6ec6f3699c9c375c16689a3c6b72b364c627e3f8adcb0a3ff7b30ef75b4486ab

Sharing

Copy URL Twitter E-mail

General

Target
test.7z
Size 11.9MB
Sample260623-hr84yabs71
SHA256 6ec6f3699c9c375c16689a3c6b72b364c627e3f8adcb0a3ff7b30ef75b4486ab
MD5 c4ac54d4c25926815f9cee3445c1ab31
SHA1 a8bb3b016a8d031dbab1c39a4465e32cfc7d23a2
SHA512 3be00e75bd6dcdd5de4d72c658299d4e861b448b8f47fc7ea80005d05e39a4ec8376d52f2f0a92deca9a6353a66fde864f915d4e62b1ac2d0e3d5097e7696650
SSDEEP 196608:AvfG87tDYWojDXrMiP+A+OQc3amHC92BhF7pZ3lLdEo046wvyvIes:xYzo/giWAsSbiqhF7pNlLdXYvIR
TLSH
T163C6333D25E90979BDAAF425F976ADE4332F531B0294EB1CE398F5949B00083B752B34
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  test.7z
- Size 11.9MB
- SHA256 6ec6f3699c9c375c16689a3c6b72b364c627e3f8adcb0a3ff7b30ef75b4486ab
- MD5 c4ac54d4c25926815f9cee3445c1ab31
- SHA1 a8bb3b016a8d031dbab1c39a4465e32cfc7d23a2
- SHA512 3be00e75bd6dcdd5de4d72c658299d4e861b448b8f47fc7ea80005d05e39a4ec8376d52f2f0a92deca9a6353a66fde864f915d4e62b1ac2d0e3d5097e7696650
- SSDEEP 196608:AvfG87tDYWojDXrMiP+A+OQc3amHC92BhF7pZ3lLdEo046wvyvIes:xYzo/giWAsSbiqhF7pNlLdXYvIR
- TLSH
  T163C6333D25E90979BDAAF425F976ADE4332F531B0294EB1CE398F5949B00083B752B34
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2
- Target
  Eaglercraft-1.20.4-Updated--main/Eaglercraft-1.20.4-Updated--main/index (2).html
- Size 2KB
- SHA256 4a4f495c2a92279c668697a83d6af3923b16342987bae253b400b3c100da2572
- MD5 91ddd512f6781af237a7913699f6e758
- SHA1 b7b5555a039783aeb151024c33caa4218099984d
- SHA512 bb78ffc779ff1374af8229968433a1e35da70215b6df7d0495932a3a69f8b6cca25740fe967e95029de8e2b11247e12dcdda2ffd2b1d6a26eaf9ca27ee22024a
- TLSH
  T13541335BB64CF59F42A0435989B3F10C817EC63B926094A276C9206FE3C9B2DC1561E5
- MD5 SHA1 SHA512 TLSH
Score

4^/10

discovery
behavioral3 behavioral4
- Target
  Eaglercraft-1.20.4-Updated--main/Eaglercraft-1.20.4-Updated--main/web/classes.js
- Size 12.5MB
- SHA256 44b0f0c25d08624205da92cb0fac6fe05f8beaa174bb06dccd331e518cfa979e
- MD5 abe73b2e4b5de109ab445ed4ba87c0af
- SHA1 8beada22db968f01b18c0923f721601f42bb7e49
- SHA512 ac24e3a7e538c784e439bab481640374729969c43c03e2329e35bbd84c10eeee633e3699df038d7fe8f2b71dbfa52ba1c17916bad61df194bd5da0fb24daf248
- SSDEEP 49152:T2s60O2SdwDouY6p7C+LdPCECpPmLlm1UGnUnztC0qeJaDOMG9rhJWN0fiyhCPwy:xldPCECpEWN0iPw23169GzJV
- TLSH
  T11AD6775A29F641FD33C0E17C809337452E194C13F519AA2B7B32EB82C63BC5AE527B65
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral5 behavioral6
- Target
  Eaglercraft-1.20.4-Updated--main/Eaglercraft-1.20.4-Updated--main/web/eaglercraft_opts.js
- Size 385B
- SHA256 ea1e2dd3ec276c53332ac79bc5a9d9ee338f024ac7891d6f778e060343106630
- MD5 3ac040787a7af8b01743625214685746
- SHA1 b647bbe04660515dd896c46f644820a50e810253
- SHA512 14215c1792c8fb653965629f96ac34c00dd5f140605015fbe7573b653b08965d25817ea0714c2ba541d0fddc69e4705077012fd5fb1c524c1d52dd4ddd97616e
- TLSH
  T1E9E0F14D0094502E07A289934ED33280BE5342DF8C2EE021734D290A73D0B1F026B1EB
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral7 behavioral8
- Target
  Eaglercraft-1.20.4-Updated--main/Eaglercraft-1.20.4-Updated--main/web/fix-webm-duration.js
- Size 14KB
- SHA256 76e4e77ac123fda5c3b80c6a202b971b587cf5cb1a15a5dde7a5716d2fa19feb
- MD5 25e41b81dccf8c00e9001ccd450fa1d6
- SHA1 57f3b4415253deea8139b45593e9206b7e166b32
- SHA512 8f11f370272625eca1ba3075f7739ce2783d4ac696681ade3fd911a237b9ab4c71096fc2e6807d12267acbd7fd6d586adb197510d0289c00d2858e8cfb145bd6
- SSDEEP 192:0ikoQHRGrUjVwy3Vo39xnpEwm5lxyO3fBKLaMl3mcMyen+BfFI1mvKT242ey0VnO:0GEGrUxbPRyOvDqBfpQ242gcPXaVVR7Q
- TLSH
  T144621B8AFA634CED6DB140388DD60408DDF49E2A809DCA4673C5E4BF89F75D4985AF38
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware execution persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral10 behavioral9
- Target
  Eaglercraft-1.20.4-Updated--main/Eaglercraft-1.20.4-Updated--main/web/index.html
- Size 2KB
- SHA256 4a4f495c2a92279c668697a83d6af3923b16342987bae253b400b3c100da2572
- MD5 91ddd512f6781af237a7913699f6e758
- SHA1 b7b5555a039783aeb151024c33caa4218099984d
- SHA512 bb78ffc779ff1374af8229968433a1e35da70215b6df7d0495932a3a69f8b6cca25740fe967e95029de8e2b11247e12dcdda2ffd2b1d6a26eaf9ca27ee22024a
- TLSH
  T13541335BB64CF59F42A0435989B3F10C817EC63B926094A276C9206FE3C9B2DC1561E5
- MD5 SHA1 SHA512 TLSH
Score

4^/10

discovery
behavioral11 behavioral12