Analysis
- user interaction
yes - max time kernel
149s - max time network
127s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
11/05/2026, 13:52
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
angry-birds-parasite-2.0.exe
Resource
win10v2004-20260130-en
3 signatures
150 seconds
General
- Target angry-birds-parasite-2.0.exe
- Size 22.1MB
- Sample260511-q6e4eabw4t
- SHA256 3550bdc53ef5e3a11a41f1cd882417c6fdcc32cab82c2aa1814d0a6cda9e4d84
- MD5 bf5a00363f5b9994dd88bbbc41d339c9
- SHA1 bc2cd27b936d08a08fe53d5c53521e484936d487
- SHA512 f1f3a112f70283e6c60e9c28028c7fc60efac29872673ddfe2971c845c5e39715d69f3910594a0ec13ea96a4f4ee2324710d25372d48170546e77b0d4631a5ce
- SSDEEP 393216:mN3eETMN7A6k35rHAhetMIwTyT6kPsVwuEjhhad43/H7sDZF:mN3eETMN7o5rHkeqIwWTJuDy7sz
- TLSH T1AA372313BAD58021D4B11071C5F9AA62166DBE3CDB26D7C792843F693A376C35B383E2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Loads dropped DLL 14 IoCs
pid Process 4636 angry-birds-parasite-2.0.exe 4636 angry-birds-parasite-2.0.exe 4636 angry-birds-parasite-2.0.exe 4636 angry-birds-parasite-2.0.exe 4636 angry-birds-parasite-2.0.exe 4636 angry-birds-parasite-2.0.exe 4636 angry-birds-parasite-2.0.exe 4636 angry-birds-parasite-2.0.exe 4636 angry-birds-parasite-2.0.exe 4636 angry-birds-parasite-2.0.exe 4636 angry-birds-parasite-2.0.exe 4636 angry-birds-parasite-2.0.exe 4636 angry-birds-parasite-2.0.exe 4636 angry-birds-parasite-2.0.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language angry-birds-parasite-2.0.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4636 angry-birds-parasite-2.0.exe
Processes
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\mrt241D.tmp\Box2DBase.mfx
- Size 284KB
- SHA256 286605641cdba584c563d7241c106bc9ea9d3e5a22028ed92e7f5cabd33e1e4b
- MD5 15c1f5c080b99d1ea6f3b70c7a69af8c
- SHA1 79e85e2d054dc6a07c0f9f611978e129e98ebf69
- SHA512 c540e8a1d1dfb60daec7694ff0f1cad210f7a061f80f6aea1a507b172a6295960c6ceaf80a808d1f752ec0ad8e4e97ad9941fd85c3926a4351095ae00aaaf1c7
- SSDEEP 6144:SOO4SN6lOpxdcf8Ic14MWh2AWWDXARdgQ82XOle:SOO4SNJCEIc14VhdW3MQ85e
- TLSH T1E6544B40B5B1C1F1E56A2975B968722B387D3D640B38C4CBA3D4458ECAF42D05AF6BB3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\mrt241D.tmp\Box2DStatic.mvx
- Size 115KB
- SHA256 7e93b5cb2042e2b2940fceb4b923bbea8005acc6024db044d90f1d7b283ada0a
- MD5 f1bc91e391c8526976533bffda783e33
- SHA1 db42f9049cc787c0cfa9abfac3b42543f3761cf3
- SHA512 65afee345ee3e2c1e60ffbea30b57d264ad5bc4e84c58f29147ecb2c240d2f974e1662ff951b7511fbdb38ffdccb2ea36a12957b0b7399f06280c7127f0a6313
- SSDEEP 1536:i9bB4q4jLPt8LlwcE67qiEuVcXOcPqR1msWjcdWulMUsrE1SamC8saZ:ihB4qkoS68bEJlMUsrE1S9C9aZ
- TLSH T188C3391132E19075E4FE1A3968749A214B3E7D71DFB8C98B2B94068E4EB47D09E35B23
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\mrt241D.tmp\Layer.mfx
- Size 122KB
- SHA256 9e9d49c81e02cdef2ea10f53fee958bb750a96e7567d680f86202f0e28e267a8
- MD5 8bba7602e13f66901207e4d7bdc99ff2
- SHA1 7efda2baa3eee70df450110bb89d934417bec3e1
- SHA512 7f31819c1ac931ff51df57b1ee0bad9a6d22c97c0e0bd6fdfc1bcec990f1c581773e90b3af609c734f9248736fa663136573298c9e0c5873307180cd2b9beb20
- SSDEEP 1536:NaGgvf+Q3Mmx0FnYGRPpnNm6prmICndZac8VkRyvsWjcdV+8OfDh+eOsadq:NaGgHf3i/nmICdZueV+vfDh/OtE
- TLSH T131C34A1176E19032E4E317325D786A520ABEBD22FB75DACBA34C014D5DB03C19B39BA3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\mrt241D.tmp\mmf2d3d9.dll
- Size 1.5MB
- SHA256 bddda991185a9e83b9855a109f2fcfa78cd2d5402e9db344c6ec77f6ce69a0c5
- MD5 c85bcc9f3049b57aa8ccbb290342ff14
- SHA1 38f5b81a540f1c995ff8d949702440b70921acc5
- SHA512 5097f9d78ddc651aabf41f217f622ee656a1c6de6a9b339354525293102cf631cca2b7babaf991e99e49efe4d1bb6792c8a7a11f82e4ae2081c3961eb9b5afe7
- SSDEEP 24576:rYhBOKa6c8DVYrsz0LbMgPqgVmpiLfmVydmN/9KcAfcLacioayK:v6FjILIgigQrye8cqua5
- TLSH T1CC75BF11B681C036C4B73231065EA37562BDAF211A7495CF17883E7A7F745E2AB3829F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\mrt241D.tmp\mmfs2.dll
- Size 768KB
- SHA256 763ef4484ba9b9e10e19268c045732515f0ac143cf075e6d1ea1f5adcc77633b
- MD5 200520e6e8b4d675b77971dfa9fb91b3
- SHA1 0c583bf4c3eda9c955fd0d0d3ba7fdc62a43bf07
- SHA512 8b7bb334b6bd83ae43e5a4fe32a92b38b1edd2c292c4a540a54c2ee16092eb30108524c1c363508f7c62617bb224d9b447f07cda97ab7de01688acbfbacec51b
- SSDEEP 24576:OAN3eETMNlmLBNc/82oLOsy6rvPXPT1YI:hN3eETMNELBNczoM6rHXPT6
- TLSH T1E4F4AE20BDC5C131D6AA247286BDFFBE19AC66300BB455CB4B881E7A1F201D36F36657
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\mrt241D.tmp\mp3flt.sft
- Size 24KB
- SHA256 81c9a9459a8e124793addf142cd513945d6fe600e1d67f74897898d7570e56b2
- MD5 5bebc3ae0122702b89f9262888d3a393
- SHA1 064731c0f1d493b5b82921fa78f06e3d1db95284
- SHA512 c10cb520c2c4a9fe7c371f17ce7f86f138db247468ab1e465dafd7abd294c2beb13cf3a2595b4c8c820d911d8b70842c8f4e45398693c4f0454f973bd58a10a1
- SSDEEP 96:24znrBZKgkk1jqIU9my5F3TM+EXt0D0CZpMC07X7Xbw9pbcPw5KqQ+5lyV:24bXSIXy3IrXtafMCOIpwPRzElq
- TLSH T159B22B12B3A10CF1E55A5E322CE7027B6E75FB9917B4625B9F91C23D1C33901A81B573
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\mrt241D.tmp\oggflt.sft
- Size 130KB
- SHA256 9e589f86317d840df9bb74f6ee20c24ca65afe58f4009740382f63a0f5531941
- MD5 0c8c1ee3ba92189f4ce21d1b396a2765
- SHA1 b7daa4a6e16416151dccbb0a89f304961b6cb627
- SHA512 0a4339092ac55bac3b1bdfaaa3401020f8f49918bd2fdb14524f3d558eb840b876aedfdeb54a1da163fa36393abf3fe8ab7e112a34ea9d891e82a22e96c85ddc
- SSDEEP 1536:Ww+JHBmul5IMIPkmLnFfUs3OF+KQ51PGTUBHnEJj0AtDLPJwdMSIiRaEUsXxTTUI:CCul5jEkSbOF+31PGTUBwoA8uMR0IjD
- TLSH T142D39E529687A0FEE8CE1978146F367FDE261A0D7218CD539314EEF69C61E10BE1930B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\mrt241D.tmp\pinball.mvx
- Size 68KB
- SHA256 cbcd1b19716940cb7b48986dfd51f36bc9e04625c4b6face3822a16ed7b49825
- MD5 b208ae4e862a6c6bd6b99bc31b7bf1f9
- SHA1 9f7cd9ea0b400c63f11c0a6e7ca5546db7ff218b
- SHA512 8ee62a8fcdc26527a2f2b733eefb4fa629ce6ea4cf65d382d95af691874839e88cca8ceaa7e267dc69aa886bdce42c2f64d3cd0743d01bd6f8fdf825fc4e74a3
- SSDEEP 768:DuW1TEiVdAhKl5GyaUfZs5Ty2EcyDnv83Mw3nJ+XiB9Eah9R6rbv8JF4LyPlRzRE:DuuV8qNG5Typrk3MGJ+i9cM5lfv8
- TLSH T179637C12F2E180F2D19A03755CA54F3BA97EFD01CAE199D74F65DA0A1E32AE0D139317
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\mrt241D.tmp\waveFlt.sft
- Size 8KB
- SHA256 92a5053cf5973a6aa228c738d55387f12f1dfa8a837d7b938c60f05b6b56b3ad
- MD5 57ea61dd14314ef155e80c6a0be8a664
- SHA1 963b0ef2fe976ff77044a821fe1e29be4a8cf8a7
- SHA512 cc23cb30d76d22500c3ed7ce9ee0388588309d0779441b95559fce25a42f1eff52ca285c347655f8b33c15b75f9d2067738a151f81f605d3b563799a3a06c9a9
- SSDEEP 96:vLor1Jnr+4O1tLj+Ct2KTOGTrgHchhAfETVdnPstJgxl8V6N/8cKH+ewp:v26Dj9t2ubTVdGJgOcGvw
- TLSH T16FF11B12A7A500F5F8DD0B7134B7627BE875FA285B11C24FC580DE6C0C301E2D928BAB
- MD5 SHA1 SHA512 SSDEEP TLSH