2b4b23ef97ee7bc6318e73bd539d6e843414c0b89287341d98fa045ac4a13d11

Sharing

Copy URL Twitter E-mail

General

Target
FFXIII-2 - Leviathan's Tears (v1.3).zip
Size 67KB
Sample260620-2sca5saz8x
SHA256 2b4b23ef97ee7bc6318e73bd539d6e843414c0b89287341d98fa045ac4a13d11
MD5 5693f08898182de11b48301136ec7b7b
SHA1 c30bba9a0b90911e298ff7f97fc70ec6c42dd775
SHA512 d43c3015c421e5582568323b2b115036265f2b673947e301b34e692064d441a30a80832edeb39b8ee6851080dc15766fdcb1c2b576313c33ce66eee84cbf6464
SSDEEP 1536:kpJn4KLSdG8Gx0HoQWKLvJWYbL88C5y/pQMtX:mJFuI9x055VnMny/V
TLSH
T1C263023CB8083525D0368F3AED6AD163F25499D24C79DF9738CC74E345A6ED52E0E24A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  FFXIII-2 - Leviathan's Tears (v1.3).zip
- Size 67KB
- SHA256 2b4b23ef97ee7bc6318e73bd539d6e843414c0b89287341d98fa045ac4a13d11
- MD5 5693f08898182de11b48301136ec7b7b
- SHA1 c30bba9a0b90911e298ff7f97fc70ec6c42dd775
- SHA512 d43c3015c421e5582568323b2b115036265f2b673947e301b34e692064d441a30a80832edeb39b8ee6851080dc15766fdcb1c2b576313c33ce66eee84cbf6464
- SSDEEP 1536:kpJn4KLSdG8Gx0HoQWKLvJWYbL88C5y/pQMtX:mJFuI9x055VnMny/V
- TLSH
  T1C263023CB8083525D0368F3AED6AD163F25499D24C79DF9738CC74E345A6ED52E0E24A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral1 behavioral2
- Target
  FFXIII2LeviathansTears.exe
- Size 16KB
- SHA256 1a156a8b43825092671ff08edb49243673152adfafeb0c078ff8f1b416096ff5
- MD5 f107469bc091d2695e50e1dd624571ed
- SHA1 25e669a9d429e941b75f43c907477b491cbc6015
- SHA512 90a529b5a9992351acf16b3c09a447bf0b53699cea834858a26667c8740e7b14934a991e2160ea1b079cdcd0418d1a997777a5b6e43cbec53d2241494977f840
- SSDEEP 192:U+k1MX1O/BbS+0wSQmkC6RLpK74YEEoDZGzQVH+OsvxHL4rlO/lvkqDDHtaKiEnh:qGO/eF16y74YDQYaKiE/yck9y4Vr
- TLSH
  T19072121577F8022AE6FFAB30D9712201C739B947E875EF4E148A114B1A6FA508DA1F71
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery defense_evasion
behavioral3 behavioral4
- Target
  IMGBlibrary.dll
- Size 23KB
- SHA256 7201f9319a94a3d8cb618e1a8379af1324e0b9433f6a286cb590718e376ef55e
- MD5 963ca87fc8372f5ecabc3b9c19a96c1c
- SHA1 100c45a57dca5097a222c50011747f4657d58d99
- SHA512 5727647227a096bd4326df214b2bc75f79313671aaa150904e2a0995c8f5b2995ce66aa298f88600dd188c9abafc5f6def10b57933c41d3fc257fb3512d63e3b
- SSDEEP 384:3eX5DvUVU5KMJTkBFrMDzW/0e72/ipi3vYN1rjGnd:sDvUVUUkTkfoWiqg3vYN1Wd
- TLSH
  T1CCB2EA492BD9633BDAFE573419F0025016F9F42BB772E70B9D83105B2D13B998610BE6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral5 behavioral6
- Target
  LocateFile.dll
- Size 4KB
- SHA256 38ad378686d7772ad85e6ca2da7bb6a97ea1c66c2f932de0a769248bfbff5ce9
- MD5 3f37ea40c706a6927a1b8a0ec2f15318
- SHA1 a71d5a440908bf1a95a7d4f826903032a1caa890
- SHA512 bf3428c1b186871b7d19f6ba0d2770919fdb42b3d91d23a3dd652968b94e0211eb61051ad498542e312007e3d7b7eca246291f64be2bd989b91657f81cfccf44
- TLSH
  T147818425A7E48777DEB74B31ED63134906B4FB609A13DB2D09C0A21B7C166244E32BA0
