Overview

overview

8

Static

static

3

Slendytubb...er.exe

windows11-21h2-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Slendytubbies 3 Multiplayer.exe

  • Size

    635KB

  • Sample

    250326-3twlvavthx

  • MD5

    1fc40e19613ca683742edebb5678dc94

  • SHA1

    5b68b00678c56facd45ff7d8d50ce083a87508cb

  • SHA256

    a6d1246d2054da7e30d2d65a8f975b64fb162a501d5967fca963272927a3b41c

  • SHA512

    80192027ffcf1d6943ba4759051f9775ea22fc5c941530661762ac4fd8829ef9a584461c6c62ed1d2bcce4e65e28fc8d666d18cd7ec078fd80868be19122a0fc

  • SSDEEP

    6144:l/7oYfSHQPWTUg4LXY7Q64EXN4L/WnqPBfxB42AFnO0NFoN4ddddddN/dmMtDJ5w:p7qTUbXYs64UOPpMOKZW

Score
8/10
defense_evasiondiscoverymotwphishing

Malware Config

Targets

    • Target

      Slendytubbies 3 Multiplayer.exe

    • Size

      635KB

    • MD5

      1fc40e19613ca683742edebb5678dc94

    • SHA1

      5b68b00678c56facd45ff7d8d50ce083a87508cb

    • SHA256

      a6d1246d2054da7e30d2d65a8f975b64fb162a501d5967fca963272927a3b41c

    • SHA512

      80192027ffcf1d6943ba4759051f9775ea22fc5c941530661762ac4fd8829ef9a584461c6c62ed1d2bcce4e65e28fc8d666d18cd7ec078fd80868be19122a0fc

    • SSDEEP

      6144:l/7oYfSHQPWTUg4LXY7Q64EXN4L/WnqPBfxB42AFnO0NFoN4ddddddN/dmMtDJ5w:p7qTUbXYs64UOPpMOKZW

    Score
    8/10
    defense_evasiondiscoverymotwphishing

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Legitimate hosting services abused for malware hosting/C2

    • Mark of the Web detected: This indicates that the page was originally saved or cloned.

      phishingmotw

    • Checks system information in the registry

      System information is often read in order to detect sandboxing environments.

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks