d4ca0c9d376de943c86ffd7c986520a78ecab167cb94e9c811a77bbd16623e11

Sharing

Copy URL Twitter E-mail

General

Target
Devil_Engine_666.zip
Size 35.4MB
Sample260623-jx6rfaa19p
SHA256 d4ca0c9d376de943c86ffd7c986520a78ecab167cb94e9c811a77bbd16623e11
MD5 befb9300e63b70da916e191e082705fb
SHA1 c5cd1cb4b99c4c86f3d038984fa7068e1b753773
SHA512 e6242a63f935da4c028ee5add374b71ae70c1dbe13033ef502645bf0059f99d78105d84b6307f9a116a0abd9f4ed4462a17b298007918e4f9edd77256a0060ec
SSDEEP 786432:74lOQ0fObYn2RTWmLU8wIpyRAzrz5SSqIexrGGuIkPT:uOQiObY2RT/U8w5yHNSsexr8IMT
TLSH
T1038733BE55342088C1790B35EB582B6CC3D9D99BD736DA0F1BFDA10159D29CAAF3244C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution

Malware Config

Targets

- Target
  Devil_Engine_666/CSCompiler.dll
- Size 32KB
- SHA256 9ebb2f9a77d65ead4b7183f8299fdb0870440601b7a67d68e11939b73729ceb5
- MD5 0365abe9023f8d65b644747d16eb0a6e
- SHA1 02b74fe85de323e98557dfcdd54ef40c0cf71a54
- SHA512 0fdc0a34fed343417221b638ad580fb16d17433b20955c690bff417d5b9ee6e4c52e8a2ffeb3c14d2c91c78a1c5d33a018f534b4ee51e6558423ce6f3935fd6a
- SSDEEP 768:zVYdrkhTBDXy2XmVEV3GPkjVBDXy2ulqwVEV3GPkjL:zVYxMdCDOE2CDbOEw
- TLSH
  T131E2395B1F3D4903EF468EBDE4C9C5437DB8F3829DDE554B901B82646A083D13B9922D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Loads dropped DLL
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
behavioral1
- Target
  Devil_Engine_666/Devil Engine.exe
- Size 397KB
- SHA256 9bb186e7e7eff3bbe32bb1a4032c41974dfee82698284bbf1f866de45104c7ee
- MD5 9dfe549b547a928670bfb1b7636f8193
- SHA1 80b41d1f6a91fb1d99ef68459b7d6317ef96d47d
- SHA512 072ad4345c25cebc37ae0f7898b037fe5ded5277032efd2d46aeec76949d710c24ed9b7067d6b58513dbdaa35d6f24a016042b4346410a2995195ec6cb089e6f
- SSDEEP 12288:h010wHrzPcHFQjL2CVpGzJT44EZ8B+gugEnoSE5yi:TwLTclQjL2CVpGzJEZ8B+gugEnoSE5yi
- TLSH
  T118846C21FA01D237C0627DBC4FA995E52A60F9202CA594CB73E71F4F1A79AE03D79709
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops file in System32 directory
behavioral2
- Target
  Devil_Engine_666/DevilEngine.chm
- Size 299KB
- SHA256 43866637cfd139ad508744746043577774ea7f1311a2de5ac59983afdea4b484
- MD5 c775d0ec20c6fe2620181dfdb1720b35
- SHA1 cf584af1b446b4cff91d6a4e2045e845c476e015
- SHA512 fa18a4fe741825d0eaf66118e09f504ad5b9cfb704ae85920618b8eaa0a058444c26dd01f119211f18ce20a51843a82fca9b312756eb675534658ca2edab743a
- SSDEEP 6144:fgOFqUYSsTDiKebI7F03RPf2rB84daXcXrcURJo8tGgqQdB5+cbsQe/zQXE9LA2:hFhYSsnl0I7FG8S4daC/RGg1bnerQILf
- TLSH
  T1E8642326A8334CBDF246C07E9ACA39D1B7E853C05824DAC743AC759DD378FA4B0529B5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3
