b931be51f58aefde0a308963de518204d7ea7422b752ddbd96d22119516d0d47

Sharing

Copy URL

Twitter E-mail

General

Target

HaxBall Win x32bit.zip
Size

51.8MB
Sample

240606-zelxbacg83
MD5

d9c0a5fb49f29f3b613ae37a60b3bf1d
SHA1

4f47691db584c3ebaf13473db5dee1a9caabc920
SHA256

b931be51f58aefde0a308963de518204d7ea7422b752ddbd96d22119516d0d47
SHA512

85990b00b109f523c4632601f0abf287e8d1150bc068d5e3cd5d863355e63f86e2b5a9846864df2d763de0e4b55cbdf659baaf7088c70c5df56e49695fb4f24a
SSDEEP

1572864:/CkxVS4uDLrFJACMODey8AbyGXv67HfJDp:/Cs6LrjA4T8AxXCbfD

Score

7^/10

discovery execution

Malware Config

Targets

- Target
  
  Haxball-Setup-0.3.4.exe
- Size
  
  51.8MB
- MD5
  
  98c2c1a926209520eda30f9c39b0d9e1
- SHA1
  
  697e61e4105fbfa4f77f2f4f438c70f0f4756fb0
- SHA256
  
  3619af438c00c13f87a34406bd379081817a7dd8b2fcd880e6c88c1ec93d7f1c
- SHA512
  
  39895e2fa79865ce7b21aee31fe5a16f1235eac2cbb1a0eabfc5cc2166d2406a52961321026752279e965ace51138595fcda4a411580f6d703d2ee256fdb60d3
- SSDEEP
  
  1572864:CqqSChgYfRrRd7QSkIVeWM43GuTTwHsnL5Z:CqH0prRpQQXM47TsMnT
Score

7^/10

discovery
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2
- Target
  
  $PLUGINSDIR/SpiderBanner.dll
- Size
  
  9KB
- MD5
  
  17309e33b596ba3a5693b4d3e85cf8d7
- SHA1
  
  7d361836cf53df42021c7f2b148aec9458818c01
- SHA256
  
  996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93
- SHA512
  
  1abac3ce4f2d5e4a635162e16cf9125e059ba1539f70086c2d71cd00d41a6e2a54d468e6f37792e55a822d7082fb388b8dfecc79b59226bbb047b7d28d44d298
- SSDEEP
  
  192:5lkE3uqRI1y7/xcfK4PRef6gQzJyY1rpKlVrw:5lkMBI1y7UKcef6XzJrpKY
Score

1^/10
behavioral3 behavioral4
- Target
  
  $PLUGINSDIR/StdUtils.dll
- Size
  
  100KB
- MD5
  
  c6a6e03f77c313b267498515488c5740
- SHA1
  
  3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA256
  
  b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- SHA512
  
  9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP
  
  3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
Score

3^/10
behavioral5 behavioral6
- Target
  
  $PLUGINSDIR/System.dll
- Size
  
  12KB
- MD5
  
  0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1
  
  48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA256
  
  3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- SHA512
  
  c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP
  
  192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
Score

3^/10
behavioral7 behavioral8
- Target
  
  $PLUGINSDIR/WinShell.dll
- Size
  
  3KB
- MD5
  
  1cc7c37b7e0c8cd8bf04b6cc283e1e56
- SHA1
  
  0b9519763be6625bd5abce175dcc59c96d100d4c
- SHA256
  
  9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
- SHA512
  
  7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
Score

3^/10
behavioral10 behavioral9
- Target
  
  Haxball.exe
- Size
  
  101.8MB
- MD5
  
  cf570c9c47715a06b6f710dedf9476b6
- SHA1
  
  7e73a5766417653c35440b0512e6721981181a2c
- SHA256
  
  6269c899e39af621eed490f79c2e89730c2e24fcbef49d6527b9fa38b270c046
- SHA512
  
  7560a87cac2f970952195428a28b018660e64ac5caee78d843bd8c51660068073c9825a5b8af5d9b5574b6a5aaf01a94bd3b43e03d50f530ea3088c53e29046d
- SSDEEP
  
  1572864:gfgUr+PCRSVD/8dibJj+9GW9Z16OEtmPGSKpy7FD3J7VX6yIkc/ZebZeTQvjqqtQ:crg/L0CtvpC3c/ZeoTHZj
Score

7^/10
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral11 behavioral12
- Target
  
