b9f0b3b682ff07ed35802e9548408d9cb5fddc2cd2dcdc0cb44361e704d20f4c

Resubmissions

02/05/2026, 16:16

260502-tq4nlsf17l7

02/05/2026, 16:13

260502-tpblfab12x8

Sharing

Copy URL Twitter E-mail

General

Target
Craft2VRM_Final_Release.zip
Size 39.8MB
Sample260502-tpblfab12x
SHA256 b9f0b3b682ff07ed35802e9548408d9cb5fddc2cd2dcdc0cb44361e704d20f4c
MD5 20dba8bf1e37937991acdb863d64433a
SHA1 3dc4791064d20f3c6b06002c48c727262863c48c
SHA512 09d9ec44da3ae23d3ec923625b1c44bec5c6cb2dd47a29e8ed096340d28861b551953bb2daffcdcb5964183df4ad600c16d12400516be1e41cce92721ab61bc2
SSDEEP 786432:qQ4C1kzkkkIVEL0rIDGoV6vOZRov90zhDEpSqxnWY8t9kRDnArVgY0b:TIkkHEL0rOGoB21pSfYGUnAJ0b
TLSH
T18797339B01972BE1D0CDB33FB434058771663D2D16B9E766184DF2205FBA8C4EE9A21B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Craft2VRM_Final_Release.zip
- Size 39.8MB
- SHA256 b9f0b3b682ff07ed35802e9548408d9cb5fddc2cd2dcdc0cb44361e704d20f4c
- MD5 20dba8bf1e37937991acdb863d64433a
- SHA1 3dc4791064d20f3c6b06002c48c727262863c48c
- SHA512 09d9ec44da3ae23d3ec923625b1c44bec5c6cb2dd47a29e8ed096340d28861b551953bb2daffcdcb5964183df4ad600c16d12400516be1e41cce92721ab61bc2
- SSDEEP 786432:qQ4C1kzkkkIVEL0rIDGoV6vOZRov90zhDEpSqxnWY8t9kRDnArVgY0b:TIkkHEL0rOGoB21pSfYGUnAJ0b
- TLSH
  T18797339B01972BE1D0CDB33FB434058771663D2D16B9E766184DF2205FBA8C4EE9A21B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1
- Target
  Craft2vrm_Data/level2
- Size 69KB
- SHA256 7ebd05f47891632973278d4d2028cd77e8b8e9e53a23ea9e2be13f864ff13a40
- MD5 2cdd59ab277a6f98670d2407982d049b
- SHA1 aa82c31848d64948fd5796ae549962c1ea12f39e
- SHA512 365f3a8e224aed737b78c2e94b828c24dca32154f501e399da87e68f7d7da8c73513813a7ec872327c9b417e8973eeed3cfe419cb10e6184896b8eec5ba11707
- SSDEEP 768:c8QqQ0zyfJ4WNVUiirDxesHqwtf5OhTChi6:d/zyfJRNVUiifxzHqwtf8hTCh
- TLSH
  T151630C4A5705990FEA393B3346970F6AFF34D4880B6E47370370617C2EF67899E5AA42
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral2
- Target
  Craft2vrm_Data/resources.assets
- Size 4.3MB
- SHA256 f6fc3220b7300a2e4a293738bd044f3f4b24276725fd91962b37e5f820e8df2d
- MD5 7fe2db30684ba5d53696852dee39d57f
- SHA1 875bbc042994821fd5736cabd893ff9c6941c46d
- SHA512 c42fd0b7c8f3a9a70ed49019833296c13f9bd82c54c347813067d22fc4569b0291018842990d59a00db9855e967a292ec8bea46a8912a0ae566865fd2aa3e67a
- SSDEEP 12288:p69+uLRXIViQ+iuxuriQMjodUw3Jih4kZTMgBAR5+N1X1MRb0RwhiHix+bq:w9+uLaVDnuxur1MsdUw3ynZTMgjm0Rzq
- TLSH
  T1CF2664873E4D75A0E02DDAB748E6341F243D385929D37D8B72D86F909B725082FCB869
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral3
- Target
  Craft2vrm_Data/resources.assets.resS
- Size 341KB
- SHA256 ccec7c13930ba7f896e444ad8a6abdbf6abf13c1ee97a56c5664412ac573c711
- MD5 26e02cd74cc64984c3a75d7e461158e8
- SHA1 83b3040d025e58a3a5ac869aa81c30db075d69c5
- SHA512 67c05476ff38c96fe44b215e7e8c0051e8583740a548a6a47bc3768ea4cf23b3690815e4f9c6a7fe9fe2b60865888253f917c4cc11ff2b73f662a73b83ba2b1a
- SSDEEP 6144:tr3IfpO4HvjoSRO1vPq3Fszy1eNYwfRWDeegPA/zRcex:fl7PyzRLx
- TLSH
  T11F7441419FA9D4BF9281182F9A3694F0D04F5BFBC31C3FD32B7362479267A920615AD8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral4
- Target
  Craft2vrm_Data/sharedassets0.assets
- Size 6.0MB
- SHA256 274bb4d55e1ef4c9472f7ce678762f28f0f15981d739b8132e3b357a31e3f5b3
- MD5 3e633b6ffc1814950cb1535bccf58236
- SHA1 bfcaead6a5ce441409e6e8ee92f16d9f0814e0f7
- SHA512 96e5fc6be849b6d06d8ee7a0d975e42e39bac4b465f8bb42d6c2321e570b1350f1680edf604d6f0419851cf59c45c48fbdfc34885d1212c5f8cc2567605f833c
- SSDEEP 49152:KnTJQMxHfMdMzmIBxILk5t6pGKsEO+jrltjUcHDIPYFkSzUtkpnBxIadv5Q4oay5:Jym4mDWkLpKdD5jMlbsk5CP
- TLSH
  T104567CA3464C3D6DED22AA3C954128A4F14E90199FD6E3F2DAEFFC2D09E25054C18FE5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral5
- Target
  Craft2vrm_Data/sharedassets0.assets.resS
- Size 9.5MB
- SHA256 e97a5216512a9ead16dfc8f37e65dfec615b72f278b8e4dd030d1074215dbf27
- MD5 26320708a3ed64fd7a992a1c39649a3a
- SHA1 df03f7075a54b501212830ed47fc2446b9793faa
- SHA512 c807a4cf18160202f22aa7154a919b6cafd15cf8e1bd1641cb6ea6d865f8c580178c5d75f1721455cd71860e6bd44dcf3d234659f5a197bb311ee41bcbcc7c51
- SSDEEP 196608:z9OLEsS57hycs6QNlob7wKV/xqighJ7sGqRiWQmNeUbQK3uCnX:z9OL6hycs6mubse/xqjqRiWQmNeUbQKr
- TLSH
  T10FA67DE84D30EA3BDB1DD1398439AEF8D26C44F4E72969B3643AFCBA15B325111141AF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral6
- Target
  Craft2vrm_Data/sharedassets1.assets
- Size 4.5MB
- SHA256 ad25aa000d3405a98826aa635cdb53580c6c64315892eb7e99ffc34f6c4b8e14
- MD5 e82c6ee41e56b14e2ebadc18772e8287
- SHA1 8d485cbc118a59ec7667b0c933ec8882506c1800
- SHA512 3c03c8580a488f1f8c01e0795b03209b8668691f661a51b0fbd67a5b788fe7a04ed643b10d9e199ac53dafaf89b88606d81be1ee47be78d86668c7027e623037
- SSDEEP 98304:Ynllp/Umw/B1ionRVrvbFNKEoKIG/bZbFHB2SBgKpRh3T:slldtw/B1RbRNK5KI2HHBPBg4RxT
- TLSH
  T1B326027679D86808CD63F33731439E3AE659E88C846FE1F5A5639FBE3DE12140B29241
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral7
- Target
  Craft2vrm_Data/sharedassets1.assets.resS
- Size 40KB
- SHA256 741078c5dfe8a24b0d9f39e235ddb4909c99b122ab79dc6ba0cb415a2b2df902
- MD5 690fc7109491aa0d5123986f18211c94
- SHA1 f853dc5188c76f6f3565d046ca342499e6ac9122
- SHA512 696c3245d9baa7e5b94e54917a7a7cb3084b89acc094afa2d67e674c8b152fbf608e0df794e7fb045e583896d061081d759f78424b0743971d419281d5983948
- SSDEEP 384:PY9tC1SpaT59uut92Ai9G59dwJA0YAC+qL3xxt:grC1SF9C+q
- TLSH
  T11803E143E682C5AFC0982AFC903A79C2C8AF95BDD3015EE1617B5C26B5435339A521FF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral8
- Target
  Craft2vrm_Data/sharedassets2.assets
- Size 137KB
- SHA256 d37ec401033866a07632e1b16460ce7a832094f680449a9bfe959c4f4035480c
- MD5 d4a88d5cd347a2ef11b94a240386444c
- SHA1 d5bf3d8b24804a82648c9a61a3e3eaf9756cfcf3
- SHA512 e68b9af2303018015f52ab22543c6a37633847baa08b252f3f11a2d963eda635052238d17caee5b6f4254eba137cd1ccdca09994e38ab3360ae4e4997e8fc286
- SSDEEP 1536:/+FXMBGMBl02x7zTdoXB84LFJstQLtfHzDmD9Q2ostQLtf2lhD:wGzTdoXq4LFryJjr
- TLSH
  T1C6D3B546B54A898DE239333B08375F51CE26D8CC0A3D6A337BB4E72E0DF178E1959265
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral9
- Target
  Craft2vrm_Data/sharedassets2.assets.resS
- Size 93KB
- SHA256 884a68aa9f5b10d087ebf3e67d720557d65971c8f5a10efb5c27628a06e99d7b
- MD5 fc6b4f9f49dc3f9cfa5dd3ff86985736
- SHA1 fb46d0daad84c36562641484fd6f9f34f0a6bc3f
- SHA512 0e0175b437095aeb2b66e73cfd2c673fc85c168ed0a750d1a35d1772732ef81d541dbda8384f9f1d41bc43a382765927fcbf63d8fd672f004eb5a337e4e83ba1
- SSDEEP 384:ClEbJNqNP79bJb9lEbJNqNP79bJbhpALNsyKFpALNsyKgGiGwnPnwYAC+qLtY9tn:ZGiGF9C+qmrC1Sd
- TLSH
  T136933782D546D67FC0A41CB4D43675F3986A1CA6D2057AF3703ABE18B6B74268E201FF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral10
- Target
  MonoBleedingEdge/EmbedRuntime/MonoPosixHelper.dll
- Size 596KB
- SHA256 3779dca29147e1c8b92668b9b3fe1b906746814b0efaec877ac9e4e42f386329
- MD5 e2864a07b20fa1d162513ee00a405686
- SHA1 e80ded267718ec29c3979956e5d0bb670ec43ace
- SHA512 6349653be7b944aef6ed32bac881e622cfcd5748d515a9e70883abe1c04996ec15e3132247d0a6d1e2ab116024ca8c5c81f9147b668e26425858d36b07d12982
- SSDEEP 12288:8OmYAmdeVH9Mwe9Ek/7jY4hOTBPyfBGan:8eAmdcMj9Ek/7jYSOT8Fn
- TLSH
  T1BBD47C56B7A402B9E577D138C6834B5AEAB27811572093CF03A897AB1F137E11B7F360
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11
- Target
  MonoBleedingEdge/EmbedRuntime/mono-2.0-bdwgc.dll
- Size 7.3MB
- SHA256 4bd841befc8c48daf78d9a154dd975eee9edcb006c3e7ac705a2466126b81847
- MD5 5eea189503043245416fc2e6b4ab39ac
- SHA1 98049b6f5e734dfc1900e55752525f944df6c13e
- SHA512 fd2afbbdd00e07215f9ae7afb0bd07ad124f72e8dd66f68400cfd69f3c6d4c2949e67c255557aed8c21950fe16e7fd2a4f3c567a82566490576ca6dce0233595
- SSDEEP 49152:3fXB26GzglFGEhY5arYaqaEaslMUUFW4hhp/wXalV/HsOqn4yCeausXvMFCPAKCe:TIIG7NuFWFCMOSvX3dKCQGtl83vzIkd
- TLSH
  T1F8766C5EA26A0069CCABC23CDB675B73C675740443306EEB46905F6A6F23AD5533E3C8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral12
- Target
  MonoBleedingEdge/etc/mono/2.0/Browsers/Compat.browser
- Size 1KB
- SHA256 8a1082057ac5681dcd4e9c227ed7fb8eb42ac1618963b5de3b65739dd77e2741
- MD5 0d831c1264b5b32a39fa347de368fe48
- SHA1 187dff516f9448e63ea5078190b3347922c4b3eb
- SHA512 4b7549eda1f8ed2c4533d056b62ca5030445393f9c6003e5ee47301ff7f44b4bd5022b74d54f571aa890b6e4593c6eded1a881500ac5ba2a720dc0ff280300af
- TLSH
  T1EA3171A238DCACE0ED7300B3FA1F14897F1A897F5B8A1505748BA1560B019B443BB39D
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral13
- Target
  MonoBleedingEdge/etc/mono/2.0/DefaultWsdlHelpGenerator.aspx
- Size 59KB
- SHA256 751861040b69ea63a3827507b7c8da9c7f549dc181c1c8af4b7ca78cc97d710a
- MD5 f7be9f1841ff92f9d4040aed832e0c79
- SHA1 b3e4b508aab3cf201c06892713b43ddb0c43b7ae
- SHA512 380e97f7c17ee0fdf6177ed65f6e30de662a33a8a727d9f1874e9f26bd573434c3dedd655b47a21b998d32aaa72a0566df37e901fd6c618854039d5e0cbef3f5
- SSDEEP 768:6CEPutHjvpMgMwP9h5Ij7khsp/6JtEZwMXVtkUI3t3CXyEyk3VbNbqDvJ4oT1y:/r6CdsCOZwMX3k5dWyklh+Dvbw
- TLSH
  T18C43C4A0EE5C8D36499B52D9F48140DCB9BCC43191299CF3FCDDA12AF09CC6DA278676
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral14
- Target
  MonoBleedingEdge/etc/mono/2.0/machine.config
- Size 28KB
- SHA256 e91782a27fa39fc6c1d6ee8b08529f5d35052310d0006034b878eb04b8f2af30
- MD5 5b791b8493c4e9a55d8c5ee522ce1cef
- SHA1 3fbcec786ac4b6e81b6d2f2ab288cf67dd6760f4
- SHA512 40c5d52de86c42512cc5c4863d14c1a374e95057de73bef11f7cb60f5445994ff5b979099f721e71853569dd5efbc373efba22107fca4a1e9a479589d4a10386
- SSDEEP 384:PbBtBtWR5RwRqrR2RN3RPfRaRvRyRaRIKbX/y4RpQXWBI43g:DuA
- TLSH
  T1AED203703609BDAE494227235C54FAC046BF57196BA86D0CB5FF625CFE2688B93032D7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

adware discovery spyware
- Loads dropped DLL
behavioral15
- Target
  MonoBleedingEdge/etc/mono/2.0/settings.map
- Size 2KB
- SHA256 49c6160f9d54af4270a3b4e997fc4a8301f79b9e2070118fa46ddbcbbc44f9a2
- MD5 22c818a23169e12bd3c8587b6394c731
- SHA1 dd2be2dbccd34736719301aee92429d4258ea5a0
- SHA512 c1352e817e01277413a1790a94a4f979dc1b8333874fef28d735441c034c97bf8ce501fd9cd04c47d25541a0c1d54fcd4dd3bee9ac3e8fbde83ada9a1d2662d7
- TLSH
  T1D3511138F708B5F50682052EA45A94D243B6023FA779495C71ECC13D6F2684B83B32DD
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware discovery persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral16
- Target
  MonoBleedingEdge/etc/mono/2.0/web.config
- Size 11KB
- SHA256 cf2b54339e069b9e42f7d6795eecbf562c50c1011f4ca8f65f578fe52d97ff92
- MD5 dc6dd6d8d1fc74e76c84b0b38dc6b1e3
- SHA1 574e4b24015852d45ac80dfce8af3c6fd4a4f09a
- SHA512 c835136bf7c203f7ae19c4aae5fb456b1d25b32e3664494be74b11cd9addf647cc256d47e1e5ba99a59638d714e9d43c6be732c2b6d6de60e77977e99bf5ec7b
- SSDEEP 192:wcedeaZSsEMYaWN5bs6yyzEVkEYEG/Z1f5v6CuCCrtQzPwkP/waeKjy:wp5YaWPs6/1zwya
- TLSH
  T10D32BD34171DEDED8B905A530420ABE162BF9B5A2744CD4CF1EF2329EB9548BE3611E3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware discovery persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral17
- Target
  MonoBleedingEdge/etc/mono/4.0/Browsers/Compat.browser
- Size 1KB
- SHA256 8a1082057ac5681dcd4e9c227ed7fb8eb42ac1618963b5de3b65739dd77e2741
- MD5 0d831c1264b5b32a39fa347de368fe48
- SHA1 187dff516f9448e63ea5078190b3347922c4b3eb
- SHA512 4b7549eda1f8ed2c4533d056b62ca5030445393f9c6003e5ee47301ff7f44b4bd5022b74d54f571aa890b6e4593c6eded1a881500ac5ba2a720dc0ff280300af
- TLSH
  T1EA3171A238DCACE0ED7300B3FA1F14897F1A897F5B8A1505748BA1560B019B443BB39D
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral18
- Target
  MonoBleedingEdge/etc/mono/4.0/DefaultWsdlHelpGenerator.aspx
- Size 59KB
- SHA256 751861040b69ea63a3827507b7c8da9c7f549dc181c1c8af4b7ca78cc97d710a
- MD5 f7be9f1841ff92f9d4040aed832e0c79
- SHA1 b3e4b508aab3cf201c06892713b43ddb0c43b7ae
- SHA512 380e97f7c17ee0fdf6177ed65f6e30de662a33a8a727d9f1874e9f26bd573434c3dedd655b47a21b998d32aaa72a0566df37e901fd6c618854039d5e0cbef3f5
- SSDEEP 768:6CEPutHjvpMgMwP9h5Ij7khsp/6JtEZwMXVtkUI3t3CXyEyk3VbNbqDvJ4oT1y:/r6CdsCOZwMX3k5dWyklh+Dvbw
- TLSH
  T18C43C4A0EE5C8D36499B52D9F48140DCB9BCC43191299CF3FCDDA12AF09CC6DA278676
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral19
- Target
  MonoBleedingEdge/etc/mono/4.0/machine.config
- Size 32KB
- SHA256 e60aec2c5115d65b3acb3c55ea21576dbd770f579166c017125571e46ae560ed
- MD5 32bf879734966ef6659d914a217691e0
- SHA1 7a9bca61e6af9ad720da1d7d24192637d9037886
- SHA512 2dac20c7daef07de93513366d8fd22eb10a6c5d62dd2142ed3b1c485d1b916afd4c8e93045e9badac6e902ed58bf937dbe19490a7d2b5c408ed185271f5115b9
- SSDEEP 384:PbtltttttSRtNRtcRtGrRtSRtBDRp5Rt70gRt2RtTf1RDRty6ugyunHMSeuWuGR0:7K3
- TLSH
  T129E2F1703609BDEE08432B235C5499C447BF57096AA86C4CB5FF725CEE2688B97132D7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

adware discovery spyware
- Loads dropped DLL
behavioral20
- Target
  MonoBleedingEdge/etc/mono/4.0/settings.map
- Size 2KB
- SHA256 ce1db1ad8a9512073164e3eccdc193f7eda036e1a9733caec4635de21b2865c8
- MD5 ba17ade8a8e3ee221377534c8136f617
- SHA1 8e17e2aec423a8e6fb43e8cbe6215040217bb8a3
- SHA512 c18bcbcbd4b9a20a72b1a934d70db1eafef047f34f3ba2c6357d8e3afed07ecaab861e5571ceb58c22d4d3e5ebb34b51e366a0553c3153fbc263d1d80472e297
- TLSH
  T1DF511238F748B5F50682092EA45A84D243B6063FB679499C71ECD13D6F2684B93B32DD
- MD5 SHA1 SHA512 TLSH
Score

7^/10

adware discovery spyware
- Loads dropped DLL
behavioral21
- Target
  MonoBleedingEdge/etc/mono/4.0/web.config
- Size 18KB
- SHA256 e38bb8cc68fe5b4edecdfd288d094b9e8ced7629039b2a347682aba0d8bd7492
- MD5 d081581e16b06480a5aaef8cdfb305ab
- SHA1 771648fadc7ed9a422b4bc26e38d854d066742d7
- SHA512 6312269cfd726a991e574b1da0c3b8a2978b248118c1610d4e8791e83f3aa6d42bdd1f4f81850eaa94c026d51e73c515971a58580cd9dfbbcadf9ba0584749c4
- SSDEEP 384:lJJuAr8F1mJ1ayCk5+H75YaW41DBWTwahst/tlLvSqwwU4FVXaS7L3nHIXYFXc//:jbEJX91Xbi
- TLSH
  T183820030472EDEDE8E522B9354208A9272AB575B33449C8CF1FE2365EB46487D3321E7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware discovery persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral22
- Target
  MonoBleedingEdge/etc/mono/4.5/Browsers/Compat.browser
- Size 1KB
- SHA256 8a1082057ac5681dcd4e9c227ed7fb8eb42ac1618963b5de3b65739dd77e2741
- MD5 0d831c1264b5b32a39fa347de368fe48
- SHA1 187dff516f9448e63ea5078190b3347922c4b3eb
- SHA512 4b7549eda1f8ed2c4533d056b62ca5030445393f9c6003e5ee47301ff7f44b4bd5022b74d54f571aa890b6e4593c6eded1a881500ac5ba2a720dc0ff280300af
- TLSH
  T1EA3171A238DCACE0ED7300B3FA1F14897F1A897F5B8A1505748BA1560B019B443BB39D
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral23
- Target
  MonoBleedingEdge/etc/mono/4.5/DefaultWsdlHelpGenerator.aspx
- Size 59KB
- SHA256 751861040b69ea63a3827507b7c8da9c7f549dc181c1c8af4b7ca78cc97d710a
- MD5 f7be9f1841ff92f9d4040aed832e0c79
- SHA1 b3e4b508aab3cf201c06892713b43ddb0c43b7ae
- SHA512 380e97f7c17ee0fdf6177ed65f6e30de662a33a8a727d9f1874e9f26bd573434c3dedd655b47a21b998d32aaa72a0566df37e901fd6c618854039d5e0cbef3f5
- SSDEEP 768:6CEPutHjvpMgMwP9h5Ij7khsp/6JtEZwMXVtkUI3t3CXyEyk3VbNbqDvJ4oT1y:/r6CdsCOZwMX3k5dWyklh+Dvbw
- TLSH
  T18C43C4A0EE5C8D36499B52D9F48140DCB9BCC43191299CF3FCDDA12AF09CC6DA278676
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral24
- Target
  MonoBleedingEdge/etc/mono/4.5/machine.config
- Size 33KB
- SHA256 ee950004b576fb28dc85f4b0435ed04bf96612de2e8b53be84d07afe85a0de6c
- MD5 25ff1ec49e3ac9285bd943cf036bd813
- SHA1 392e5ae6b3dad59418bda890952ee27a8b290e90
- SHA512 e4659f07893c8e6c737eed5711acd32c84bf595a6953631d960305434d3e40c73867f4d84ad0b62b167e3bd9631150dcdefac03a23198135a44d3a2f011f9b3c
- SSDEEP 384:PbtltttttSRtNRtcRtGrRtSRtTf5Rt70zDgRt2Rtuj4f1RDRty6ugyunHMSeuWuN:dk3
- TLSH
  T1BBE201703609BDEE08432B235C6499C447BF57096AA86C4CB5FF725CEE2688B97132D7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware discovery persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral25
- Target
  MonoBleedingEdge/etc/mono/4.5/settings.map
- Size 2KB
- SHA256 ce1db1ad8a9512073164e3eccdc193f7eda036e1a9733caec4635de21b2865c8
- MD5 ba17ade8a8e3ee221377534c8136f617
- SHA1 8e17e2aec423a8e6fb43e8cbe6215040217bb8a3
- SHA512 c18bcbcbd4b9a20a72b1a934d70db1eafef047f34f3ba2c6357d8e3afed07ecaab861e5571ceb58c22d4d3e5ebb34b51e366a0553c3153fbc263d1d80472e297
- TLSH
  T1DF511238F748B5F50682092EA45A84D243B6063FB679499C71ECD13D6F2684B93B32DD
- MD5 SHA1 SHA512 TLSH
Score

7^/10

adware discovery spyware
- Loads dropped DLL
behavioral26
- Target
  MonoBleedingEdge/etc/mono/4.5/web.config
- Size 18KB
- SHA256 c4cbddd4fd9347b58cc5a72b36dc4ba1ad2bb699e65869d05cd3fb9865f0d824
- MD5 5075af18fe1d2b5f9555d5cc68029814
- SHA1 56c4c47501664bc3bcd54be505cc3d9f7d0761f5
- SHA512 dfe8ed72b013e67c3cf0622cfe7d14ffde97a4d7132ca6690db5cf2d347f3535b475119b01984923ff6c3f39b8865f857c67ed465c3b0358e2fd06bb0dae0909
- SSDEEP 384:lJJuAr8F1mJ1ayCk5+H75YaW41DBWTwa6st/tlLvSqwwU4FVXaS7L3nHIXYFXc//:jbEJi91Xbi
- TLSH
  T12A820030472EDEDE8E522B9354208A9272AB575B33449C8CF1FE2365EB46487D3321E7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware discovery persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral27
- Target
  MonoBleedingEdge/etc/mono/browscap.ini
- Size 304KB
- SHA256 4ddd50f31fb968f30bedefc253a46dc3f2890192d05cdaa9e0a64a056eee807e
- MD5 378be809df7d15aac75a175693e25fbb
- SHA1 2d5454e161de8a5b65910f27bd70d9d0ad8fa476
- SHA512 d0d181e806cbd2c016eb0a8786f7d9db877463eaac0195db4e891be111c9ed87491a1abcfa0d9ed7c2743e004e1f4a3f4789333d0b535e63358c672ae833c363
- SSDEEP 1536:D+dN5JLXlU4XteKJeYPMxBUm9huPj3bkeoO3cTKr0AzhjRzi0v5XfDlVlvr778BN:DYPEBOPjLkeOTA0AzhJMutEbbt0oK7M
- TLSH
  T18364FCC27495A47A9135DF3234F2D34957B39B9A8CBF9C4CD8628810DE61C0653BBAF2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral28
- Target
  MonoBleedingEdge/etc/mono/config
- Size 3KB
- SHA256 107b0d888b6169bb0e51205e967d88fa82899cc6f66bde54ef9b70169dc43b1d
- MD5 ced30438c7663df1f57af23bba624460
- SHA1 e02a718d8e6efb74bd8bbf70a1d6bc644055f39f
- SHA512 925d2b0c356d86a2a193de997daef501359445df226a386994716867f891255316165e3bfa4c9546a508f29c0b579dd78218a1d96cf4e891e76c74394838920c
- TLSH
  T18F71EAA7F26C88F871612A6592FFFBDC41B380A4DD3D2005AE51DA011927F9BC953AC7
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral29
- Target
  MonoBleedingEdge/etc/mono/mconfig/config.xml
- Size 25KB
- SHA256 0c56e34c69124510fa8c19e7b4c2ca6c1c4ff460ae19f798dd0ca035809e396d
- MD5 f34b330f20dce1bdcce9058fca287099
- SHA1 936520d5bb5c00a1985d7a4c4f0ef763a9031862
- SHA512 d6d4a8321eb44c117755a41a2590296be86a0568d27a5347f9d7f32f2d151d8f7e169675c83faed2dab5ad0f8d81858f8cd1167e439cd4bff7e68c243e3544fd
- SSDEEP 192:Bt074zTxASaKp3T7pJsPpPT8B13eeaVonGdEBMmhVbeyeTfWDBzmAwdavahmhNIa:LAMDp35JyPCCu96yJwgag
- TLSH
  T1E9C25025B9FC9DE7050240236E61A1969F7383B7527C3808B0FD63989FAA54743932FB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

adware discovery spyware
- Loads dropped DLL
behavioral30
- Target
  UnityCrashHandler64.exe
- Size 1.1MB
- SHA256 4dac68e4963d66b9e46a4a744dccc9e701435d494f28daf8ad9c684197462689
- MD5 58656bc8a06b489699f9e2761f8a7554
- SHA1 05807de10bfc58d85d4058bac0e3b9907c330c4d
- SHA512 e5243f665c9c962a0d430c862b00831c1f1ad16da14ce947009bf8348a41cb02bd1320e2428f8cf95c25c28fcceb5ab178f0a140f924fdc6d8d5927252d3b64f
- SSDEEP 12288:d7Ykuv/yAneQI+PmCgakRstNlTZUAfWNMhTTvfoDxCaFwQfz2fzA3I:uv/yiHuCgakk34MhTT3Oz3z+zA4
- TLSH
  T1BC357C6A6AA800F8D5678139CA56890FF2F27C1503619BDF1390B76B2F376D51E7E320
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31
- Target
  UnityPlayer.dll
- Size 27.5MB
- SHA256 7bc696e2ab761289570ae0fe72094ab898cefa35dad0a7af5a8b8636fcb3b3c6
- MD5 31ab2def19e116c8c8314ba8cb911afe
- SHA1 8fbba04d0b36178469a6f9f6a19a293042e91459
- SHA512 1c70b0608140978869f1e09306f281b6df901f11327efd73c8a702d3dde6cdd95dc55470c7edd5f456e0e628403c166682ea572c5276742c1ed7d83624cd5763
- SSDEEP 393216:OnT2//D5YmJvk1MICwtE4SX//W7AOPiDgr2Jdj27qDZZpqNUg1cSRfTLJuMX0fU6:Oo1dCP/8JDUr3jff6
- TLSH
  T102579E9562A840E8C47BE078D65BA90BF771304A033186EF13E146A96F77BF01ABF751
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Resubmissions

Sharing

General

Malware Config

Targets

Loads dropped DLL

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Loads dropped DLL

Enumerates connected drives

Loads dropped DLL

Loads dropped DLL

Boot or Logon Autostart Execution: Active Setup

Loads dropped DLL

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Loads dropped DLL

Enumerates connected drives

Loads dropped DLL

Boot or Logon Autostart Execution: Active Setup

Loads dropped DLL

Enumerates connected drives

Loads dropped DLL

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32