General

  • Target
    geometrydash_full_archive_version_3.4.zip
  • Size 4.2MB
  • Sample260531-vm41msft9l
  • SHA256 6a6458d1fe876cf64da45bd4336fe7ffdeb4695fb6c4342d3bed327219a0e9a4
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Targets

    • Target
      geometrydash_full_archive_version_3.4.zip
    • Size 4.2MB
    • SHA256 6a6458d1fe876cf64da45bd4336fe7ffdeb4695fb6c4342d3bed327219a0e9a4
    • MD5 SHA1 SHA512 SSDEEP TLSH
    • Event Triggered Execution: Component Object Model Hijacking

      Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    • Modifies system executable filetype association

    • Target
      arm64/package.json
    • Size 1KB
    • SHA256 009d0741ba23bc75d8d2323208e01eaed1b14a2079d108d76c025cb10e4dd38d
    • MD5 SHA1 SHA512 TLSH
    Score
    3/10
    • Target
      arm64/www/data.json
    • Size 61KB
    • SHA256 1ff2dfff21d68bda781890aa3f58dc0b08c0b7ecd8bff7208cbc665be68fedfd
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    • Target
      arm64/www/icons/icon-128.png
    • Size 16KB
    • SHA256 56d66d35bdece8f0dfec0cefe56eec1e86fc9cc25d85eba0a935ec4b473fa7e6
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    • Target
      arm64/www/icons/icon-16.png
    • Size 767B
    • SHA256 1eaf0a704b39426ad07de694facd86c2a4d088f85b9f31b158e957a6ceff2834
    • MD5 SHA1 SHA512 TLSH
    Score
    1/10
    • Target
      arm64/www/icons/icon-256.png
    • Size 51KB
    • SHA256 6821df6550de140dce25822b400c3437c7711210e34f0447266b64b3cf83af3b
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    • Target
      arm64/www/icons/icon-32.png
    • Size 1KB
    • SHA256 73524e36b4d78e0f234cbdacdfb8e5032c7b8d716c79104acdcf12e9e6569b4d
    • MD5 SHA1 SHA512 TLSH
    Score
    1/10
    • Target
      arm64/www/icons/icon-512.png
    • Size 19KB
    • SHA256 adc611bf676cc4740aeb25f28fba8ffdc89f0d664b1676deb7d2a22aa55bfecf
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    • Target
      arm64/www/icons/icon-64.png
    • Size 4KB
    • SHA256 42697d5688a67798f1079da0322f2dea2b7b80f667e92416854f28cdb46688bd
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    • Target
      arm64/www/icons/loading-logo.png
    • Size 63KB
    • SHA256 952d8ebe316d4d9b1da2fa060d6b69280ea0bd349bbfe0ed9d7d6b7262d0517f
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    • Target
      arm64/www/images/geo-sheet0.png
    • Size 282KB
    • SHA256 bec5727a28d32788dbe7a3b257972b623a17c39f96fbcd798214cc0930fab29f
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    • Target
      arm64/www/images/shared-0-sheet0.png
    • Size 164KB
    • SHA256 a5631e5980ebca0b13aeb3e330d2d1c0ae677eac359ec83d031d0a3aec54f7c9
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    • Target
      arm64/www/images/shared-0-sheet1.png
    • Size 88KB
    • SHA256 27f2995733e2dfb3a9c140140d051c32e2c06e99aef580b09fee55df2b496441
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    • Target
      arm64/www/index.html
    • Size 925B
    • SHA256 c7dfaa22923341696c16a0522ee42e558c0f1135bb79d40b0db1099e3619d2a0
    • MD5 SHA1 SHA512 TLSH
    Score
    7/10
    • Loads dropped DLL

