d7dafb1954e6216b222a0a74a7b8f3d9ab12a4101699a93df8cdf8e7dfc348cb

Sharing

Copy URL Twitter E-mail

General

Target
SP.rar
Size 7.1MB
Sample240302-ryqqlsee76
SHA256 d7dafb1954e6216b222a0a74a7b8f3d9ab12a4101699a93df8cdf8e7dfc348cb
MD5 6783768a5b8722d24720fe32fedcca48
SHA1 0d85241c32c428c7c2977bee0806246172effe56
SHA512 a42d96b767924f482a8867515c059823b78c9612559d8a5f556e3bfbaf2174595d1008eff15611d7b80c80b8603e96997e24df88c1c59595460655a74d6721be
SSDEEP 196608:j9YDxWeHnCvozDOv9wKuoqntQU/0CZz9TH:j9olCvQ0ugQ3/Hz9D
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

persistence upx

Malware Config

Targets

- Target
  SP.rar
- Size 7.1MB
- SHA256 d7dafb1954e6216b222a0a74a7b8f3d9ab12a4101699a93df8cdf8e7dfc348cb
- MD5 6783768a5b8722d24720fe32fedcca48
- SHA1 0d85241c32c428c7c2977bee0806246172effe56
- SHA512 a42d96b767924f482a8867515c059823b78c9612559d8a5f556e3bfbaf2174595d1008eff15611d7b80c80b8603e96997e24df88c1c59595460655a74d6721be
- SSDEEP 196608:j9YDxWeHnCvozDOv9wKuoqntQU/0CZz9TH:j9olCvQ0ugQ3/Hz9D
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral1 behavioral2
- Target
  SP/Profile/CRACKED BY CodeAway/SteamUserID.cfg
- Size 61B
- SHA256 bc9a5b91ebb132e6cb3247f73c357290187745a6c1adfc5547c0aa68a05863b9
- MD5 5a46be2930024cce1502b0daeb82754d
- SHA1 fc28dd34643b72bb6cd71f35c4f4a15491c5d7b7
- SHA512 de5d122ae7a08ccff17c948d66948a5f23cad871507e87c6b33755c99f0a43c7dc52184ba200b7b6867059b7392e64f36be1e074e21a3f0590b1fa79e623676a
- MD5 SHA1 SHA512
Score

3^/10
behavioral3 behavioral4
- Target
  SP/SteamConfig.ini
- Size 134B
- SHA256 fdc30c33e21145b1234964ff7f8c8186b4c3afe7afd496aaeb9ef520ad3041a9
- MD5 dba39f8d59720ec26a5520e15933908e
- SHA1 b5021df42613dcac92009626c6857ddfb0c9387d
- SHA512 bc127b984245eae3f552a46f16fdef472e0082550604b0f901456becb8c931ee7368d1435c2c54b01feb7e7dcf38a3b2877ae5f47ac6f44ca7a6f9ef70a42735
- MD5 SHA1 SHA512
Score

1^/10
behavioral5 behavioral6
- Target
  SP/UniteFxControl.dll
- Size 1.1MB
- SHA256 afe6075ea7dd1bdcbc47b38385216d11cdd5ebc3f82eeedfa6d766e9249d6252
- MD5 6ac19cffc0c58ce35ae704c381c4f702
- SHA1 c43900c5d56d62311a337b04c9489afc1c75c175
- SHA512 61197228b9a1bb9810c68cc04928fd47e2bbe78d36f71c4a2ee498742fea8fd6c950cf43578fa20c6009f1ed6343bf8ca7bfb155512018aac88a4191fad4f939
- SSDEEP 24576:XBLW5gqPvbSfiCRcXw0qU6RmWByuAy5a/owH/1:ZqPvbv/Zwm4yi5aQwHN
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral7 behavioral8
- Target
  SP/UniteFxUpdate.dll
- Size 442KB
- SHA256 562b17370c7283e92a3353b76ab2aefd301c2e78782fa60ec9ee35676ad44f96
- MD5 0ee743073ee6b68f8222be2661d95315
- SHA1 2e642772ec19edf73422fe25a8d45db1a006ff85
- SHA512 c3f2037bd37cef7978187f67f1d0633ee3067b4837e0ad9ae2a5c8efab8ec4ce6a14c1d88e200ffaa8677f74fd5995789297e6a7b5ac18d19dc9d53b4d9170ba
- SSDEEP 6144:12UHPCFzuxTmVCp41NpA9+2pVbW+i6kdIkl7haKGrgEOHWeohg6yKJIGFEph:12NzSC1Na42ekuMs2eoqO+Dh
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral10 behavioral9
- Target
  SP/Useful Soundpad.exe
- Size 11.1MB
- SHA256 c70588016bd102bddfe032629f4376cc4b25e819b02d2441e68c72e3d5a15777
- MD5 00e89f97bd25ce68147d995f930a2b39
- SHA1 e467aa2299c23982bf174d6d0636208156c6b6ab
- SHA512 b065d74c5b24d6770650d3ae317db441be7bd7145b5694776866093e60a508b3a62d0454f17850c144ea652253cfd7439000e7dcb0d9ca23ffd636d66e3f0401
- SSDEEP 196608:7DRlger67uOemwy1LR/XU3gmsRM0wWM+wC89ooEvhG7ceMIz:4erSwAVE3XsRMiJps8GyE
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10

