Extracted

• • Target
    WaveLauncher.rar
  • Size 1.4MB
  • SHA256 2e36c4dca04eb40a84823d46703e1cbd81913f1f10ce7a9163ae22b702dd3823
  • MD5 f47ae33f041504dbd7a1b3f7d4c497d0
  • SHA1 69c52179fbf18954722b77484ec56e26be2477ef
  • SHA512 2008d754137ee712c1a136bdbd4a53703a2b9018cf0fa318b3fe1edf0809bc9fa1003330e12cc872728f81e149eb26fa33425f837b6620fe177d984999f2e857
  • SSDEEP 24576:RBKR3Wi57V9qIeJjrkZAoWF7EYsraOIbkfolLdYETCcz9otaWlE2Euewu4pCB:E335Pq7Jj3R+1rar0o/TCgg4ueypCB
  • TLSH
    T1BF6533B178C80248CE5FB77B49C894E32240837E5509B9315656AE93FAFDB4CFD25CA8
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral1behavioral2
• • Target
    WaveLauncher/LICENSE
  • Size 1KB
  • SHA256 53873dd0c41a38676a1be819b10d5ae45f319d033c92723d77c85fdda587b88f
  • MD5 036736de4faf3a67f6dddba8c335e98a
  • SHA1 2f4d7a4014c6ad2a71609bb3f87a63976b285c68
  • SHA512 18e5e130d194500d65bc1b596a3a82eb31d0b7a627aa8c22d9dc9d2e12fb762c18625f3104d0636dd3e8c4ad3dbecd5adb59110b9bfb46d8a87920a14ecdaed3
  • TLSH
    T1A611B51EB2600B72289B13A05578ACC5F23BB25F7A6F2A84146DF341233A06CC5FF840
  • MD5 SHA1 SHA512 TLSH

  Score

  1^/10
  behavioral3behavioral4
• • Target
    WaveLauncher/License.dll
  • Size 5B
  • SHA256 04cc5b3b49a7e9e9b6c66c7be59a20992bf2653746b5d43829c383fb233f88fa
  • MD5 b08a5c34cf0a06615da2ca89010d8b4f
  • SHA1 626a77d86d9d12d1772f788cf67c8e77fd9f797a
  • SHA512 5dce742cd0f649461b08f8f8018e0fa39ef19e813a74a91f434a15754a4fa8be83096e8fa49cf1828ac011220b7ad3724e7e4ea9cce7937a3168169d8e561b2c
  • MD5 SHA1 SHA512

  Score

  1^/10
  behavioral5behavioral6
• • Target
    WaveLauncher/Wave.exe
  • Size 1.1MB
  • SHA256 ca500fbbfc4f5879fa7cee1bfe1e52a46beb5fdecac60e1ac264560b1a8cb9e6
  • MD5 cb566b17cd21d9d885d8dafbb3c15dd4
  • SHA1 a23b776aad47f1b39645050c07a73211b943eba9
  • SHA512 63849706b0667b44c70f3499af105bf7dccd0925fabd1440483cb337ca74446e2657070c1265d953500f1db0a4eadb5b33b727805291d212236a8e99d6db232a
  • SSDEEP 24576:2XzSdpLuaKHng6yDvJbY/hHRbRghtQlx+nS8FtpDvbtz2hamTJCqq7:6HhyDv69Rb1ES8FtpDxmTJCqq
  • TLSH
    T1F34533D8511EA671C96F14F33B7FC64E060132EA4A95FA88DACE63C2A5F25EC23D40D5
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  credential_accessdiscoveryphemedronespywarestealer

  • Family: Phemedrone

    An information and wallet stealer written in C#.

    stealerphemedrone

  • Uses browser remote debugging

    Can be used control the browser and steal sensitive information such as credentials and session cookies.

    credential_accessstealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral7behavioral8
• • Target
    WaveLauncher/config/Base.ini
  • Size 33B
  • SHA256 226e2ed6957cf8d5d7be843556425a4e3da5c33d54407d2187f8105aaefc92d9
  • MD5 369e92a1f7a7ecedcaca7d7845cc3f74
  • SHA1 c001ef0b380bb783adbea52ef1d9061882122499
  • SHA512 8a06ca6b6cb92e5f79b4095b20f943a0a61f8049f4f4d7d3b45b5e09e5f9e9d2335baaaab3501a63037ea8fc58a80c7a51e24608bbeb2ca469e31e95e9928cb9
  • MD5 SHA1 SHA512

  Score

  3^/10

  ransomware
  behavioral10behavioral9
• • Target
    WaveLauncher/config/BaseCompat.ini
  • Size 16KB
  • SHA256 94084a0ac73f6e397fba74351fc98ee644885c44d65bedf66a67ffecb4f732d6
  • MD5 b668cd7e275f6e3bf027ff410c8c0628
  • SHA1 713690e6ac1fc6f99fe734dfa66cac849a840aaa
  • SHA512 836aa12515799d8ff2da83803e0f93bdb1c7b31031c74fc7cf6503422a04a971ff24c2ffededb61485fcbf271a6917ab117953d6a7962f814ef2116e72395ebe
  • SSDEEP 384:fM8lt+gBZBnSDAl1YtGOgEFnRqtrVsVBq6n/kDSXUFQY50VPQVbQaIavaGmaZG:D+wBnSDAl1YtGOgEFnRqtrVsVBln/kDe
  • TLSH
    T121726BE3A489045031277D6A793238327A7CE51851E7D9CAB47F1BC633C52BE8FBA416
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  ransomware
  behavioral11behavioral12
• • Target
    WaveLauncher/config/BaseDeviceProfiles.ini
  • Size 33KB
  • SHA256 ffe32a801774ea1db3649e24534458c00065037277f013c04add50ed19f6f00d
  • MD5 10ae9cfe530fb68319daa15ba1c3a8fc
  • SHA1 6a725189bf8df1288c4df0fd188ed3410ded2728
  • SHA512 6428827cf4ea92e604628e81b20d0bbde90125ff5a008aac1d700e8918ccc1e501613fdc22ea700ab4a45d734d53483be50bc04b15aac44f7c55375c09a2e9a4
  • SSDEEP 384:dkfI+LHANt2rulkjOFOQgNtvjOaO63vYcDbEyBoOWe0mp+Pwh0XeTfasQ/mzU+lv:dkZiBqbn
  • TLSH
    T14AF2D16777AC15379B2F3DC97C2926703961A971063F418E90E1AB3EFEDA84360C961C
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  ransomware
  behavioral13behavioral14
• • Target
    WaveLauncher/config/BaseEditor.ini
  • Size 61KB
  • SHA256 7a8e44e35da5d8d2e42f82442acfe40c23819a481832ee01e472034902d7c72a
  • MD5 82ab89c834b5f8e587eb723377e12048
  • SHA1 8add1949a3d406c252fcae39d83886af56b60cd5
  • SHA512 20ca2c1e2d4b8954387ac979088650c6a2af477a135ab1ea2d7e87506cb7a665eba916428ab43c98539ee56d9c2630ffb49883e5b895224d270e37dc4e6c393c
  • SSDEEP 768:B/ARjad7m1l21+glCDjCkcbdqdkMTLIt1rWbZmhQNzSkC7i4q1ZkhlhoohG+SHYe:BoRjad7m1lRohij
  • TLSH
    T10953E9F361868C1FC0565AB7D5F6B10904B1F39B09EC68A5C4F8669AFC420493B9F35E
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  ransomware
  behavioral15behavioral16
• • Target
    WaveLauncher/config/BaseEditorKeyBindings.ini
  • Size 5KB
  • SHA256 a80b5908d2a486d3f8eedad6de4a1de9c3c2d4f600bf6d5a336d91ee06df5e7e
  • MD5 00e7de2f4847edfac23383cea6a90cc8
  • SHA1 d1a52f754196704e4e23c904cea1edb4461c8438
  • SHA512 4f028a26044df61884deb6edb8e82e11f18735e13ef20efc997d705f472314d0aa1a7c8a226e478bc6f799f2d08a4cda9b801182605bbdc5115ac11a83092ae8
  • SSDEEP 48:4s53tIHK3tIHcm3tIHuM3tIHVP3tIHmx3tIHzq23tIH4DFQ3tIH9fI3tIHsFb3l9:4iIF2hcLSbkBuZdyn+k
  • TLSH
    T107B1B5F793126C4300B4255EDAEBA7C8A7DA337F463524C6C577EE4FA2A106036AC4B1
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  ransomware
  behavioral17behavioral18
• • Target
    WaveLauncher/config/BaseEditorPerProjectUserSettings.ini
  • Size 41KB
  • SHA256 7e6ee32858110980b859fdfe441dfa77fe631d85d33b98d326afe83eefdf9968
  • MD5 7076a6890d3560923e3ae1d3ba191872
  • SHA1 14ccd31d90f6cc1e913ea80919e9d3c29674870d
  • SHA512 17253daf10c0cde96752d7eaadc7d9c900382d203625ba32cbb451dc59c44c5f65520119da1826c96f2731898218674372191ca20406549db501b37056290492
  • SSDEEP 768:VLEINTUu+XR19nGdyqyMKeA4d4sUAWI9GYaakHHRiULSZ8imwo/bH4dhPPTN5nL2:pEnR1oyMKeA4msUAWI9GYaakHHRiULS6
  • TLSH
    T1DB1308266B074979C0AB8A83CDD77B9771B1329C05B7405BDAE8164EFC42D04A72F1AF
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  ransomware
  behavioral19behavioral20
• • Target
    WaveLauncher/config/BaseEditorSettings.ini
  • Size 8KB
  • SHA256 a76b680a5aed60ee35b09c35b658d92d7f85c117096c6e10ce01311b7423f720
  • MD5 fecb90733cecc045a416c3ca3f14a27d
  • SHA1 725978752f6e13aa85a348ce8e635d5c7cf74454
  • SHA512 f0905662e8809abcd8f34e446b48e04bf1abd8351d8d8c830019dd27ce22972125ffe43ad28b8526e47c4ba4c5d3814dbace90a6db9a919509f1fd8261927892
  • SSDEEP 192:VMnlCGKQ+28N8vv/tJBQNjtbXssNYWAdA8DWc:8lgQ+CPmNjtbXsmMCNc
  • TLSH
    T14D02B6B2A449C53731AE93A167C4A79B1298460FC6B2D22CA4FDA42CD0C7DD063B74FC
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  ransomware
  behavioral21behavioral22
• • Target
    WaveLauncher/config/BaseEngine.ini
  • Size 153KB
  • SHA256 241d7ee03ce03f1ab65e535dbf9cc3d8eb8699153f1ef177f0ad5dd8efed2bfa
  • MD5 20e5f3281e264dfd2d9fcbb6fa51f0fa
  • SHA1 a8dbbdaede03e791805d48e9027396257b3a7c9d
  • SHA512 0e06472a7b89bff3f5dc474207123e55b30d61dcc7b3efe9426e3ddb96c4753a75549032d2c0514e2a899f92ee5c09bf6df67415c4718f932324bc8bc2082bde
  • SSDEEP 1536:+SBCkfn5OkZX53ftqSiyh1olLWI5qs7ieWy1xAeU5GCg3Dnz1Y0nXpSrVWpXFVsW:+AD1olLd7xUZENxg2VX
  • TLSH
    T14EF3F97D73D1DD7749C6635AB827630622F0912F437D9C7CE2B53A45BC8F0042A6A2AE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  ransomware
  behavioral23behavioral24
• • Target
    WaveLauncher/config/BaseGame.ini
  • Size 8KB
  • SHA256 8de52c97a02d0e7534c29771287d1c22262d662476f42a04499ba815430c2d9e
  • MD5 afcf12792af3585089655c44a1fc0eb9
  • SHA1 0047879e31e3f5a9975a0055696d2af85a6a9f9c
  • SHA512 22f88092e17f1bd059210eb3d5dda10ba725b609b23dc4ec98d06b8ee7f217584d93fd51fac32aec45b33e6eee144531fc003b8e54b087a73147dab29bcf39ec
  • SSDEEP 192:csI/kW5yetWhSnARbRCRGjO7JKD97MZIurV9zX1jCnABcF:BIcW53tWhSnARbRCRm8BtX1jCnH
  • TLSH
    T10D02B5C32942896625AB9373FCE799112D3903C94013B50ADC9476CCAD8E711ABB72FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  ransomware
  behavioral25behavioral26
• • Target
    WaveLauncher/config/BaseGameUserSettings.ini
  • Size 61B
  • SHA256 cd92b03b5a94ead554160461a3faa9e8e1fdf52f37a23c000ebe1164fc28f90b
  • MD5 1db30560254dc359ff91940e10ddb1a6
  • SHA1 6b9f33e0f1b5e827028fc838c233259f2e389485
  • SHA512 2baf7b85a29f23460dae30e128ff42d46d91ebdffa36ee62d5d5dbfdf178729e4dce5ba9b9a30a1deb6365d36971f446f5084a40f307f49842b85626397131dc
  • TLSH
    T178A002F75597000D688F507304A2D0D9696544FD41A18EC55D86559A15DB8EC072BF16
  • MD5 SHA1 SHA512 TLSH

  Score

  3^/10

  ransomware
  behavioral27behavioral28
• • Target
    WaveLauncher/config/BaseHardware.ini
  • Size 4KB
  • SHA256 cc0eab873fa059d2cfdae0d6f85ef4e6f358207e689645c83b76562f635cdfda
  • MD5 f6ed8409da23b3060e5f94aa19aebbe3
  • SHA1 0bf89a10386753a1848c5d4a30c801d187ef6c38
  • SHA512 88bdbc9806f7eba3e234010786a2abe33884f1d146cae841d9beae855d78d49c90ac2de3ccce1e0050f5d226253214d26e843aedbc9ae257bcfed782b5bd6dea
  • SSDEEP 48:oPOKhARVa8bx9XSx+qpg9BmJ+FenqE4G+r4HKJY3brWHdrq89zn9uAedu8iD0/SQ:wmVaEnbqpg9BmsFmIYbrSb9wu8iQKqv7
  • TLSH
    T193A141CA4D4757F581B0C3E7E34721A6E3FCC28447BA9198A05A8217630A7AC976F7F0
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  ransomware
  behavioral29behavioral30
• • Target
    WaveLauncher/config/BaseInput.ini
  • Size 22KB
  • SHA256 ae00c724a485f2dbc9c8de02a2d8895e8d3b89cedb1abb3b9683653977e057f4
  • MD5 c7bcc54e2a29ff36f835d94e764bd905
  • SHA1 dc48080dd9f4d0231276c8275c98c2c4d700f128
  • SHA512 390aedd55fea45579a01abf347c552df96dec88c4d026ae34cfe9e1860f8e9a2637d516ebd2c958929ce6925f0f839842e7ed61a144fa074cfd1136ea2661347
  • SSDEEP 384:a1ruy4oANDpIhcNa0yuvIWWGLNmgwrA9ZDznNzgz:a1ruy4o2M+ryuyGLNmgwrAP3w
  • TLSH
    T1A5A2AFD4A9DC804F52F3867FEB2623C2CAD583961374AA530EBDB4BE21049CB195D8F5
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  ransomware
  behavioral31behavioral32