General

  • Target

    SP.rar

  • Size

    7.1MB

  • Sample

    240302-ryqqlsee76

  • MD5

    6783768a5b8722d24720fe32fedcca48

  • SHA1

    0d85241c32c428c7c2977bee0806246172effe56

  • SHA256

    d7dafb1954e6216b222a0a74a7b8f3d9ab12a4101699a93df8cdf8e7dfc348cb

  • SHA512

    a42d96b767924f482a8867515c059823b78c9612559d8a5f556e3bfbaf2174595d1008eff15611d7b80c80b8603e96997e24df88c1c59595460655a74d6721be

  • SSDEEP

    196608:j9YDxWeHnCvozDOv9wKuoqntQU/0CZz9TH:j9olCvQ0ugQ3/Hz9D

Score
7/10

Malware Config

Targets

    • Target

      SP.rar

    • Size

      7.1MB

    • MD5

      6783768a5b8722d24720fe32fedcca48

    • SHA1

      0d85241c32c428c7c2977bee0806246172effe56

    • SHA256

      d7dafb1954e6216b222a0a74a7b8f3d9ab12a4101699a93df8cdf8e7dfc348cb

    • SHA512

      a42d96b767924f482a8867515c059823b78c9612559d8a5f556e3bfbaf2174595d1008eff15611d7b80c80b8603e96997e24df88c1c59595460655a74d6721be

    • SSDEEP

      196608:j9YDxWeHnCvozDOv9wKuoqntQU/0CZz9TH:j9olCvQ0ugQ3/Hz9D

    Score
    7/10
    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Target

      SP/Profile/CRACKED BY CodeAway/SteamUserID.cfg

    • Size

      61B

    • MD5

      5a46be2930024cce1502b0daeb82754d

    • SHA1

      fc28dd34643b72bb6cd71f35c4f4a15491c5d7b7

    • SHA256

      bc9a5b91ebb132e6cb3247f73c357290187745a6c1adfc5547c0aa68a05863b9

    • SHA512

      de5d122ae7a08ccff17c948d66948a5f23cad871507e87c6b33755c99f0a43c7dc52184ba200b7b6867059b7392e64f36be1e074e21a3f0590b1fa79e623676a

    Score
    3/10
    • Target

      SP/SteamConfig.ini

    • Size

      134B

    • MD5

      dba39f8d59720ec26a5520e15933908e

    • SHA1

      b5021df42613dcac92009626c6857ddfb0c9387d

    • SHA256

      fdc30c33e21145b1234964ff7f8c8186b4c3afe7afd496aaeb9ef520ad3041a9

    • SHA512

      bc127b984245eae3f552a46f16fdef472e0082550604b0f901456becb8c931ee7368d1435c2c54b01feb7e7dcf38a3b2877ae5f47ac6f44ca7a6f9ef70a42735

    Score
    1/10
    • Target

      SP/UniteFxControl.dll

    • Size

      1.1MB

    • MD5

      6ac19cffc0c58ce35ae704c381c4f702

    • SHA1

      c43900c5d56d62311a337b04c9489afc1c75c175

    • SHA256

      afe6075ea7dd1bdcbc47b38385216d11cdd5ebc3f82eeedfa6d766e9249d6252

    • SHA512

      61197228b9a1bb9810c68cc04928fd47e2bbe78d36f71c4a2ee498742fea8fd6c950cf43578fa20c6009f1ed6343bf8ca7bfb155512018aac88a4191fad4f939

    • SSDEEP

      24576:XBLW5gqPvbSfiCRcXw0qU6RmWByuAy5a/owH/1:ZqPvbv/Zwm4yi5aQwHN

    Score
    1/10
    • Target

      SP/UniteFxUpdate.dll

    • Size

      442KB

    • MD5

      0ee743073ee6b68f8222be2661d95315

    • SHA1

      2e642772ec19edf73422fe25a8d45db1a006ff85

    • SHA256

      562b17370c7283e92a3353b76ab2aefd301c2e78782fa60ec9ee35676ad44f96

    • SHA512

      c3f2037bd37cef7978187f67f1d0633ee3067b4837e0ad9ae2a5c8efab8ec4ce6a14c1d88e200ffaa8677f74fd5995789297e6a7b5ac18d19dc9d53b4d9170ba

    • SSDEEP

      6144:12UHPCFzuxTmVCp41NpA9+2pVbW+i6kdIkl7haKGrgEOHWeohg6yKJIGFEph:12NzSC1Na42ekuMs2eoqO+Dh

    Score
    1/10
    • Target

      SP/Useful Soundpad.exe

    • Size

      11.1MB

    • MD5

      00e89f97bd25ce68147d995f930a2b39

    • SHA1

      e467aa2299c23982bf174d6d0636208156c6b6ab

    • SHA256

      c70588016bd102bddfe032629f4376cc4b25e819b02d2441e68c72e3d5a15777

    • SHA512

      b065d74c5b24d6770650d3ae317db441be7bd7145b5694776866093e60a508b3a62d0454f17850c144ea652253cfd7439000e7dcb0d9ca23ffd636d66e3f0401

