fa925b3e76ed9daa56d7dc81d622202a7aa2649f923f97a986d214bc1ccad048

Sharing

Copy URL Twitter E-mail

General

Target
Cat.Goes.Fishing.v13.11.2019.rar
Size 27.9MB
Sample240302-2lcnbsae44
SHA256 fa925b3e76ed9daa56d7dc81d622202a7aa2649f923f97a986d214bc1ccad048
MD5 80a06d27fd585daf1b9e79a71fd722b7
SHA1 8b9cb56a6a08d2a3e70bf5e55a5f826b3f4b3637
SHA512 cc2441c9a5c0d7368405d11a0705a2de55db21a9722241498238034705afe79586962308fca0e76672d680748297c31ccd3592f230956e0b7807623c8b0e96a7
SSDEEP 786432:yOcRxcI2F3/Fdi1PO2j/rDNAoZa1z/9hCji6Kl6/Hq:yxx6FTi1WO/lza1B0ji3lSK
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Targets

- Target
  Cat.Goes.Fishing.v13.11.2019.rar
- Size 27.9MB
- SHA256 fa925b3e76ed9daa56d7dc81d622202a7aa2649f923f97a986d214bc1ccad048
- MD5 80a06d27fd585daf1b9e79a71fd722b7
- SHA1 8b9cb56a6a08d2a3e70bf5e55a5f826b3f4b3637
- SHA512 cc2441c9a5c0d7368405d11a0705a2de55db21a9722241498238034705afe79586962308fca0e76672d680748297c31ccd3592f230956e0b7807623c8b0e96a7
- SSDEEP 786432:yOcRxcI2F3/Fdi1PO2j/rDNAoZa1z/9hCji6Kl6/Hq:yxx6FTi1WO/lza1B0ji3lSK
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2
- Target
  Cat.Goes.Fishing.v13.11.2019/Cat Goes Fishing.exe
- Size 4.3MB
- SHA256 fab76ae5f809e690fe130857a266d822b772e91f829781a09c11b4c380b5889c
- MD5 906f75296beed2234b5488f8199fc75b
- SHA1 f9371f6f24a40594dcf4b96585a9f4033a70e59e
- SHA512 4d156e3429ea1eb372ace4c4fd0e708b15afc99aac4c7b2b214ac74df31d8e055bdc644dac173a125f161a179c33d8f58ad33e633d101fb5fa894c6c08a8cc5f
- SSDEEP 49152:S3wAodQ91UcVUFWPFVjI+bPb4fuJXsvgKbV0RnLMBTWdjeJw61:S/odyacVUKjOuJX3KSRnLM0djxa
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10

upx
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral3 behavioral4
- Target
  Cat.Goes.Fishing.v13.11.2019/D3DX9_43.dll
- Size 1.9MB
- SHA256 0b28546be22c71834501f7d7185ede5d79742457331c7ee09efc14490dd64f5f
- MD5 86e39e9161c3d930d93822f1563c280d
- SHA1 f5944df4142983714a6d9955e6e393d9876c1e11
- SHA512 0a3e311c4fd5c2194a8807469e47156af35502e10aeb8a3f64a01ff802cd8669c7e668cc87b593b182fd830a126d002b5d5d7b6c77991158bffdb0b5b997f6b3
- SSDEEP 24576:8UtU6OIyl2Wy9M3bJ45fPS0zFZghQ6aOiFaKOE31GrvFXl74YZ29X1MDd6olmrBs:8566l2u45BiNYFrz31Cv3D29kd6kWa
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral5 behavioral6
- Target
  Cat.Goes.Fishing.v13.11.2019/Profile/IGGGAMES/Stats/Achievements.Bin
- Size 1KB
- SHA256 0527950d2c12e613c37e1936a57b856c94bcfdf36756920e24598f54d87e0d7b
- MD5 30c4dc46a1d124ed26fceaf3285b3681
- SHA1 5add349ce4a4dbf220654cae39a81648f1542cb3
- SHA512 cee6990f90694a67b2b531ba73a053799e8db812342ff4a4372516d5ed10b08915582a978f4b51031d5b3e0765268e40e522b0596bb5051c7422558fec45e030
- MD5 SHA1 SHA512
Score

3^/10
behavioral7 behavioral8
- Target
  Cat.Goes.Fishing.v13.11.2019/Profile/IGGGAMES/Stats/Stats.Bin
- Size 140B
- SHA256 b77b80e5f9dbd14fb9c20bfe9643e8a8fec147807ed59b8fbf6a0116264a498a
- MD5 23c1f2aad9e5efd1646a3022dec6cca1
- SHA1 0f158db17e73f7b85f61cdcc93a4eb7104956532
- SHA512 d0fb4cfbb3099354ae4036f1c0be3c8b2758a9d32ee3c7ab80d583fc0970158d82bed98d594a12ab5360ce5f54fe775e6a983151264d1167cc20ca122c84b79c
- MD5 SHA1 SHA512
Score

3^/10
behavioral10 behavioral9
- Target
  Cat.Goes.Fishing.v13.11.2019/Profile/IGGGAMES/SteamUserID.cfg
- Size 61B
- SHA256 0df1701f4b1bedb3de2696137b67b89b2c018e23d19048fa953ae39de22c7b89
- MD5 b4a0699180340c9f8dad77d7baf0e6df
- SHA1 c59bd474a84fccf0fe698fbbd26b40cc61a89a3f
- SHA512 7f0a7c09ddab8260954a9b7a4e29c7b43a6646d9b7f1ec59be657ef953d1102df695798f8937b7d44a4250a87112bfb72c9d1dc4c91e0e7cdae52e57986aaed2
- MD5 SHA1 SHA512
Score

3^/10
behavioral11 behavioral12
- Target
  Cat.Goes.Fishing.v13.11.2019/_Redist/dxwebsetup.exe
- Size 281KB
- SHA256 111aeddc6a6dbf64b28cb565aa12af9ee3cc0a56ce31e4da0068cf6b474c3288
- MD5 fd6057b33e15a553ddc5d9873723ce8f
- SHA1 f90efb623b5abea70af63c470daa8674444fb1df
- SHA512 d894630c9a4bdb767e9f16d1b701acbdf011e721768ba0dc7a24e6d82a4d062a7ca253b1b334edba38c06187104351203a92c017838bdd9f13905cde30f7d94d
- SSDEEP 6144:pWK8EGMUjp5cGQ3Mek1B3B9h8Ins3i8AEYBSawz1YSc:JGvjp5cj35kDB9hrs3zARBSaJSc
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10

persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Drops file in System32 directory
behavioral13 behavioral14
- Target
  Cat.Goes.Fishing.v13.11.2019/_Redist/oalinst.exe
- Size 790KB
- SHA256 b8f39714d41e009f75efb183c37100f2cbabb71784bbd243be881ac5b42d86fd
- MD5 694f54bd227916b89fc3eb1db53f0685
- SHA1 21fdc367291bbef14dac27925cae698d3928eead
- SHA512 55bc0de75a7f27f11eb8f4ee8c9934dfe1acd044d8b7b2151c506bdcbead3ab179df7023f699c9139c77541bbc4b1c0657e93c34a6bc4309b665c6cb7636a7e5
- SSDEEP 12288:0s1yfEcpPzdv+t4cRIy3ze3SUN0PXGTjiqRy2p3kwzjGHTkV:NwfLrvi4cRIyDe3SUNaXy+WypoGHgV
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10