  LICENSES.chromium.html
- Size
  
  4.4MB
- MD5
  
  ceadeb2ef45d9689c77dbd491343df4a
- SHA1
  
  285147815c0c173ab965a3aefa2738d87fe02113
- SHA256
  
  7c40e8639f24a7f2a509cb4782f79848c9af1dc985f17a09a6d2b8de3518271d
- SHA512
  
  99475ae5e9d41081efc4aa8b710ce31be5c0960507ad9ffff90bde8bf2d38f46e34a1db7a17369a618199598292bccd0a2b590f7282bbcf886151f2354fd7a50
- SSDEEP
  
  24576:cwEBqmnLiLRK2BrArXKzCXkUZZAwi7Qx7uj:1cqmLAZNe6Whxe
Score

1^/10
behavioral13 behavioral14
- Target
  
  d3dcompiler_47.dll
- Size
  
  3.5MB
- MD5
  
  2f2e363c9a9baa0a9626db374cc4e8a4
- SHA1
  
  17f405e81e5fce4c5a02ca049f7bd48b31674c8f
- SHA256
  
  2630f4188bd2ea5451ca61d83869bf7068a4f0440401c949a9feb9fb476e15df
- SHA512
  
  e668a5d1f5e6f821ebfa0913e201f0dfd8da2f96605701f8db18d14ea4fdeac73aeb9b4fe1f22eaeffcdd1c0f73a6701763727d5b09775666f82b678404e4924
- SSDEEP
  
  49152:sXMoHAsisjBFjJMLhHELxJm8ZU8W/GBj5Z535TMpinAizxkl/cD11bqCG7jHbOkD:srZOb8W/G5hnAizxz7NZy9AG
Score

3^/10
behavioral15
- Target
  
  ffmpeg.dll
- Size
  
  2.5MB
- MD5
  
  db7974db8af148508cab4ce2017e8b1f
- SHA1
  
  48c81f39f0e2223aa0b110a3474bd8d0213d8760
- SHA256
  
  2f1d4a76994c2defd144ff1f2e7c64b8bd028d197994403b135f97657410980a
- SHA512
  
  2450420be11ed84fb2a533128475d51e83573085e8f4de43ff9390bfde08ae9f7e35a19079bb8d085d9f55d9e32ecfe6bd2695760e46f3363a210a6292cc938f
- SSDEEP
  
  49152:OqXk9OqD0uQqLdi1n8r8dES75xFAgelEeTPCJYGgkMY:1oOqHhsAgQEeTPCok
Score

1^/10
behavioral16 behavioral17
- Target
  
  libEGL.dll
- Size
  
  348KB
- MD5
  
  985125118e135a027cf98c189281fccc
- SHA1
  
  5eac86608875e127810b02122c5a7d8aa258c233
- SHA256
  
  f156ca816c7bcfef973b16c745afb472173366f9eef015176ac3c5d6cb698639
- SHA512
  
  439591c75f909a633f8534bfca39b2ec9c20e181b6fcca2a927dde2108d3d8317732369cfe04c1296b43dd3f60a0c191947ecfc5da33586c63a03b932e8fe614
- SSDEEP
  
  6144:ReMWV0vGisRRDwaHZNHHmtCZa29BeyyAYrhsV6fnrHZhGHJQCBf/QxX7Rlk4SEMz:sMWV0vGisRRDhHLHHmtCZauBeyyrfr5Q
Score

1^/10
behavioral18 behavioral19
- Target
  
  libGLESv2.dll
- Size
  
  8.0MB
- MD5
  
  858ef7e52143fa10ac2ae622f8dce4de
- SHA1
  
  c98296693133006b8e386544e1fe96681558fce2
- SHA256
  
  af8915450edb35401433e8c70a6e6f04b734f297662b2a4f419b10e2f8f616f7
- SHA512
  
  692712ff5478f760cea32d404a3dbd7dc20c5d50c8b4946bf62083335727dbf87a24056e393099733f6d1b005dbb9f6d06e36aa84d1d8e6378c4f33de8ff6693
- SSDEEP
  
  196608:I31mPbnBTx6fecSbjYs1ajCGfXH3iCZyhgMFVgp:I31mPP6fecSbjYsajXXH3iBhgqa
Score

3^/10
behavioral20 behavioral21
- Target
  
  resources/app.asar.unpacked/node_modules/rcedit/bin/rcedit-x64.exe
- Size
  
  1.3MB
- MD5
  
  78a23bc6548f7c06051864c8ebfabc59
- SHA1
  
  e33bf8eabdeecae85a5667aeb468e0897b110341
- SHA256
  
  b8dda19cd775798beeca7b4bf6fe2d27580d38d7d8c833ea173f7a1ba529d9cb
- SHA512
  
  4f481b7fecd47d253386da3af093e466be0a787d092edc358d1c3d727a4ac814c9a4aee856931b6823b3bef97e92054645d27bab4d4af9cc6ab555f3383c7e47
- SSDEEP
  
