bdfac098adddbfed2f574ab6c9adccf5c6dfcc85ae974052f9c447baf0648cb3

Sharing

Copy URL Twitter E-mail

General

Target
FFXIII-2 - Console Button Prompts (v2.1).7z
Size 3.5MB
Sample260620-3ac1dsas9k
SHA256 bdfac098adddbfed2f574ab6c9adccf5c6dfcc85ae974052f9c447baf0648cb3
MD5 168a80d81c1c7b59b8c9a5eeaccf1f91
SHA1 b11bd21cd83306010d2e6bf6925220741ed8b44d
SHA512 e96a326f8e7c709222eea50b1c1a0f294896320f919594c6df1232bcaa81282b64715df2226c30a1bac9489490d01891df67af5425fa3c8037f30a3fe24762fb
SSDEEP 98304:qmvTZRzjOwdGGtVlVn8NXnxzBo+5D0ZA1f0a4sTGPMdAJ3i+ClK:7F1VDMnfo+5gIf0alTGEaDCc
TLSH
T13A0633A36078246BF4D3E63344BE99794D9CDD345BB693202A36160F4C236B88D73A77
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  FFXIII-2 - Console Button Prompts (v2.1).7z
- Size 3.5MB
- SHA256 bdfac098adddbfed2f574ab6c9adccf5c6dfcc85ae974052f9c447baf0648cb3
- MD5 168a80d81c1c7b59b8c9a5eeaccf1f91
- SHA1 b11bd21cd83306010d2e6bf6925220741ed8b44d
- SHA512 e96a326f8e7c709222eea50b1c1a0f294896320f919594c6df1232bcaa81282b64715df2226c30a1bac9489490d01891df67af5425fa3c8037f30a3fe24762fb
- SSDEEP 98304:qmvTZRzjOwdGGtVlVn8NXnxzBo+5D0ZA1f0a4sTGPMdAJ3i+ClK:7F1VDMnfo+5gIf0alTGEaDCc
- TLSH
  T13A0633A36078246BF4D3E63344BE99794D9CDD345BB693202A36160F4C236B88D73A77
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  Install Console Button Prompts.bat
- Size 5KB
- SHA256 fe90f4fd960fd4b83c825a508ec55c8c7a3dab109a251d2fe9ff7534d5dc7271
- MD5 7641ce782a66c8c4541fff7ab72ff161
- SHA1 510d61a8930ba5b3ce0a4fd3d98ec7a1bcbb7b94
- SHA512 e33d2642a9e0ee1c8b57408048971c1eaf821b88bed80e6fff4e3288b04645026cee74fc7dce76d035f24adc1a344eb0ecca829f007b6df242c04b8cbb5adc8e
- SSDEEP 96:m4LSLjEdmI3L86I3c+c6F7mdcWmCqC5XYqczcjcc1iecjJmv1wRmI3L86I3c+c6/:mjUD8rmb+wKXRD8rmb+wKAOyq
- TLSH
  T163B154583E629AA4C2F1DE499C2C8579FF05BC875A182C2491FB8CF849313D173BC55E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  Readme.txt
- Size 1KB
- SHA256 bb006d40567d8960ff4ea3059c545486d5403ed25e6c86e41cbda7226083eb12
- MD5 22efe9bdd94f307067d2d79c8bbdc315
- SHA1 a3b5caa922ea7c0caa0418dbe8f7dc6d0d52b01b
- SHA512 5c70ff86b5c5ecd2e41bdb01bc001c5a3d5bbc057f3cdbf066d4e50bd14f0c37a95509a52eee0c899fac4ff83b3dd02f70d9afdfba149eb4f891779df6af76f8
- TLSH
  T131315454BAB48372097310B6577F6020A2A5F8ADB36F9561001CC0F827D57ACD29B5CE
- MD5 SHA1 SHA512 TLSH
Score

1^/10

ransomware
behavioral5 behavioral6
- Target
  mod/7z.dll
- Size 893KB
- SHA256 a1e1d1f0fff4fcccfbdfa313f3bdfea4d3dfe2c2d9174a615bbc39a0a6929338
- MD5 04ad4b80880b32c94be8d0886482c774
- SHA1 344faf61c3eb76f4a2fb6452e83ed16c9cce73e0
- SHA512 3e3aaf01b769471b18126e443a721c9e9a0269e9f5e48d0a10251bc1ee309855bd71ede266caa6828b007359b21ba562c2a5a3469078760f564fb7bd43acabfb
- SSDEEP 24576:TW+wsDaQw6DDz3qRyPnmGfrnvVUKueY8RmneWtJ:TasY6DwOBfrnvV7UeWt
- TLSH
  T1BB156D15FBBDC474D28A44318A29ABB250F4E71ACA21E4D367C0FE3E1F36995C129E4D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  mod/7z.exe
- Size 160KB
- SHA256 ac9674feb8f2fad20c1e046de67f899419276ae79a60e8cc021a4bf472ae044f
- MD5 a51d90f2f9394f5ea0a3acae3bd2b219
- SHA1 20fea1314dbed552d5fedee096e2050369172ee1
- SHA512 c11f981136db7d9bde01046b1953fd924ff29447d41257da09dd762451e27390cea9b69e43206a8fff825ebcd4ddec5a6247bb502aefbd6e8285622caa985bf6
- SSDEEP 3072:6nkCMZlG+fHlDum7uVouWEHR92dZH5TTY8A7GyH367uPlDKw:6kCMndv8WiYZH5A8sGw367Y+
- TLSH
  T1E6F36C3139F4C577D2230530CEE86BF5E0F6DA650E2248A733C94B2D6A79995C329E2D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  mod/Cocoon.exe
- Size 197KB
- SHA256 73370931b1a7b187744526b9829a08b912c251e60104539c3f5af6daf44db0ad
- MD5 79a8b65c69c4daef0b7afa242748c301
- SHA1 91f2e18247d2fb1f68a7c846ccefc104928da699
- SHA512 5d113774761b9d08d6144e1af12c68afabb3de7fcd6fcc32fa34d15bca5d07c09f22734789efb7e02a99ac954adc76bd9207b442d290a5eae239b3d27ae1ece0
- SSDEEP 3072:gFQUdAh33sjXdaDoEslIVWV41/sGB+BUKCag7dPYbsApeI/KQ73Wmy6b3k54L:gFQUdAhHsjXKj+PCag7dwbJQ6b3C4
- TLSH
  T17314F82C62EC5F26E4BFC7F884F021614730B057E962EB892CC395D90E76745AD45EA3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  mod/Cocoon.vshost.exe
- Size 22KB
- SHA256 58d46a3801c280908698ef4ff789546427b9be7cd78f61a7533cc2f56c1b881b
- MD5 5a968502b84a268ca84018f1a9f6bb59
- SHA1 473b76e89014eebfaa03aa6c3b741dc3747c98c7
- SHA512 73b0a1903b92e95ca0251e78a18d4fbdf61be15ec29f283488a7c3914ca2bdbb4267a4f5f86e0cd20a809bed1f0f0e804189da541a58a50df35271107f0c1bd6
- SSDEEP 384:TICPZQWMPW7SUA0GftpBjcV+ILKHRN7illI66s1:8WAMiWVm566
- TLSH
  T1E9A26C95CB7C8153ED935DB067E8EA837C3CA7D34C21962A006AF5C82C833D49F24A2D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral13 behavioral14
- Target
  mod/EntityFramework.SqlServer.dll
- Size 606KB
- SHA256 a1bf6c9e3820e83f43e9f20dd7d9b0a3362a93146f0afe0b1330185e2d51b0cb
- MD5 b9e43b7ac178bf49fc3c7c9de0f6e031
- SHA1 4cc846edd69aac12e1889c1062c25eb30b57114f
- SHA512 145d229ae1b95861cd573a157bbfa3233e7d6e0b290fb0251101536c45f1d8e3a0d4dd4986e789dc909586682abc6345e0d3f6de6fb9fa2f3b85cebcc797cde4
- SSDEEP 6144:f/U3GfiLi/PQG2puGeqVmjaVmnS4bKO68iOJzrhfyxKdPHI1mpCUO:nUGiLDO689z9f/pTO
- TLSH
  T137D4F811B3D05D25C37F4334283A241CEAB4C2A3627D1684F59E63DF6FBB92559A3B22
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral15 behavioral16
- Target
  mod/EntityFramework.dll
- Size 5.0MB
- SHA256 ed6ebd749052f9018f6699671ae5469adedf086cf8b1bd4256bbe9c4e7f6ff05
- MD5 a35746d7a8c835f4cdaa90efe1f11511
- SHA1 c6869e2de30809f944e12b79f216ce6cfb68c9cc
- SHA512 bb8a582a573f1da3545925178f89616cb1652251723f1589a15be929ede18611798283718a42dba57cc41ac4a96b394622ef425ffae32050f54a3eddba2ed15a
- SSDEEP 49152:tz/3gBPwUkIQUWc5ql111N82UA1eiLJP+OOQoMyVWgMNsHUV26FqFcbYkDlc0Lpv:tr3QOX8HeXnzwnrm
- TLSH
  T1FB363A82BBEC06AAE5FF4779653750098AFAF9272212D71C310DF56D2A22B404B57337
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  mod/Misc/system.win32.360
- Size 4.0MB
- SHA256 8ba7bab67b6ef509e935993ad9302f2e64c541830ab5350035f46fe626c9a6a2
- MD5 55db5e0a63461605263b22b265587088
- SHA1 bfc74c47de715875e4c0b7b62dc4763f0d9b4e37
- SHA512 cf22fd517a7071371f8679dbe5af23fd3f971f36d714e34537d1c118a322a389d7bbe9d7f7ca6bdee2e18cb2cb058f58fe60a086517ab485e30899152838d832
- SSDEEP 24576:niMC4JDHbjI/WoHd7WssXVW0NruxSqJLoTsux:nTFRHbeWssFW0NrqSqxoJ
- TLSH
  T17916961EA774C10AC8085CB48CB8C398ABE5FC63155443E3B199EEAEEDFF5414D6A5E0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral19 behavioral20
- Target
  mod/Misc/system.win32.ps3
- Size 4.0MB
- SHA256 18dda5e4446e0591a982037a11d80470f206c9f14c65795490616d97c0debce1
- MD5 cb96fdb83f2661501c1f225e76cdfc71
- SHA1 b261bdd3b978a1266993acc4e5899dc5da72af8a
- SHA512 41aef1f7c94000411575d56d8ec09c70decea77cab09ec45fe8a2a089e0d39cd4321d11ba3efbff6cbf41c0f34277f56a1f11b763af11d408d0db75993150e6e
- SSDEEP 24576:niMC4JDHbjQWoHd7WssXVW0NCxSqJLoTsux:nTFRHbQWssFW0NOSqxoJ
- TLSH
  T13D16B80EE774C10AC8085CB49CB8C798EBE5FC22155443E3B199EEAEEDBF5414D6A5E0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral21 behavioral22
- Target
  mod/System.Data.SQLite.EF6.dll
- Size 182KB
- SHA256 f82e683b1936959d7fe20aa912fdef83d9fdb328e0216ffb1b3c8a1cd2623c6b
- MD5 713d180f4b615645014aa879667068c4
- SHA1 ec4b6253ba0b6af3a896ef2e874116d97ab41b5d
- SHA512 5451ea44f4223f0039296803ab9de065d769fafa479daf3a68c70fdbc81e1c64e48d0accf146b19381bf7e56705cd6854ccd168495b1f5fff1af8f9a1b3e1ceb
- SSDEEP 1536:yyUY5AraS9jcgl6KP8c6iLE+vD0UZDZ+MTJsAaDOBzOOk9abge9lh0EV:yq5AHcs6KP8cFLEalHcOTAaZ9T3V
- TLSH
  T16E049729B3F09E31C1AB42302975355CADF482F3233D9598FD9E73AD9F6A81106A3B51
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  mod/System.Data.SQLite.Linq.dll
- Size 182KB
- SHA256 02f09a1f6b530c490f34ec5f0c46f34ad77da64f425c818339f8d6737d7d603f
- MD5 7a80ccf8a6b0d4d97e6b3e7ea128a26c
- SHA1 4211c85000e9e044db7e697b035886d2ee5c7218
- SHA512 256335059514f4382dc234e4729fcc9448e73e77b35570a463c7e26db9d77592b1646326bcc98eec9764609523ec91f01bc52237db02579d343c716ab75caacf
- SSDEEP 1536:tyUY5AraS9jcKKnAHz6KP8cAwcIdAaDOVzOOkaabge9lh0E8:tq5AHcS6KP8c3fCcO/raZ9T38
- TLSH
  T1F7048629B3F09D31C1AB42302975355CBDF481F3633C5598FE9EA3AD9F6A81106A3B91
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  mod/System.Data.SQLite.dll
- Size 287KB
- SHA256 ba27c638037d5c1f31ff9340cc3d6f81c5597a90750b8c7c68e7510724078e96
- MD5 932b62b1a44100ad85ae382a6b6128d5
- SHA1 4fa55031c2db29f3b6f506e52ae4eda6cc01f5b5
- SHA512 664e48caf6da98b12d6f818fac07bbe739bc007e3a356b9bc292fcfb9efd48e00c652a4e3ffef4dbe74687cfa06b96974f10fb6d844d9a9dd8c3e13dc028f27a
- SSDEEP 6144:ZfN3D2JGVx0f+XXIqFNFaFeFOFwcGF6cmFWc0FWc8cIcKcUFJFpcNcHc7cbchFFh:L3D2YVmGoqFNFaFeFOFwcGF6cmFWc0FH
- TLSH
  T1AA542B9427DC660AF5FF63B5E8B058418B71E4236A6BC31DBCC068AF1D66740AA13773
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  mod/Utilities/ffxiiicrypt.exe
- Size 37KB
- SHA256 f9dbc8ac8b367196e449fbb78df396d15aa5f7d8d07e1e295c4435b6c1192ce3
- MD5 9bfe27440a4973e38d824b4f4f5c5791
- SHA1 94372dda860bc1ef547c9b1393115cdfc280a1fa
- SHA512 a542b656a6420a94134a2693b71d4183424dbb876844ce1911f4589a15860ba37c06f7e844b55054b551df170364c68ceee9e3526ed3aa14525b5bc6fbdeb461
- SSDEEP 768:wNXkrl4gEhJQjDtahqg0PXXEQFRiSdOE31h:wNXq4gEh61a10PkoXOoh
- TLSH
  T121033A2F63CBC1B2C1467170583B932FC27B7971375477E7BACB69A91A502C218BAD06
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral29 behavioral30
- Target
  mod/x64/SQLite.Interop.dll
- Size 1.3MB
- SHA256 6358d8328ccb9ae97d61db164136f46dd7b40832bed8f2e4376649686db08899
- MD5 3d1c8bd25963fe980916271f298ed045
- SHA1 a7d0f81855507417fbd1659af73b1cd6caf8d645
- SHA512 6973d3cec065d605eb996fa2dc66cf099bbdd993efe807137676ea808e5ee273236596f5d40c4361f5c9b2b2a77af21ec062a158c56b3d6a8679aab6ad48cbb4
- SSDEEP 24576:4cIS7tIjpEV/KDzgS8hshpUTfBBGQFcckmOaZ3VnIRWbv:rV/qShs3UTpFFPkdaZ3VT
- TLSH
  T1A8558C4BB2A501ACD5AB817D87179B07E7B174051360ABEF47AC8BA52F13FE116BE310
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32