f7264b06aa12ffaec554a93c2d85af1a860fbb10655070f638c3d3f7857ed97c

Sharing

Copy URL Twitter E-mail

General

Target
Novatsug's extra clothes v1.8.1.mcaddon
Size 1.1MB
Sample260622-ptbpsab15r
SHA256 f7264b06aa12ffaec554a93c2d85af1a860fbb10655070f638c3d3f7857ed97c
MD5 8097e1ab926ecef334ce772055278c74
SHA1 8022cd4bf64724bab0dfd4d6e166a8e8fe9ea3e6
SHA512 a535f6bb1a9b77b791acc59b1c467b1c0a6db985f0643f18e33862a5e10c9317e7536a4870f75e85a1e156f95c750d4c9d27904bec6d98feb0ad150c22f4f48f
SSDEEP 24576:E1pwmvR9EqG/Y9a6Jud+VGYwb3WnKH2tb1LhxC9GNB:cp9FG/Y9a0ud+Vbwb3SFvLhvB
TLSH
T1EC457D1DBFEBDC9BCB7BD5792104A203D4188A5E8A40E04B6AC1BD7C58E09894752DFF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Novatsug's extra clothes v1.8.1.mcaddon
- Size 1.1MB
- SHA256 f7264b06aa12ffaec554a93c2d85af1a860fbb10655070f638c3d3f7857ed97c
- MD5 8097e1ab926ecef334ce772055278c74
- SHA1 8022cd4bf64724bab0dfd4d6e166a8e8fe9ea3e6
- SHA512 a535f6bb1a9b77b791acc59b1c467b1c0a6db985f0643f18e33862a5e10c9317e7536a4870f75e85a1e156f95c750d4c9d27904bec6d98feb0ad150c22f4f48f
- SSDEEP 24576:E1pwmvR9EqG/Y9a6Jud+VGYwb3WnKH2tb1LhxC9GNB:cp9FG/Y9a0ud+Vbwb3SFvLhvB
- TLSH
  T1EC457D1DBFEBDC9BCB7BD5792104A203D4188A5E8A40E04B6AC1BD7C58E09894752DFF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2
- Target
  BP/entities/npcs/giru.json
- Size 1KB
- SHA256 e676a98a9ecb94b3fa0d35a518763d34e0293702aa1ab87c40feafee5438cfc6
- MD5 cbffbc878441b4cdc37a57fd902d7d96
- SHA1 4dfd8b9b29e8f59492a39701ca19746d6d769510
- SHA512 e5c57dea0b17d77f787505f04aba6e626877b3803699f4363b8c476248942bd9394f2bab25d11a64a65be5087ee81aab0e17d4f83e9f79a346cabf1596a217ef
- TLSH
  T1D131AF18D9A62D6F21BFF634ADB95342F770823F9100189A7ABD904D2FB18A45103F6D
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral3 behavioral4
- Target
  BP/item_catalog/crafting_item_catalog.json
- Size 18KB
- SHA256 9571ae23b8f9781047485e5e00d290592fc2349ce935654ce43f0dcd8572b31d
- MD5 2f155e3fed9754dbb8429440565fb4cd
- SHA1 6b9540de9e13999f97919a58ff7084ab43edc119
- SHA512 5da3892863d1661222481d5d970916e628d9c332312c0682483b5af31e45e4a7a877d96f298dc3d6425c886db35ff538c45630d992b6112e5b060cbbae801496
- SSDEEP 384:3slxDdsZ4RFI93k0cm83lEwyMugsopU8LpS7urq9GQDCWRYdnH3dAFv6gXAfhe3o:3hRuMA
- TLSH
  T11F82DE1BDEAA9C6803708A9DDC851A04F5A4431FAEA8844777FFBDDC2FF10A0D56750A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral5 behavioral6
- Target
  BP/items/armors/amy_battle_boots.json
- Size 1KB
- SHA256 a903e412e14a84d3b457156c0ae49073d0dfc749baf74e6e9c719f65d5aa8556
- MD5 cb3ae5d5d1d45227bd74a6fb11f9ddf0
- SHA1 dedc6ec8901d0b18fa7bb0afb237e21fa181b12e
- SHA512 9f4c742309408c286cf24089349d327e4eecaa3ce3ba00a24e6e2372c7c310674c7e2bb01e82800e9419dfc48c2820574423433fb87e566bdffc3b01134c38a0
- TLSH
  T1A421D22AC9162E9B20BAF37AEEBD0601F7A4123B854104CA3ABC551C1FB2597D006F2D
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral7 behavioral8
- Target
  BP/items/armors/amy_battle_chestplate.json
- Size 1KB
- SHA256 d8a765ed4d5a0a49c17e0191bfc46b4c275d58e5644a72847c5c7760ae52fde3
- MD5 977d27cc3a07dc670a2e4e54f02e8a6f
- SHA1 150a4c031a983e3ffed7c36e9017341f0a2ffd19
- SHA512 3c1964625f6edd836083d6ac68e1678d238de029a993f8fcf56d0616367d158e33798aa1df7d068b537fc146a0742389823c6cd6c7a9bc9bb0b95c0da2f2a75a
- TLSH
  T10721C43AD92A2EAB117AF3BAFEB90601F774122F850104CA3ABC851C1F715979006F1C
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral10 behavioral9
- Target
  BP/items/armors/amy_battle_leggings.json
- Size 1KB
- SHA256 33660023e19334830c1bfc46e34a7fb0ca4ddc1268ac45e620289be617848548
- MD5 4b073b9276f39421ea5e82dd94ccc94b
- SHA1 add2593360c913fc9ba0ccd3bd70e1cd91b813bc
- SHA512 5a0283421532ad8cd5ccdffcf0c7968bf59f4f473b57cb09fab911b1c0d0ee26a7f885daba014ae81097d49ce9cde0341d8f3193320bb81cca3fcec5b880d94b
- TLSH
  T104215519C8761EDB209EF5696EFD0141F3B4502BCD092DA93E6C410C4F548AA946FBDC
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral11 behavioral12
- Target
  BP/items/armors/bardock_super_boots.json
- Size 1KB
- SHA256 70aa78c29a384d0e80adfcc3c49644b91b3194a1496a56d36a0c0f4adb6dab9a
- MD5 8adb47986910982ae971d566a64904f4
- SHA1 829c9580772610fd3960dc31747e25cbeec5e5e2
- SHA512 137df43ef19a48415f0198ed404fbf77c5425a1fb1551547689e2fd4dab75cf87953fb713b79888c2e20e0decc3b93838351fb430a9b7b6e711e0d8714d1e6b2
- TLSH
  T16421042ED9A92E9F607AF37AAEF91601F760422B854104CA7B7C511C1FB2597C016F1D
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral13 behavioral14
- Target
  BP/items/armors/bardock_super_chestplate.json
- Size 1KB
- SHA256 e0707364792e8b859741af09e377a3f4877fa65e2c94b64296fbfb32559daac1
- MD5 61fa1aefef184d34e9af8d9839a0edc8
- SHA1 8a6d5d88e2cb4cc14ddedb9788c2dadcd1281d5f
- SHA512 f58ddff51e8147ee41b43f1258e88f54f9a2e420262a98a0371e20d63babffe89e36b1b193abfa564522f8746d1558fcbf8687553e36c0e4ef92d035ec003d94
- TLSH
  T1BB21E93ADA6A2E5B617AB37ABEB91601F770422BC50104CA7F7C451C1F725978016F1C
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral15 behavioral16
- Target
  BP/items/armors/bardock_super_leggings.json
- Size 1KB
- SHA256 55b1b8371d41ca45e94fac48ae17c1b0cf5373b4bf13e95b392ff973d1ae08b5
- MD5 07853fbe3799be044c6fa3a4aece7a90
- SHA1 78435d556317579996b024e4fad600ccd2006f4f
- SHA512 616dd0a5919c4affd822d5108d3ab49404fb7aa2faf4b18f339a2155204b31f2cfc941c10a46cf1a34524b38370f0c66b3319fa8fd2df9109e03523de7d1d8f2
- TLSH
  T11C21E52ED9A62D9F607AF77AAEF91601F770423BC901488A7A7C410C1FB25A79017F1C
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral17 behavioral18
- Target
  BP/items/armors/cabba_battle_boots.json
- Size 1KB
- SHA256 a492daf35c78d3295d10f4de6bee86a1a0b0ce0118c5504194cf244995d2c02b
- MD5 9ced55ba7a1ec25007b1cf1107aafc35
- SHA1 e12695cbb22e35ec5efda56b9b64d2f97ed6af57
- SHA512 0c8ee4ef86f538a5aca8c905fafdb7c57be0f563d9505f7e760ef8c56401ce7105ef8bd40025249f7b5eda3ea8abad2b0e04062d9b6ab78e829159ad31947899
- TLSH
  T1C021D22AD91A2E9B20BAF37AAEBD1601F765423F854104CB7A7C551C1FB2597C006F2D
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral19 behavioral20
- Target
  BP/items/armors/cabba_battle_chestplate.json
- Size 1KB
- SHA256 f114a5e237d4287d1719b1c9450c8f93869200a61502a177a815701b08c14d0b
- MD5 8f42cbd108a77e6845009633f6d86a07
- SHA1 09bd08f7b9a4f7287b3cd68f79b731ffe4dce19e
- SHA512 511a896b6f4a41a8a0946e7a531d461980ea500887851792385c79c4e29c3e3253f3016aa7ce0fc662308cfebef50cdd8550e688c3904d157d67987488c1b94e
- TLSH
  T15421C83AD91A2EAB217AB379BEB91601F775422F850114CA7E7C451C1F715978006F1C
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral21 behavioral22
- Target
  BP/items/armors/cabba_battle_leggings.json
- Size 1KB
- SHA256 5a155128f4e1fa477b46a473210876b54a9223f77aeda45cf10ee29319f3c6c5
- MD5 23444826ca1236e6ced9732d87bfde09
- SHA1 499cb1a3741a9e8e0395a8b763790a8d49561959
- SHA512 5bc6f9a0c7e2668f968f311e46e252a6afa31d738833587f135b9d6cec4cbdfccadb26a7a01ac8610047198ef7a43e59c2f06926aad640e23f8f42f9348743f7
- TLSH
  T15E21E12AD9262E9B20BAF77AAEF90601F771423F8901088A7A7C810C1F715A39007F1C
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral23 behavioral24
- Target
  BP/items/armors/cheelai_boots.json
- Size 1KB
- SHA256 256ba2be0d6519389f1cee29ce4ec5a6d43b58e7d587ba12adf1b6bb51d65267
- MD5 6c1275aafaa08aa0be40bed9dd4fbd11
- SHA1 81a738c31074583ae240281bf8d484e9fbf1edd2
- SHA512 f836d28ca1eec244889111b71fa38cd7de1bf97402cf77d4fbc32e14f3d53acd2fb96499bfd84f7d99a43a5af2cf9eb27596f1a321767174ce9c55dda200a5af
- TLSH
  T14F21802AD9162D9B20BAF33AAFF91205F7A0522F9141148A3A7C561D1FB25979006F1D
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral25 behavioral26
- Target
  BP/items/armors/cheelai_chestplate.json
- Size 1KB
- SHA256 d22bede003343e18cbccf6cb6ca558cffd6aec15792adca0175200a158fc67c3
- MD5 6b52e08f5a2fd2e19381b0e7bd421b63
- SHA1 e81425cd0270b77aa1454ac54201c6f3aa285789
- SHA512 e4911b59a66596d1a0ebcab6251f22adaf07058f731706be27c091234dd5af2fa397fb00005b2c04187614826b7c62fd71adc08e766ed548a3eb42f9f5b67fc4
- TLSH
  T10A21C42AD9262D9B21BAB37ABFB91605F770022F850514CA3A7C851D1F715979006F1C
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral27 behavioral28
- Target
  BP/items/armors/cheelai_leggings.json
- Size 1KB
- SHA256 701c69ad688bc6fbdb507482d1d317decb374f322a1602e9dc244cb84446c968
- MD5 40c7421d45a652f5bb8b0ff173588def
- SHA1 a163110d4ea9defe101622db7cf6d93ac4c992d0
- SHA512 5a4558f8d8552a65861c1b77db99f97c23cc5a75545efe52cf50d52cb7ec036e8efd5c1c31c12af399bf01b5fc05f69ca2c2098fb07348929d021530428554b9
- TLSH
  T1F821AD2AC9162D9B20BAF73AAFF91605F770127F8501148E7A7C811D1F726A79017F1C
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral29 behavioral30
- Target
  BP/items/armors/dore_scouter.json
- Size 1KB
- SHA256 c0645bea0568aad42bbc9f53077711eb2d397463bd7aea410b37aba6bfe6f168
- MD5 fb00b5e1cd5a6c3df115f08fe408c273
- SHA1 5f78bcdd2f5283ebd9c70180d886ff88472da322
- SHA512 74c7c3940ac12d20b774d6b759964b8330280a5480ea52710636f68270adaebc9c9a964147c5707e2c8bca6765203f0fc7cf76718ec2b6cb0a0c82599255b4db
- TLSH
  T18D31D33AC9262D6B15BBF779BEB90702F720423FC200098A3A7C811C5F725879106F2C
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32