- Target
  Devil_Engine_666/DotNetDataCollector32.exe
- Size 181KB
- SHA256 8312fc0995f3d3610832f1cee9088d41f86bc0d8c4d06dd05d38289625253215
- MD5 31387e70d076b5df7a49eaa7bbd0f95d
- SHA1 9ab60459c7feb444408ec8b9d523b1a465b87e5b
- SHA512 3102faa85c0e334f9d06f94bfd0aeb730766591bd9fae3c6449ad488cf0e76f86a73a8513096b4bb2e9438a57cf8b43fea237914f1084557db956bd3a413960c
- SSDEEP 3072:RFOXPyvo+v4EaqkutaJTNO5TANKig/qmzAVsY8Gs6f9cwwTPfw4P5H/fhT//:RYXuo966Oi9g/qT18l60fBP53hT
- TLSH
  T15C04AE217982C433D9A7093458E4E6B65CBDB9311FA899CBE345473E9E303D25738A3B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral4
- Target
  Devil_Engine_666/DotNetDataCollector64.exe
- Size 207KB
- SHA256 d5067916862571e95b421764bd7f0b27d53df53305e590526e4abc043301234d
- MD5 96064e863008671fdf971727e6f10f13
- SHA1 47af2c62eff70879ca0ab89b3b01bee76c613e2b
- SHA512 9ea446701f85c1995d333d298598d9caeb4e776a9ff63935009cc3ad1c7cc859e01a82dd1e834aa9aab8b2d0033fd961c9debe2f9f87de52b018720c610c8dd5
- SSDEEP 3072:L3yCe/y5J0slY9iqkieUehCm/vclHvyjSNCnSHlSzr/sh/C:L3nFsslKffeUMCFx+SkmlSzYk
- TLSH
  T12E249E4573B400F5E66BC63DCD96851AF672744607699A9F036403BBAF233E06F39B21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5
- Target
  Devil_Engine_666/Kernelmoduleunloader.exe
- Size 236KB
- SHA256 f19e24e26470aa7d440a37b47a85d765ebfc0a04bf5176d594f6331d0a224c15
- MD5 8d85e4a5f183e316ca4126442d2a21ee
- SHA1 d1daa70480ac5c7ef90f7c8239baf7d60332d503
- SHA512 d650f263946b6c6d50b24aaad146b54774ae3d30caa94f315900d03b053382e2b12e4cf8806025011d2c25394c78e69e98ecfc9e5c1a0f7b7dbaf921bdc08115
- SSDEEP 3072:Bj9mOBuELLZXBJPCR6ygny56rs+iO2AwCNCtALb44TPk3Ap1rleY/DptNr/P0urV:fn7LhBJ9W56A+iOlfN/LbZnbptN4udH
- TLSH
  T113346C6ABA818277C1633DFD4ED6C4E66F60FA202C6580DA33D60B4F9A35BD03E65345
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral6
- Target
  Devil_Engine_666/Tutorial-x86_64.exe
- Size 3.4MB
- SHA256 2e1f43a9656a0a5f208f98b0b58c367856766a399e4417bc5f8c1911f30ad579
- MD5 e5503d1d95672f05564201e200c9797a
- SHA1 1fce20aad39d961a35d8836a88a94a4dfd8050a9
- SHA512 8249340fbb580cfbc45c8255e0d76ad2fc7b6d91aae8048fe1c6ec827fef75f59ecf7c0142a2d11cf69cf889c4c5c0d1a614bd46dc572f8313c5ff48817e947d
- SSDEEP 49152:tWWbqTd73eNgi0eb4V58F+/7XpVmnyXv26WuDgRP5o3Ns6WcfQ:TbqT53eNN8b8WjioY
- TLSH
  T1E3F53BFBB632CA98C0CBC9B4245797E2BB307D1408B5134676CA231F5FB6D501D99A8E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7
- Target
  Devil_Engine_666/allochook-i386.dll
- Size 328KB
- SHA256 b053277f6caf620ffb6904fab7184b21af9a551fc402040ae305c6bbdcc62363
- MD5 cec29240ed6add4bb0c26a566701820e
- SHA1 cc53ade49be3aa890a572683e26267393e6b3f8b
- SHA512 f73d114d3dc803cc628c7862c74017d1a4638e06bc141576f3b7412b7eba13347b74a741e0167a3f123a7b8b01323daea6cd5de7377c793b296f48a4970d961c
- SSDEEP 3072:6LYEDJlXw5pAnHp2ukwTX6N8B4A84zMtEl1knxgajZ3nbanlYZn2l1S2COYOjIOs:6LYEDJAAnHp2uk2KNO0tEsV+bpZ6
- TLSH
  T16D643C52AE419333C6AE273402C3839CF534DB14676B97D6B8D96EBE2EE17D06E31112
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral8
- Target
  Devil_Engine_666/allochook-x86_64.dll
- Size 468KB
- SHA256 f6a73a0c79c4b29b095734419aa01f423b702638f742e63e37e74dc3bd30fc7e
- MD5 5decea8769a5dbec5f4c530f8f4469e6
- SHA1 9816f2f33e3150ba01e360b0e40fbeb6c151a7b0
- SHA512 2f109a27ddfcf0074f630b8b6413a8475ceaf4dd5829c437f396839e11b2b7bc1f75dd18a1c2298cae90aa529686465d942bf1da87662e151e9fe6bc0bff30b6
- SSDEEP 6144:Tch6UtcJYg8yRAkB+vsoqOvfkv+q3ilZkaCEKG:e6Utc6gdcfkv+CIh
- TLSH
  T1BEA4F7B679918A67C1DFCB3500C386A8F234FE1413AF579584D523BA2EE67C0BE7501A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral9
- Target
  Devil_Engine_666/autorun/DotNetInterface.lua
- Size 20KB
- SHA256 eae2a91808bb58b386f3bdde75176c7208c22bf5515c5d6e467c583df2e72e15
- MD5 04cde30d6aa9999a846b5fc3cfc1f56c
- SHA1 2187ab73161ee8a516d25f8295bb4c7e3da2f7e3
- SHA512 fb2f27f3981e587ddd379d54999067092dc2fbe2f243e4a49b2f9d4da172907d169bc708aa0840631c951fb01ccb9e69a403eb2e19a5f1aff1be3ff0eec27c62
- SSDEEP 192:Rmi4uQRgQgAgm2+CXgSKgKghmg60gGg4tgKplg/Dhrf+1e5l7jTRgzKgIgmoJMQZ:y3KQBHvSo9a452TZ0YgkP
- TLSH
  T11392EE9D39866AC316FB827477471424F627408323262BD5BE9C8CD1FBB497CA0E97A4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral10
- Target
  Devil_Engine_666/autorun/dlls/src/Java/CEJVMTI/CEJVMTI/JavaEventServer.cpp
- Size 8KB
- SHA256 e3795c3b94c84491a368c78fcbc4076bfadca038afe74da2fa7fab7415945658
- MD5 59529578cde1ae578abcaaa331aa4fba
- SHA1 33ab98509ed784580a259d1b310827c50b842f50
- SHA512 acbd3884642e466d29fbe6d6a7337ccbaec55147ea735098f9e463c6875b52b255480745847c3efabcbac72f9b72dd45cf259880a8d4700afb68c3c07ac747be
- SSDEEP 192:reWH42e/J83LkXasXVHMFyWH9MWUnsUeTxtbPYN9:C42RA4VL/RV
- TLSH
  T17D12C99A764F80074A12630C5131D0AD473AC076FAA55AF07EF3EE2DE7418BD87399E8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral11
- Target
  Devil_Engine_666/autorun/dlls/src/Java/CEJVMTI/CEJVMTI/JavaServer.cpp
- Size 42KB
- SHA256 9a7688efc29166873a9a9d6f17fa195477eb2c1537e9ca3a980e3f705545c129
- MD5 1f0cb33bd5c148860bcc3355bfcf09ca
- SHA1 5c0cccc714cd547e22d86c0bfa8e6a02903f0039