    • SSDEEP

      196608:7DRlger67uOemwy1LR/XU3gmsRM0wWM+wC89ooEvhG7ceMIz:4erSwAVE3XsRMiJps8GyE

    Score
    7/10
    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Registers COM server for autorun

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Drops file in System32 directory

    • Target

      SP/installscript.vdf

    • Size

      631B

    • MD5

      1a792aff29d6f07d1c3381634ba6baff

    • SHA1

      f2c7bb49ccaf63ffcd38d06dd2d51095b08d4344

    • SHA256

      270d2a3eef463b768ca4368e62444a7ccaff4e98c71f2ca05b721bfef2e03e05

    • SHA512

      3971dee038f1cd1aacf9151196a53e2bfbf4bc9a665f60ae79309b5544d81a733e3f7b9db422e17c5a95ba2930248be408e6fbf877f8eb12235277f46af5a4f1

    Score
    3/10
    • Target

      SP/languages/cs/translation.mo

    • Size

      48KB

    • MD5

      5e8a5fee87f5795b0c3c8d02a6a83eff

    • SHA1

      6f86c686a7f29260d7d9b03180488fe668765c47

    • SHA256

      ca876dcfb11522ee63977c07e176cd3fdddc8bde374fde53a6a7367680638214

    • SHA512

      13fbd8912a361b59bd23b9ecb2ad4a80e0f6e32fc91fcf0befda5d31b182b1f492cd0ca6c095550383e2fb75258d6fc6230ac5f70e34d18e0a4c65e90262a5ec

    • SSDEEP

      768:4ZPGJavWhcadx7PW2DH3PdVvW/h7jUUhllX+XVSlngTvDpzWAAePn:4AJaehc6xDFDH3PW/hse+XVSlWpzWA9

    Score
    3/10
    • Target

      SP/languages/da/translation.mo

    • Size

      46KB

    • MD5

      aee77e5514dadabfc575808e3e3b4cd6

    • SHA1

      a1518effa9c956e4048918f3c53a4b9b5ef11b26

    • SHA256

      c954cca2b32bab1cb5a8a8a578329c72c49368598126b90ea480340b7aacd524

    • SHA512

      0ea132359196b292d4de350172f5675baf1f1eaaee42e0075ff3d74362abff05214ed76f62da54d55817bca3c115699c6ba6f204b6a324809113760f0247e2e7

    • SSDEEP

      768:4ZPGJn6rW6U7PW2DH3PdVvW/h7jocsAP+AVvmocV/ZVrMrtbwQFc:4AJn2YDFDH3PW/hgdAP+Yv9cxmJXc

    Score
    3/10
    • Target

      SP/languages/de/translation.mo

    • Size

      49KB

    • MD5

      6ff1d323c51c2ed88f05ee7ff468900f

    • SHA1

      49c7d5042fc7644c094c3be52d7d0666c268accb

    • SHA256

      5220672f99b439b1db77479ab170a5a0f2b65b4b14416b72447ded6f1ebcd40e

    • SHA512

      32c065115ea0ebca406fb0d5831c39c79acb7c8e45941df8f0074a3ebd4077a61e5b8b6661a3a001114269b085877f3cdb39a456f0db42c5d492adcb06aca97b

    • SSDEEP

      768:4ZPGJO77PW2DH3PdVvW/h7jCJrAWGNVu+6hI3uY11zxdHFXeZwxzU8d:4AJgDFDH3PW/hqJrbGNVKuLFywnd

    Score
    3/10
    • Target

      SP/languages/es_ES/translation.mo

    • Size

      50KB

    • MD5

      f0be4e99dca44e2aa70c3b32dccfa82a

    • SHA1

      61c49931b877f4af8ede44dd9e29d2ff4fb7d420

    • SHA256

      d35905c669534e8770849dd51ba74071836f43e1047a7df7ef99c373ca185c73

    • SHA512

      eb32e5c6360822eed54c0274bd365db19cc69c56aee083ba17d07777b302c69554c50e16cf12e155fb53d35b2e34e4efdf27d1c960f1ab6f558e0628b32b300a

    • SSDEEP

      768:4ZPGJC2pFxC07PW2DH3PdVvW/h7jdsSI6Nrc45OFHztG:4AJ5pFxFDFDH3PW/huFhG

    Score
    3/10
    • Target

      SP/languages/fi/translation.mo

    • Size

      48KB

    • MD5

      05561f37a16002c2ca8f65faef7d1749

    • SHA1

      260d64b7e458039316001eb15b09d844e909135c

    • SHA256

      8dcf58474fc5ab1514461e1f9b8e336ef0c13b49f26f7bceb14d477da7a85b6a

    • SHA512

      7a3c4c8c11512383d9db9173caa4db6203bc21bc931c1bf3f5460296589cc41e71b30b20018e201c95ee7aeae34f0c4fb9016b8049d2142c927f091e30d2fa91

    • SSDEEP

      768:4ZPGJyWk2M6bi7PW2DH3PdVvW/h7jfYPko2FAvikYPMt7i7:4AJyP2M62DFDH3PW/h3yj2qikYPMte7

    Score
    3/10
    • Target

      SP/languages/fr/translation.mo

    • Size

      51KB

    • MD5

      9fd6ad7c6bc2b8fa3b155a97f0326fbe

    • SHA1

      862379e994419c9492b9f502cdbb3741f95fa54b

    • SHA256

      bf44674158ed2dec81843c7bfd0dee6595bb36946bec92e09ecfb9943fd0e5a4

    • SHA512

      c030d773818b6c0d41c09ad1ef2d965656708f8c53a1b8e6012d70a8059e25a5652fcd65d18a6be3d7b6ec1c99403068a6497178a40ecd3c075ee403365ed919

    • SSDEEP

      768:4ZPGJS7PW2DH3PdVvW/h7jdfXRHVEzKDx0EyhtIRJl:4AJSDFDH3PW/hFwe7/

    Score
    3/10
    • Target

      SP/languages/it/translation.mo

    • Size

      49KB

    • MD5

      896a7d5d126e4473cedf237b76dbfae6

    • SHA1

      9729f9fbbc1810b31ee86094d68edba2b4e1766b

    • SHA256

      9e5fb77abbc5b636cca97637a07c9d40e03af74981afa2835900e3b65beeaf38

    • SHA512

      052e16ffb72c3e9576fee2a2c4faf47fbfa443ceec7cae65f12312b56d998b4ea89ccd5bbd3e7993822812a3798892c31b429b4b4b6409dbc96e87719bd4870b

    • SSDEEP

      768:4ZPGJfdV5iOoUh7PW2DH3PdVvW/h7jngOgZAPdUlLfci:4AJfdV5i/ODFDH3PW/hfgOgZIi1fci

    Score
    3/10
    • Target

      SP/languages/ja/translation.mo

    • Size

      54KB

    • MD5

      d16294852611eb3fbe3d7407878148b0

    • SHA1

      990c4500a0c11e82639d15c0bc66f4a0686b0540

    • SHA256

      7a6b8050163aace177a004a2cf14eaa825229e7e3366318517f2ed434563cd87

    • SHA512

      010a9a614c413ce5ba2ba1244e5c2c2420ed7c76be4fc20b4f01c4784fdeb7c39df7e9de98334a5327133557116c6d6cb6d44e346fb4e7f26288b1842382d257

    • SSDEEP

      768:4ZPGJGCVca7PW2DH3PdVvW/h7jhQhq5Kzil6jwjohno:4AJGCiaDFDH3PW/h5Qq5Kzil6Aohno

    Score
    3/10
    • Target

      SP/languages/ko/translation.mo

    • Size

      50KB

    • MD5

      9f0282e5e1e42e196a48261f57247637

    • SHA1

      dc80d18ec9a1244120a1feb1a3e70a058468642d

    • SHA256

      dd6d1dacef96225413043914fb7ae5beabafc72969b6312e47dce033896c32fc

    • SHA512

      e6d5535e182c5ea005e73d0c0277fc4732164b6b65c2faf8231fb269a0b524e63b8db8629aa1083fb23eab09f881cad1aa260db95b5ba26a07eb3ddf43459916

    • SSDEEP

      768:4ZPGJxjqIDMI7PW2DH3PdVvW/h7jjdeq5DPFBhwifn6K5y0/HxdJO:4AJxWWBDFDH3PW/hJJNwiSK5lU

    Score
    3/10

MITRE ATT&CK Enterprise v15

Tasks

static1

upx
Score
7/10

behavioral1

Score
3/10

behavioral2

Score
7/10

behavioral3

Score
3/10

behavioral4

Score
3/10

behavioral5

Score
1/10

behavioral6

Score
1/10

behavioral7

Score
1/10

behavioral8

Score
1/10

behavioral9

Score
1/10

behavioral10

Score
1/10

behavioral11

persistenceupx
Score
7/10

behavioral12

persistenceupx
Score
7/10

behavioral13

Score
3/10

behavioral14

Score
3/10

behavioral15

Score
3/10

behavioral16

Score
3/10

behavioral17

Score
3/10

behavioral18

Score
3/10

behavioral19

Score
3/10

behavioral20

Score
3/10

behavioral21

Score
3/10

behavioral22

Score
3/10

behavioral23

Score
3/10

behavioral24

Score
3/10

behavioral25

Score
3/10

behavioral26

Score
3/10

behavioral27

Score
3/10

behavioral28

Score
3/10

behavioral29

Score
3/10

behavioral30

Score
3/10

behavioral31

Score
3/10

behavioral32

Score
3/10