  24576:3EyXNImAx9NyoFP0gP/4C2bO1qIQP/JPlfg/OXnE:3EydbMyuqIQbfMO0
Score

1^/10
behavioral22 behavioral23
- Target
  
  resources/app.asar.unpacked/node_modules/rcedit/bin/rcedit.exe
- Size
  
  933KB
- MD5
  
  3213f5a9b6945ab5ccf86719c95fd826
- SHA1
  
  51bd273e3d5d5c2b0c466665f254630481bd0d0d
- SHA256
  
  a4ccc63aa48137a1c05e9069c8f744103cb907593eb8f902d873bfceb19089eb
- SHA512
  
  ab67129b13626c9b7848f9421ee7a8f71fb335b709ce6d099a88fd9804188365bab5d2286f3c2daab009763fa6dab23135cf3d000b0453a86afd50200920b206
- SSDEEP
  
  12288:raKwwMP7EpEzsXMQmgEySArWgH7irNxkDzfRF3sriU8ivsAQm5:raKTk7EpEzsHfBDzzsrj8esAQ
Score

1^/10
behavioral24 behavioral25
- Target
  
  resources/app.asar.unpacked/node_modules/rcedit/lib/rcedit.js
- Size
  
  1KB
- MD5
  
  d1a127233675396405dd67ca962e8a2c
- SHA1
  
  471fc4c6ae7cc065de27ed462bcbca63383bf8b3
- SHA256
  
  55d6b171dcaeae77f89beba245c39c07327a6584ed847082a77e98473638f557
- SHA512
  
  72bb0aeee4f109514b19d6a387dd078ca47097fb162229c0b314d290f454c7fc2fd60d70ebbb4f2566d9cfe841c5b4edcedf10750790017c7eb0318a2394614f
Score

3^/10

execution
behavioral26 behavioral27
- Target
  
  resources/elevate.exe
- Size
  
  105KB
- MD5
  
  792b92c8ad13c46f27c7ced0810694df
- SHA1
  
  d8d449b92de20a57df722df46435ba4553ecc802
- SHA256
  
  9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
- SHA512
  
  6c247254dc18ed81213a978cce2e321d6692848c64307097d2c43432a42f4f4f6d3cf22fb92610dfa8b7b16a5f1d94e9017cf64f88f2d08e79c0fe71a9121e40
- SSDEEP
  
  3072:1bLnrwQoRDtdMMgSXiFJWcIgUVCfRjV/GrWl:1PrwRhte1XsE1l
Score

1^/10
behavioral28 behavioral29
- Target
  
  swiftshader/libEGL.dll
- Size
  
  372KB
- MD5
  
  bb9ded3f46e382a20d7ed52365360dfa
- SHA1
  
  d7c5d595d357fbbbb5d2c9df1884ed063e923672
- SHA256
  
  b5bc4fff5e7ac12141fc4bdc24c2ba0a8bbc640cb98ad855a98e4dd1e9e83e10
- SHA512
  
  802b9f595ca60f587b2700f17b4a1ee994d7f38e2fb4e6e7af478d052aa0bfdba60ccb36a5f7e18c92dbebaf5d4bdc8451bc6382c3f517eac162cb8bda4fb029
- SSDEEP
  
  6144:g+jv9NINABpRcpflx3sSOYlYg64Q8goGa84V/vuqRIizwgjnFghINUB4Qu1KJT8e:fmABpRcpflNJOOB64QEGev3IizwgxVQ1
Score

1^/10
behavioral30 behavioral31
- Target
  
  swiftshader/libGLESv2.dll
- Size
  
  2.7MB
- MD5
  
  01d26b5b8815fd05c35f707e6fd66043
- SHA1
  
  72e843f983376f1a250bda111441509bba897872
- SHA256
  
  054db533d7821f3cca25dc120525fd642b054a82f3de6a544f9759b198e88a64
- SHA512
  
  6db41be8f85d0b8826b280506a46c1cff292cf1943273ae95cc7e40f0223cf2345398cfaa96356ca8f1de7dc2df5d430e49bc7331706a590f8ebb11ee0c2e19c
- SSDEEP
  
  49152:tSCBLsGp/5RsK+57hxxy9d7JJYxU3tWLbJp0rQT9daYI9mUuXgxL9PS1b5TWnDeB:8WLsGp//0pce9TWDe87F+pmRsZDt/gxs
Score

1^/10
behavioral32

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Checks installed software on the system

Checks computer location settings

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32