- SHA512 1e44466e6bc676d74126533353091fd748ddaf5cb373fc0cbd4b1a6afc2b81ba136f759efa936f2863dfc6051eed3017d7e9ae3219396d66be78d567ac3f6fac
- SSDEEP 384:QwCobTfG/ATdMak2lBpn/Z2jc/AKJlXCR5A6Qw/iNufJiTTvMm5ETln6H:OiT+1WBJRCZQw/iNuBiTTvMvl6H
- TLSH
  T1F113A555374F24E65C22D248403311DAD9ACC032E96266DAB8F3CA1DF4948DD87BDBAE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral12
- Target
  Devil_Engine_666/autorun/dlls/src/Mono/MonoDataCollector/PipeServer.cpp
- Size 96KB
- SHA256 84ab1fc052a6ef41dc1a3fd5dcf0f412f67b7b10096445d680373490b264e23f
- MD5 f966c6e5be2e52900380647268e66506
- SHA1 9d466946495137fc6e93bda94eba85f1a1f1c487
- SHA512 af95bb3d6ebacb55bf82d6403a2fa9ba63e714c2a762a70e4dc7a38ed6776a9312d3aaf37b9d575aba0c72a528f45b3815be4869030fc1d5e8877a3a3394fac7
- SSDEEP 1536:fBqs9YYxb65cBVD88G7gDmP2XB5zKIcW03zR1aalsJTluvOeOhZzTYc:fqybR5zKIcWWzRSJTlvYc
- TLSH
  T144A3C795F80F2056D94AD00844B2520DDD6CD36EAB13ABA5F8DED838F7B041C05BAE7B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral13
- Target
  Devil_Engine_666/autorun/dmahelper.lua
- Size 25KB
- SHA256 14d8b3a5cd2408879e70a186b5ed320a60769d5aa437599ad7d69e81560f78e0
- MD5 49a4e62f524d0b69f7bb8c7f4b842e44
- SHA1 ee129bf5c2736eea004c8057f243554d21b4665e
- SHA512 070b5e3d26aae41954c5bddf9b5ceb85477f36521ccb70cb209eafa2fc512f468f3cfd3909ba84d04d4b5005abcc79a5d9451b0f436eed134e14bc807a9fd8cb
- SSDEEP 384:x1naENIaoAPNfOr1R4hDd5KSI4AKayNukxgqpqThH//VXxOU+a8:7deAPNfOr1R4dd5KSISolqpqTNY
- TLSH
  T1A0C2A806361A5A7120F6C2AD799B2C03D7E5468322BF0A3579DCC2923F3539CE6B57B4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral14
- Target
  Devil_Engine_666/autorun/dotnetinfo.lua
- Size 89KB
- SHA256 05ea247e494d3b685e5126511af52483c6dd0128076ff7893e15d6979ecb3886
- MD5 750e3130127888b6513f5449b8657491
- SHA1 bf32124c27d303ab6f8f45345e2aac7f1797c7ad
- SHA512 d82b4b98639fb11e3e5d5e94900bf663ba5e8bc6a9276be9d936ee4b8a366a3bce8b32d40562152809606c85b0453630d9e4941a5b75e302748c48aaddeed77c
- SSDEEP 1536:yKY5w2LnBaKigkk33YBRX6hT5Od/Ff9zpuzy5AchgL+oSam0WEj:lY5FBa2kk33ERX6hT5G/Dz6y5Ac3oSaH
- TLSH
  T1E4933156354323EB61BA826EA8CA4C02D7132063D45B5D90BBFC40963F7835CA9F97BD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral15
- Target
  Devil_Engine_666/autorun/dotnetsearch.lua
- Size 15KB
- SHA256 9dcceba54c44940f7d97b971f61eb6186055eaa389ee4d4d399f106750f17c85
- MD5 a61f01399e3f91c1fd879ebc25c48f92
- SHA1 ebac47e5d09229d4a27b3542e9de65cfb884e47e
- SHA512 c6bb30d75669751a3af1e701b170d0c688975945cbd2384926505d45e989b1d37f98499520020531c3edd304fa41377e36dec093c152e9999cb00e796ac5c070