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  PatchData.bin
- Size 7KB
- SHA256 52849a9409d2b021e5fb95b16897bcaa3c141fc219752cc20d0a7a2f9f2de48a
- MD5 dc506b5c95a2319dcfad23b7b8b769ca
- SHA1 c0a7782d3f716022b9b2a4e232baec15c484bdf8
- SHA512 3a451144dd38222053c286649479a9689714517f893d27876ca020165208bb2cbda16560e29216241fd4df08941d566e7a371f1e36c9cc818d8bcd4a86fa82bb
- SSDEEP 96:MPHIkrOjAVUb8bbBPtdQME85k31l5hamjAZbI1WtPnwVgzgkeC84UHz75d31:DMVc8bbBPv35yz50pI2Pnmgzg1ie5Z1
- TLSH
  T1C6F1ABFBC40482D9C9084EF97071463DB33EB633E98A7ECE572A042949A75604F3799B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  vfx/field/weather/weather07/_veffs.jp.win32.imgb/v8cc6bbc2d6112f.vtex.dds
- Size 3KB
- SHA256 5fc020ebf29212ef067f2f7b4236fc2806ebd648493b0ff5befc6345db922fdc
- MD5 3d3fde65ca02944c19b2a9f21c24c951
- SHA1 ae635fd4a4dfd51ac15e340160b8d4d05f8e4452
- SHA512 374a1e5d5cf7ee3a3b3a2c74f2db0a3859a455a56bdfe4f12eed09cc1cbadd01fb01101d8387b853df7650aba49e1439e454b62d9096f839d783fc29518cf139
- TLSH
  T1CE6113F7840095E6CE084DF4B552063EB26EBA37F489BECF273A095189275554F378A3
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral11 behavioral12
- Target
  vfx/field/weather/weather08/_veffs.jp.win32.imgb/ve961e1acb4d64e.vtex.dds
- Size 3KB
- SHA256 e06cb5657d0ef65920eca7914bccfc9eb351b271c14bd1d1a9d64c67d1f4d314
- MD5 30d8e659b9967722f174cf9e86cf7c5d
- SHA1 fed393d79a3f5b23691edf7b0f18da692ef6bee9
- SHA512 b543674d1aaa20f6d097d0ffd2b1bda01b374e4b8ca252d9dad63a5797a6314a447ce4ef38e9738f3792e37a146c144c1c40a6f5d3f72f5d41a7e3deebd12c96
- TLSH
  T1226150FBC41492D5C6084DF9B172463DB33EBA32E88BBECC171A097899A74144F374A8
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral13 behavioral14
- Target
  WPDtool.dll
- Size 10KB
- SHA256 846db0fbbf2e3af124cbf5126185706e2d19b22b890c7c4b9e5af600ca7ad6cc
- MD5 982d844f8533565b84074ba77615e031
- SHA1 3dc3f7ae5b9b2681e5b2abe4ad76c82b7472102a
- SHA512 c5d2cd8ac03ee103c05b96d9ad71ebb8216fb60e29396fca04a58250602ca321f907a6d36c964f31e9fc03a5923368d54242ac6fdbd23f483697d84bb3cdb0f7
- SSDEEP 192:BzURztQwN9n8dbw0XMNuehC+ExTDdujCdiTNSDpRjE4cVk/x:BzgZQw6QuxHdujCpsVkp
- TLSH
  T12622C5047BE98616E4FF5F767CF103100231F617EA72CB0F6882555F6E32B9588A0BA2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral15 behavioral16
- Target
  WhiteBinTools.dll
- Size 114KB
- SHA256 b3ead2ea9df39b03e11a1b73fd39210abf2ed6ce89c268b8f28e77e9703ff1a4
- MD5 8710cc5c4eb7d147a0299c69c353fb5c
- SHA1 ee7564c9103eb26857d383ea6d7c681645865314
- SHA512 5f4ce8902266a13af3e54de8ca764429394209beff2401e69be592aa57526b8be0209006e518f0669785f634f39ede41c427cc556118c71b7482d6ad8cc5999b
- SSDEEP 3072:hIONhLQToLxcQACtWiKXVkkA28mVN5VgweI/KQ73WmVNc:hIONhLNLxFtWiKXas8mVN5VdN
- TLSH
  T154B35C346F9D9B6FD4BE82FDA4B0127503F0B136B61BE79B694024F919037818A11BE7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18