persistence upx
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Registers COM server for autorun
  persistence
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Drops file in System32 directory
behavioral11 behavioral12
- Target
  SP/installscript.vdf
- Size 631B
- SHA256 270d2a3eef463b768ca4368e62444a7ccaff4e98c71f2ca05b721bfef2e03e05
- MD5 1a792aff29d6f07d1c3381634ba6baff
- SHA1 f2c7bb49ccaf63ffcd38d06dd2d51095b08d4344
- SHA512 3971dee038f1cd1aacf9151196a53e2bfbf4bc9a665f60ae79309b5544d81a733e3f7b9db422e17c5a95ba2930248be408e6fbf877f8eb12235277f46af5a4f1
- MD5 SHA1 SHA512
Score

3^/10
behavioral13 behavioral14
- Target
  SP/languages/cs/translation.mo
- Size 48KB
- SHA256 ca876dcfb11522ee63977c07e176cd3fdddc8bde374fde53a6a7367680638214
- MD5 5e8a5fee87f5795b0c3c8d02a6a83eff
- SHA1 6f86c686a7f29260d7d9b03180488fe668765c47
- SHA512 13fbd8912a361b59bd23b9ecb2ad4a80e0f6e32fc91fcf0befda5d31b182b1f492cd0ca6c095550383e2fb75258d6fc6230ac5f70e34d18e0a4c65e90262a5ec
- SSDEEP 768:4ZPGJavWhcadx7PW2DH3PdVvW/h7jUUhllX+XVSlngTvDpzWAAePn:4AJaehc6xDFDH3PW/hse+XVSlWpzWA9
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral15 behavioral16
- Target
  SP/languages/da/translation.mo
- Size 46KB
- SHA256 c954cca2b32bab1cb5a8a8a578329c72c49368598126b90ea480340b7aacd524
- MD5 aee77e5514dadabfc575808e3e3b4cd6
- SHA1 a1518effa9c956e4048918f3c53a4b9b5ef11b26
- SHA512 0ea132359196b292d4de350172f5675baf1f1eaaee42e0075ff3d74362abff05214ed76f62da54d55817bca3c115699c6ba6f204b6a324809113760f0247e2e7
- SSDEEP 768:4ZPGJn6rW6U7PW2DH3PdVvW/h7jocsAP+AVvmocV/ZVrMrtbwQFc:4AJn2YDFDH3PW/hgdAP+Yv9cxmJXc
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral17 behavioral18
- Target
  SP/languages/de/translation.mo
- Size 49KB
- SHA256 5220672f99b439b1db77479ab170a5a0f2b65b4b14416b72447ded6f1ebcd40e
- MD5 6ff1d323c51c2ed88f05ee7ff468900f
- SHA1 49c7d5042fc7644c094c3be52d7d0666c268accb
- SHA512 32c065115ea0ebca406fb0d5831c39c79acb7c8e45941df8f0074a3ebd4077a61e5b8b6661a3a001114269b085877f3cdb39a456f0db42c5d492adcb06aca97b
- SSDEEP 768:4ZPGJO77PW2DH3PdVvW/h7jCJrAWGNVu+6hI3uY11zxdHFXeZwxzU8d:4AJgDFDH3PW/hqJrbGNVKuLFywnd
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral19 behavioral20
- Target
  SP/languages/es_ES/translation.mo
- Size 50KB
- SHA256 d35905c669534e8770849dd51ba74071836f43e1047a7df7ef99c373ca185c73
- MD5 f0be4e99dca44e2aa70c3b32dccfa82a
- SHA1 61c49931b877f4af8ede44dd9e29d2ff4fb7d420
- SHA512 eb32e5c6360822eed54c0274bd365db19cc69c56aee083ba17d07777b302c69554c50e16cf12e155fb53d35b2e34e4efdf27d1c960f1ab6f558e0628b32b300a
- SSDEEP 768:4ZPGJC2pFxC07PW2DH3PdVvW/h7jdsSI6Nrc45OFHztG:4AJ5pFxFDFDH3PW/huFhG
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral21 behavioral22
