e386100dd9eaedfb422da100a979e46d15cfe25698aa43ce32da84315c94dc3c

Sharing

Copy URL Twitter E-mail

General

Target
Granny-Chapter-Two-SteamRIP.com.rar
Size 484.3MB
Sample260427-bbvs2saz7z
SHA256 e386100dd9eaedfb422da100a979e46d15cfe25698aa43ce32da84315c94dc3c
MD5 64a2f6918f47adbfa842a5e51cbf0383
SHA1 1a2c43347e2c207d4e44970cac513a94010e41eb
SHA512 a27299f1df32b413b180f2b2b9c41a563f6b682cda07ce3931c5b6a6f8400ade9ac364aa3af8f46fed3e1e79cd727874f7540406b3cb64eb8c469e8b227dbce0
SSDEEP 12582912:A5xZi49o3snfapaTCnFIolvHXVwPo0zhvFA2i8ed+4Q:6b9WpaOlv3aQ0zk8edw
TLSH
T19E393342E4200A4AC3F67DB3C1623359A2A7A65D7EE0E42B9A104E037E1D1277D7DE7D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  Granny Chapter Two v1.2.1/GameAssembly.dll
- Size 15.8MB
- SHA256 4c01541ca83daaa4290c2b9d08af5dafa4cd0c4613492fd13ded47467cf76e16
- MD5 27e79fd29fc650fa2c856f866001ad68
- SHA1 c23662c61c5f059b576f0f3b5b93d406961725b2
- SHA512 1c95f0cd67ca65598572b16dbacac8c2b1669e8e758b5630540e9bce914807ff3ba3e1a8d42efcc5c63a46df0c5d22c7e0a8c46754afdbd1a6a42653bc01e8de
- SSDEEP 196608:GATFdqGENkdoeryR7phahwTEvmW+HeAG9e:GA2p+dGphaOEv2Hg9e
- TLSH
  T1B2F66CAEB6B98058C07AD278C913454BEBF238006F745BDB21904BCD2F737D5A57BA21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1
- Target
  Granny Chapter Two v1.2.1/Granny Chapter Two.exe
- Size 639KB
- SHA256 5876404d7991d718cde6936119ee536f833a849066f3ea41310b689d36660141
- MD5 f9f4ae3a08dbbecae1a0cf1063dd3ef4
- SHA1 55dd8718d17b531d5875170437965ce700341435
- SHA512 a86e0ec5c7e448f44e77d43f7104adef69bd9f994a04abfc4bb1ca14f0457b7673da785e277b69680c8b59691a1ef13a7c3ca404e56466cb72afef90c180bbf1
- SSDEEP 6144:PEbaWnBUCGabkR2DOS4lyT6QWrRfsTAykwS0s+LIR06di/vEl+RKoyXe5UyESy8+:PoCCROS45mvs+LYcZ+Gfc3X1mTlVy
- TLSH
  T1E9D45C2E0B69C507E3506EFCA4A1F1E1B6BD40F18D2E890FA9B2D9D75968DF72D4D080
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral2
- Target
  Granny Chapter Two v1.2.1/Granny Chapter Two_Data/Plugins/x86_64/steam_api64.dll
- Size 282KB
- SHA256 51e220f91dd32f40303763b0283329f68ca81045b4b39583090945162be6e1b7
- MD5 5b8063a2b9fa8035c5098ee8542a9cb3
- SHA1 b1b2dd610b3cd995192394ff9b6cdd11249bce8b
- SHA512 4e9488e6fbc214e0b6795f93a2663ae7d80a9dcb7419fb2c28e60db2ceecf55106e9da4f31c619bb53d2f750bdbc935856cbb415baf85f50f95cdf539d743d01
- SSDEEP 6144:AaVHKzmilQBrUssevOkHcAxilMrCynC0bcLd1x:BVHZbr3se1SynC9x
- TLSH
  T185542879A2350CF4D5B2C239CD814D4BEB71384B23159EEF2BA413365F536C26E3A296
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3
- Target
  Granny Chapter Two v1.2.1/Granny Chapter Two_Data/Plugins/x86_64/steam_api64.krg
- Size 282KB
- SHA256 f1eb582e607a1e43cdb1654bfb7cb29ad46f6728b3fb89a14f7727e0e8daab69
- MD5 2bca4e2c047ec969cb3cff277e7fc184
- SHA1 c4b5b00b605e59c6fdcb6731f2e53069506e287a
- SHA512 3819178ec650298157b1d67317e0895cb92709b106d0d8525921e341eba5e960f42434e010066bb405f1ba1619adff1a645ede58e16c4b2d88df2c90611a6cb5
- SSDEEP 6144:Aa0EKzmilQBrUssevOkHcAxilMrCynC0bcLd1x:B0EZbr3se1SynC9x
- TLSH
  T1B7542879A2350CF4D5B2C239CD814D4BEB71384B23159EEF2BA413365F536C26E3A296
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral4
- Target
  Granny Chapter Two v1.2.1/UnityCrashHandler64.exe
- Size 1.1MB
- SHA256 1fd81f9564217dd0583cb1eb38563e58e7cd3b82844e308754b9b9f85c6b0d9f
- MD5 5eec0649c16cb0136e52cc72ed57d22a
- SHA1 b0c212fe8c5651c329cbed0787d2b1d68998dd0b
- SHA512 5cd488b71f180620d88edc7a1154b97cdcebecf6dee4bad9e0bc354a011c567e5a08279e7e850f3fa1388569f30f5c6359af711859f34a5fd190586b19fa5fc1
- SSDEEP 12288:bv7acYJrQZS1qzIZyEpOoro4uoT4gmWtR+ovrbyVyQfz2fzAwr:facY4C2IZyM/uq48R+Dz+zAG
- TLSH
  T1DE356B6A6A6800F9D5678039CA56490EF2F27C5613618BDF1390B76B2F376D81E3F720
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5
- Target
  Granny Chapter Two v1.2.1/UnityPlayer.dll
- Size 27.7MB
- SHA256 d9a238b44d4e83b68aea7d592688eaa6e3f2ef7ee1d584cc7a81e3c262ef4551
- MD5 3497fe8b2e3a9a79071d61447c4ad377
- SHA1 96f43cea7ae1041169451ce14b2d28a13c812d58
- SHA512 1f8c1b79320a1841e32f97852508e8371a26acbe2d7a82b41ce3a34f098292fcdd1a680693b28af309284fe850be0b2eb4d7983dded48344da1414985bb976d9
- SSDEEP 393216:T6dOHQNR0r9xtp1+mnLV5cxhLQTKmbYrvzAZzeqZKbG0MwspLZ+CJI55SF78fczr:TBJaMZ7MspPMUF
- TLSH
  T15D579E9562B840E4C47BE078966BA91BF7B1344A03718AEF13E145A52F73BF026BF750
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral6
- Target
  Granny Chapter Two v1.2.1/baselib.dll
- Size 395KB
- SHA256 ab893f495bec93dc1615120c2662b6b4b7c2cd46982918de671145e05de1eb3e
- MD5 5dee120553a6472b2dc5faecea68ac43
- SHA1 77f627fc9e5088f4b3f6e1da11b63b5254066886
- SHA512 c3024f16dbb6de6a56864cfa2225e69ebf1ba25c5f7e07b9935162a00d8116d08da279cafa5b8ea5d2ff5414f0aa1fd054068e9ac47cda1130481e7aa9e0f28b
- SSDEEP 6144:mmLYaM15dNBJ69tUpFxE3qj4fW1Uyy5Um7vn78sdTW4FwVXpQkp4o3FL:9Ya8P2UiWeyogGdeF
- TLSH
  T188845C9AF76408B5E5679078C9B3890BE3B27C49176187CF23A4439A2F33F91563E361
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7
- Target
  STEAMRIP » Free Pre-installed Steam Games.url
- Size 219B
- SHA256 4572f3812daf7bcd347d1a36834c5a9fec1f530093adf688a6ecd9e6092cbf76
- MD5 bb3af69a2e7704bc210886920ff7681f
- SHA1 42fa4a09d62cce1c0d70a63e0816135fd6b410e3
- SHA512 4f86d06f06859ed87d5f5353de9971c118477c956a8e0e0019b275f6eb035b2841c7cb959c9f4823a599ca7e73f6a0ed320207d917e8f4ab2a9b20e732551839
- TLSH
  T119D0A9BA0B58900AD321C81AE030BC08E44E75568CDED0B932C4CA8A4D96481C8A6BA8
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral8
- Target
  _CommonRedist/dotNetFx40_Full_setup.exe
- Size 868KB
- SHA256 fa1afff978325f8818ce3a559d67a58297d9154674de7fd8eb03656d93104425
- MD5 53406e9988306cbd4537677c5336aba4
- SHA1 06becadb92a5fcca2529c0b93687c2a0c6d0d610
- SHA512 4f89da81b5a3800aa16ff33cc4a42dbb17d4c698a5e2983b88c32738decb57e3088a1da444ad0ec0d745c3c6b6b8b9b86d3f19909142f9e51f513748c0274a99
- SSDEEP 24576:+tW4x8xAxCdUcyezFSjaBHFaNlsqK5/oh6iZf1LUXw/vxNI:d4x8xqCGexm8FCspg0iZf1LUXD
- TLSH
  T1F2151232ABA0C133D4DB28B48ADDB6B2657DE6610374C4C7B7440BEEAC307D1697964B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Executes dropped EXE
- Loads dropped DLL
behavioral9
- Target
  _CommonRedist/dxwebsetup.exe
- Size 281KB
- SHA256 111aeddc6a6dbf64b28cb565aa12af9ee3cc0a56ce31e4da0068cf6b474c3288
- MD5 fd6057b33e15a553ddc5d9873723ce8f
- SHA1 f90efb623b5abea70af63c470daa8674444fb1df
- SHA512 d894630c9a4bdb767e9f16d1b701acbdf011e721768ba0dc7a24e6d82a4d062a7ca253b1b334edba38c06187104351203a92c017838bdd9f13905cde30f7d94d
- SSDEEP 6144:pWK8EGMUjp5cGQ3Mek1B3B9h8Ins3i8AEYBSawz1YSc:JGvjp5cj35kDB9hrs3zARBSaJSc
- TLSH
  T1F154F11267D9853BE0F56B705DF341236B75BCA15E7AF32E5246A88C0C32784B83A727
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Drops file in System32 directory
behavioral10
- Target
  _CommonRedist/oalinst.exe
- Size 790KB
- SHA256 b8f39714d41e009f75efb183c37100f2cbabb71784bbd243be881ac5b42d86fd
- MD5 694f54bd227916b89fc3eb1db53f0685
- SHA1 21fdc367291bbef14dac27925cae698d3928eead
- SHA512 55bc0de75a7f27f11eb8f4ee8c9934dfe1acd044d8b7b2151c506bdcbead3ab179df7023f699c9139c77541bbc4b1c0657e93c34a6bc4309b665c6cb7636a7e5
- SSDEEP 12288:0s1yfEcpPzdv+t4cRIy3ze3SUN0PXGTjiqRy2p3kwzjGHTkV:NwfLrvi4cRIyDe3SUNaXy+WypoGHgV
- TLSH
  T1E005F10020D5CC73E4EB32B3843586746EBA7E912F0A285B7FC476AEE673176DA71215
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops file in System32 directory
behavioral11
- Target
  _CommonRedist/vcredist_2015-2019_x64.exe
- Size 14.3MB
- SHA256 b6c82087a2c443db859fdbeaae7f46244d06c3f2a7f71c35e50358066253de52
- MD5 f0248d477e74687c5619ae16498b13d4
- SHA1 9ed4b091148c9b53f66b3f2c69be7e60e74c486a
- SHA512 0c373b06ffe84f3e803831e90f22d7d73304e47a47839db614f63399ff1b7fcf33153bf3d23998877c96d2a75e316291a219fdd12358ca48928526284b802591
- SSDEEP 393216:q5lptVYmfr7yBG/4WoI+j6LTinXKSf0fzTDv8:q7pttD7yBG/uljIinXj0fQ
- TLSH
  T1AFE63332A598402BDBF20473EA94F9242E3DD119735589BBE2DCDD0E1F7818217FBA16
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral12
