fd358eacff1fb7abd4b3265d4226ccf994b1bac62fba6454d6f787b17f9b057c

Sharing

Copy URL Twitter E-mail

General

Target
Scritchy-Scratchy-SteamRIP.com.rar
Size 211.0MB
Sample260621-psqsbaes5y
SHA256 fd358eacff1fb7abd4b3265d4226ccf994b1bac62fba6454d6f787b17f9b057c
MD5 245c42b2dbba75f55929149b3915c241
SHA1 087d08bc45202b0767aa63dd61600a6ad605f3c2
SHA512 8a80ecf8fbf099cb01cf81090fd42254608815f6f593d97d6a93f74093ad2da6dce767605d85abe9c82f4769398c69bb62af2eda22eed8eed98b2788174ccb2b
SSDEEP 6291456:9SUZaOvzp69ORyveRxvW0BvuIXpmIgCxBrSXgRJQ3sZ9V9LOhIw:9RD09ORqcx+0ZRXpmIgC/66QYLOj
TLSH
T13EB833F1CB81AE97D2D7413539254F6FF3E680E184E7026BD8131E053E76AA583BA943
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  STEAMRIP » Free Pre-installed Steam Games.url
- Size 219B
- SHA256 4572f3812daf7bcd347d1a36834c5a9fec1f530093adf688a6ecd9e6092cbf76
- MD5 bb3af69a2e7704bc210886920ff7681f
- SHA1 42fa4a09d62cce1c0d70a63e0816135fd6b410e3
- SHA512 4f86d06f06859ed87d5f5353de9971c118477c956a8e0e0019b275f6eb035b2841c7cb959c9f4823a599ca7e73f6a0ed320207d917e8f4ab2a9b20e732551839
- TLSH
  T119D0A9BA0B58900AD321C81AE030BC08E44E75568CDED0B932C4CA8A4D96481C8A6BA8
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  Scritchy Scratchy/D3D12/D3D12Core.dll
- Size 5.6MB
- SHA256 31f364f2b3aa1753e7ba9ff912d0721c8f424be5fa14503efddafbb30c635d3b
- MD5 f2ba8763a1ef9857c4d4b7cab5631edb
- SHA1 296b7e537d6e986a2e4021834fad3334867acf3b
- SHA512 44f272560e1dbc282e70cb07c87e95ca3a7ef41839ebd20194fc411c67626e9c54e6f4b261aed3670dd21c6829b56ebdd0d28319207834a236fc462f97d4ce91
- SSDEEP 49152:k6PExwEh3ElnqHtuNfXlOunv5YcoqqjThYiwQF0Q29DgUOkpiq0SpTqJQEnUR034:1GYNfC50LRgg1x
- TLSH
  T13B565B47B2E942D8F1B7D17D8FA74A0AF6717421632097DF12110B9A6E13BE04B7B3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3 behavioral4
- Target
  Scritchy Scratchy/GameAssembly.dll
- Size 58.7MB
- SHA256 8405029b1ad0c40c2420ee32c7dd7d67c4d04d0e118b0a6cbea1be802b33b78e
- MD5 0bc165732c4be618ed0d13034daf6813
- SHA1 a0a12bf00b03d4c0332f7b2a2e8aa363f4a73236
- SHA512 da7649d3cf2994eed926e1218c5f4b2315b7866c8fbd617ba61bf529cfa3abef86b835a696d7a50a3060a11ca34ad29ef965bc0185530d75073bbe1b78056744
- SSDEEP 393216:B4H8IPNkf7qFyC8vq7A7GX23sNgbTfbW0KdIkozpBeodDPGEcWfE2Y5R+Qh2AXJz:IxK/DPGn3NL8aO
- TLSH
  T159D7294ABA754448C4AEE2389A13149FDBF13C445F606BCB24900B9D1F77BD8A87BB71
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  Scritchy Scratchy/ScritchyScratchy.exe
- Size 656KB
- SHA256 d1d70c18ac09d8010c136403e2ca9d5ad489dd7d84f5671e863437045f63f0c1
- MD5 fcde314997625da453aa2c851aa7ee80
- SHA1 7c00d576dcaed56a9227af4a92e6ed50068ef508
- SHA512 64b936dd22c78e1f4ecb26856a5102cd654f0b7027c10e9b9475c8525977e3b2b534fe6a9f94287263a3053c03f4255446ac941d3a01f179a6d7c938594a75b9
- SSDEEP 12288:o2NCDdJr3d48xBMOfkubjGOWIkOJxIVcVNfbtsKbaLkfxHuXrSU:cj2OfV6OWInbfb/baLkNer
- TLSH
  T179E47B56E6C9339BD6665B35C59ED33A83E76C20F26979411291BC8F2E2A1830CF4C73
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  Scritchy Scratchy/ScritchyScratchy_Data/Plugins/x86_64/lib_burst_generated.dll
- Size 555KB
- SHA256 fb49cd1af630835d8b21f5a5267694e2715fe535b8947faa16b78f926f3eff4c
- MD5 6b15f77ee10a2b8e5af0bf1078ea2818
- SHA1 4872401cd66b8db872f668e0c348b1664682dd89
- SHA512 60113016d62411c7e70aa47b0b418a4e6f55fffff9f20286889aad22d199eb47ac82943268d0cb5b6b0352555a15c679fbf164f30d042b7b588433603199fa2c
- SSDEEP 12288:YfZhPc48Ncj5Pi36qVuxij+4Xn38WkNGm:YfLwcjaV+kXwG
- TLSH
  T10CC48D78319776BDC11EC4B0032AAF63B223384A17455DF740D184B63EEA9D72F7992A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  Scritchy Scratchy/ScritchyScratchy_Data/Plugins/x86_64/steam_api64.dll
- Size 7.0MB
- SHA256 b677e8e5c88896d52378aa8f16a200226deacc07013e0f25c82de33c544787ab
- MD5 b4cf8d9bf983905be9e6524e964809e9
- SHA1 38eff1a5f63cb202edbc357233a9f999cc6fe7b1
- SHA512 159abca62dad8b565d7aab0cc29ac55cd01008c6372255dc8f0a2e6ba4e368be31e4f363732007292fde7cdf6494c63a969ecd675a558f0e3b37c9433f26c7d3
- SSDEEP 49152:WaYlqNiIpxQUvbpl8dIPt6TESpzWaALHg/JJLzp7QGzwYlyConLoJmaWx8dcifI/:UITP8di2tAIJJLttveY0rhyY
- TLSH
  T106761917E7BA01E5E5B6C1789653623BFD7134958334A7DB9B80560B0B72BE0EA3E340
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  Scritchy Scratchy/UnityCrashHandler64.exe
- Size 1.5MB
- SHA256 00aaefc57355c5735a4b4838c939dd6c6217c56444b09690e665e5291b146a6d
- MD5 05aa9c30dabc8d4f78a7e11a68a0a937
- SHA1 d6a500d3887fc4bafb5d5d4f82f7eff433737f72
- SHA512 9b721d325717b7c5aa8c9c9cb621b3f80204ba5801585f08c448bf927edffa059e7e1a92ec336ca6de24c294ffef278a70dedfd1d583a83eebd86bf2a572e7bd
- SSDEEP 24576:CwDi8sDK/wsgez1vdQo5wuRw9PTVoxz/y/N9w/X/:Cwm3BO1lQOwv
- TLSH
  T1A275282A2E641DCCC466843ECB83869FD2B1BC1A1F714BD717A17BA76E320D01A7B751
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  Scritchy Scratchy/UnityPlayer.dll
- Size 32.1MB
- SHA256 08dcb0794bdfaa42b2f7e21c31885418189934fa3e004e8b45490bb52ac2b058
- MD5 58a22fd5a00c85a78790cd34f5bc4193
- SHA1 e38f3e847968f04d78f11a7f5909a4be0aee2eae
- SHA512 e9f825fd553905da53c8ff5b31ec12c672996018458808a505104b4cdc2ad7c297ca6316b35a83b02d1c10967de58b6d09925a17183431abb7522168f626370f
- SSDEEP 393216:TDo1OVt/wEWfNvyJ0Ah1EylZutmPf4rwJgefmEciscsYxsd:TxiECSgGQYSd
- TLSH
  T140779D56A2B950D8D47BD038C75BA91BEBB1344503318ADB52E04AA56F33FF12A7F720
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral15 behavioral16
- Target
  Scritchy Scratchy/baselib.dll
- Size 233KB
- SHA256 1c3e100cb02f70bc510d48fb12b3c0c0beefa9e8727f4b81085ba60acfc84df8
- MD5 2de3c9def2ca905c27b2f250178be3b3
- SHA1 6940e35b3281dd42558f30d060b23c3156fb29fe
- SHA512 a5da57ce6fd1bb5cb7271c728f75c31e24d8be14ea44a55cc6bd7116eb79626661f0d9eae510c5b4504f70a7d9344ffce650f8d7d06d41f2807bcb92a3d9d780
- SSDEEP 3072:QAMqETWDciJRXaQutKbrMPaDSaZhQYDW6/JkjNe6hlTNQ68sxndwzxe1y+H/:QAMqECF7qtKbrMPbahQYpRIyCya
- TLSH
  T11B347D4573A41DA6FD7781B48E532A17F6B238024744DADF03A043A99F2BBD0693F762
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  _CommonRedist/VisualCppRedist_AIO_x86_x64.exe
- Size 30.1MB
- SHA256 3c188e4651bcc07df2bdb06d69585158797b1bafb91557b09217621628cd5b23
- MD5 1a7523d92b573859df4cbe8e75509b9e
- SHA1 65b0ccf1fe1f23c4a0557b8a30251cc7e70a1f73
- SHA512 f7c684c00265402876a4159869774096090c7482358fa1882a50468c89483c9a30066667418d510dcc5b9780fbdfd1bcc6672f92ec53cb933c0b36292c6ec40b
- SSDEEP 786432:4JVdGL3z5NXeyQIwJtNYUJwif0nOJa9WEWRIOG5B7DVGLhYNBFv3cnZCa:gjOLXelIMjJwi0wMVW6n7ShYWCa
- TLSH
  T10E6733B51858C4B8E7E0B1F00807F5E1769AF9BCE9C5CC46B1F4BC99A19E4618FE612C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware discovery persistence privilege_escalation ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral19 behavioral20
- Target
  _CommonRedist/dotNetFx40_Full_setup.exe
- Size 868KB
- SHA256 fa1afff978325f8818ce3a559d67a58297d9154674de7fd8eb03656d93104425
- MD5 53406e9988306cbd4537677c5336aba4
- SHA1 06becadb92a5fcca2529c0b93687c2a0c6d0d610
- SHA512 4f89da81b5a3800aa16ff33cc4a42dbb17d4c698a5e2983b88c32738decb57e3088a1da444ad0ec0d745c3c6b6b8b9b86d3f19909142f9e51f513748c0274a99
- SSDEEP 24576:+tW4x8xAxCdUcyezFSjaBHFaNlsqK5/oh6iZf1LUXw/vxNI:d4x8xqCGexm8FCspg0iZf1LUXD
- TLSH
  T1F2151232ABA0C133D4DB28B48ADDB6B2657DE6610374C4C7B7440BEEAC307D1697964B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Executes dropped EXE
- Loads dropped DLL
behavioral21 behavioral22
- Target
  _CommonRedist/dxwebsetup.exe
- Size 288KB
- SHA256 2cf71d098c608c56e07f4655855a886c3102553f648df88458df616b26fd612f
- MD5 2cbd6ad183914a0c554f0739069e77d7
- SHA1 7bf35f2afca666078db35ca95130beb2e3782212
- SHA512 ff1af2d2a883865f2412dddcd68006d1907a719fe833319c833f897c93ee750bac494c0991170dc1cf726b3f0406707daa361d06568cd610eeb4ed1d9c0fbb10
- SSDEEP 6144:kWK8fc2liXmrLxcdRDLiH1vVRGVOhMp421/7YQV:VcvgLARDI1KIOzO0
- TLSH
  T19654F15197E4817BE4FA1B311DF2025327797DE86CB9E32E838658881D71780BE35B27
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery persistence adware ransomware spyware
- Adds Run key to start application
  persistence
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral23 behavioral24
- Target
  _CommonRedist/oalinst.exe
- Size 790KB
- SHA256 b8f39714d41e009f75efb183c37100f2cbabb71784bbd243be881ac5b42d86fd
- MD5 694f54bd227916b89fc3eb1db53f0685
- SHA1 21fdc367291bbef14dac27925cae698d3928eead
- SHA512 55bc0de75a7f27f11eb8f4ee8c9934dfe1acd044d8b7b2151c506bdcbead3ab179df7023f699c9139c77541bbc4b1c0657e93c34a6bc4309b665c6cb7636a7e5
- SSDEEP 12288:0s1yfEcpPzdv+t4cRIy3ze3SUN0PXGTjiqRy2p3kwzjGHTkV:NwfLrvi4cRIyDe3SUNaXy+WypoGHgV
- TLSH
  T1E005F10020D5CC73E4EB32B3843586746EBA7E912F0A285B7FC476AEE673176DA71215
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops file in System32 directory
behavioral25 behavioral26
- Target
  _CommonRedist/xnafx40_redist.msi
- Size 6.7MB
- SHA256 47260420773a20443fb1e38a89b7f39c5237a80a842de598e6c8f7f90a3bbd6d
- MD5 ff1c0202ab7147c9dfd34b582f1da13f
- SHA1 5fc95a9ad87a38e71a953af116fd1f1cbe46a3e7
- SHA512 9a233fd33fa535d0783ac4a97108166b860d7647998ce184e6e5103200a6c8522a5e4d035b85e02280f5176c092e0d3e61a60f228d7ca17f09fcf2fc5cdf5253
- SSDEEP 98304:synfL329J1XswfXO6wiBB+4RZg6aENaCZAU5PMO0MntfERyJGH2YPq/:sYD3C1XXfzH+4cLHU5PM/Mnt+YGlq
- TLSH
  T1D06622A2751AFF41DDB406FCD970CA490925CF3B82274C686929356A7BF7E0202E9D4F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery persistence privilege_escalation ransomware
- Executes dropped EXE
- Loads dropped DLL
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral27 behavioral28