6a6fe61a43e850e200d52fa5f64263a6e060e04e0f7b25f8e496a26db683b3ae

Sharing

Copy URL Twitter E-mail

General

Target
FFXIII-2 - Console Content Patch (v2.4) (1).zip
Size 7.2MB
Sample260620-2yctvsas4j
SHA256 6a6fe61a43e850e200d52fa5f64263a6e060e04e0f7b25f8e496a26db683b3ae
MD5 062829e1582d29b5230827baa0a32df0
SHA1 b531c844963cca70510b82d8a6660639b9927197
SHA512 19e13f8a87ff19863eeb77eb930ab75614c9de28cc40fff048a46ee11dbaf32906c300811065c53d898e4779deda3e694e2cb1b42e106588762a3b0206fb43cf
SSDEEP 196608:UljYzY6wY4H1xiD0HnI3UqaUGSXeSFpghLGKwATEsQS2SVQQG6bWK:UljY86+H1xRo3UqnPghLFwA9D6QWK
TLSH
T1AE7633C1D32ED69BCB39C36DF6E7F4C227322F986452090AC93B12612E8153626FD759
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  FFXIII-2 - Console Content Patch (v2.4) (1).zip
- Size 7.2MB
- SHA256 6a6fe61a43e850e200d52fa5f64263a6e060e04e0f7b25f8e496a26db683b3ae
- MD5 062829e1582d29b5230827baa0a32df0
- SHA1 b531c844963cca70510b82d8a6660639b9927197
- SHA512 19e13f8a87ff19863eeb77eb930ab75614c9de28cc40fff048a46ee11dbaf32906c300811065c53d898e4779deda3e694e2cb1b42e106588762a3b0206fb43cf
- SSDEEP 196608:UljYzY6wY4H1xiD0HnI3UqaUGSXeSFpghLGKwATEsQS2SVQQG6bWK:UljY86+H1xRo3UqnPghLFwA9D6QWK
- TLSH
  T1AE7633C1D32ED69BCB39C36DF6E7F4C227322F986452090AC93B12612E8153626FD759
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  FFXIII2ConsoleContentPatch.exe
- Size 22KB
- SHA256 ddd39508d7c90b08e1a349046955c0087b6dbd129dd9ae71fb970e835d20afe5
- MD5 859dbb4e1a29189a1e8d9ec3a3993314
- SHA1 7aac806310ed794ee349e09f6edececdac01c48f
- SHA512 ebafdacd369ba84f5b6913dc091bdb016373cda57102395b6ad532817b17d7f1ea792f75d0989d1394b47adffd43e041b905253125c3ff1aafdba6f18d904404
- SSDEEP 384:iWhLMNqQy/F/64YFZ2n9ZycQc9faTgTOmf4fzfGf6fVuQuCuzuDuf9W919w9M9Fj:i+P/0j2n9ZBQctEgT3f4fzfGf6fVuQus
- TLSH
  T1FFA2701DBAD0062AE2FED73589B256518D363D63F932DF0D28DA024D01A7E426C50FBE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery defense_evasion
behavioral3 behavioral4
- Target
  LocateFile.dll
- Size 4KB
- SHA256 38ad378686d7772ad85e6ca2da7bb6a97ea1c66c2f932de0a769248bfbff5ce9
- MD5 3f37ea40c706a6927a1b8a0ec2f15318
- SHA1 a71d5a440908bf1a95a7d4f826903032a1caa890
- SHA512 bf3428c1b186871b7d19f6ba0d2770919fdb42b3d91d23a3dd652968b94e0211eb61051ad498542e312007e3d7b7eca246291f64be2bd989b91657f81cfccf44
- TLSH
  T147818425A7E48777DEB74B31ED63134906B4FB609A13DB2D09C0A21B7C166244E32BA0
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  PatchData.bin
- Size 18.9MB
- SHA256 1ed2f92a56d9ddd60d5f8fd803cb8a95764281ea159454d7c5b18d926340b5b8
- MD5 39d6a89aef856455bb741b4510fc59dd
- SHA1 b0cf2bd4ca80763823a5aad2b51eafb268b57515
- SHA512 096896badd401245f6abd7336a7a64fd27a2b3b2774261a45f969ce6933601054e9cd174f4e7818a94e5f1feebab3523b33024351fd46062652e86453b3ffcc9
- SSDEEP 196608:mJqOOgbagPQEXe8dQuYMfJ/xQ45vvL0pv+h:mcCbagPs8Dft5bb
- TLSH
  T17917F71EFAB44D35D00D19F4896B9FA0D3AEC1362A0486A37D7C2728FFB33511E66598
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral7 behavioral8
- Target
  WhiteBinTools.dll
- Size 114KB
- SHA256 b3ead2ea9df39b03e11a1b73fd39210abf2ed6ce89c268b8f28e77e9703ff1a4
- MD5 8710cc5c4eb7d147a0299c69c353fb5c
- SHA1 ee7564c9103eb26857d383ea6d7c681645865314
- SHA512 5f4ce8902266a13af3e54de8ca764429394209beff2401e69be592aa57526b8be0209006e518f0669785f634f39ede41c427cc556118c71b7482d6ad8cc5999b
- SSDEEP 3072:hIONhLQToLxcQACtWiKXVkkA28mVN5VgweI/KQ73WmVNc:hIONhLNLxFtWiKXas8mVN5VdN
- TLSH
  T154B35C346F9D9B6FD4BE82FDA4B0127503F0B136B61BE79B694024F919037818A11BE7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10