- SSDEEP 384:fTJbJcJtJdJtJFJAmDF3zY0PLTuHr7tIutT9AT0HqkVWAcK3wMexR9WnraIeBXjJ:LJbJcJtJdJtJFJAmDF3zY0jTuHrhIuFG
- TLSH
  T18F620F27650012BAB4F3867D2AD3A88AD612514399931D54FFEE80823FB43DDA5F43BD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral16
- Target
  Devil_Engine_666/autorun/java.lua
- Size 84KB
- SHA256 f72ccb038418ddab6a94c419821f64aa5cbc832e025c42ed074812a4dafdc902
- MD5 9ac122ea50329f69cc76ba5945190b91
- SHA1 d243aba373208a506f552d10b2053af9d79d0acb
- SHA512 563444376200c2a06d43cff8c2bb09497da8aec66c4067c1b6f3f98b9ac9021c50cf56930f3c94d12582f914f78c4f21fefb1c7abcc38cba72707d6d56f9a104
- SSDEEP 1536:JiRtmZhlpsM/bMWohLZZM0h5G87N6F7MCjLmQ3cRCJdGwLDxIB8BDC+Nt0ENjokk:JiRtmZhlpsMyM0q87efmQsYBDC+Nt0Ms
- TLSH
  T1D283E657680B11A155F3C3B26C9B480EF3A49023653B5A98B1BECD523F7820E55E6FBC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral17
- Target
  Devil_Engine_666/ced3d10hook.dll
- Size 128KB
- SHA256 fe9829d705e41754fceef01a2d7a321db80d14e3dd2577909c287b6933b9b35c
- MD5 ce6e78e70af01147253b5464883fa9d7
- SHA1 23b927264e429de8b4a2f3e4d94a0f62f717e433
- SHA512 27700ef886f0d78a7810444b9a97d51a158b868e76737984400f6639f725631b170c8969864871abfa9bc27931af30f3cee76108b3cedd84390f1a1df30a83e7
- SSDEEP 1536:jRXPVJPMo10+PfXl/IRTlsfQstLh66crJWeWyPCUpfqCWV13P1ACUOEFCvOEMI7:BdJPMlMb1g6e0dU9qf3PNUOtvOja
- TLSH
  T1E2D39E127620C072CA4A5D7D8096C7726FBAA6719BDC40C7FB661B3D9F203D16B7930A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral18
- Target
  Devil_Engine_666/ced3d10hook64.dll
- Size 140KB
- SHA256 f68cd1e433bba1346a9feb85dd208d8e477de3188e8f86a97ff0e68d877aa345
- MD5 4a98760d0bcfb3ef18bd17ad1ea6245f
- SHA1 fcd47a58c106d60a774255b612f0f3f5ebd53e73
- SHA512 a88039a1d14c539f4d22c4304766473e8347156581355b1479d7c09603fe83c74f475846aeceb18447a5ac4b8fe0b2397b489b0ca26581f01d3e8bf75694b727
- SSDEEP 3072:Kd3u82FbW5v1B9omLKfBbYWFhFCsfa5z8vaPFZ1sd3OV1Ow:Kd+NFbWUMKfBTjFxfa5B1IGN
- TLSH
  T11DE37C5B737540B7C60ADA7DC9C3DA47EBB0B0420BA4538F4366865A1F177A0AE2F325
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19
- Target
  Devil_Engine_666/ced3d11hook.dll
- Size 137KB
- SHA256 72615172f221ff153b613f4b81165c076fb1c0739180b9bb8165b86ba0c59bc0
- MD5 43df2e24e9507423712a68c5e3a3a664
- SHA1 d7542f7ca7d2957f7655f59894009f9b265c722f
- SHA512 3962e97c1c40e0250f827cfd212c1f5f6859a22992dd2b4b4c9de7a09be9b54ade45a4710ee3450b0143c75bdb33509ebe8680a7c6ac24c7490929292dbb95cc
- SSDEEP 1536:onOLYqoZQBD3m7bmVLcuVGpGXlWXQznQN8erRxQEmsYOT1GlHRbo3iV8n/7DWCWE:o4YqoZNHi7VBAXvXMZ7l63iynpWOr3Oc
- TLSH
  T174D38C12B661C433CA4A0C7D809AD7266F7EA6715BE844C7FB5A173D5F203D06B3A31A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral20
- Target
  Devil_Engine_666/ced3d11hook64.dll
- Size 146KB
- SHA256 03403f63357c0e01d8920e0ca65b111dc988e094271981db2ddc0134821c53a2
- MD5 48fa7aa75022668879dde36798800430
- SHA1 bc6ee3e4d2d092f4a8b060b7b593359ec8f5c93a
- SHA512 4736960b9c11f9405cdbf8d7741af53eb466eb0b0f6b252562a16485e29f5e223c30ce89ce2460e916abb2903226c67c51faf7f780f26c909455d0d0b5ae2f7a
- SSDEEP 3072:/20T06lYodB6ZcnHgSFulvfV0tYP/ipHQ8PFRBWiObNOW:1Y6bdB6uHgSwtfV0+P/ix1BWjD
- TLSH
  T16EE36C4773B540B7D606CA7DC9D3A657EBB070450BA5838F4726862A6F233A0AE3F315
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21
- Target
  Devil_Engine_666/ced3d9hook.dll
- Size 124KB
- SHA256 ec1e2fb8fc50b205bf7bb6fdf419cd8834353881e5be3eb0c6736ffb8832edaf
- MD5 4982f5ba3a2853924914a545003471b2
- SHA1 5a38c4b34e1d7bfc6cf75c82cdc08610e61419ff
- SHA512 422d3a718d1d7806ce6aaa731cdff1803c6bed7a36d3cf9604bba55c4efcb82452d30e1d46ff01af4a9ae30fb5d68f4347d7b49c522acf84a66f284aedcfd4a6
- SSDEEP 1536:yq8Iw0TnMfrUEuKo+w/lT35oBqhSw3kmuqW3Crs0d3N1N+CeOEy6ZCMpOEsC:yq8IdTMTyXUR2JJrF3N9eOZMpOu
- TLSH
  T10DC39E123224C073CA8A597D80D5E7726F7EA6A18BE848C7F77907795F203D07B3921A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral22
- Target
  Devil_Engine_666/ced3d9hook64.dll
- Size 136KB
- SHA256 ce0070d1ce933cf00a68e183fed38c12dda3ea5922b07a40c09812d8bac2a8dc
- MD5 04f7043bed282254ab4834a79b5dffa3
- SHA1 b808fc6dd02dba05ba43aab14ba0f5a4e848b5c5
- SHA512 60df528a452cc385b7660527dca8efa05be3c976928b535ef50a5f7b566a272896d1e62fd338edf66f67872b542c0a6d6288ad5f9971b9f1cc7784d6f3169631
- SSDEEP 3072:6UoPePVhoZB34/UWFdQomnRep0PFn35EoOXSO2:j8ZBvWrnmnRhSZ+
- TLSH
  T17ED37B5B777500B7CA4AC67DC9D39687EBB0B0424BB5938F4326865A2F133E06E3A315
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23
- Target
  Devil_Engine_666/ceregreset.exe
- Size 302KB
- SHA256 860bdc465bb439475bf463bc6c35b8c0a2b2e0a7cadc9c357aa742fca2750ed8
- MD5 c9f9d5a2a708dac99a1dd66f7149cc0f
- SHA1 f6b78e87e7c3f5a48a408d1ba54c55c11ee2f545
- SHA512 8b654ebc10bbbc151aea87094cbea0228a99d54b99b1842963087e6a42e2d518cf4163a264a626e6e3b021dee28bebd1a7349253666dfcdcc22f328b5ea37236
- SSDEEP 6144:RDwf7I4zq0ZDVQ5uIqp5rkeoPajp8vtQI:R0f7Bz/G5uImQpPajpO
- TLSH
  T1986408A2E941C237C17229B8CAA5B2F16974BD20D9674097F7F63F4A76316903B2F305
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral24
- Target
  Devil_Engine_666/clibs32/lfs.dll
- Size 107KB