- Target
  SP/languages/fi/translation.mo
- Size 48KB
- SHA256 8dcf58474fc5ab1514461e1f9b8e336ef0c13b49f26f7bceb14d477da7a85b6a
- MD5 05561f37a16002c2ca8f65faef7d1749
- SHA1 260d64b7e458039316001eb15b09d844e909135c
- SHA512 7a3c4c8c11512383d9db9173caa4db6203bc21bc931c1bf3f5460296589cc41e71b30b20018e201c95ee7aeae34f0c4fb9016b8049d2142c927f091e30d2fa91
- SSDEEP 768:4ZPGJyWk2M6bi7PW2DH3PdVvW/h7jfYPko2FAvikYPMt7i7:4AJyP2M62DFDH3PW/h3yj2qikYPMte7
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral23 behavioral24
- Target
  SP/languages/fr/translation.mo
- Size 51KB
- SHA256 bf44674158ed2dec81843c7bfd0dee6595bb36946bec92e09ecfb9943fd0e5a4
- MD5 9fd6ad7c6bc2b8fa3b155a97f0326fbe
- SHA1 862379e994419c9492b9f502cdbb3741f95fa54b
- SHA512 c030d773818b6c0d41c09ad1ef2d965656708f8c53a1b8e6012d70a8059e25a5652fcd65d18a6be3d7b6ec1c99403068a6497178a40ecd3c075ee403365ed919
- SSDEEP 768:4ZPGJS7PW2DH3PdVvW/h7jdfXRHVEzKDx0EyhtIRJl:4AJSDFDH3PW/hFwe7/
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral25 behavioral26
- Target
  SP/languages/it/translation.mo
- Size 49KB
- SHA256 9e5fb77abbc5b636cca97637a07c9d40e03af74981afa2835900e3b65beeaf38
- MD5 896a7d5d126e4473cedf237b76dbfae6
- SHA1 9729f9fbbc1810b31ee86094d68edba2b4e1766b
- SHA512 052e16ffb72c3e9576fee2a2c4faf47fbfa443ceec7cae65f12312b56d998b4ea89ccd5bbd3e7993822812a3798892c31b429b4b4b6409dbc96e87719bd4870b
- SSDEEP 768:4ZPGJfdV5iOoUh7PW2DH3PdVvW/h7jngOgZAPdUlLfci:4AJfdV5i/ODFDH3PW/hfgOgZIi1fci
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral27 behavioral28
- Target
  SP/languages/ja/translation.mo
- Size 54KB
- SHA256 7a6b8050163aace177a004a2cf14eaa825229e7e3366318517f2ed434563cd87
- MD5 d16294852611eb3fbe3d7407878148b0
- SHA1 990c4500a0c11e82639d15c0bc66f4a0686b0540
- SHA512 010a9a614c413ce5ba2ba1244e5c2c2420ed7c76be4fc20b4f01c4784fdeb7c39df7e9de98334a5327133557116c6d6cb6d44e346fb4e7f26288b1842382d257
- SSDEEP 768:4ZPGJGCVca7PW2DH3PdVvW/h7jhQhq5Kzil6jwjohno:4AJGCiaDFDH3PW/h5Qq5Kzil6Aohno
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral29 behavioral30
- Target
  SP/languages/ko/translation.mo
- Size 50KB
- SHA256 dd6d1dacef96225413043914fb7ae5beabafc72969b6312e47dce033896c32fc
- MD5 9f0282e5e1e42e196a48261f57247637
- SHA1 dc80d18ec9a1244120a1feb1a3e70a058468642d
- SHA512 e6d5535e182c5ea005e73d0c0277fc4732164b6b65c2faf8231fb269a0b524e63b8db8629aa1083fb23eab09f881cad1aa260db95b5ba26a07eb3ddf43459916
- SSDEEP 768:4ZPGJxjqIDMI7PW2DH3PdVvW/h7jjdeq5DPFBhwifn6K5y0/HxdJO:4AJxWWBDFDH3PW/hJJNwiSK5lU
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

Checks computer location settings

Loads dropped DLL

Registers COM server for autorun

UPX packed file

Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32