2c2beb11d94693fab759c92615109a178db1a262664c9bbd6019bb0be4936c5a

Sharing

Copy URL Twitter E-mail

General

Target
Eclipsium_--_fitgirl-repacks.site_--_.rar
Size 507.2MB
Sample260619-p8d4fsf13p
SHA256 2c2beb11d94693fab759c92615109a178db1a262664c9bbd6019bb0be4936c5a
MD5 b19ea0a045cdc68ff8d1109abe472a5c
SHA1 c5ef748f05e8ae7c33cd02ab794766c372874906
SHA512 345225b243db64ce6a3b5ad336d3f6bef812a790d6990d98012e7ec798705febd1975a904951032c46424529c47981cd6ef4adfa8a930509004fa93e7e357f35
SSDEEP 12582912:FMOzOHtfsBHas8o41gCAHmQRzWfd9lmek8c9yhfxWTAkTH9:GsBHas8oKAHmQROlmeYCWr9
TLSH
T1D9493359EBA41735F98C027959E7A015193893B588F23CE33D169B0EA4BE047CED373A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Eclipsium_--_fitgirl-repacks.site_--_.rar
- Size 507.2MB
- SHA256 2c2beb11d94693fab759c92615109a178db1a262664c9bbd6019bb0be4936c5a
- MD5 b19ea0a045cdc68ff8d1109abe472a5c
- SHA1 c5ef748f05e8ae7c33cd02ab794766c372874906
- SHA512 345225b243db64ce6a3b5ad336d3f6bef812a790d6990d98012e7ec798705febd1975a904951032c46424529c47981cd6ef4adfa8a930509004fa93e7e357f35
- SSDEEP 12582912:FMOzOHtfsBHas8o41gCAHmQRzWfd9lmek8c9yhfxWTAkTH9:GsBHas8oKAHmQROlmeYCWr9
- TLSH
  T1D9493359EBA41735F98C027959E7A015193893B588F23CE33D169B0EA4BE047CED373A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2
- Target
  MD5/QuickSFV.EXE
- Size 101KB
- SHA256 a6371461da7439f4ef7008ed53331209747cba960b85c70a902d46451247a29c
- MD5 4b1d5ec11b2b5db046233a28dba73b83
- SHA1 3a4e464d3602957f3527727ea62876902b451511
- SHA512 fcd653dbab79dbedca461beb8d01c2a4d0fd061fcfba50ffa12238f338a5ea03e7f0e956a3932d785e453592ce7bb1b8a2f1d88392e336bd94fb94a971450b69
- SSDEEP 1536:lYfzZTBgMtgBKOX8eXDfRQpDm63htpmKvEZfn0X8u165J+S0YKxjy1:liVTBTgQOX80I59VJ165J+S0YKx+1
- TLSH
  T11FA37D527780C5F2E451267224E6E7724B3BB83503E556D3FB883E5A5E702C07A7E38A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery adware defense_evasion persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3 behavioral4
- Target
  MD5/QuickSFV.ini
- Size 155B
- SHA256 74ca5a42469197eded04f5a0bf34ca251c72f7cc06a3416ac035230cb8e81629
- MD5 c5c28798bca6e9ed5d84fa67b656065a
- SHA1 4b6fa3465f1b393e22e9f083b177462028a48e93
- SHA512 c06baa4b31e2866fc3f298826930f43fb1d9c2de24e0984594e41f72f022a9090712b478e84d3cb46e0cb0f45d4e81d6c6443b69c7513775340324d9eda92963
- TLSH
  T12DC02B3D075C40150D310E54D0CD71406D4C550F6438CC01AC0437009F10D232A18FA0
- MD5 SHA1 SHA512 TLSH
Score

1^/10

ransomware
behavioral5 behavioral6
- Target
  MD5/fitgirl-bins.md5
- Size 244B
- SHA256 fe70b6b2657bb1900e753cd2f134aa29d751ca3fee2ba70bb8ab057b67b98130
- MD5 0eaef7878e17a6adf25d3ff8da67a7eb
- SHA1 49d390d23bae1a93c9b1404faf30fe00ab0d4d28
- SHA512 62cc115a18819d04f7d7614e2df6aa19a979c73e7d7ea364a7f4cf40a7d5de51db31aa3c25bfcfbd1bfc99ed29b1683871194babca9cfdd4b3bd2dedfbb75fe4
- TLSH
  T143D0A7AD94075AB0855AEDC9F695EDCA02E910195A27674020E03246507254D4C65BE2
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral7 behavioral8
- Target
  Verify BIN files before installation.bat
- Size 69B
- SHA256 95ff8038ebfcdbdbf8fbfd047447b0418e960c2a2dcb20515ee3c5e8349a5540
- MD5 a3a1d3f8400dbcefeed01fc6293644ff
- SHA1 d6445e7814729612aca5952b3c0bd6b5328b6a20
- SHA512 e50706a605f53eb4534cc699454d5f8552617d7dcf87f970debb44d1cafb41a42d132188452cb0d41f0ce55762ee8aea332a9b5b9410aa99a265473595cc8a67
- TLSH
  T1F6A002C16BE41500585E8D60E2AF32CDF88E70676145BAD0B0A2B1B5589FD8863676F6
- MD5 SHA1 SHA512 TLSH
Score

3^/10

adware discovery spyware
behavioral10 behavioral9
- Target
  fg-01.bin
- Size 307.9MB
- SHA256 da3c2b313f1aa455786f31288e03ba8f9b4be52e3809ab5be3243500c567687c
- MD5 7bc15e204d10d028c6970d9bfd77b8c8
- SHA1 788856d996e3e1c60d538727d114af378aafdd6c
- SHA512 3f08cba32d9381b041f31fac3714c57912c6aad938198f58675848960bc412f8616c28f44195abf083c8c38c34cf4638864103f51f1c98f2e72a25284eada943
- SSDEEP 6291456:arVGp8zZ2BF4CtlNsBHas8o47ipAGhE8wZBtrGW8mTMRygI:aMOzOHtfsBHas8o41gCAHmQRzI
- TLSH
  T11CF83317F1F8BA90DE8C11A028639828553CF2718E937DE7B54A1B1EB5AF09B49C3F51
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral11 behavioral12
- Target
  fg-02.bin
- Size 173.6MB
- SHA256 2b6c10a244182d688d72ff74510ffe86e58ab6464d7203aed9c967104ad120ff
- MD5 710ccef38211199b756f600a3db77e36
- SHA1 1bce2318be21e95a428855d13b51f02ec62d8b8c
- SHA512 a4bc65c0e604361fb71bca1476ac535cdda8f2fed7cd97cfd5a080d9f9d26859668b77596c73c369c90ce8c62613c4b91fd54e0f3c1b5e75b3ad24ff6d58affc
- SSDEEP 3145728:VPewD8VM/xvjhO0yx5Kd+ZpYftsTqiz1wzpiM9TbMJEvo0ZpXtP6PMxWy8+LNhdC:FfpvE0wLYfeek1wzcyMJEdpdP6UxWTKs
- TLSH
  T1DC9833F84B0B131AF6A40B7EC7FF621754BB879C987064D72932E512842E416DA8673F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware discovery persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral13 behavioral14
- Target
  fg-03.bin
- Size 19.6MB
- SHA256 3ed9e14c0327ba211ece602934f52e719d051fbb59b270baefd749041e30f0f5
- MD5 dfebe66a5029bdeb0ec5bec403b0a4fa
- SHA1 9fe848378b3df9a506f24d6945b461455307942b
- SHA512 7296cebec1ac965a2e27b6578d3199b78cc9a56b05af8dfa4572ad83d0ee03afe3fa3b85113ef592c9c9956badb4df0d1bca29b5b2d74beda005c5312124150b
- SSDEEP 393216:8fgz83wpqQTR6h/yNxoan6Mp7eYehIUg4U9+feq35mC8i2RoU4ryhXwTpT:84z8kqQTR6g764ethGUfeq35mW2Ryy+t
- TLSH
  T1D427331D8D31CB1C63AF9966D08EA687178507FB2E783C022C7B59358E95C0B5BE32B5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral15 behavioral16
- Target
  fg-04.bin
- Size 1.7MB
- SHA256 b03282adebb7ed935cfeed94913e8128a56c3ff323fb34db0db12716df64edba
- MD5 f344c46c3201f5dae55d96267c903775
- SHA1 23c3460acca7c2f8bf2ff089306d724d60a04e54
- SHA512 8ef0da60354ecf4d00dca38d9b7b7bf680f6cf4c43368bc963d0986110d6efc2abdbbf10b8c0c99aff387b516020f1e8800237331f83ceb21f6a2d27b0b07ab8
- SSDEEP 49152:AfCUy6vZAu6kwcwBTwuU/wCYpyBdL1VEcwXZQYaSGbbf0UoemK:Afg6RAu1kTwuU/jYpyBREcwXZQYSXsUX
- TLSH
  T15B8533CF45EE627E24CDA686B9C6D5E416C2B975C49712AAE3EFF281BB4673C4033110
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral17 behavioral18
- Target
  setup.exe
- Size 4.3MB
- SHA256 9be8f93f584200fcc46dde3cbd88a60b569298ef1049141002650d800af93434
- MD5 6deed1dc3d28b1265e9dce7870a69112
- SHA1 dc5097a2a373187a43f2895fe43e0da47c45abb9
- SHA512 48354a0121670b9197a7cf1dc39b77a43793376ea35f35bf10a6ce7720e06f110c7bd4c6ff8af89ae4479afd6e94fba2cba4d34c18e9a29bd53e955278ce4b11
- SSDEEP 49152:vH0cAfn7wh0QIaUrjJcIAVUbUVPH12JxQHh3PWpO4oCDvLPQt+hCJ5g73MmV1ta9:Gf7wCQInrje/CAVMJy1Wp3l2+hH3Lt6N
- TLSH
  T1CD263301F7D31836E46408795D5294A86E23B6BA19E570261FBCEB4F07B82C37BB75B0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery installer upx
- Drops file in Drivers directory
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral19 behavioral20

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Drops file in Drivers directory

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Checks installed software on the system

Enumerates connected drives

UPX packed file

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20