a6a2098dad8a709da3521c2d50a13f010cbd22571d5d3df0c08ad0ab441866fd

Sharing

Copy URL Twitter E-mail

General

Target
Five-Nights-at-Freddys-Sister-Location-SteamRIP.com.rar
Size 953.7MB
Sample240608-hd48tsag79
SHA256 a6a2098dad8a709da3521c2d50a13f010cbd22571d5d3df0c08ad0ab441866fd
MD5 f50ae3d38e09d5a7b1ab975889c2b408
SHA1 36ac0b3734db8e6b876df8cf073ac382f8048c97
SHA512 9509ec2b6be3830515a91105cba1ddf8436018de8818b399042381deb4da3afe2ac8fca1e1a305d493e3f5c11e4e9eb0e270beccad8cd77fe423f12fcbc9c198
SSDEEP 25165824:ABtY37CGE88Mdv6aOS/vFLTEnIj2TmofwUeOj2ZPkNN3IZTRMzuE3I:OI7CGDfQaf3iXTJA8mc793I
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery persistence

Malware Config

Targets

- Target
  STEAMRIP » Free Pre-installed Steam Games.url
- Size 121B
- SHA256 83b3dea5feeb0e8b98b33b647634264abeb7a069801833bf3d80836405921786
- MD5 2c50d64e61fd60b0071ca34e7f2c21a0
- SHA1 f7eb323fa0a8634535678b072dc1247a679cd0f2
- SHA512 ceee0f559b04b85951e2e52b4db05b8e6ffabf7fc0692be19787b0dadb247ffb667550ba0dd052facdc4f4b9b0ff97bfdd2497fbf2ece37dffe09eb67abe9186
- MD5 SHA1 SHA512
Score

1^/10
behavioral1 behavioral2
- Target
  SisterLocation.exe
- Size 906.5MB
- SHA256 c60e1c7994316426d824b82004aa5c76e3aab06d4e78e0c9391628e0d52b2c73
- MD5 cc2b5b61426c2593ce050edd44249211
- SHA1 4a8ce3c74cef76fd67b3e5ca80eb5bd1b36576cc
- SHA512 21ad96969b1e2fd6c09714bbd21389d392fc74b2b49f9c8dd5b166300c98845b2e021bb57cb06a7fe9a2ea0c02091245e9f7c5bbe1fcffe6fb4e61e9167c73e1
- SSDEEP 25165824:Q7zWfLoEi71Cimdgsp/r+t/XSAMphd3ieHA9+:6zgLop7cimdgsdr+tQphZAg
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10
- Loads dropped DLL
- Drops desktop.ini file(s)
behavioral3 behavioral4
- Target
  _CommonRedist/dxwebsetup.exe
- Size 281KB
- SHA256 111aeddc6a6dbf64b28cb565aa12af9ee3cc0a56ce31e4da0068cf6b474c3288
- MD5 fd6057b33e15a553ddc5d9873723ce8f
- SHA1 f90efb623b5abea70af63c470daa8674444fb1df
- SHA512 d894630c9a4bdb767e9f16d1b701acbdf011e721768ba0dc7a24e6d82a4d062a7ca253b1b334edba38c06187104351203a92c017838bdd9f13905cde30f7d94d
- SSDEEP 6144:pWK8EGMUjp5cGQ3Mek1B3B9h8Ins3i8AEYBSawz1YSc:JGvjp5cj35kDB9hrs3zARBSaJSc
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10

persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Drops file in System32 directory
behavioral5 behavioral6
- Target
  _CommonRedist/oalinst.exe
- Size 790KB
- SHA256 b8f39714d41e009f75efb183c37100f2cbabb71784bbd243be881ac5b42d86fd
- MD5 694f54bd227916b89fc3eb1db53f0685
- SHA1 21fdc367291bbef14dac27925cae698d3928eead
- SHA512 55bc0de75a7f27f11eb8f4ee8c9934dfe1acd044d8b7b2151c506bdcbead3ab179df7023f699c9139c77541bbc4b1c0657e93c34a6bc4309b665c6cb7636a7e5
- SSDEEP 12288:0s1yfEcpPzdv+t4cRIy3ze3SUN0PXGTjiqRy2p3kwzjGHTkV:NwfLrvi4cRIyDe3SUNaXy+WypoGHgV
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10