- Target
  _CommonRedist/vcredist_2015-2019_x86.exe
- Size 13.7MB
- SHA256 ac96016f1511ae3eb5ec9de04551146fe351b7f97858dcd67163912e2302f5d6
- MD5 de34b1c517e0463602624bbc8294c08d
- SHA1 5ce7923ffea712468c05e7ac376dd9c29ea9f6be
- SHA512 114bca1ecd17e419ad617a1a4341e607250bcb02626cdc0670eb60be734bbad1f3c84e38f077af9a32a6b1607b8ce6e4b3641c0faefaa779c0fec0d3ac022dac
- SSDEEP 393216:/d/FlptVYmfr7yBG/4JU4TRjtjUMy4i6kgsY7i:/1PpttD7yBG/QHTJtYMyke9
- TLSH
  T134E633326554402AEBF20573AAA4F5342E7DE62D230449AEE3DCEC0D2FB919357F7612
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral13
- Target
  _CommonRedist/vcredist_x64.exe
- Size 5.5MB
- SHA256 b06546ddc8ca1e3d532f3f2593e88a6f49e81b66a9c2051d58508cc97b6a2023
- MD5 630d75210b325a280c3352f879297ed5
- SHA1 b330b760a8f16d5a31c2dc815627f5eb40861008
- SHA512 b6e107fa34764d336c9b59802c858845df9f8661a1beb41436fd638a044580557921e69883ed32737f853e203f0083358f642f3efe0a80fae7932c5e6137331f
- SSDEEP 98304:EuLgywiNHBeSLxYK/bxE3q/BlZkWMGPQflVJ/EK1sLyzs2T2Q1mOjq4/:V7wqheSVYK/bua/BlWWnuVhsus8nm+qi
- TLSH
  T19A4633229343E243EC97FEB8E16E484FDD65C2B31736D6677326848D9D3DB1848A0399
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Executes dropped EXE
- Loads dropped DLL
behavioral14
- Target
  _CommonRedist/vcredist_x86.exe
- Size 4.8MB
- SHA256 8162b2d665ca52884507ede19549e99939ce4ea4a638c537fa653539819138c8
- MD5 b88228d5fef4b6dc019d69d4471f23ec
- SHA1 372d9c1670343d3fb252209ba210d4dc4d67d358
- SHA512 cdd218d211a687dde519719553748f3fb36d4ac618670986a6dadb4c45b34a9c6262ba7bab243a242f91d867b041721f22330170a74d4d0b2c354aec999dbff8
- SSDEEP 98304:RuLgywiN1ah6HcG0UJrN7SDgndrHZDMeaNNjt0CKKBgY2r71pZ/APaOR72HgQo0z:I7wq1W6HqULS8djZDTaNNeCKVP5ORsg0
- TLSH
  T1D3363341B7A660F9D20778B256377FDB1C28C2CC7B28130AA365E5E87ADB7C08355798
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Executes dropped EXE
- Loads dropped DLL
behavioral15
- Target
  _CommonRedist/xnafx40_redist.msi
- Size 6.7MB
- SHA256 e6c41d692ebcba854dad4b1c52bb7ddd05926bad3105595d6596b8bab01c25e7
- MD5 97c2eebb30c5a88c68c8f24f37183f1d
- SHA1 49efdc29f65fc8263c196338552c7009fc96c5de
- SHA512 c9d1017b274ceb1b4ee624cf7e628787c32a727c64f715fbce1f1ae929d9114f8fe1291e34583cec615619b0128c01206b07efc878e7a5c57b792453f73fd0da
- SSDEEP 98304:wynfL329J1XswfXO6wiBB+4RZg6aENaCZAU5PMO0MntfERyJGH2YPq/:wYD3C1XXfzH+4cLHU5PM/Mnt+YGlq
- TLSH
  T1906622A2751AFF41DDF406BCE970CA490925CF3782270C686929356A7BF7E1202E9D4F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery persistence privilege_escalation ransomware
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral16