target

      annelids.rcss

    • Size

      26KB

    • MD5

      93bf8d03489a3ba7129ec5178bfcfab7

    • SHA1

      bdc1b559f9ae5fba8e471108c0b2e318e89de8e9

    • SHA256

      7bb0cf4acbe858d9f8943b2dc51944053277b722eeee5298f25a68636511d0c8

    • SHA512

      8c20ee88e0330c180c98dcbeae450fe9dff6a50f317dbfd1f0575fb718aac51f5f24e5be69231846be5edfbe992d16fc1d8864cc08b7a5c2d0bfd1aa5a867be9

    • SSDEEP

      384:104gv6B9UbhpEI7i/jP2WcW0DJwsWJ1Mv4sL1Ex:1U6B96EI7i/jP2WcW0DJwbJ1EL2

    Score
    3/10
    behavioral12behavioral13

    • Target

      ask_for_rating.rml

    • Size

      659B

    • MD5

      0dc75b610e16f27f528ac90fd99ee7a1

    • SHA1

      f7bc01b995ee6d077cfdd6badaae6dc37019a032

    • SHA256

      e97c295fa8801630053feb8fc8163e4313b66610053f3e4a71577e8862cfb8f4

    • SHA512

      ec2fc81d5257e580a4bcd1313b4d6063de5ab66ba43a901fb931f54550135ce811e9caa9f287944c2c10ec13925fe2247c9982cfab67c9604e3bc15c2f56ae5d

    Score
    3/10
    behavioral14behavioral15

    • Target

      background.frag

    • Size

      401B

    • MD5

      eb3b4f8507914d38fd23d0701f85695e

    • SHA1

      25af732a4b9622159d56d1fbc0ca1d5741ac3ca1

    • SHA256

      415f25b0853747f7c26fcbf9b24378865ce4e26638785073badd8138a26056f0

    • SHA512

      a38e50508998e9c2ea82115a78b6179696568bcecbc7792169370d63f8ec83d8680be9a79a86e09540fb86d077c29649e696aab2f5fff749d70462e8e1da5e38

    Score
    3/10
    behavioral16behavioral17

    • Target

      background.vert

    • Size

      588B

    • MD5

      fbc74118bc4c246879e1fe4a07092061

    • SHA1

      381a5ebd44586d66bf74219ea9ac65a86bac03e3

    • SHA256

      19bffadcabb55f8693e95fbf6b1fe8c7facd5d8477e13ee10c8184fde8db2339

    • SHA512

      1ea70c5df5a86be8c1115188fc11eed94d6a77bebae11f74ac3c1776bce9450ca0129215d1111bd26965cb3c3374316cd7adacbfa346feb86e2ff8a440ba51c4

    Score
    3/10
    behavioral18behavioral19

    • Target

      background.webp

    • Size

      7KB

    • MD5

      2eb141c3cf82936e58f2ffb397e10c76

    • SHA1

      b2bdd8d7fd04f04db4ae9ca0214e9f5ccf02051b

    • SHA256

      ccf0606d129dadfbaf5c51cdec59aec972cd0fae28a4db8d50461ad4f1082eaa

    • SHA512

      af6851beda3ff04a7063da885b10e48c6218b6877f81c05d2c29ae9803c6e463f865d9b2df3bdb48ccd956b42606ce423216d3c5895890d3eb8e1aa8e3c1540f

    • SSDEEP

      192:pw99Gdi+lGClqGYi/T2TqD4asgEQvL0UnAeAHKenE0jsSzsygi6:m9Qd2MjDL2TE9sUvLOeAHTE0j7zss6

    Score
    4/10
    behavioral20behavioral21

    • Target

      background_2d.frag

    • Size

      1KB

    • MD5

      8eea3e88fd747c334f3f0572b557165a

    • SHA1

      bb48688af7d54be033e0ab141bec20135c131187

    • SHA256

      996bac8b90b0f5aaf911774f834b720f895c5106847648342db2ac83117bb87e

    • SHA512

      1de7d8ff88615986da1522afdc9c6681ae555ca2fc44e0f6f478efdbb4f3cdca5ee515a1790b772ce911f2e05cf1f1d20a10bbad1c9d77a1b4ace9fbd3c5a6a2

    Score
    3/10
    behavioral22behavioral23

    • Target

      background_border.frag

    • Size

      277B

    • MD5

      c3de3a3ad0e86e4c8ea505d848cc14f7

    • SHA1

      5be6136084441095017b4987106f641e8438a0f3

    • SHA256

      13edc8d844ec8209e3969828a849fc3f3ec9f0982aa06d03b9abe53cd3c61404

    • SHA512

      8145fb3764bc02023c7eee9bf898624141caba240c461c510b62ff76073eb596654753166694bb83b63ca38d3f4f598cdb69c50a32786d533c6fb240744d63cd

    Score
    3/10
    behavioral24behavioral25

    • Target

      background_border.vert

    • Size

      399B

    • MD5

      b58f0647022cfe4e1c6e001200f20c4c

    • SHA1

      c7a1150b001c211bed9bdf39ec207ae688dac5f0

    • SHA256

      bcee4206d4c9c395a787cdfdff2497741e9ef8721f04168a7ed51e8e9a576c26

    • SHA512

      8d2427d8e60ef0b2ca36d36141f3435e66933568fc139576ce8fa74b99e441c4a5c6a0b546240d136228b3e3c82df24cd674f2312f2c544e8b10b937edf1715c

    Score
    3/10
    behavioral26behavioral27

    • Target

      background_city.frag

    • Size

      1KB

    • MD5

      1a308d814e82ef8466aafe73b8ab230f

    • SHA1

      de62ed66981cb1b10e6ed9915ff81aa939f0a599

    • SHA256

      0a32f769b43965b778e0e64080e581ee3eaaf74f9e400d9bc78b32bd8bb5fa0a

    • SHA512

      31901d91dfcaf67e405155c130b700f653502847c6d96e7dd70e7b7bd96870f6d925bc74f03a87dee60286a30daa06dad6db7a18a92636e421904de41ed96da8

    Score
    3/10
    behavioral28behavioral29

    • Target

      background_decal.frag

    • Size

      1KB

    • MD5

      f92ae79bcd827edfeb9c2136904de433

    • SHA1

      64c882194f0fca4da97b4a72ad49b7f83b3703fc

    • SHA256

      a7b2899b26296abd5d7159cb4f88d792751d6ff02a0041222f25c20aac6b5b54

    • SHA512

      5dd8e9b5cd74f47d27cb2b73185d22d128a3bdbf94d00e8b7487f9ecb4de386dd60275cbcc12daa7767e26f360b6a30bea01bee8af61236a36640e418ff6bb4c

    Score
    3/10
    behavioral30behavioral31

    • Target

      background_decal.vert

    • Size

      651B

    • MD5

      d319884574ef4aa7607564332b2ca25d

    • SHA1

      bc09abe4998361fd9cdee23a173bb9ff764a323b

    • SHA256

      d8f944b55febdea491ea10e6de6b928e1e79d78ba8ed7ae889ff0dfcf9c708c3

    • SHA512

      614ad718abaf58787755f5142068d4082160b76b096b0da3049a3628f192a3a8ee1a85950d869e9555ef425c3eb7d356e0037b40481469eb062bceb0993979e6

    Score
    3/10
    behavioral32

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

20
T1082

Query Registry

4
T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks