4533b738edcc59235ec1649b9dc29083897a3d98cbf12bc6b18fe58d0d2d3f8c

Sharing

Copy URL Twitter E-mail

General

Target
fqwejfu.rar
Size 86.2MB
Sample260602-lbe3psa16p
SHA256 4533b738edcc59235ec1649b9dc29083897a3d98cbf12bc6b18fe58d0d2d3f8c
MD5 2002f865fc0a202980f540db4deb1556
SHA1 99e6c5ad06d3634325bedf1a861f7d5bd8ce2d0d
SHA512 5a1f0e97b76fc9967cc30de4c7a023c01396051a687266539ad9c27f74b1653d7bee92dad6f599d873fa76cbc6056eb1820a58b4a6218a8474de673ae011927d
SSDEEP 1572864:h/jZqYmtJUb8JoSMJUNv7WTLYSwbqhmb9TPSqEjR/NjfEgIWV6chQsM8mGaHe:1tdoUbuPhv7rSEVGR/NTEgYcisM83a+
TLSH
T1AE1833D05121F5774F8796E7C723583AF9F1A0CDA73E800F8E7E09AC646AF825856D0A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  STEAMRIP » Free Pre-installed Steam Games.url
- Size 219B
- SHA256 4572f3812daf7bcd347d1a36834c5a9fec1f530093adf688a6ecd9e6092cbf76
- MD5 bb3af69a2e7704bc210886920ff7681f
- SHA1 42fa4a09d62cce1c0d70a63e0816135fd6b410e3
- SHA512 4f86d06f06859ed87d5f5353de9971c118477c956a8e0e0019b275f6eb035b2841c7cb959c9f4823a599ca7e73f6a0ed320207d917e8f4ab2a9b20e732551839
- TLSH
  T119D0A9BA0B58900AD321C81AE030BC08E44E75568CDED0B932C4CA8A4D96481C8A6BA8
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  Your Only Move Is HUSTLE/LICENSE.txt
- Size 257B
- SHA256 f64147778f1231a15602a24cde2894552ca8f460ada7116c9473236b9ef07a39
- MD5 cc765d6b5e3273b36e1a2dd952232ca2
- SHA1 9d2d63d4da5cdb1f8a566c7ce6747caf1b59c240
- SHA512 b02f3e47824b2e2bb11ae6f60d3f92cbe3921cb9495db034a2ba1d607b67514c01c35bc00ac12948724626e025462e9878dd923ee4af0aa66a4b72c2700e1ad6
- TLSH
  T1EBD02B56A09847B4288048C1FD3ACACBF11E190098EDE67CB178C07920088525F616C4
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral3 behavioral4
- Target
  Your Only Move Is HUSTLE/OnlineFix.ini
- Size 550B
- SHA256 ca4dd2f127ae9af3df019b23af870c9081508a1f4b6af69388cb768a108cf3ee
- MD5 54a774528e993d350795460529dfeac1
- SHA1 f6c3031fa7a507e6bfcc4a52dbea0e4a5603d5f0
- SHA512 9bfd5d59cebdaf3a30f16e61c836a092539591acc4b65c968a8b2a4102e26def04810823d1c6ec69a7b67664e402f7b5cea94816c9eae8b2846650e91e7ea4c0
- TLSH
  T16DF0C0D836AE337C8A265E5C6E43BCA2B59D394231070814B2025B8F1486E12A16910E
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral5 behavioral6
- Target
  Your Only Move Is HUSTLE/OnlineFix.url
- Size 46B
- SHA256 3cb526cccccc54af4c006fff00d1f48f830d08cdd4a2f21213856065666ef38e
- MD5 59bf167dc52a52f6e45f418f8c73ffa1
- SHA1 fa006950a6a971e89d4a1c23070d458a30463999
- SHA512 00005820f0418d4a3b802de4a7055475c88d79c2ee3ebfa580b7ae66a12c6966e5b092a02dc0f40db0fd3b821ea28d4aec14d7d404ead4ea88dc54a1815ffe26
- MD5 SHA1 SHA512
Score

1^/10
behavioral7 behavioral8
- Target
  Your Only Move Is HUSTLE/OnlineFix64.dll
- Size 7.0MB
- SHA256 1a799640ab36616fbb8af9540ca24c16a9f3cdf1b1d6e7a119bd1b9ad6d31415
- MD5 eddb8b18e993c39fa8c49aa4a707faf2
- SHA1 ee88dbd3cb4bac69c71d5f28af1b25fbd91fa12f
- SHA512 43db2315327a0b55a678863cf42b79b7f675ce10830326789aed80c039631b8c5a9700ab0dcfda11793372871aa29fd8fceae675e97f2329903e57c42e9439fc
- SSDEEP 196608:QRDytzGW6rn9INrVGH/DCFljDEKKrdx8CxeNKHl2:QOiJrn+NrVGbgD+rEC0NKM
- TLSH
  T16A7622D175C893B8D0CA4A3C7582948E37E0ADE954A8CB09EBC99C237FD1F5D016A763
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  Your Only Move Is HUSTLE/YourOnlyMoveIsHUSTLE.cmd
- Size 38B
- SHA256 90a686434146f2dd6b6d4339e118a731fc3f64deeb6b3507f5202a57361b0f30
- MD5 c4d6605c40c7f4bdec7f1c96491c6e4a
- SHA1 43e3ff93298183c2a5496116a1b05ee99dd50ac4
- SHA512 ac7f32d3e8522d0a152bce9eb7dd54832ac3c7cb76c4038340434d67e7199813f7ff570573f70c90db91249b0ca46cc0bda322f2b76141487018bf05dab74de3
- MD5 SHA1 SHA512
Score

6^/10

discovery
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
behavioral11 behavioral12
- Target
  Your Only Move Is HUSTLE/YourOnlyMoveIsHUSTLE.exe
- Size 41.0MB
- SHA256 9cb277ae5c9d1c89058426270cdc0c58e22a4d9b148ac3aebf1fe20b50a62bfd
- MD5 677c486cadd78c34c882aa6c8161132c
- SHA1 f015bfb07d9f8a54bf50937ba8822adb6e9e1cd7
- SHA512 485fc618c164697f8a8a4767f0aa495477c417238482e734125e99dcf259aa3527837bfc39787b1b650de937d109d17b8a3406b639e93de4615eed1d60b0dab6
- SSDEEP 393216:sAnZtt1CNkTixGEmgiKGWYiGcbfVxBHkSF8uvywzluXQr9LKVF+S3ea3QgiHkXWS:snPEXDyiIQe5l
- TLSH
  T1B6978D5AA26601EAD07AD0B9EA4BF057F33A305853344BE709A197655F37AF04DBFB00
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
behavioral13 behavioral14
- Target
  Your Only Move Is HUSTLE/YourOnlyMoveIsHUSTLE.pck
- Size 18.5MB
- SHA256 39a4f10c16db81effb8adc4748b001db851a8bffdb88601744261dce9e91e4a7
- MD5 58f33366104b9d1c847e833178724663
- SHA1 8450f809a3441f80d81058687a858240225d3380
- SHA512 9e37b6d7df1d5f3ca3c3ecd872ff1e62d3e4a023e3a9b1936a5c0d49e8e185b8bb211600bbecd7858b5b047b6ba30542625d5515c99a905c62eb24a960904b9c
- SSDEEP 196608:9D+ETxd7hCDadWeShLPAJsDsvk+7Y52DpyEGMgqycoMMm7SHZ9mscaz:9aETgzcJosBqqycoVz
- TLSH
  T17817BE03D682882EE172A139A563CF81CE60D544A76C157BF7B8E93CADF778836CB505
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral15 behavioral16
- Target
  Your Only Move Is HUSTLE/YourOnlyMoveIsHUSTLE.x86_64
- Size 48.8MB
- SHA256 3b49814e900240f15d5c6cffa8cff4f0295db3574366ec9c63d8a980d2900562
- MD5 545b14560c11b1819b6b5d7870282d08
- SHA1 8aa7c3a606179c2c31c7a1d78f9c76bcdefd5a25
- SHA512 4e05db3008751ed569f048e6d920b2d1509aeafce4934feddbea6c3fe29b4efa65acd1eac793f49024900d9fcabcb8ee94d87ca35da143a76936a7b179df42fa
- SSDEEP 393216:o9lyce5rZSW15i0L5zuGQw+csUGseiJT/F8BDw+mZL6Jwz:o9AsWPj8w5sUBJT/FEW2iz
- TLSH
  T18CB77C0BFAA1949CC00DD478734BE167A535B45885353BBF67888F341FF2E689BA9702
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17
- Target
  Your Only Move Is HUSTLE/libsteam_api.so
- Size 411KB
- SHA256 c0cc3d2802e5f2463bfa0046c41d2f65a6335baaeefbba6c7dbd5681d5ca7c46
- MD5 9fb2f341377ac3192369199ab8862138
- SHA1 95dcd3f3e03c0674e6604968a645c1d83d3caba9
- SHA512 18bcb6d918d3a24c4a546295e2adceb2d9064bcc5546c84c9191a371bcf18f4a96d47cd48d6a57676cf4baa42531edc26de7044b718a07ff6cca86ad8c25ac62
- SSDEEP 6144:pfwFZwCjnQDUEkWTyPnHmoOyFV2EOIuA/mVVDoV8YWK4zHdbQgPwFfwCjnQIUEk7:p7Cjn6hGx92ERl4xZpCjnjhg
- TLSH
  T1E194D737A12201F8C1E6D034899B9E1B767934CB73152E7E3094A5317D83A6E2F376E6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral18
- Target
  Your Only Move Is HUSTLE/steam_api64.dll
- Size 291KB
- SHA256 395c5a430c080b3eb99357da70471c3a87049b3b6170bda65b4f64a7f66b22f5
- MD5 1c48d80ac6f880a0e1300ed04d44efc2
- SHA1 f6fe3a4513da7bd57e7e546c6e6686ec72434561
- SHA512 5e83eaa660ed826a4abf1ace8460e375800b4eba2f692672b5cee51a2ffd2d88afc3eab1cb12d3404a439ce1c3b7d8c2f3857cd2773f28b7b705e4cd307baa0e
- SSDEEP 3072:504VEQ2u/niy9UVLCe9ZqdrP+VXvv+sJYB2RHKBi65lhTbCc+hnvvEyP7yq+ueic:QZu/i874ZcrMv2cRh7yqO2CP2HxYq8/B
- TLSH
  T12D54487AA2710CF4E076C13A88565E0FF671744B63219EFF226053369E576C21E3BBA1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  Your Only Move Is HUSTLE/steam_api64.of
- Size 291KB
- SHA256 1db3fd414039d3e5815a5721925dd2e0a3a9f2549603c6cab7c49b84966a1af3
- MD5 6b4ab6e60364c55f18a56a39021b74a6
- SHA1 39cac2889d8ca497ee0d8434fc9f6966f18fa336
- SHA512 c08de8c6e331d13dfe868ab340e41552fc49123a9f782a5a63b95795d5d979e68b5a6ab171153978679c0791dc3e3809c883471a05864041ce60b240ccdd4c21
- SSDEEP 3072:504VEQ2u/niy9UVLCe9ZqdrP+VXvv+sJYB2RHKBi65lhTbCc+hnvvEyP7yq+uei1:QZu/i874ZcrMv2cRh7yqO2CPLHxYq8/B
- TLSH
  T1AB54487AA2710CF4E076C13A88565E0FF671744B63219EFF226053369E576C21E3BBA1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  Your Only Move Is HUSTLE/tbfg.dll
- Size 1.1MB
- SHA256 1955831c2c30c026321117c3f95a54f4378ebf51c7763824b4aac346f1824f32
- MD5 a6ca3968cc5d6dc8b9de1b1114a7cf35
- SHA1 890efbc05e3d76fef8387a420de70a3cd0911cb2
- SHA512 b33eedd6d1ca65c02d12eb79da41a13c7797432962eeff004ca7f333394b601ebd8ae66eda7b465c26be632f883c0b6374b195a1c11e98d9cf65cc503d726f50
- SSDEEP 12288:C9yzfRpBpBLEgUopD792IeWkja7HetgguuDHkakVwG7lAx4e6RW1dsxPpwzhe:LLZpH92I6ja7HAzuuDHm7AGW1dsXm
- TLSH
  T1DE450B293F67D46DD859C4B093E78BA75E1038CE5B3879EB49C094B43E6AAF41B3C604
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  Your Only Move Is HUSTLE/tbfg.so
- Size 4.9MB
- SHA256 edd2e7e91d70a0c52c182d0f68f46a6cde9953607603e4decdb60dcd95fe957e
- MD5 4daa0f93e4e314a0ba61a31a51aaf398
- SHA1 4b1fd250590f23e2ac833fe0057ab4a9dcb98743
- SHA512 c9569ff853252cee8ef04063d514574a270c4ba2c7135c45ac700dd1961350dced7251344208b3fbc23cf049fe5c35ec9a93cbca9234804c2f79306cd174bd2f
- SSDEEP 49152:1fZtwkpfEHHp9G73KW1isHYPyPyNXuZxt7s3eijuCWqUK9WjXnFFrUS2tRTIX9vZ:Dc6KW1isGBZWdqTwix91OvFWG
- TLSH
  T1DC364A11AFF82B30E9E79D32809E67143B31FA09C719CFA34D26C2B1AD43265BF56645
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25
- Target
  Your Only Move Is HUSTLE/vcruntime140.dll
- Size 96KB
- SHA256 d66c3b47091ceb3f8d3cc165a43d285ae919211a0c0fcb74491ee574d8d464f8
- MD5 f12681a472b9dd04a812e16096514974
- SHA1 6fd102eb3e0b0e6eef08118d71f28702d1a9067c
- SHA512 7d3accbf84de73fb0c5c0de812a9ed600d39cd7ed0f99527ca86a57ce63f48765a370e913e3a46ffc2ccd48ee07d823dafdd157710eef9e7cc1eb7505dc323a2
- SSDEEP 1536:BxhUQePlHhR46rXHHGI+mAAD4AeDuXMycecb8i10DWZz:Bvk4wHH+mZD4ADAecb8G1
- TLSH
  T1E0A37D4A77A542BBC06ED274C1A39906F7B0B840877063CF07B5466A5F23BE19E3E356
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral26 behavioral27
- Target
  _CommonRedist/dotNetFx40_Full_setup.exe
- Size 868KB
- SHA256 fa1afff978325f8818ce3a559d67a58297d9154674de7fd8eb03656d93104425
- MD5 53406e9988306cbd4537677c5336aba4
- SHA1 06becadb92a5fcca2529c0b93687c2a0c6d0d610
- SHA512 4f89da81b5a3800aa16ff33cc4a42dbb17d4c698a5e2983b88c32738decb57e3088a1da444ad0ec0d745c3c6b6b8b9b86d3f19909142f9e51f513748c0274a99
- SSDEEP 24576:+tW4x8xAxCdUcyezFSjaBHFaNlsqK5/oh6iZf1LUXw/vxNI:d4x8xqCGexm8FCspg0iZf1LUXD
- TLSH
  T1F2151232ABA0C133D4DB28B48ADDB6B2657DE6610374C4C7B7440BEEAC307D1697964B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Executes dropped EXE
- Loads dropped DLL
behavioral28 behavioral29
- Target
  _CommonRedist/dxwebsetup.exe
- Size 281KB
- SHA256 111aeddc6a6dbf64b28cb565aa12af9ee3cc0a56ce31e4da0068cf6b474c3288
- MD5 fd6057b33e15a553ddc5d9873723ce8f
- SHA1 f90efb623b5abea70af63c470daa8674444fb1df
- SHA512 d894630c9a4bdb767e9f16d1b701acbdf011e721768ba0dc7a24e6d82a4d062a7ca253b1b334edba38c06187104351203a92c017838bdd9f13905cde30f7d94d
- SSDEEP 6144:pWK8EGMUjp5cGQ3Mek1B3B9h8Ins3i8AEYBSawz1YSc:JGvjp5cj35kDB9hrs3zARBSaJSc
- TLSH
  T1F154F11267D9853BE0F56B705DF341236B75BCA15E7AF32E5246A88C0C32784B83A727
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Drops file in System32 directory
behavioral30 behavioral31
- Target
  _CommonRedist/oalinst.exe
- Size 790KB
- SHA256 b8f39714d41e009f75efb183c37100f2cbabb71784bbd243be881ac5b42d86fd
- MD5 694f54bd227916b89fc3eb1db53f0685
- SHA1 21fdc367291bbef14dac27925cae698d3928eead
- SHA512 55bc0de75a7f27f11eb8f4ee8c9934dfe1acd044d8b7b2151c506bdcbead3ab179df7023f699c9139c77541bbc4b1c0657e93c34a6bc4309b665c6cb7636a7e5
- SSDEEP 12288:0s1yfEcpPzdv+t4cRIy3ze3SUN0PXGTjiqRy2p3kwzjGHTkV:NwfLrvi4cRIyDe3SUNaXy+WypoGHgV
- TLSH
  T1E005F10020D5CC73E4EB32B3843586746EBA7E912F0A285B7FC476AEE673176DA71215
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops file in System32 directory
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Contacts third-party web service commonly abused for C2

Contacts third-party web service commonly abused for C2

Executes dropped EXE

Loads dropped DLL

Executes dropped EXE

Loads dropped DLL

Adds Run key to start application

Drops file in System32 directory

Checks installed software on the system

Drops file in System32 directory

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32