3cb228a31d88177ebad64e3c6255cc1296a37026efddd70ffd0448571ad28d02

Sharing

Copy URL Twitter E-mail

General

Target
Crocotile 3D 2-4-5.zip
Size 152.6MB
Sample260415-twtetsfz71
SHA256 3cb228a31d88177ebad64e3c6255cc1296a37026efddd70ffd0448571ad28d02
MD5 6b7a82168819e65ada4879231fa6a099
SHA1 9291ef7fa02d98427096d44a0340a26311f6e19f
SHA512 126498e6dcc4e9bdb3b82223907a8652b48d5887b43f92118f0f43f237fb47adad268b4c95b7ca0b918df3bd46940b389d0cc4852de6183c520df4e25b7a71a2
SSDEEP 3145728:3NRbJXbjKmNJ0CbF6+wZqgU5G67hUi3bNTqZKeUBdILYss4QgbjjQT4Ir+:3NRlnJ0AY+/7ai3bBZ5dI8ssJgzIr+
TLSH
T1F67833B411B5816BA2F06531D0D721B0E75E0489FF28BF413ADF338A5DEB986B93B815
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  Crocotile.3D.v2.4.5/Crocotile.3D.v2.4.5/credits.html
- Size 8.7MB
- SHA256 30afb0f22f81cedbbe78c427ff48c18103798e24a3aa34feedf513c839ee9bcb
- MD5 b5fd8f7212d47ca715dae4cd649664ba
- SHA1 7e938e34c85e6c96de7401b8f729c623d6626cd1
- SHA512 6b5ec6933a9a02ce91e559baa58cfdf48b39a9cc0c504dc5a1dd22af41e829cddd5689adeb6ec569c183d60064cd7182253bc5443137d53988c0298011577b23
- SSDEEP 24576:EDZ6cF6f5kqWS2Rd/w9amfz6W6M6H676HH54Kp9b:Em1m
- TLSH
  T17996A52F7F48037306C642627B8B65CAF21E903F3B561A54345CD1681F6BA2983FF699
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery ransomware
- Loads dropped DLL
behavioral1 behavioral2
- Target
  Crocotile.3D.v2.4.5/Crocotile.3D.v2.4.5/crocotile3d.exe
- Size 6.5MB
- SHA256 7eccaa002bdafed62e1171c054a7068a9128a6228f7fe9c9d08e0b1a980831cb
- MD5 465203b858f36f08aa69726bccfc947f
- SHA1 3c92d73ea31a0df7102341fb29831315ada08da7
- SHA512 0fd34608038fac960d322cca62e7725ba0d330b55e5cf9c3970c9d965894d4c84667f1fa4fc0b4ae475055818d49ff2566262a1dfc0a68561ccd04013ab43e4f
- SSDEEP 98304:6AlfLQyyshkCtCtNn5xftWw1fz/qPk+zSQNCqsOd3Nmt7NC+Bl:7fLQy7hXtCtV55tWmi7QZ7zl
- TLSH
  T18466E007A55450DAE59DE070CE459221EB723C6C47F632FF32B2AAE92D73AC13B75620
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
behavioral3 behavioral4
- Target
  Crocotile.3D.v2.4.5/Crocotile.3D.v2.4.5/d3dcompiler_47.dll
- Size 4.7MB
- SHA256 7353f25dc5cf84d09894e3e0461cef0e56799adbc617fce37620ca67240b547d
- MD5 2191e768cc2e19009dad20dc999135a3
- SHA1 f49a46ba0e954e657aaed1c9019a53d194272b6a
- SHA512 5adcb00162f284c16ec78016d301fc11559dd0a781ffbeff822db22efbed168b11d7e5586ea82388e9503b0c7d3740cf2a08e243877f5319202491c8a641c970
- SSDEEP 49152:KCZnRO4XyM53Rkq4ypQqdoRpmruVNYvkaRwvhiD0N+YEzI4og/RfzHLeHTRhFRNc:xG2QCwmHPnog/pzHAo/A6l
- TLSH
  T1AA367C5673EA40B9C1ABD178CE479213EBB1781403345BEB4190C669AF73BE16A3E734
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5
- Target
  Crocotile.3D.v2.4.5/Crocotile.3D.v2.4.5/ffmpeg.dll
- Size 1.9MB
