d2401169fb5a284f7ec2f9b6b715727e640dc88a7c9fc6805b8b37a5574373eb

Sharing

Copy URL Twitter E-mail

General

Target

Undertale-SteamRIP.com.rar
Size

166.6MB
Sample

240905-wemxtsxare
MD5

c53ce2b90be03aa48049a59150c6bad8
SHA1

ba7b10a88f3df9d228f559d01f8f30775c521b8c
SHA256

d2401169fb5a284f7ec2f9b6b715727e640dc88a7c9fc6805b8b37a5574373eb
SHA512

87ca541a7dfabf27879284a12168241676e7edc3673ad75b289f600f1cc681e0d5599bb9b2868a702f492bfab97e1402a57ec8fb912958ec5a53831745d785f6
SSDEEP

3145728:u/nnl5iQtzmu2SHbhTtuU+i185BxseS1SNyYbsQqRFRc4nVZZXzcD+XiTkKBE:eB5fB5b1wBvm0yWGRFhVZhEZTkK+

Score

7^/10

Malware Config

Targets

- Target
  
  STEAMRIP » Free Pre-installed Steam Games.url
- Size
  
  121B
- MD5
  
  2c50d64e61fd60b0071ca34e7f2c21a0
- SHA1
  
  f7eb323fa0a8634535678b072dc1247a679cd0f2
- SHA256
  
  83b3dea5feeb0e8b98b33b647634264abeb7a069801833bf3d80836405921786
- SHA512
  
  ceee0f559b04b85951e2e52b4db05b8e6ffabf7fc0692be19787b0dadb247ffb667550ba0dd052facdc4f4b9b0ff97bfdd2497fbf2ece37dffe09eb67abe9186
Score

1^/10
behavioral1
- Target
  
  Undertale/D3DX9_43.dll
- Size
  
  1.9MB
- MD5
  
  86e39e9161c3d930d93822f1563c280d
- SHA1
  
  f5944df4142983714a6d9955e6e393d9876c1e11
- SHA256
  
  0b28546be22c71834501f7d7185ede5d79742457331c7ee09efc14490dd64f5f
- SHA512
  
  0a3e311c4fd5c2194a8807469e47156af35502e10aeb8a3f64a01ff802cd8669c7e668cc87b593b182fd830a126d002b5d5d7b6c77991158bffdb0b5b997f6b3
- SSDEEP
  
  24576:8UtU6OIyl2Wy9M3bJ45fPS0zFZghQ6aOiFaKOE31GrvFXl74YZ29X1MDd6olmrBs:8566l2u45BiNYFrz31Cv3D29kd6kWa
Score

3^/10

discovery
behavioral2
- Target
  
  Undertale/GameOverlayRenderer.dll
- Size
  
  1.2MB
- MD5
  
  0ec731067f6886b526eb75ff94177bba
- SHA1
  
  5ada34244869985cf941fc08937142a521adadd6
- SHA256
  
  ad143640b71a36b45dadbe1b68096e9ca6e4fd0af69b6e3e50b90ea98bab5700
- SHA512
  
  3bf15f43e451a2f19491353e10c116a92deec6b9c372a9924e7205e33fb4bb2e1c437ca8c88992ef9fd836539d91c744e905480cde48d85afebcf66c1bf2be16
- SSDEEP
  
  24576:fQZ4H9hYmdtVPtlD25KtGJFwLpK6S0QIwRDyiGO:C4dhYMtVPDdOFN6S0QIwRDyiGO
Score

3^/10

discovery
behavioral3
- Target
  
  Undertale/Undertale.exe
- Size
  
  3.9MB
- MD5
  
  8741fe2075cfbb8070ff1ccb7468981a
- SHA1
  
  9ff96c296cc555a6a000133e07fb3f4ab92811c4
- SHA256
  
  c8c4191026bf5587a6fad120855b8b82ffb4fa0c3eaf10515be472ad84248e58
- SHA512
  
  c5e424cece81a4dad5f4e66e6e00b19d0ce014853f4dcd1a45d16e8d4321ba33f6333e2ebaf2dba3152e0fb22f942749664f231e6df5982e4511788a30d7e655
- SSDEEP
  
  49152:XAt4d/SmMp/luXDffWTCcAt0ZqJEK8AbYMsYVOMsT49:iN/UcAt0oJ0A3sYEM99
Score

6^/10

discovery
- Drops desktop.ini file(s)
- Network Service Discovery
  Attempt to gather information on host's network.
  discovery
behavioral4
- Target
  