- SHA256 77caaebfb03ce67e6d2c463ce5e2071b5e634507a9c9746d53775dfd8c0dd038
- MD5 6fedfc1b9d789680c948f3295939c471
- SHA1 778d16b06b37d571a4f041ca5083aac524b254d4
- SHA512 d92d98930e4c56b74e672855bc553e36ce0f44f2cb59e28926207cb9f1a8d1c917e15f3d69324b94027d8e7c2fee0fb6325db484ee4ec2a91340bbe37eb52a4f
- SSDEEP 1536:3jVqSAqTNsYdNB3XT8le/lqWG3v0ESpz7cv+qsWjcd4yJ:3jgYd3T88Up/0wuFJ
- TLSH
  T135B36C1272D1D0B2D0EF063D94B58B22073FBD32DA39988777842A4E99346D17E7AB53
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral25
- Target
  Devil_Engine_666/clibs64/lfs.dll
- Size 125KB
- SHA256 b4796c502befc79dd2c9115452c1a04b96092808ec95615e8f21f44d8a8710d4
- MD5 1e6c0b35ae21b942ac0a722b2e3ba320
- SHA1 bceef0edde27a195f9b4d67ab8c1ebf455744f42
- SHA512 46ed9acf959038b44f188f2fdd7f980fe64d7455259823acd5425d77e137596a33a2d1d18b3a0dac1e65ee2eda6ef7fc21fa0809ce1761b0085f87a9ff675ab4
- SSDEEP 3072:BzlRkrowTiYa0u6lQUf3V/4MSfayysXZzjGaobJy:BRylTHa+/yMByyupD
- TLSH
  T193C36C4773E101BBE467E638C9A34905D7B2B8570634DB8E03A4425A5F633D1AE7EB32
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral26
- Target
  Devil_Engine_666/d3dhook.dll
- Size 119KB
- SHA256 0fb201aa891ea032d5f1b95cd2f89c4cedcbfdc31413f9317e8299327d99b66e
- MD5 908588402be35c1ef9665ff3608fe92b
- SHA1 4508f6738e18226409acc36d5b7a49464e7695b2
- SHA512 0310e5426018f1f62e801c87aa796696fb4d7096f925ac177ebd2cb7b37b26be7366faf8ef69db532e748ad8dbdd8645ef74a0a3f38b25c2f9a17a5010d267ab
- SSDEEP 1536:QyfNvGKKZVGcuasOKQBBTff07PSZHCSVKOCDDA32XQaQCKnOElChMOE6:lNvG7vGcIiBTMS18RDs32zYOxhMOr
- TLSH
  T148C39F123FA0C073DA8A5D3D8096C7627E7EB1719FD948C7B62907A95F103C06B7A25E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral27
- Target
  Devil_Engine_666/devilengine-i386.exe
- Size 12.5MB
- SHA256 21cac5ae76b413beabbf39b5d9779e0e390069bb8767699d306a51cc5cef2120
- MD5 259610227d7574a4e6f530ea187a0ebc
- SHA1 30d38731c9d6d46078624176462915a4cc3c93f4
- SHA512 f391b50824df1c5fa8f6d9e0c96b79ade0402c16da9b3c7276b2de17f9e4e397df2bece3eb1b0a109a5d833d23f92d548076413dd5484ac6880336fc12cab9b3
- SSDEEP 393216:IatdxcMydnitC7x6azHVuJLJnHUNiGWGgr/pSEw8n:IbwpeWHpFwy
- TLSH
  T1B5D67D12B722C22BD47376B48E9785C41E71B7242A32989733EB2F4D6B75B807E16707
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops file in System32 directory
behavioral28
- Target
  Devil_Engine_666/devilengine-x86_64-SSE4-AVX2.exe
- Size 16.4MB
- SHA256 7fcdd816609a3a5ab122b5b8b5442eed455e947533149a9393d09f0cb466be94
- MD5 ec8e36864eb9a98fb54ab0a2d345f853
- SHA1 b2f876a83fa4bfe92fe56251f4da541447b9e309
- SHA512 dd233d2734d379210037705bf4110688c23063915acc08268504ed0ed3e7082982ecdb61c1212ab7a0d3852293d0a2f1b9adedec2fba30f43e81e45f9d8548ff
- SSDEEP 393216:hu1NJf/dhzMYmcDbqCwxtRPQaDLjcJw8r:hyhbq1LIwe
- TLSH
  T176075CBB76619A98C0CAC1B15597CBE22F31BD2408B5134723D9331E9FF68805E5AD8F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops file in System32 directory
behavioral29
- Target
  Devil_Engine_666/devilengine-x86_64.exe
- Size 16.4MB
- SHA256 87c556ff8299dcc3fb06c78b438bc5cd0a82422936bbcfb2690a152fd4eeaab6
- MD5 1b0eda8337b46beab3cc3cd71b28de61
- SHA1 509b316e58d3b9be4485b95a17617740b995ce1d
- SHA512 1ca855e87b4310b70e6ac971c2b40ac01a7f189b33b28c222c2c2a5f6a34bb62cc345021415037d5ac8b36edb2960a3b5573aa2053285d5e68c121953e5b4304
- SSDEEP 393216:4vQipNHLhmaRmfbqx4XGJxNWQfDFPtDw8m:46bqx4WFVDwH
- TLSH
  T1EF074CBB76629B98C0CAC17654D79BE25F31BD240875134323D9331E9FB68801E9AD8F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops file in System32 directory
behavioral30
- Target
  Devil_Engine_666/gtutorial-i386.exe
- Size 3.0MB
- SHA256 7ae63641b30a0127728d6198680655d3a6cf7c884cdeda6467b694c904c2d501
- MD5 aa630334e45a00fa33244a05e3401eea
- SHA1 fea45097524e3089c654497cbe7dd6849d99d128
- SHA512 2016a029ca113d8524b5f5e1b7ec85a585c062f3f01153576263df1f9be0ee00b8dfbd8ae8d3f88e4a17bfb730f11a282717abd98a0f65e42b76b0d451a7eead
- SSDEEP 49152:8ZTcvES1U19s4RClBGvIh++WtpFpaikoZpfJvio6WuDgRPj9QPSij1:8ZTc8nSHhbGZBkupfsMRkSiZ
- TLSH
  T182E54C62F242C22BD4737BF48967C5D55E64BA241426884B37DB2F8F7B75A803E29703
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral31
- Target
  Devil_Engine_666/gtutorial-x86_64.exe
- Size 4.0MB
- SHA256 150181a12632b82b240a082b1d8fc94c332d944ab3d041b76c3c14eff16e97ec
- MD5 e3abe5bad3437463283e69795b18bb6d
- SHA1 eabaf45ad3073714b8cf2f70201d167d92ad98d4
- SHA512 2a9e713d1e491cdb06884c52a148b6d2285c2315c3585a22782e1fa6baa549abd47c714228d9d81f78107fb07157b0aae5d9216425da55842b7e182f93bf8441
- SSDEEP 49152:BTRsBu0UCSiuWbql+EjXnJP/BtOiCs1WVllNXLh/Qoo6WuDgRPc7KkYPSijA:7sBumSSbql1bnN+MNSi0
- TLSH
  T14A161AFBB221CA9CC0CBC5B01097DFA25F20BD1508B5534672CA271F6E76D406DADA9E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Loads dropped DLL

Contacts third-party web service commonly abused for C2

Checks computer location settings

Drops file in System32 directory

Checks computer location settings

Drops file in System32 directory

Checks computer location settings

Drops file in System32 directory

Checks computer location settings

Drops file in System32 directory

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32