- SHA256 9356c1f3c39e3ce71b5c12d15b6d295051284e3b011b9dd9774f525e9b3f5632
- MD5 94e9609e026eb3090d543dbf5ab936d3
- SHA1 979626811654848279e9a7ee534775dce1a46ba6
- SHA512 fc2b328c99a6b9353be92876f3cc2d20746cfe28747cf7b4cc8dbab1f1476c3c9c411da57c7ebf45019f7dce3afbff48e40c3e9c804dde9ddd0c61b628d9c5e9
- SSDEEP 24576:CuAB9qXBAxeJxpntbrLP63A84N/BhA9aYbWwhTjpKY3keyC4SFPy5vMyKhbe7:b8sRnVS3UN/BhYWMjQY3ryC4StCvMI
- TLSH
  T12995AF06E2D604A9C05AC174C35B9727F63278468B646AEF13A096283F76FD05F3EB71
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral6 behavioral7
- Target
  Crocotile.3D.v2.4.5/Crocotile.3D.v2.4.5/howto.html
- Size 603KB
- SHA256 cfb9fecbd56d9753775acb7e71acbb626e64d51ac8225a059e731b4f494be61e
- MD5 18dac3ea5d026bb3b50415e40364d88e
- SHA1 53ea2d62a2eeaf3bd49d18abbdc8fb5fd1e3b2a4
- SHA512 5623e4c804a657306d83655183c807526feb1390eb0ec786eb02b12359f7d2bd71d9d09f33a862794c3174d0edd8b881a6fcf2970232040db6bb40f6516ec154
- SSDEEP 12288:GaBvYNhwZCT53K3pt/alx9/YCEM/mQkQQrQ5t8:Ga2hwZQ63pt/alLYCNo
- TLSH
  T16FD4B71B324CA675060591C373BAABE2F72EC86C931181B270BE41BA11D6574A5FB1FF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral8 behavioral9
- Target
  Crocotile.3D.v2.4.5/Crocotile.3D.v2.4.5/libEGL.dll
- Size 450KB
- SHA256 4a71a7298b3af27ad42fdbf2dab2a820e3d072be847d033675002fc5742c6cfa
- MD5 5fb9533f03e564b89097a4595ddca7bd
- SHA1 327237e7b9812b126ab3158547d4314efdab81f0
- SHA512 b08e094f60e536339469ffb58bcd188ad24a020028270ec7dbae94bf087173266dc57d7c4dc48fb00c3fe63f64afa7a074f4aaaec1688570d87e6297d1054435
- SSDEEP 6144:u0K26y1e8gm472kLy1ssprUVNKs0FVQzQUKXDpAEo54zxM:uA6cI72kG1NprUEFMQJTprK
- TLSH
  T1BCA48D05B7A448B9E06AC474CA574A46DB72B49A0F35F7CF02E4826D2F777E85B39320
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral11
- Target
  Crocotile.3D.v2.4.5/Crocotile.3D.v2.4.5/libGLESv2.dll
- Size 6.5MB
- SHA256 1ed6d796da30ca04a9dda346fe97ee753cfd1cdd8290107a255c0eafa2420fa6
- MD5 3bf66c8f526d280b5f76258b6f4df28c
- SHA1 7bbf83283e973bc890ad378c7cb7cf4721f165c7
- SHA512 78347d9726919eff4d063a30ff9c10093856c0f2ecb2e30499eb24e5f6867f5ea18fd9b631907d08af5766578f0a93ec040af2f97e293ae9b385031f5e1e51f1
- SSDEEP 49152:JFvtWVo+WxLYUMSxRkAANDEvHVDkRwsDGIhwI/r+6IzjYHXJtS71KH1Gf86oJTeU:mIw6kJyXfkkrXZvYHGx4XZ3sWT5Dj3
- TLSH
  T13C666C03F1A540E9C05DD2B8DB5B9622FA71B8990730B2DF2A5817212F77FE06B7A714
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral12 behavioral13
- Target
  Crocotile.3D.v2.4.5/Crocotile.3D.v2.4.5/localization.html
- Size 331KB
- SHA256 54b120ffe75e62c50385332995f9c3c54da785d573c8f28c30cf8ce93af882ef
- MD5 1f397d33d279b6da1a1827018a76338a
- SHA1 4c9d488a4bf99db631bea251692b79b6a15acafc
- SHA512 7e445f046e77ffebd18834c9ce90875aaf4ebda2e4c86c760e8ea62295c44415dee740eaf637589d7d6c72ca86f494169dca2277c5544bc4f689bea8b6bdae81
- SSDEEP 6144:P+GNbdGq9T7rtu60g7Ll1NtVNWrGzD0Fqp/aE/gL25Q:GGNNtfWH
- TLSH
  T137743363312CF4349295B8DB72B50FB1EA4DED68C14640E1625ED2EB06DA538B6F31F2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral14 behavioral15
- Target
  Crocotile.3D.v2.4.5/Crocotile.3D.v2.4.5/nacl_irt_x86_64.nexe
- Size 4.3MB
- SHA256 b52916cb7c2fd145d4245b319ba960ba572cdf9d05bba91788af3c0c995a0f5b
- MD5 02deda45c69057eda99a82bc3c8aa610
- SHA1 f44da677c7eead886498470dbb81b02b7be3f13f
- SHA512 ad75fb3316168a91e602bb43bfcf4ebc2bd1b164a375d11855f346c4e08f7c3d2534edc971f3c2e72cc3bd94a912edf3a7cfc934a8f20a0ab755ec3836911411
- SSDEEP 98304:G5EwP3qieUtiWVdZaVdeSK4N4FDDNYCIFeN:GP/idevLN
- TLSH
  T1CF2681E82273B57CCF0F48741119FEF37D14C9A92A414E33A4A5DBB0193693C692AE76
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral16
- Target
  Crocotile.3D.v2.4.5/Crocotile.3D.v2.4.5/node.dll
- Size 17.3MB
- SHA256 3f0c8f561d98aa49ccc3472bed74f6b95a9cf00d85c86a5437fbed2dfecc2b96
- MD5 7c1890cb0ecdb8a5c163ae72c650137f
- SHA1 1a3cda53caf8e23a7e9e87f6cdcd9628b09b2022
- SHA512 571b4d9b63b549d7b66196d4ad06df5b00cd4b6faeccae922597dea833b10d69d2d2d70561521a34f85d4f8d178f70bcfc714a60cccfcf591d0fc1dcb62a1217
- SSDEEP 196608:ouIoeBg1AJqLRChPWl+fwXwR11sHmGmxCeC:ouIosgiJqLRQWofwXwR11sH/6C
- TLSH
  T1F5077D03B7E70059D0B7D2788BAB5526A633B4061B34E6DF325C47142FB3BE4967AB60
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  Crocotile.3D.v2.4.5/Crocotile.3D.v2.4.5/notification_helper.exe
- Size 1.1MB
- SHA256 87905459145f93b751e9ec4648232a2b0bbf295fb13aee120760ad6b20c9cb03
- MD5 47188597aafc0b6fcc0e137f2ffa9705
- SHA1 a2eb6f9fca70607d634511273dc5f85d60c9e7f8
- SHA512 85fce43055014392f3d99f8734ae3c9f204d17ca4fe44769827608af556633ebd93f736e3135039f2e10cc0ec7254da312ed91779cad2ce744e50cc517098de6
- SSDEEP 12288:9HguUxlh8dXxZYnmMUwHK2CfNjoouG9EVWVzTVFro7EmLirF/8giZaMI+nk4ozVx:Kz8dhWvKvFHuGGcrro7FLWcdQ6E
- TLSH
  T156358C17B69941E8D06EC1B58B564232FE72B4560F34B6EF069083292E3BBE45F3DB11
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  Crocotile.3D.v2.4.5/Crocotile.3D.v2.4.5/nw.dll
- Size 194.1MB
- SHA256 e7a959076d9b678d6c32718eadc7d19ac9958a3070e6155cfb90b0071a4e6ae4
- MD5 0b3de201958a612c69209072353e1451
- SHA1 03efb227e3d13cb87eaf495dd631ce0542c75674
- SHA512 e7dfc7b60ea4cb6507771b589b8f412fcf9d5fc894b1906a0d3fd9ee89d4ef0e0b5dd5a68473aff4f44fbd7b6bbee4a737f18a1af004ad16e021c3da85526fff
- SSDEEP 1572864:wrCpjI352fyRGrsn2XmxOPStOOCP5g5oa3BA7J8hat4qYEBBGRNfq6nB10Z:VMCNboZsBABC
- TLSH
  T13EA85B03E29A80E9E09DD1B59B578633EEB178894729B5DF07610B512E77FE42B3DB00
