General
-
Target
UndertaleTrainer.exe
-
Size
3.8MB
-
Sample
231224-wlv7saeff6
-
MD5
8669e8f71fd06872bbc1d2399c33d7b1
-
SHA1
6cdcbc65e5b4d30c3e2e9e3e2c7ad4ed8373bcc5
-
SHA256
b7d757263aac8d89154f7962550b795cca99e2df080d8bfdfbc3582b1a0d8d43
-
SHA512
b353fb22d846994f6c09258cccf63f92ae9db14e4dc5965bc67c7c539bdc8f51e599c7bb70a6668d8d6aeacb1551e333ae70630e1ac58f21c49032052dffa847
-
SSDEEP
12288:zNS9x1JXkDAoqsTAoFhb6lRZu4W1K8waHyu2Um4ytvqMNVw2LW86B7SiU:zeAzW4f
Static task
static1
Behavioral task
behavioral1
Sample
UndertaleTrainer.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
UndertaleTrainer.exe
Resource
win10v2004-20231215-en
Malware Config
Extracted
marsstealer
Default
www.msk-post.com/server/init.php
Targets
-
-
Target
UndertaleTrainer.exe
-
Size
3.8MB
-
MD5
8669e8f71fd06872bbc1d2399c33d7b1
-
SHA1
6cdcbc65e5b4d30c3e2e9e3e2c7ad4ed8373bcc5
-
SHA256
b7d757263aac8d89154f7962550b795cca99e2df080d8bfdfbc3582b1a0d8d43
-
SHA512
b353fb22d846994f6c09258cccf63f92ae9db14e4dc5965bc67c7c539bdc8f51e599c7bb70a6668d8d6aeacb1551e333ae70630e1ac58f21c49032052dffa847
-
SSDEEP
12288:zNS9x1JXkDAoqsTAoFhb6lRZu4W1K8waHyu2Um4ytvqMNVw2LW86B7SiU:zeAzW4f
Score10/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-