  Undertale/codex.dll
- Size
  
  103KB
- MD5
  
  7b8887951d5834203f155e1f16005da5
- SHA1
  
  e199242e51d816b1abc3e4091c429a22175b1ac6
- SHA256
  
  382a95940910172335a3f6356671e3cf6e514ec95b98faf5d943b23870164afc
- SHA512
  
  bf849ce862aeba8b0782997fa5ad2adc27644c37e080bf3b52d6ebe3a33dfed48b781d6c021c20164fd1d1a058fa00b1cf5bf5745a012947739f364f9fc7539c
- SSDEEP
  
  3072:zI3fhg4ZOSLv33g58RD7IE7ZsV0/pNDWItqcD/3lGbal:zI3ZQqv3w58ZIEyV0/baajVG8
Score

3^/10

discovery
behavioral5
- Target
  
  Undertale/steam_api.cdx
- Size
  
  210KB
- MD5
  
  111b4505eab5f342d9292dd592e6940c
- SHA1
  
  6562c7f856f5ba1bb390474d925f7a79ae432122
- SHA256
  
  64eb5531bbee05db713dcd47e4a74c59e27bf067b0cfe9603eeaea5a4601fe90
- SHA512
  
  176ae878132081037a81d313407cdb99b66a1a79ea86d79ccc7cf0dad333cf21753b0e885af06ec3e9e5084315ae645c9184bee46eeff0fb487545d55b60aaeb
- SSDEEP
  
  3072:1GqYVbRkudWS/0AvM/29pNpeAA+2C+48IaD7+drNVRICcCB7Pa7Orx4I:1GqYVVk4Wa0Ke290xUXqCcm7v6I
Score

3^/10

discovery
behavioral6
- Target
  
  Undertale/steam_api.dll
- Size
  
  210KB
- MD5
  
  30ae1db76c1af7f46e6f41c375e1b9b0
- SHA1
  
  5e30d08ae301bb866a8856b4ef2c57d788bcda4a
- SHA256
  
  dfa223f72fe3b975b5033ec03d505e5a702bf4ff632bce7ba1b8a5ff411f0245
- SHA512
  
  2a4239ffb214341b9495ae02fae90785b9a8f2712fa91a59730b1a9778aaa35b6c8cb88cb57f19c34a131a2bfecaef71c4b56a26fac4bbf6e1a3d8748d8f7b70
- SSDEEP
  
  3072:1GqYVbRkudWS/0AvM/29pNpeAA+2C+48IaD7+drNVRICc/B7Pa7Orx4I:1GqYVVk4Wa0Ke290xUXqCcZ7v6I
Score

3^/10

discovery
behavioral7
- Target
  
  Undertale/steamclient.dll
- Size
  
  255KB
- MD5
  
  2e5c2c249c56a6bd8b374e8d32b2abe7
- SHA1
  
  116f109add3102e64ca3ac435b734c695737f6d5
- SHA256
  
  6b8411ea4559e739995beab3f8fc26a9c590291a5338a642d7ecb2f38a833950
- SHA512
  
  10b5c80c3c666d7c2a9b9f3ee5242cc5defee3008b7c9c687b8835afa3ca0ba00d69662852d0544d845a0d59c9b7a1e7fe595e9883c0288eca71cb854193484d
- SSDEEP
  
  6144:c3NY4YUfQVKLb0ZC9RmqdzANCNxAd8CGyCvBG6Vdq:c3VYnVfC9R9EkxkIyeXVdq
Score

3^/10

discovery
behavioral8
- Target
  
  _CommonRedist/dxwebsetup.exe
- Size
  
  281KB
- MD5
  
  fd6057b33e15a553ddc5d9873723ce8f
- SHA1
  
  f90efb623b5abea70af63c470daa8674444fb1df
- SHA256
  
  111aeddc6a6dbf64b28cb565aa12af9ee3cc0a56ce31e4da0068cf6b474c3288
- SHA512
  
  d894630c9a4bdb767e9f16d1b701acbdf011e721768ba0dc7a24e6d82a4d062a7ca253b1b334edba38c06187104351203a92c017838bdd9f13905cde30f7d94d
- SSDEEP
  
  6144:pWK8EGMUjp5cGQ3Mek1B3B9h8Ins3i8AEYBSawz1YSc:JGvjp5cj35kDB9hrs3zARBSaJSc
Score

7^/10

discovery persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Drops file in System32 directory
behavioral9
- Target
  
  _CommonRedist/oalinst.exe
- Size
  
  790KB
- MD5
  
  694f54bd227916b89fc3eb1db53f0685
- SHA1
  
  21fdc367291bbef14dac27925cae698d3928eead
- SHA256
  
  b8f39714d41e009f75efb183c37100f2cbabb71784bbd243be881ac5b42d86fd
- SHA512
  
  55bc0de75a7f27f11eb8f4ee8c9934dfe1acd044d8b7b2151c506bdcbead3ab179df7023f699c9139c77541bbc4b1c0657e93c34a6bc4309b665c6cb7636a7e5
- SSDEEP
  