discovery
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops file in System32 directory
behavioral15 behavioral16
- Target
  Cat.Goes.Fishing.v13.11.2019/_Redist/vcredist_x86.exe
- Size 4.8MB
- SHA256 8162b2d665ca52884507ede19549e99939ce4ea4a638c537fa653539819138c8
- MD5 b88228d5fef4b6dc019d69d4471f23ec
- SHA1 372d9c1670343d3fb252209ba210d4dc4d67d358
- SHA512 cdd218d211a687dde519719553748f3fb36d4ac618670986a6dadb4c45b34a9c6262ba7bab243a242f91d867b041721f22330170a74d4d0b2c354aec999dbff8
- SSDEEP 98304:RuLgywiN1ah6HcG0UJrN7SDgndrHZDMeaNNjt0CKKBgY2r71pZ/APaOR72HgQo0z:I7wq1W6HqULS8djZDTaNNeCKVP5ORsg0
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10
- Executes dropped EXE
- Loads dropped DLL
behavioral17 behavioral18
- Target
  Cat.Goes.Fishing.v13.11.2019/data.win
- Size 30.5MB
- SHA256 5f8f4cace5209e04b2e0ab89bd389bca2f8267324451fb1dc9aff2b8afeff670
- MD5 f0f83505ddf3809d75ab491f2b973251
- SHA1 32399876db595612fd20fe238843687b81d3f664
- SHA512 4e4db0dc092224854e096e94adbc8c7c3e85fe777e20afa36b6dd64953f398cb29e730c9fb33228e7cf8e5796ba6f2e7b1d4e027b5b29967dd4878e26f1fada0
- SSDEEP 786432:azrw7DXbDhcBQncsCUUcKN+CjcN3EaMjsdXS:F7DXbD5c58Eai
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral19 behavioral20
- Target
  Cat.Goes.Fishing.v13.11.2019/music_EasyLemon.ogg
- Size 1022KB
- SHA256 22358861581e2c7616b96aef602ce3b1553c1b4ad68ce330a27aad6576f74211
- MD5 34424ebb6a54fedb133782d9ed7e5e87
- SHA1 f8a285ce0b8ae267751a335c1a56887e59f53cfa
- SHA512 4cc739277ef537431913e312594a94dabfcd7d04544f891ed378222dbce12e73a1c1c0eb5da8e57f12f1d86b5e563371d31bbe1539653558ecb861b6895456e8
- SSDEEP 24576:XErSZsqLxHcbaYQ8RIyFKUK5lwypgZCIHRg0d:kSZs88OSRm3vuCIG2
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral21 behavioral22
- Target
  Cat.Goes.Fishing.v13.11.2019/music_IceFlow.ogg
- Size 1.2MB
- SHA256 9e1dec951bac722e931bf2ea6e138659e00ef22294a9defa1e19dbcac31fbf7d
- MD5 3557a9551c55af7a6144175a1801b390
- SHA1 a708731f97e8a8e0978c167a1eeccf8b1c5220b8
- SHA512 3df51fddf86c0df079a7b1533029ba33ca97e1f21b5a3f7e02c68438198a3b8f4b1bba7e0975d5de2bf03e68bbeb05ef01382d55b6887a3676a1e4ff9a2b43dc
- SSDEEP 24576:rxQJ29hoLF1lTWx0P+7YoUgW38yjj2HnWHrBhwwqPtPtgbjuUCN846olSt:CJqhsF/TWp7YPGScWLBhhqTgbSUC+LoK
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral23 behavioral24
- Target
  Cat.Goes.Fishing.v13.11.2019/music_NightOfChaos.ogg
- Size 1.6MB
- SHA256 c423c0306fb44d959cd29299009d97d6d42c8273b62230a5a527248045e20601
- MD5 6ed37a2c7a1b192f7c3a60e4cadebb49
- SHA1 041169fc4b9e58195173472375d2ea550d7fbf8b
- SHA512 97c38492f00d17de5a35da1890dac21fe46f1125fe282df006e9b1a05392b9ba15a9a8014b65bee96a03f0aa9cf6733487abd42e725642d3bf5aafbda672517c
- SSDEEP 49152:kYKmIRNLhmSA5P652sJdUTZgU23VXp7RXAMgh6zirsh1:fIrLhmi524IOUitppk0Wg7
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral25 behavioral26
- Target
  Cat.Goes.Fishing.v13.11.2019/options.ini
- Size 97B
- SHA256 78551ea5cd108c378602eff0b445f766e5252d415a1998b163b0e589f8634ef8
- MD5 2f2198b66079f15ffd4cb61754627549
- SHA1 0dc32fb9c422f7ec21134225f3a5ed95335e4f70
- SHA512 2b5d617cdd24d9b141ab2aae226145e0f3579bd5687f19768c8f0961b50ab4f1646dc65464c0a7b7f5b7b3f0373db3374cd46f4ef05044916e82ba304211ec8d
- MD5 SHA1 SHA512
Score

1^/10
behavioral27 behavioral28
- Target
  Cat.Goes.Fishing.v13.11.2019/steam_api.dll
- Size 1.2MB
- SHA256 5432b15f9a081e807fa3d22f982d51c60d5a683d31cc467180d73726fb9f182d
- MD5 18f1462ac04e9cfa08a0412df6025449
- SHA1 b0f7258ccfd01f3fbfcb68e9b3e1416a05beae00
- SHA512 96de56597da5f33fc44098eb5389baff29b47aefba44ea141e0d20afec307bb39b4084f99eeb0d392a6702c3508e63ceee09c9704d1033441e0ee3446e37a4db
- SSDEEP 24576:4N6jAk67BG5ZQ9myvJrKcL+qXpyNpGiKPCtDYWEcMMZLcZ1oq/bSyNCqqpsnkoaI:F8NBc+8yBrKcL+BpGxgkW1uZ1oq/BCVL
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10

upx
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral29 behavioral30
- Target
  Cat.Goes.Fishing.v13.11.2019/steam_api.dll1
- Size 219KB
- SHA256 af17df745250d1814eaa274fff7b0faeb43381e6762e026267e5859778477abd
- MD5 fe8e00c889a156836d57919ca23cde50
- SHA1 7aba06d474175bd0d7f672e101b0a05104580bb1
- SHA512 bdd89b54381da6faf50c9e18d9941f68b8d300d952bea84bd785ca00d617eef6dbdf7d9589adfb14e1dcbe6d836bb2d7785ccc9529e781a64f3125bfc4ce091c
- SSDEEP 3072:Mc8htAhfVOxDSMVmNp3yv5GPNSv7WAbYiAs+6pyiy6oICJwRWbaqH2RD4f:MptAhNOhVmN+wPNSljyCCJcWaef
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

Executes dropped EXE

UPX packed file

Executes dropped EXE

Loads dropped DLL

Adds Run key to start application

Drops file in System32 directory

Loads dropped DLL

Checks installed software on the system

Drops file in System32 directory

Executes dropped EXE

Loads dropped DLL

Checks computer location settings

Checks computer location settings

Checks computer location settings

UPX packed file

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32