9bc877b840f95f36d7aba931bf8138eb0934fc6206ac9a07a99feaed452b16ec

Sharing

Copy URL Twitter E-mail

General

Target
Night_Of_Revenge1.0.7_Fixed.7z
Size 428.2MB
Sample260621-txecasez51
SHA256 9bc877b840f95f36d7aba931bf8138eb0934fc6206ac9a07a99feaed452b16ec
MD5 39de40052ca8489bcf367652cd9c6739
SHA1 d0f650a4f0009cddf4c9a2cf4d890b04d0ffc168
SHA512 55d56e89106781aafa984380eeb9a50900330fb3cf51fefde5db1fce3cb01c99de916ee30e720941b5a4b9e822b42fb75eba6a4139363b3cae582ca2aba3cf9f
SSDEEP 12582912:A7YyK5wJtuv+O3qizicc/wLq9BfoevGMc2qYHxgva:P+ahdz2/R7GJyxgS
TLSH
T1722933AEE42B8F91D1AC9D3E00E17FE36E17997FDE9601FB880208754CC6A55160F867
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  NightofRevenge_1.07/64bit/Plugins/AudioClip.bep
- Size 29KB
- SHA256 15f32a1e5002650ad7167254a8f0e64db2cc41b03b51b55572853338def82984
- MD5 49e02ee475c4c29b066f42601df63005
- SHA1 1bf56f1ec80914cef1fcad813bd0d5686f12d26c
- SHA512 7a2b54248ca9580926901ded95610907660dd9816fda5f07b86494cbd3f174adb584e06fd384892af3fddb12a6d008900095d450f8a37ef31b5837e481554b67
- SSDEEP 384:xrzTvM2VlcoXzUPMOwTzrKVgUQn6+ln46rit5GT8LYJ54DJf6yHC/PTD4WOlJ8h0:lXEsgPMh3HVut5Qcy54h6DD/Ol+Tu
- TLSH
  T148D2E86837AD11D9F162D938D83B5603C773749A1B3257DF13A0825E0E2BBD8DA78B02
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  NightofRevenge_1.07/64bit/Plugins/Mesh.bep
- Size 1.3MB
- SHA256 32fad3df3130557766406f78d85a9e0ed018b8f46b32a268770a4688d52a0ad9
- MD5 a0e7841cc9b48276013d9eb44aebbd03
- SHA1 1070674c9f8a3ab24377b3fc6fd2178475b9f215
- SHA512 9e5b5770fc7d2864c66a2d6737572a12b25ddc8669fb4455a78ac78d6d1d17a8b755b3dec548c6bcbe98cf5729830ee3d30dbf51c5fe51cc2b043c94040f2c31
- SSDEEP 24576:8QpafGa6USAsTSKKWR4wUfF6bImJIgTuIKxV1fk2lQvrdoNsBrkm/TKqAEQ:RKWR4wyF60mJbbKxV1fk2lQvrdoOrkCJ
- TLSH
  T1D1557D2627AC8074D0BB92788AD6C587E7F234854B76CBDB416A491E1F33BB1463DF21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  NightofRevenge_1.07/64bit/Plugins/MovieTexture.bep
- Size 35KB
- SHA256 fb5685b7dddd305dd47bae6e41d0dd2f4152e9a920a4a517271f0e23f4bba3ba
- MD5 93984aac4da09737edb81364c27b807b
- SHA1 2cdd661597af72ed4f5ccce1732b52452dfb08fc
- SHA512 726ee718cdebdb76b7cf2f49630db8bbbe613594207d853756e7b2b03f8751973588848f18fdb2c652949649514156686b2b89c86f92480366e5f4b36f834b80
- SSDEEP 768:9Oq50wUerNT+BEELLnQFE//UAFEY6BVoxzedyHYRTOlUKs:9Sk+BBz//UAFEh7oxz+yHEOl1s
- TLSH
  T131F219297B6C4092E0B691BCCE664B46D6F234454B255BEF93B0821F1F37AE86538721
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  NightofRevenge_1.07/64bit/Plugins/SubstanceArchive.bep
- Size 21KB
- SHA256 ba1e9d7f2d3d191a69d234567fca417222edc5619eafda18eaed20277656d7b8
- MD5 7d1b70b54b1ab8763cf5e437c46d8257
- SHA1 33d24d77d30b3fef851e5cfada8d7ed09b5f8859
- SHA512 ec1aff8d323ef97a42e66c4af971457982449e36a0c29d3f48cc4efb9db66acee61a17ebe94034798a86440f62331c6d9cab43e2119969c7b4f7ef84d26cead5
- SSDEEP 384:H2h8n/w1Jo7gfKn2wmJhgLTbUaSC6ufyZTURRVarxBf9OlCtQ:E8/w1Jotb8qn7SCry9iGFOlCK
- TLSH
  T124A2391E376E41A6F13BD6788AB26503CAF230431B27A6EF53A1575D0F237C89D38A51
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  NightofRevenge_1.07/64bit/Plugins/TerrainData.bep
- Size 37KB
- SHA256 e6b639df03e40e3c77c7cd7fddfc54ea21ca1c966d6007274feff9033a93028d
- MD5 7023c20cd4c595751e6b969606a8bd91
- SHA1 9804b15fd710b78f1af159cd1a8a1dc407c04c6f
- SHA512 752ac6799f9093c6689a13a2b141badd25ecbfe07a61ff8c7611faade4bd1a4f33340553a85b2fab0bd600b71f511df7880d607fd981ddab5fd3bc4790ebf917
- SSDEEP 768:ZHVHbSIc7+ppyXUpkT/m8H2+GzzEjjn+64fq+KRNX9B7SOlUxNa:ZHh+IcKppyXUpK/1hjjjn+xynUOlc
- TLSH
  T112032B297B6C80A5D076D1BCCE660A52E6F374510B329BDF63A0861F1F37BE89934B11
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral10 behavioral9
- Target
  NightofRevenge_1.07/64bit/Plugins/TextAsset.bep
- Size 34KB
- SHA256 03e776532d552e650c5c18f937ca8d1ed1c537780202a7523ef96f7707f47da4
- MD5 16497d2d7ce76c7317293bb7f357dfe7
- SHA1 ce1a1ee14c4657dd4017d61baf02ffcd08c9dcb4
- SHA512 f919bbc662d030392c5177f834836867136e171bc1cd7940681964ec5a601a2d6e5ab5931ba536279d1e5ccd732684ae856d54e662d841e4307878918f5e50c9
- SSDEEP 768:XietJQ06mEtpPNJsEll+AGTclFOlUIW6:XiuN6/nTll+AGTOOllW6
- TLSH
  T1ACF22A2D3B7C4195E17AD17CCF664602D6B274410B269BEF93B0861E0F37AF96938721
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  NightofRevenge_1.07/64bit/Plugins/Texture.bep
- Size 169KB
- SHA256 8308dd7a4d2c277d778dd1464ccb615df7f703fbc15ea73ec6f4e69d4339ee72
- MD5 ccca1798ec7c82fd684c283e16f1ac5d
- SHA1 bbdb1ff14b7f3123e1239817123bf4063ee8f274
- SHA512 ccb18c705a97358a9d094e5c4916fe315419bdf4c270324cd64cce0470cd9880c0e20a885020ef8b2dabcfcce373262ce28ea2a275a03ce3afdbd6c1c58de66e
- SSDEEP 3072:txHDUI/1gfK/kNZ2Fg2W++lNiJsutNbbb1WSHfnGSOlzr:zHp/1RMNZ22cUiKutNbbb1WSpOlz
- TLSH
  T1C2047D547BF740E6D067C178C9A19A87F77238450720ABEF41A1877B1F27EE26A39360
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  NightofRevenge_1.07/64bit/Plugins/UMAMesh.bep
- Size 32KB
- SHA256 d4843f5df0abd196eb5294277a4522881c144cc020f483d234c028464933aec6
- MD5 0914ec372b22680f1abe685931c2df9c
- SHA1 6da2eacd7807a25bbfae82f267d1922653fb731d
- SHA512 b47c9222fdb146a5ebb31f12fcefa00ff72ee80c7ba5b0ba62937ce2b8073bcef7f4ad4de83b3e8cbe563b37b82ce80945a97810ed27e405ea632157c35d703e
- SSDEEP 768:U8xpHzCFIzlXMIaxyA5AVEEqkxYZXWOlYb+:jxdzCFqIHAVEEqcIWOl2
- TLSH
  T175E23A58376C11E4E132D17DCAAA4A03E6F23853072297DF63A1575E0F376E89938B71
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral15 behavioral16
- Target
  NightofRevenge_1.07/NightofRevenge_Data/Mono/etc/mono/1.0/DefaultWsdlHelpGenerator.aspx
- Size 56KB
- SHA256 d87d5196b2ae2abf4e673315e1fd22c3a44df80192f23e89b78108579c287524
- MD5 66fed2411c14a0fc8ce4c593ef601bfb
- SHA1 4680a34aae1193f1e4a6aac1a5dd3c307de257fb
- SHA512 331874a9956c87db0646e4d21937a88009804a59fdf5f5882ea5b1dfb7dd7ef17724e09877d98f52e7327bbf38a46dde0c54d5c85f1e860b88322bdfad64679d
- SSDEEP 768:M28utHkOFpMgMwP9h5Ij7khsp/6JtEZwMxVtkUI353cXyEyk3VbNb1gNuoT1y:ZDF6CdsCOZwMx3k5JYyklhxgRw
- TLSH
  T17743C4A0EF5C8D36499A52D9F88140CCB9BDC43291199CF3FCCDA12AF09CD6DA274766
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  NightofRevenge_1.07/NightofRevenge_Data/Mono/etc/mono/2.0/DefaultWsdlHelpGenerator.aspx
- Size 59KB
- SHA256 ae044cd9cc2c7c42f8864195125ab440472d657e5f0d55e131f7890bd45c518a
- MD5 3b3452c399f27a24ea5a589c7bfe750b
- SHA1 b06cb1d09ad3bbdf1d8214c910e3da2a228d113c
- SHA512 41c099350159e942be8bc04c8f59c7fb0fd4bd99db46f1c0158f0fa053c08ae0c73e9d169f6816b77376283cce5beafdcfe5d3d5e3b98e8b358d67c34b954a04
- SSDEEP 768:6CEPutHjWpMgMwP9h5Ij7khsp/6JtEZwMXVtkUI3t3CXyEyk3VbNbqDvJ4oT1y:/q6CdsCOZwMX3k5dWyklh+Dvbw
- TLSH
  T19F43D4A0EE5C8D36499B52D9F48140DCB9BCC43191299CF3FCDDA12AF09CC6DA278676
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral19 behavioral20

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20