  12288:0s1yfEcpPzdv+t4cRIy3ze3SUN0PXGTjiqRy2p3kwzjGHTkV:NwfLrvi4cRIyDe3SUNaXy+WypoGHgV
Score

6^/10

discovery
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops file in System32 directory
behavioral10
- Target
  
  _CommonRedist/vcredist_2015-2019_x64.exe
- Size
  
  14.3MB
- MD5
  
  f0248d477e74687c5619ae16498b13d4
- SHA1
  
  9ed4b091148c9b53f66b3f2c69be7e60e74c486a
- SHA256
  
  b6c82087a2c443db859fdbeaae7f46244d06c3f2a7f71c35e50358066253de52
- SHA512
  
  0c373b06ffe84f3e803831e90f22d7d73304e47a47839db614f63399ff1b7fcf33153bf3d23998877c96d2a75e316291a219fdd12358ca48928526284b802591
- SSDEEP
  
  393216:q5lptVYmfr7yBG/4WoI+j6LTinXKSf0fzTDv8:q7pttD7yBG/uljIinXj0fQ
Score

7^/10

discovery
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral11
- Target
  
  _CommonRedist/vcredist_2015-2019_x86.exe
- Size
  
  13.7MB
- MD5
  
  de34b1c517e0463602624bbc8294c08d
- SHA1
  
  5ce7923ffea712468c05e7ac376dd9c29ea9f6be
- SHA256
  
  ac96016f1511ae3eb5ec9de04551146fe351b7f97858dcd67163912e2302f5d6
- SHA512
  
  114bca1ecd17e419ad617a1a4341e607250bcb02626cdc0670eb60be734bbad1f3c84e38f077af9a32a6b1607b8ce6e4b3641c0faefaa779c0fec0d3ac022dac
- SSDEEP
  
  393216:/d/FlptVYmfr7yBG/4JU4TRjtjUMy4i6kgsY7i:/1PpttD7yBG/QHTJtYMyke9
Score

7^/10

discovery
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral12
- Target
  
  _CommonRedist/vcredist_x64.exe
- Size
  
  5.5MB
- MD5
  
  630d75210b325a280c3352f879297ed5
- SHA1
  
  b330b760a8f16d5a31c2dc815627f5eb40861008
- SHA256
  
  b06546ddc8ca1e3d532f3f2593e88a6f49e81b66a9c2051d58508cc97b6a2023
- SHA512
  
  b6e107fa34764d336c9b59802c858845df9f8661a1beb41436fd638a044580557921e69883ed32737f853e203f0083358f642f3efe0a80fae7932c5e6137331f
- SSDEEP
  
  98304:EuLgywiNHBeSLxYK/bxE3q/BlZkWMGPQflVJ/EK1sLyzs2T2Q1mOjq4/:V7wqheSVYK/bua/BlWWnuVhsus8nm+qi
Score

7^/10

discovery
- Executes dropped EXE
- Loads dropped DLL
behavioral13
- Target
  
  _CommonRedist/vcredist_x86.exe
- Size
  
  4.8MB
- MD5
  
  b88228d5fef4b6dc019d69d4471f23ec
- SHA1
  
  372d9c1670343d3fb252209ba210d4dc4d67d358
- SHA256
  
  8162b2d665ca52884507ede19549e99939ce4ea4a638c537fa653539819138c8
- SHA512
  
  cdd218d211a687dde519719553748f3fb36d4ac618670986a6dadb4c45b34a9c6262ba7bab243a242f91d867b041721f22330170a74d4d0b2c354aec999dbff8
- SSDEEP
  
  98304:RuLgywiN1ah6HcG0UJrN7SDgndrHZDMeaNNjt0CKKBgY2r71pZ/APaOR72HgQo0z:I7wq1W6HqULS8djZDTaNNeCKVP5ORsg0
Score

7^/10

discovery
- Executes dropped EXE
- Loads dropped DLL
behavioral14
- Target
  
  _CommonRedist/xnafx40_redist.msi
- Size
  
  6.7MB
- MD5
  
  97c2eebb30c5a88c68c8f24f37183f1d
- SHA1
  
  49efdc29f65fc8263c196338552c7009fc96c5de
- SHA256
  
  e6c41d692ebcba854dad4b1c52bb7ddd05926bad3105595d6596b8bab01c25e7
- SHA512
  
  c9d1017b274ceb1b4ee624cf7e628787c32a727c64f715fbce1f1ae929d9114f8fe1291e34583cec615619b0128c01206b07efc878e7a5c57b792453f73fd0da
- SSDEEP
  
  98304:wynfL329J1XswfXO6wiBB+4RZg6aENaCZAU5PMO0MntfERyJGH2YPq/:wYD3C1XXfzH+4cLHU5PM/Mnt+YGlq
Score

6^/10

persistence privilege_escalation
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral15