fd2a37564be1114ed0a3228613dcfe949a41f33e888760801a84b1cdff12c3ee

Sharing

Copy URL Twitter E-mail

General

Target
DragonMose.rar
Size 5.4MB
Sample260623-appzaaht6q
SHA256 fd2a37564be1114ed0a3228613dcfe949a41f33e888760801a84b1cdff12c3ee
MD5 668b1f6d5cad6819f3fdf7b457bfda0b
SHA1 49b599633d54668635760c6a50de17c47156feb4
SHA512 5c59e218f29bf1b6d93500f4b6b9ed08ecb3c579c6575ec9ae9df42bde54714fbc095f2835d3336847de894da9da09571d1b293c41676f51016339f927472619
SSDEEP 98304:UzB3NenpwX56B4k63bsXb/056mUCZozY7fDqLGk8pQ2mN6+h2VnXKAoUW+J:UzBWwp6ekugXbMI7t87fDUD2mN69n6Ax
TLSH
T1674633D9940ECCA47774E860432279C4A0E956401610FABBE37B93F64ADF11D1B3B6BB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  DragonMose/DragonMose.Game/Accounts/Account.cs
- Size 4KB
- SHA256 5a62f50ff6aa77fdddcb9fd768f8d940f2b87233b0ebe6760851014601bfcc8c
- MD5 158e61d381a70d127067d2aa24bfeb7f
- SHA1 532d60ca40591b79d1753a71241f4482d9acaa6e
- SHA512 2b2390d6117d7e2806573303e78bb180baf576b1f391ad6563908a3d5c9a066932d704962b295637b83f78aefa3d54979fc9b25cee6c21f4be4ccad14340119c
- SSDEEP 96:Jo4h2nXVhxt2jDzjh7KcHDfLKDX5Ez3F43QSHEBTGqRHHF3A+39Shr:9UFhGjDzj4MDWD+zK3JkoqRHK+39Shr
- TLSH
  T13A91EB4516258A21D93341FABE61C1CAFA53B54755A7D12CFCEC8140AF3281591F8FAF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  DragonMose/DragonMose.Game/Character/CharacterCollection.cs
- Size 4KB
- SHA256 2e2db966c882a8875861db3bfc0b36d9b2718e0b32d67184a8e2bae8289a09b1
- MD5 e013d8214ce151e46a4c7608f7c03e54
- SHA1 c21754a7eec8cbc2fd168a8cf19d5ef59942aff0
- SHA512 f48b35e3e6790d3a7be734e175d13428bfe6d04fecc0eb23b454e2e438f69cfea14a67d75a9326a9cb22b02202927051480ebb9f1bb2e15f224a087b7110ea7b
- SSDEEP 96:Jo4H4h2nXV0VswqitQuo1OuEbWqR/EfMCgsYbI+A:9YUF4swqmo1Ou63R/ye7sL
- TLSH
  T15291D27824C7861B1333632DBA43E489EE33062B959F4816B9ADB040FF3F0C48569F4A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral3 behavioral4
- Target
  DragonMose/DragonMose.Game/Character/Data/CharacterInfo.cs
- Size 1KB
- SHA256 4407cffe40b6b7b810e492a179b6b8239d7143006d9aafafa9bd426a77315eb9
- MD5 b43c382b722fc4a794ee40a85c340a1d
- SHA1 703712834269aa212ac8100f77bc4189ae1d2ae5
- SHA512 b58e3fbe0a5db8c866bbd0b1d6a97b330a9c24adb04b0e21486be13a5145f4b6885186cdf0f829ccba5814f00e525d4015b58d265d76a2b017861508fdae5000
- TLSH
  T1D941546A03938A254532417EBAA7D18AEB736583139BC358BDAC1201DF3E8045260FAF
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral5 behavioral6
- Target
  DragonMose/DragonMose.Game/obj/Debug/DragonMose.Game.dll
- Size 18KB
- SHA256 0238676d7e62fbfa2ad8a2015a326b229797e08cfdab863a0bf508e4327890b6
- MD5 94150278f1064974044f8903eafa0620
- SHA1 57f467ab78b9ed47cc3809d1a60c40f0cf2467ef
- SHA512 e84fdf5257700a5ffacf0fe769e0516a8d8610716b222e0318d3401a4bc012a0c1d4aea811c7ae41d25372d71a3daa547d9a6976cdd324aa9681bf7e2689db7c
- SSDEEP 384:4kPWko7FZP79Dv73ARx0d8zNUjVt4rYWuKNuqwoU:ZWkw/P79zKdNYdK8sU
- TLSH
  T15E820AA497A8C2BDCF2A473AF931416A1B71B1073513EB9DAFD4B8CB7E5B3049502670
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral7 behavioral8
- Target
  DragonMose/DragonMose.LoginService/Config/LoginConfiguration.cs
- Size 1KB
- SHA256 8af12b7d53cbd86fdcf257a78ef1caf85b90b8c8d5a34165be02dc705e219449
- MD5 aae8f8b3e2a041d6ddc0eb1adaeb5492
- SHA1 13ac0b721f977aa9a815cb03efdcf388ce9cb3e5
- SHA512 bb22a6eecb2a790f899a497d4d6b48932e0b76eabd0202b2296c6def54ed52fe0dd66b94e1142c1e0450d7ac93639e14fdd15fd2a5c6b36bfa95b64d313a33e4
- TLSH
  T12841389B52024A7355361336DA839444FF334E63825AC82CBD5EA2052FB941EE363E6D
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral10 behavioral9
- Target
  DragonMose/DragonMose.LoginService/Data/World/WorldDataProvider.cs
- Size 2KB
- SHA256 62d719f87e04d48edf82fca04a6c7cf91b4f9cd06ae5f316282d9419db4545b3
- MD5 a9cfa51637eb3cb2980732cd8452f908
- SHA1 5ae04259ae02815c94b1d1101a56383657672720
- SHA512 462c150e100ad88732c0cfc7e822599621511d3caf0060cb2b08049a82867d28cd3a7e4c0ab44b8459a9e7ed30086aefbbc0ed996ad00e8c86c38d6808aed6b7
- TLSH
  T13E41AB8822028A6D557B561CDD76C9DCDB73451F22EE8650FBCE4280BF318007637E6E
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral11 behavioral12
- Target
  DragonMose/DragonMose.LoginService/Game/Accounts/LoginAccountManager.cs
- Size 7KB
- SHA256 2e463d15c64e191b0dee325b40bd84f67d8492d9ddf26e4680ca7b70ae90101a
- MD5 4c329a87c9e52c8b397fba3a29b77b74
- SHA1 fbbbbf950214a5c6c04a2f6449b7e352f1c17481
- SHA512 2d8741b1cab0c645be592836ec4adab65ddbdee1445cd472668ffcc5ed3af0f6be479bf2fa23eb591fdd92675fb55f41f655d05a95b1fa34ce1c1d32a2ed5abb
- SSDEEP 96:sx+o4hc52nXVrxBLZJjbpsZE6O3IlD5yxgZga4qmHxO15w0ReG9uWLuhA8:su9FrtJjbpQ04D5Bga4qmMqkLu28
- TLSH
  T138F13F0A170A05825E3262A17F37D05DE636310B315A9518FCDCE6126FBAC13F1F9FAA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral13 behavioral14
- Target
  DragonMose/DragonMose.LoginService/Game/World/WorldServer.cs
- Size 3KB
- SHA256 73e476545b53dff4b7fda9b1ea9c2cfd57facde48e1738a262ffd48c8a88c882
- MD5 1122e627292965ab549399303299324a
- SHA1 401adda2e0a30e142cedd471c07b4a790aa09f4b
- SHA512 8fcc650846243659d3d5c8f3c0650b30ed5e3be66275c13c33e693da967a6caedecae503aec0297bed8361220c0dbfca7f0ad4a32a5d1897cc87ea2a7e113553
- TLSH
  T1A8818E5DAA0245B99931D239AD369094FF7A082731770069FFCC4042BFB744CC26AEAE
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  DragonMose/DragonMose.LoginService/Game/World/WorldServerManager.cs
- Size 2KB
- SHA256 dafa3358beef5264a5a46fc9a13568cd7ed63a328f9496bf499ae79a7e102e4f
- MD5 589958de406cba83918a23b923c45811
- SHA1 e731ed88639fd6f3f28f8606369e52b4332e5ab5
- SHA512 f7a4b78bff8d091ff721f9f9cc4e7f899d939c043a536e371edef0a8918e883f8e2edefcc89f349a335bbb52b979fdcba08733e24968e3309d55e1d4c44cf82c
- TLSH
  T15641806A7647D6AD61339111896690D8FB2B062312B98118FFDD0292BFF701C433BE7D
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  DragonMose/DragonMose.LoginService/GameNetwork/Listening/LoginServer.cs
- Size 1KB
- SHA256 31ef4820b69b323bceeafd4ecc04ed887d34a6b6e549e054f5cb69715e3d97eb
- MD5 aff27066400d09bb2e44ab12e7546ab8
- SHA1 35d35c6c8f61e31a84f0023d4dbc09286767e9a8
- SHA512 81af0baca63d8add91fb42e7abca83b8d4e3dffb1469d1aefce6b1448a07a6a5fc6afd34e6d3b3f0803f271dcc3a2a04aa93fe4c542bc14e787f3e01d9023437
- TLSH
  T1E6219B1E6207966F6332E2164D21A008EB324B132226D8497EFCC1C5CFF94A51372F69
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral19 behavioral20
- Target
  DragonMose/DragonMose.LoginService/GameNetwork/Listening/LoginServerManager.cs
- Size 1KB
- SHA256 a9e7a953acf2cacdea092094f3e98ac0d307a22fbc6974c539a31e1637164513
- MD5 5786fbe672ff91cf0c0fcafd977953a6
- SHA1 65af14ba38377e247057b95dd12eb134706c069c
- SHA512 4627ade24985dcf7c7b8a419344119a8078798d725b4f6b4055c2afc9a22e95c178853f6c7e7b13b2cafcbb05fe91206be247bdee7e65cf52a85144a5582609a
- TLSH
  T1E941B90E520395E5A132E20D5952E048FBB70E17227AC8297BAE41C3DFF502E1379E7D
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral21 behavioral22
- Target
  DragonMose/DragonMose.LoginService/InternalNetwork/Listening/WorldService.cs
- Size 3KB
- SHA256 34927e87811aab17e03b99da602b36f989ba930fab775ecf2850bdcd71785a05
- MD5 09debd34249adc5c5dcf41d262f6116a
- SHA1 6aca3d5b56e11b587d095f7524d682de0c9a54ae
- SHA512 e272f74975d9126a6d783ae695b63c26fdb0690660e706b45ba6113891d959047b9ee3dcd1ab0ab0a6f9721f575e26de5aacf16dec42f21a1f6fed0722215e47
- TLSH
  T1FA61AE6E63538A7EA136D3215E225045EF370913113AA55CBFDD0181AFFE02E0366FAD
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral23 behavioral24
- Target
  DragonMose/DragonMose.LoginService/Tasks/Server/CloseServer.cs
- Size 1KB
- SHA256 28ee6a1dac1ccf2ce4b4a72888a7f114de8c368387138d282cdae1e1d9617583
- MD5 99955db9d3bb028332c52a5448bf4a45
- SHA1 22038bc73d0b1a2f17eb1a1b028796fcce823a3b
- SHA512 de2033dcb966aa42975f57747f181c6f55b1e43d318d9e40bae735a40c63509422d6285e14e36edf1b203cae0913f6b86febc0724cf1eca51a1fc05c382e850e
- TLSH
  T1D0319E1E12439BEA0972737EAE077085FF231317055EEA04BF9F42829FB5955B128F68
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral25 behavioral26
- Target
  DragonMose/DragonMose.LoginService/obj/Debug/DragonMose.LoginService.exe
- Size 111KB
- SHA256 827ba6564c25c9f245de6a68f3d07b4c2c4a964596b39769150df1642aef431c
- MD5 1173048df491ddc8442e385250faf19e
- SHA1 f6f9e46c953c96d43bd5543480d795856337e975
- SHA512 5d24f8a96bdec8180c4f6f41546c949be4d1c7d9d20c905a0ac0d8b2ae01b2124f9c3f3ff66ebaf18f9355250577298bf01836a4afa678ff424403792bf2540a
- SSDEEP 3072:/rBQVqr4En74GGLnKQ++DRB2R2WryD6M+t9:Kq4ErYRB2Rdr1D
- TLSH
  T129B38D620398C4BBE76972B6A460B725CBB0E5D90932E20FEF6174DDCD1B3974829331
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral27 behavioral28
- Target
  DragonMose/DragonMose.Networking/Data/Packet/Protocol/PacketRequestManager.cs
- Size 1KB
- SHA256 03ab5b38a1194fdc8ccbd72e19952a4f7a11c15800ea4561c6f642c376d8b573
- MD5 838e79963f7734c4710759ec41ba2a95
- SHA1 ec3ef349756ace9a481727bfadb829a37ae090d5
- SHA512 1435a956dbd88ff6855d773a3cc1d90c2643d41a5d8eea78e4dadcbde9b0fb6f96cea4eea472549e5888136f292cb4cfaee18c2e679fe98218524ab081c24c25
- TLSH
  T19641994FB146917ED1328325CE31D29AFF77002B22DA4576B89C02C29FBA1145335E1E
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral29 behavioral30
- Target
  DragonMose/DragonMose.Networking/Data/Packet/Protocol/RequestServerPacket.cs
- Size 2KB
- SHA256 3a9457be883e04734becfc251e563f12f98465da6a294967a6c784152f309aae
- MD5 ab7946d6854a9634e7de05ef20c47bdd
- SHA1 2c95e216425847b02cfe328bd8dca1109e34dbf7
- SHA512 7501df9baa049425cc9995698c0716369060f3a9ac31b0885ca765a5ba61e4d2963ad083560fbe2fa25258187e4e16591cbcef2fa76f7dd3f1e7e5af5170775a
- TLSH
  T1C541530F630B5B7AC3722219DF96D682DF720283A71A54F37A9E07910F768006128FBC
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32