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  Crocotile.3D.v2.4.5/Crocotile.3D.v2.4.5/nw_elf.dll
- Size 1.1MB
- SHA256 3666c308b6e19c4b304c5e9ec412a28f01f8ec0016226aeac47a3990052adb06
- MD5 d59af901d97b2d85c3a5f46282410f1f
- SHA1 5ebf320b8a7d0ca61f29800a2e037b1154592cab
- SHA512 7800240ffb78e1121fffb30b260686afe13ccb5440ffbb39fd8e772f8e23122d1e1e88e73925a54df551fafaefcfb666b128777a3b4eb5ab1902afada28a5d81
- SSDEEP 24576:Gj/GYA55WJHli+xGW0HrqKpO8g/s9koIiyF:MzMWJHliEK8/k9bIbF
- TLSH
  T1EF357C07B29941E9D06ED1B4CB674636EE72B4550B34B6EF06D082192E3BFE42B3DB11
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  Crocotile.3D.v2.4.5/Crocotile.3D.v2.4.5/pnacl/pnacl_public_x86_32_crtbegin_for_eh_o
- Size 1KB
- SHA256 ef8c071cc16eece0e80a3aa0ccdb5de8ce4f55c58ebfb5dd204f38a8b28dc42a
- MD5 e7b77f37e97cd66f4211b910ffe99f99
- SHA1 d6652041a76768413306e4dde57e35a3e3bb407d
- SHA512 523ff39cafbb2e6921c59506aeffeef604cb918fe95d260ba1d18439e3ee503beb6f73c26316209dd6ea793efc406106a07dc29c65d02ed449d6657f59195ed8
- TLSH
  T1F93123C76391FD7BDEA8073516670B683335C477D6D2AF1B8404CE355D135C14656E82
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral25
- Target
  Crocotile.3D.v2.4.5/Crocotile.3D.v2.4.5/pnacl/pnacl_public_x86_32_crtbegin_o
- Size 1KB
- SHA256 fea474a2880661f9ebe73373ff897fed2edc73b8338d4ccf45b68c005778f356
- MD5 b7c162bc44020fd035511896655f62e1
- SHA1 1c2e3497cea05d712435369b0daacee83220253e
- SHA512 92211dd563579c45cfcff08133ea65622472fb9a4808e52ca0ced5fccae33fd60d3eb401013e44586dc7204073b56178f47a82550b92bf446e5b4307d213a093
- TLSH
  T1023132C747A2A833DDE40B396B6717583378C07383E29F6B4819CF399C636C46556E92
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral26
- Target
  Crocotile.3D.v2.4.5/Crocotile.3D.v2.4.5/pnacl/pnacl_public_x86_32_crtend_o
- Size 1KB
- SHA256 21c7d17b7a5d9f6a70c1267b9a033ab17ceed696790ff1336c02c596f2aca68d
- MD5 daac055b20f0ae477fd19e1ccd74e8ad
- SHA1 6a96f967e0a9082cd1c70e7c5515e9f7f4550874
- SHA512 0c9ad86ec2257f4031e3d06b56cd35e75739a0dd6cf486a438aa187d999a04ce78f2bb5211b23703f96e6700d0b47229dc835555aaf22e690333727ac69a8cd8
- TLSH
  T18121DD57A7E12D32E974553D2A3713683368C606DBD2C383E0048C21AC532C22B9759A
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral27
- Target
  Crocotile.3D.v2.4.5/Crocotile.3D.v2.4.5/pnacl/pnacl_public_x86_32_ld_nexe
- Size 1.8MB
- SHA256 6be0dae613ce39ad20ac46479b5bd2825a7dd4082829b0d537d1d49d4808454d
- MD5 5230c09f4df1f383f1e697953250efdf
- SHA1 d502afff070355e1b3d585c3b7cebc7585bf1262
- SHA512 ca90d203576a2cb9b54393064f26c80ade9e8653dc64a3268c6b793f05c1024c374db57185dc61dd30d74eafe856bd068a166696cd883b567e2429eb57d7be8c
