47d5dcf31c16165f0a422836e2f288c2e179f73c92f43469fd82a07295bcef39

General

Target
HappyGames.exe
Size 32.5MB
Sample260621-wae2esev2q
SHA256 47d5dcf31c16165f0a422836e2f288c2e179f73c92f43469fd82a07295bcef39
MD5 98d72db4fa757af70865707e59cb03ba
SHA1 27ebc84d57a633eaa41b83fbbc8e9d4ccfbcd89f
SHA512 4d5df1d374417a2af359be9bb66f71a5e0a6372cc87ef9b5ceb76697cf7c4ea4121cd19694263a8105fec5c337da8966837161bd86330fa8152c5707017ff481
SSDEEP 786432:EYljSYGuSUA0L5fa7KZzW+NjcOjTNGCgK/2eVVuiDsX/6CelBe:EojSjd0Lda7KZzNNoK4C2eNoXyCel
TLSH
T135773311FBD416F1FAD9527C50ADD422AEBAFA966736C08F047DA4630FA35E11938E30
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  HappyGames.exe
- Size 32.5MB
- SHA256 47d5dcf31c16165f0a422836e2f288c2e179f73c92f43469fd82a07295bcef39
- MD5 98d72db4fa757af70865707e59cb03ba
- SHA1 27ebc84d57a633eaa41b83fbbc8e9d4ccfbcd89f
- SHA512 4d5df1d374417a2af359be9bb66f71a5e0a6372cc87ef9b5ceb76697cf7c4ea4121cd19694263a8105fec5c337da8966837161bd86330fa8152c5707017ff481
- SSDEEP 786432:EYljSYGuSUA0L5fa7KZzW+NjcOjTNGCgK/2eVVuiDsX/6CelBe:EojSjd0Lda7KZzNNoK4C2eNoXyCel
- TLSH
  T135773311FBD416F1FAD9527C50ADD422AEBAFA966736C08F047DA4630FA35E11938E30
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

credential_access discovery execution persistence spyware stealer adware ransomware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Loads dropped DLL
- Reads ssh keys stored on the system
  Tries to access SSH used by SSH programs.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Enumerates processes with tasklist
  discovery
behavioral1 behavioral2