8badbf3137eff3ef29b93dc0da985aed4f974fca8c1f681601ab1c87d747b845

Sharing

Copy URL Twitter E-mail

General

Target
skytools.exe
Size 4.1MB
Sample260620-tfrajafy4k
SHA256 8badbf3137eff3ef29b93dc0da985aed4f974fca8c1f681601ab1c87d747b845
MD5 e0ac877174e33d9a3cf1e2d2b39eb9e9
SHA1 398de1c207f0d3c6fe5f140890c2e6013a9cd5b8
SHA512 930ae3245b0910a3d3e31efe15b7364eb90b232e63e719ad306b10bf5876683a3b21d0bada9131ac4d682eb7b7e9c8a659a14517df03743d0351f0f007c61400
SSDEEP 98304:g6uoe0/jI++/1V9QLZn234MIscUz7rIaebALUjdw24tFCig+wRYM:g6KwjI++/1VSFnG4WjzXM+KdYtFyR
TLSH
T1C21633668BF5D47DD8A4EB792F74480553E84210B2C876DBE3E0631DFCB6191E30ABA4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  skytools.exe
- Size 4.1MB
- SHA256 8badbf3137eff3ef29b93dc0da985aed4f974fca8c1f681601ab1c87d747b845
- MD5 e0ac877174e33d9a3cf1e2d2b39eb9e9
- SHA1 398de1c207f0d3c6fe5f140890c2e6013a9cd5b8
- SHA512 930ae3245b0910a3d3e31efe15b7364eb90b232e63e719ad306b10bf5876683a3b21d0bada9131ac4d682eb7b7e9c8a659a14517df03743d0351f0f007c61400
- SSDEEP 98304:g6uoe0/jI++/1V9QLZn234MIscUz7rIaebALUjdw24tFCig+wRYM:g6KwjI++/1VSFnG4WjzXM+KdYtFyR
- TLSH
  T1C21633668BF5D47DD8A4EB792F74480553E84210B2C876DBE3E0631DFCB6191E30ABA4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2
- Target
  millennium/plugins/luatools/backend/restart_steam.cmd
- Size 532B
- SHA256 0b17eeec8d2e0e72c5a896a1d9558ac06928e3e2edcf7af23428afe571aa790e
- MD5 21b7509230737e6d588e450c1056ce7c
- SHA1 c57c7220578e542f249bbade1dc4cf6e4dff3508
- SHA512 6b2152e412869e99637b6fc06e4f58aa573ef1ce0803690ea7629903d83dab731c969027bed7b5fdf212f7819066f40e27d43c3f5db82892e52215124fde3b04
- TLSH
  T1E6F0C900EC022835AFE853B6ED051177AB5BE513400E1DD2929B45A0A8297CA25F68BD
- MD5 SHA1 SHA512 TLSH
Score

8^/10

defense_evasion adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3 behavioral4
- Target
  millennium/plugins/luatools/backend/scripts/downloader.ps1
- Size 3KB
- SHA256 80b38e5f195ee246ff6e3e5503d3505fafa849f57a44284c5ed1d1a76861e8b4
- MD5 f74b46e536fdd729cc2f14aaf60e943f
- SHA1 66185c63225ae927957139f30d9a727e05406ba6
- SHA512 f45ae3073e2175506e2f53fde291b27831221279fbdb57f1cc9973d363adbc88d0b0ed239c63b2b4f7aea171b3196cf7d3a10b8ae1d4b36e168c160968c87b4c
- TLSH
  T12081732092D1B990478366FDAD48D808BEB24027604D1C51F9CCD6C6AFE5B2CCEB6BD7
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral5 behavioral6
- Target
  millennium/plugins/luatools/backend/scripts/downloader.sh
- Size 802B
- SHA256 8f68002b55fcb79a3c53e3ac662b5c01e23819e8426a69cedc668fe36d151235
- MD5 5f04a20fb05271e7c4884efd6f941918
- SHA1 b49fee729486743c093b4e21b7306e37ae76968e
- SHA512 95865ff092d0b614ec410fccd08b90866ebc3fb1862951231e3f0bc03db5465037b935b96be50c79b5fef65fddc657476ce2e9d97d6c19c5580b89a74fefbef6
- TLSH
  T1A201264AB08663BF14E715485E4FA0A43CA236638E1C6D28B51C21A82F36592F77C71F
- MD5 SHA1 SHA512 TLSH
Score

4^/10

discovery antivm
behavioral10 behavioral7 behavioral8 behavioral9
- Target
  millennium/plugins/luatools/backend/settings/manager.lua
- Size 7KB
- SHA256 877e819d42dfc657f029a44892d0fc2d957faad0ea21bcd299a4aee017e00a8b
- MD5 5be34b386320e7d77f23a97ad4271e39
- SHA1 26b8e673d10678e48b7e97aaa4fde759a1375ac1
- SHA512 294c1823764fb244b062392779a3b745b21c52f826ec8ab4c3fe56e25389bf9ee9e5e3cdcc5704c6ff0afd80cc691aeefa35d554ee68e998d5be56c46c59f0d6
- SSDEEP 192:/UJGqvDFJ8jCHIefeXh+rW1F4FggR1K8YdfYR+DROW84fGxmtAoWm0Rr53R1bDYi:/UtvDc1h+rUtgYd5CTxmtAolcvHzqTcL
- TLSH
  T143F153AB3647A011A8F3D5C0EC4F5801E32A414361294859B76D8DA93F31E9DE3E2FBC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  millennium/plugins/luatools/backend/settings/options.lua
- Size 3KB
- SHA256 7f4afa44df72ef3a398dd77d8b895035440d3150dca85f3b6fe18c67ea765c3e
- MD5 50e3d0d52819c1731d1299358cf4abe0
- SHA1 fcb18ee40339647d294e13d325e0b255db39629c
- SHA512 f8a20648523ade192549f33092328551328dca9731d77ac9951c93edd161479327836b36770d5501e9649084bf7ee1fce865953b0e9601116a2eb4233486f97d
- TLSH
  T18781EB4E7E52E90060C7F8E1149588067D35930779053868B7EE8AD92F1CA2FE0F339D
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral13 behavioral14
- Target
  millennium/plugins/luatools/backend/steam_utils.lua
- Size 3KB
- SHA256 119d6cdc6c4313854e0851db865084202ac02545544ebf4501a9b0d6b3328b50
- MD5 ccf431e863f85cbb134a782fa3640e8d
- SHA1 88c1563d95b6f477599b05cd19c53542705d9b4b
- SHA512 a7bde56d343240cb950cabd42fff5c074081fc07a2e0816de521f3da8ad6eb3e6e9276abd2ec8d221bc7c42eb03689c2e0ea611f63ea953b008fe84e0e07c588
- TLSH
  T1D471D06A554A66547AF1D798CE0B1C5BF14284E3431A0030BAFD09C53FB12BC95F6BBE
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral15 behavioral16
- Target
  millennium/plugins/luatools/backend/temp_dl/3959110.zip
- Size 41KB
- SHA256 e4363f268258cbf21c128e1f2a7973b17d6e06b073f3d8fa578ae68ab6c811bd
- MD5 77086aafa422145c3012d557411c0578
- SHA1 2cbfc38b3f85be6f44e918bb8225011ac5cf7ba6
- SHA512 f3a8b1d96923a8aeebc4c3116823111c78371a9805b9279717593b327659c2842ce0fc1066ce08b195041a74fe3220b7d4fc8c6da2f277aec435528ab9719736
- SSDEEP 768:DNbkQAT/VglAFCg6FEwrZrWP/2h4BJYvqsbSdz392LoZCKDv0cEaEtQ7VzVrKx:eQ64AFL6FEwdceh4BJYvIP28Dv0cjEag
- TLSH
  T19513F14B47EA4A21D21B593C622A65F7E3F8B0E44F5F50D79A0083383929BE4EC52771
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  millennium/plugins/luatools/backend/temp_dl/3959110_state.json
- Size 24B
- SHA256 60c1d67182d2541875343360c19e15f1129a46eae07507dcdb1e9d014e6d6d44
- MD5 0ebe7bdeeaa92871979b2834cba7269b
- SHA1 fe97e60e10547347638d1a1daf8c950689f4caf6
- SHA512 445b4a53b803cd8b8b1da4e74a1c9720d6d159387ad3561c3e91dec68cc0e2f2ef747be7bc4aa5c8841ac9fe93d26a57ec7f8067a0ebe9052467ca9e402ced12
- MD5 SHA1 SHA512
Score

3^/10
behavioral19 behavioral20
- Target
  millennium/plugins/luatools/backend/temp_dl/extracted_3959110/228989_3514306556860204959.manifest
- Size 2KB
- SHA256 069148f8dba81ddbd7cd596fcb25430a3433fb28dcaddaa572d1e437cd10f0ad
- MD5 72e6f1a926d91a9bb1316d6b861bcd4b
- SHA1 9e3cb0f7e403757e366ed95341fcbb583f5d6875
- SHA512 b2b7a7c4c29d6763c78defddac83f3308a2d0faf34bf2317fb547b215dce4f14b4904723f5b03aa825702d03bfb23dd14fbae999d5def658cbb1d8fd537c3628
- TLSH
  T1435183513F95C0DBEF9436FB6447F91C88851DB244611E17D54D93E28CAC8C7B286A22
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral21 behavioral22
- Target
  millennium/plugins/luatools/backend/temp_dl/extracted_3959110/228990_1829726630299308803.manifest
- Size 24KB
- SHA256 1fee2c5c9b75352f6f5c44472ed1a7d9a8fb0bc97e43eca449bba2362e2adeaf
- MD5 52687c2f2b1184fbf3fd662cf17bb40b
- SHA1 b78bd741f53fdd76c5a5618038c5d8172b67b812
- SHA512 f5c0e9c020fe1d003cec0c237d525e00f3a45c966804297252b192e9dfe05695b335c894caa1eb143e394d1805d74beac45c8710f30504d73c71e0f8a4597546
- SSDEEP 384:Yub383UtI498KZijyzUA93nDgjn702gYBsREHJqtCPMGkezi:q+98KZF3nDO7yYSRwQCPMFki
- TLSH
  T1C4B2862372EE41CAB591E1C9619BB50C90FD027A0AE47E458EDB33EB9F2E45D6070832
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral23 behavioral24
- Target
  millennium/plugins/luatools/backend/temp_dl/extracted_3959110/3959110.lua
- Size 455B
- SHA256 9f3cab84ba903c787f1b6716da0dbe8f4318e9ca9a2ecdad0dba64e3e528b48c
- MD5 5d9cb660315acf55a5656eea6c08bf2f
- SHA1 636e4b4ac449ef3e35aa2392be563a745b66ccb3
- SHA512 f5d32a732acc6d74436077cf0667c4a7a9ec8b61dcd2be139c827b746bd52ceb047dc8d494eb0bf3beaf638093209d6659afbee160878e7cdc2a13907adfd8fd
- TLSH
  T1B6F027225A3458543B20582AB65F8E3B38A980E7779E96B7441079CE114B578CF2590C
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral25 behavioral26
- Target
  millennium/plugins/luatools/backend/temp_dl/extracted_3959110/3959111_6230809352819513535.manifest
- Size 31KB
- SHA256 aae1ca322fa799ef880bc8216f63e5a7d4a822da3734e9cce9031b14db51e14f
- MD5 0ef0383ae4be67ab72c3874863b0079e
- SHA1 4c3e1d683ce484e81867f094585d91316e31682e
- SHA512 eb7c9d1de3d3003107d5cbc406c39be9505c319e17856acc6c01dc6023cc0bafe18666b59f48abfd45dc721c43dc78680e30c6cd7486429c186ed55101bb92d6
- SSDEEP 768:IUs8TucdFUu+BiwqA9Kfhs3xdalqpCNdycg6na5TD:ZLrUu49uhs32w/6na5H
- TLSH
  T179E27C503A3190E1E304377B1C89F76CAA424E734741A8A6D61D99A3CDBECFB5BCA705
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral27 behavioral28
- Target
  millennium/plugins/luatools/backend/update.json
- Size 111B
- SHA256 dcf46ba9b2f6ddee75d6bf8fd37940efa50078d3da618dc679136aff6d94e590
- MD5 fc86cbaecc921cd3b58993aaeab67cce
- SHA1 a6c317d566b5bcbbeab4bae9035c8ee31d06bceb
- SHA512 b522abf4afebecd0ed937f3acae28e0df630c068f4d2dff1dbb6face24a9708bc6393dbf8c250d10a460264d45648f0e3529c5a07f2bbf800c9ded3cbe86eaf1
- TLSH
  T1E9B09244942D4E2206BA02C4447680C2A048468B5A14B812A3312B2F9F8C2A618572AC
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral29 behavioral30
- Target
  millennium/plugins/luatools/plugin.json
- Size 288B
- SHA256 c5319b88763941e64d34e9884123c8ef06e3ccf5f17bcf70fa91582c2d347bd7
- MD5 7dc8e9f2e69ee811fbc17dc840f6777c
- SHA1 ca2465517c90de8dce83009a6c48120587866420
- SHA512 4e585c0fe99a102acee6e6bf5ea4f5c4c281894a5ad64c120620d8fa3bdc8861081af989b91556c28b434dd048d57358063c5d42d0644dc032f794ce6fe4cf7d
- TLSH
  T174D02BB8CC16053305EB87ECAC6C92E7D6A11E8B6054F669C713A51C8BDC4B764B631D
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral31 behavioral32