- SSDEEP 24576:WCuliv4YrdmmcgDpOosHxTbslU700bOQideWVSeds0B7M94wVumBY:puq46Of9sSBWDsjWj
- TLSH
  T1AC85A3C8A657F0FCEF4702B0505EBEBABA24C59180358D77CBB4CB319772A114966E36
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral28
- Target
  Crocotile.3D.v2.4.5/Crocotile.3D.v2.4.5/pnacl/pnacl_public_x86_32_pnacl_llc_nexe
- Size 12.1MB
- SHA256 f017d10f751ca944498417a54a684824926356510a83c2424160fc135d2b33c9
- MD5 51bb0cbc6e0082c6de6d8ed041088ba0
- SHA1 a9ee52f662c164557a6a7c14ada2537c828d1d3f
- SHA512 334cce838c3f654ed5ee75589fe1a52ecf1d6896691b1c65d005ba56c67425956d221e11d243a386b4a9b9e1713bebd7b1dc2832f5511da1f4769085910b2ea3
- SSDEEP 98304:HXrZo2nItIOfep2qfOBt2hvtGZHTqviYUrjOtI/:Hq2n42HBJtG
- TLSH
  T1DAD671C8A617F1FCDF8B1670505E3EBABA30C59040384E77CAF4CB349AB6A115966D36
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29
- Target
  Crocotile.3D.v2.4.5/Crocotile.3D.v2.4.5/pnacl/pnacl_public_x86_32_pnacl_sz_nexe
- Size 1.6MB
- SHA256 2b924f53e8eed7f6c2aee0723a010bc05c14502bf6f1c95e7a952ccfec0b0f64
- MD5 02b8f032a3127f2f24316c6dae0cd1c9
- SHA1 b08238ae1049ac0087b10f317513e5f70a26056f
- SHA512 077f7f3c78cc18ef845567c8dcc651338604e0e0275dc7ac0728ebe43b2e452eb984f2f496dbafa7ce2bd93f4dc88c0f97dc8823bfb30d107e7d29baac05a887
- SSDEEP 24576:t3/jMxANRx4HrEORoCeWQC6g4kamCp2lU8Jty1lCAvv/YCbbxQsy0hoUREa0kPxT:t3bMxvoCeICk9y1lCAvv/YsxQsVd3
- TLSH
  T1FE8591C89A57F0FDEF4B4270405D7EBAB920C5D180395D7BCAB8CB30D6B29124966E36
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral30
- Target
  Crocotile.3D.v2.4.5/Crocotile.3D.v2.4.5/pnacl/pnacl_public_x86_64_crtbegin_for_eh_o
- Size 2KB
- SHA256 b326cc4bc8821db50a323929f1c0bbb47bcf45902afe6d8c7747a485119d1193
- MD5 691da4f86341b8c109281467d523f53a
- SHA1 d1bf788ae1f62724f526844f4f4061cf91e0f62d
- SHA512 a7bce06153990fd4ff3b9bcce0d2ecf0cfd3de43cd44709ea09121a79e1aa70b2a1a3632e1994913c03b98be7a6e0717231be307316b34c06d8159670c3c78d5
- TLSH
  T1A551578363718E67D8AD0A34446B07603736DD756B6297078C44EA313D333866E0A446
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral31
- Target
  Crocotile.3D.v2.4.5/Crocotile.3D.v2.4.5/pnacl/pnacl_public_x86_64_crtbegin_o
- Size 2KB
- SHA256 c0ab5ac7945a73816a47b5ffce5c8662be47742076b8dd39a4d22f76a0efa654
- MD5 96ada83d2ec5abada5662fc1f782a5b2
- SHA1 d7de720247667d7014a6233540623a62f46e632b
- SHA512 b3ae1281ffa3f575b5ccb74201ab1f70d27c25013e34e0e792f9d048f3c15c1439c9f8e645863474ed520c61538c62947edb5375dc1569cddbeba1ca8757c7b6
- TLSH
  T1C451ED8343719DD7E8AF0B3844AB07653737CD796B639B178889D9302D3234A2A4A80A
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Loads dropped DLL

Checks computer location settings

Loads dropped DLL

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32