    • Target
      arm64/www/scripts/c3main.js
    • Size 52B
    • SHA256 eabe5a136cca6805a02fd424998480457d694ce96aa4c90db92896b75e886d09
    • MD5 SHA1 SHA512 TLSH
    Score
    3/10
    • Target
      arm64/www/scripts/c3runtime.js
    • Size 1.5MB
    • SHA256 e92feeebea83568b3bcbf4a8bd62e6995984b757944b23dee4b92d350a58a6fa
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    • Target
      arm64/www/scripts/dispatchworker.js
    • Size 3KB
    • SHA256 dad4c4dbc5a124550a43d497d829b2b5f38619febd0deee28bf136017a216723
    • MD5 SHA1 SHA512 TLSH
    Score
    3/10
    • Target
      arm64/www/scripts/jobworker.js
    • Size 2KB
    • SHA256 5beca2dcd2915b2846192c20913133dfaa5ad6263194b6ad0f02cf7642a7dd51
    • MD5 SHA1 SHA512 TLSH
    Score
    3/10
    • Target
      arm64/www/scripts/main.js
    • Size 128KB
    • SHA256 a89c8f6c84bc91efa661491053b1bd4fde2ab7d0d60ded3d272ae63464a694d6
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    • Target
      arm64/www/scripts/modernjscheck.js
    • Size 153B
    • SHA256 914af3dc0bb16c71e2be8fec8b8353fde0b4f8c49bcfd7c978020d7cf297ee23
    • MD5 SHA1 SHA512 TLSH
    Score
    3/10
    • Target
      arm64/www/scripts/objRefTable.js
    • Size 4KB
    • SHA256 c3b063a6c60fc2cd2df806fb10b44131fbdaa9a2d57ed6801f17a91a3e1cff7f
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    • Target
      arm64/www/scripts/supportcheck.js
    • Size 4KB
    • SHA256 6173f57586040a4937f752c81f8f30586fbc50a8426180e5f65b52cf56115b9a
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    • Target
      x64/www/index.html
    • Size 925B
    • SHA256 c7dfaa22923341696c16a0522ee42e558c0f1135bb79d40b0db1099e3619d2a0
    • MD5 SHA1 SHA512 TLSH
    Score
    7/10
    • Loads dropped DLL

    • Target
      x64/www/scripts/c3main.js
    • Size 52B
    • SHA256 eabe5a136cca6805a02fd424998480457d694ce96aa4c90db92896b75e886d09
    • MD5 SHA1 SHA512 TLSH
    Score
    3/10
    • Target
      x64/www/scripts/c3runtime.js
    • Size 1.5MB
    • SHA256 e92feeebea83568b3bcbf4a8bd62e6995984b757944b23dee4b92d350a58a6fa
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    • Target
      x64/www/scripts/dispatchworker.js
    • Size 3KB
    • SHA256 dad4c4dbc5a124550a43d497d829b2b5f38619febd0deee28bf136017a216723
    • MD5 SHA1 SHA512 TLSH
    Score
    3/10
    • Target
      x64/www/scripts/jobworker.js
    • Size 2KB
    • SHA256 5beca2dcd2915b2846192c20913133dfaa5ad6263194b6ad0f02cf7642a7dd51
    • MD5 SHA1 SHA512 TLSH
    Score
    3/10
    • Target
      x64/www/scripts/main.js
    • Size 128KB
    • SHA256 a89c8f6c84bc91efa661491053b1bd4fde2ab7d0d60ded3d272ae63464a694d6
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    • Target
      x64/www/scripts/modernjscheck.js
    • Size 153B
    • SHA256 914af3dc0bb16c71e2be8fec8b8353fde0b4f8c49bcfd7c978020d7cf297ee23
    • MD5 SHA1 SHA512 TLSH
    Score
    3/10
    • Target
      x64/www/scripts/objRefTable.js
    • Size 4KB
    • SHA256 c3b063a6c60fc2cd2df806fb10b44131fbdaa9a2d57ed6801f17a91a3e1cff7f
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    • Target
      x64/www/scripts/supportcheck.js
    • Size 4KB
    • SHA256 6173f57586040a4937f752c81f8f30586fbc50a8426180e5f65b52cf56115b9a
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    • Target
      x64/www/workermain.js
    • Size 3KB
    • SHA256 3bc13560c6cce96348aa6181968851d8830348aef5874d35ed6fd0c32e86fed6
    • MD5 SHA1 SHA512 TLSH
    Score
    3/10

MITRE ATT&CK Enterprise v16

Tasks

static1

Score
3/10

behavioral1

adwarediscoverypersistenceprivilege_escalationspyware
Score
7/10

behavioral2

Score
3/10

behavioral3

Score
3/10

behavioral4

Score
1/10

behavioral5

Score
1/10

behavioral6

Score
1/10

behavioral7

Score
1/10

behavioral8

Score
1/10

behavioral9

Score
1/10

behavioral10

Score
1/10

behavioral11

Score
1/10

behavioral12

Score
1/10

behavioral13

Score
1/10

behavioral14

discovery
Score
7/10

behavioral15

execution
Score
3/10

behavioral16

execution
Score
3/10

behavioral17

execution
Score
3/10

behavioral18

execution
Score
3/10

behavioral19

execution
Score
3/10

behavioral20

execution
Score
3/10

behavioral21

execution
Score
3/10

behavioral22

execution
Score
3/10

behavioral23

discovery
Score
7/10

behavioral24

execution
Score
3/10

behavioral25

execution
Score
3/10

behavioral26

execution
Score
3/10

behavioral27

execution
Score
3/10

behavioral28

execution
Score
3/10

behavioral29

execution
Score
3/10

behavioral30

execution
Score
3/10

behavioral31

execution
Score
3/10

behavioral32

execution
Score
3/10