discovery
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops file in System32 directory
behavioral7 behavioral8
- Target
  _CommonRedist/vcredist_2015-2019_x64.exe
- Size 14.3MB
- SHA256 b6c82087a2c443db859fdbeaae7f46244d06c3f2a7f71c35e50358066253de52
- MD5 f0248d477e74687c5619ae16498b13d4
- SHA1 9ed4b091148c9b53f66b3f2c69be7e60e74c486a
- SHA512 0c373b06ffe84f3e803831e90f22d7d73304e47a47839db614f63399ff1b7fcf33153bf3d23998877c96d2a75e316291a219fdd12358ca48928526284b802591
- SSDEEP 393216:q5lptVYmfr7yBG/4WoI+j6LTinXKSf0fzTDv8:q7pttD7yBG/uljIinXj0fQ
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10

discovery
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral10 behavioral9
- Target
  _CommonRedist/vcredist_2015-2019_x86.exe
- Size 13.7MB
- SHA256 ac96016f1511ae3eb5ec9de04551146fe351b7f97858dcd67163912e2302f5d6
- MD5 de34b1c517e0463602624bbc8294c08d
- SHA1 5ce7923ffea712468c05e7ac376dd9c29ea9f6be
- SHA512 114bca1ecd17e419ad617a1a4341e607250bcb02626cdc0670eb60be734bbad1f3c84e38f077af9a32a6b1607b8ce6e4b3641c0faefaa779c0fec0d3ac022dac
- SSDEEP 393216:/d/FlptVYmfr7yBG/4JU4TRjtjUMy4i6kgsY7i:/1PpttD7yBG/QHTJtYMyke9
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10

discovery
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral11 behavioral12
- Target
  _CommonRedist/vcredist_x64.exe
- Size 5.5MB
- SHA256 b06546ddc8ca1e3d532f3f2593e88a6f49e81b66a9c2051d58508cc97b6a2023
- MD5 630d75210b325a280c3352f879297ed5
- SHA1 b330b760a8f16d5a31c2dc815627f5eb40861008
- SHA512 b6e107fa34764d336c9b59802c858845df9f8661a1beb41436fd638a044580557921e69883ed32737f853e203f0083358f642f3efe0a80fae7932c5e6137331f
- SSDEEP 98304:EuLgywiNHBeSLxYK/bxE3q/BlZkWMGPQflVJ/EK1sLyzs2T2Q1mOjq4/:V7wqheSVYK/bua/BlWWnuVhsus8nm+qi
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10
- Executes dropped EXE
- Loads dropped DLL
behavioral13 behavioral14
- Target
  _CommonRedist/vcredist_x86.exe
- Size 4.8MB
- SHA256 8162b2d665ca52884507ede19549e99939ce4ea4a638c537fa653539819138c8
- MD5 b88228d5fef4b6dc019d69d4471f23ec
- SHA1 372d9c1670343d3fb252209ba210d4dc4d67d358
- SHA512 cdd218d211a687dde519719553748f3fb36d4ac618670986a6dadb4c45b34a9c6262ba7bab243a242f91d867b041721f22330170a74d4d0b2c354aec999dbff8
- SSDEEP 98304:RuLgywiN1ah6HcG0UJrN7SDgndrHZDMeaNNjt0CKKBgY2r71pZ/APaOR72HgQo0z:I7wq1W6HqULS8djZDTaNNeCKVP5ORsg0
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10
- Executes dropped EXE
- Loads dropped DLL
behavioral15 behavioral16
- Target
  _CommonRedist/xnafx40_redist.msi
- Size 6.7MB
- SHA256 e6c41d692ebcba854dad4b1c52bb7ddd05926bad3105595d6596b8bab01c25e7
- MD5 97c2eebb30c5a88c68c8f24f37183f1d
- SHA1 49efdc29f65fc8263c196338552c7009fc96c5de
- SHA512 c9d1017b274ceb1b4ee624cf7e628787c32a727c64f715fbce1f1ae929d9114f8fe1291e34583cec615619b0128c01206b07efc878e7a5c57b792453f73fd0da
- SSDEEP 98304:wynfL329J1XswfXO6wiBB+4RZg6aENaCZAU5PMO0MntfERyJGH2YPq/:wYD3C1XXfzH+4cLHU5PM/Mnt+YGlq
- MD5 SHA1 SHA512 SSDEEP
Score

6^/10
- Blocklisted process makes network request
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral17 behavioral18

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Loads dropped DLL

Drops desktop.ini file(s)

Executes dropped EXE

Loads dropped DLL

Adds Run key to start application

Drops file in System32 directory

Loads dropped DLL

Checks installed software on the system

Drops file in System32 directory

Executes dropped EXE

Loads dropped DLL

Checks installed software on the system

Executes dropped EXE

Loads dropped DLL

Checks installed software on the system

Executes dropped EXE

Loads dropped DLL

Executes dropped EXE

Loads dropped DLL

Blocklisted process makes network request

Enumerates connected drives

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18