59da2847e06e71d72fec8b0ca0a89e31c84d0f008f6433916043fc30c658d7be

Sharing

Copy URL Twitter E-mail

General

Target
Hackhub Build 23804867 Portable.rar
Size 13.1MB
Sample260623-ss93qsdy7r
SHA256 59da2847e06e71d72fec8b0ca0a89e31c84d0f008f6433916043fc30c658d7be
MD5 7e1823d1a8910c8e5c95a8c08d8304c5
SHA1 204004938f6a976ef3a5704185d935f58391af4c
SHA512 5420abb2de77a13a0465fad482665da428dc529eef8fa33a3880b6f423b7ad3739ce8bed1395584fe49983b8f7c078778a8ab2e902d1abe10070b67efd31d1b3
SSDEEP 393216:Dy+LtAad5YhKKKp/0V/GyI7qRT0VPMLjjgAmZ+10O8z:u+pAaoQKK+GOPjjghZ+16
TLSH
T1DFD63363C500DBBCFE6E8831D079EED705EC87551A2970218ED37E8AD83614BA8E553E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Easy Language Changer.exe
- Size 311KB
- SHA256 f24744a334bc5e1a9940b5b8cf5ebe410d6c6efb40f1ec6d8261d0efe784527e
- MD5 b9c76649ae337a6b5bb1e3eb8ef44370
- SHA1 e98b95c295227b5d8aad34a3d55d0e585453b57d
- SHA512 0d4a77ffb83d27f11394531de820da76cabd46c35930c2900c6a1a11b67c97a9871394044b21a3695f43526462c2f717f6d246a049a07bd206ff2835d1024843
- SSDEEP 1536:si2Lu0EVVgeGMlj5xLd/GiSVKiJ4OOXwH2gEuWCQC722gBlDA3Yl:4I11LNGiSURJwH2gEbCQCmYYl
- TLSH
  T1F6642C6133145F0EC0636B7A99E5E370775A6FA0E6A2C2C784F0ED13B69D0E76E624C1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral1 behavioral2
- Target
  GameOverlayRenderer.dll
- Size 90KB
- SHA256 511fca09aba9869b48c4159790e1ba24d53531eb0aaf9e423682972bd8854430
- MD5 aa7a9f60e039601f6af9b62aa22c1e51
- SHA1 b9dc8abd8a456d34935556446f04d77ee517b0a2
- SHA512 96ea76bb5a02ac764c5f3339bc2f74ef99526feea5cf6a58e999c5159f4f572412f5e5ee689cfe1c7a9c11392621843a79930a0c95bd543617a1c9a0476c2740
- SSDEEP 1536:AKdvKPplN6g+JIxeorHU5CA9W/LCXO2g9epxBnsW6+cdwNceVZ55vHSTeeC:AK1+p+xori9W/Li2epUfwKeZ55vHSTeb
- TLSH
  T15693380176D1B135D9BED9351B34FA65CB3EB910DBA0DDEB2B9902690E302C1DE31A26
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3 behavioral4
- Target
  GameOverlayRenderer64.dll
- Size 108KB
- SHA256 5f32fb9f472a8be07fe552c6e0f20acd0694b70891da0668a456f4dabb516b92
- MD5 164e7125308a07200e21fdbf1a9be94d
- SHA1 2a58626f37c2176812f52daca49adfd2e691a68c
- SHA512 4bf269e2230f5b2e1a313512b755c543e21bd99d54c69665fb7054938e33367fdaf7d52bfecb931cb0701228c443365992f2719334d672e8ac960759f218f665
- SSDEEP 3072:3fdMI7f7soXfZGY2oQcEVWdtV03APhrNAbct345l4:Ftf7TBH2o5EVe3AIt3g4
- TLSH
  T1DFB3295776E530ABE1A6C6348B733E06D7B6F81507619BAF03A0425A1F273E0CD39B61
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral5 behavioral6
- Target
  Hackhub.sha1
- Size 10KB
- SHA256 b535895131816c89a5f33bddadaab93bf6851b51765d713521a44850113bc8cd
- MD5 b644abb3507b42443e204637dad3fd3a
- SHA1 2ad4fda12ce0f79c5fe43673984dfcac782554ae
- SHA512 f2e6833124db45df65ea42c4ffe8e355c76a09f986726995075fc7d4cc6b6e9093ea9015df73fedcf53552dc83e2ab7005d3a2dab99467d07c9c71429b03b839
- SSDEEP 192:AeQXmxAaqmnHNa0Z9MmmzjvdLtBX2eApimLUCfjnLMyd6ndLHyniFarIDJc5qakn:AeeGpUm3DHMgzUrX
- TLSH
  T104222E7E210A15931A1777D67E3DB87685174B2AC03F2E68423B32850CAD37DBAC24AD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral7 behavioral8
- Target
  Play - Hackhub.exe
- Size 376KB
- SHA256 538c3d15ad78d92a4be612e830050aefef1a871fd064d0ea795618618e141472
- MD5 eed166364240bdd7be4dcb2496284675
- SHA1 f27fc2615a506e7c55bfb4e84befa840ede8baef
- SHA512 e2ae7b4841d231dfc6e17d5d697b7bffa9dffb49d89ac013448dda4af92717ddd01979f4ca0249996a5e4a79c96c0f0545a85eaa15dedb5d5d1594662c144b26
- SSDEEP 6144:tGq6IsVjt9VhdgG0DDU5kGf8U+W4AxTjaK2F/lrA5eiLTXVXdfAt:tMTKG03U5kRWnxT52treTXVm
- TLSH
  T17B847E66F79414F9E1B7C238CD428905EBB2BC5A4761EADF13E04A962F236D08E3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  Play - Hackhub.ini
- Size 1KB
- SHA256 78ccfd3954f1c3f1b23e84371b52d6c715925f89825be4800af37dd30b85ae15
- MD5 757e9d86266774717748acf567a39b37
- SHA1 8e84342e2e1ca7c760e38b14bdf95e718570c8b0
- SHA512 d408368fe38d20fef018e8aa6a0f40c5373a9da9bf9080604773a3e189f7e82b197a83700a0102f79dd086836db4b5dfc1294526198201ee0db540b11642e9f4
- TLSH
  T18A4143426F4843759271E309F50EB8E8E23E84DA527244A0B068D05D66A0EFEA33F1D9
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  steam_settings/extra_dlls/StubDRM32/StubDRM32.dll
- Size 83KB
- SHA256 1ea7f3442c7066a48594270b5367e638d4b7895757429a0ea243f16c102683db
- MD5 86ce06d74e7825c999d257ef08c53444
- SHA1 666080a4131ae227a6d91bb1d17179a1cc9302bb
- SHA512 105c25c5cc59b949386a68b7847171ee80c128c07d3a5eb3a7bab6ba9fa2aaf271649c9ffe35a591f39bd57947129993f4432c04059d31cf74e19d73263b43f9
- SSDEEP 1536:9jCK4f+EoOo8l/zPHdJ3KfADvvJcosWGVcdxXDg8yXzGDIsxg:js+EoO7zPHrDvxc7kxXDg8yXzGg
- TLSH
  T115836B4072E2D071E5BE1D3514B4D6624F3EB921DEE0DD6F3B4A06694F702C1AA39E3A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral13 behavioral14
- Target
  steam_settings/extra_dlls/StubDRM64/StubDRM64.dll
- Size 99KB
- SHA256 b3c69278e405c84cf4f1b264bae028707cddb6009da9df2f4979b1b3d2d30852
- MD5 c6bce42887a0c7553fb8e26677483b05
- SHA1 939b8a4e7e754c5c6e5d1e8c8d8c43fcbe32f9a3
- SHA512 6464000f5c160263f8c4b733f2bd7d57f10224a463361ca7896b7a01f088a1e5dd4016bd92999517a1a6372ace806f0d241dba266aeee7c44e419c6f9b346f94
- SSDEEP 1536:MpippbBIj1ttsg8273S7IlTpQ3eAA5zveX2sWGd09dlEDB/eXIskC:MpiDKj1tugh3+Itp4eAAp2XDMW9/ed
- TLSH
  T1EFA3494B72E604BBE0728638C4A35E0AD772B8511661DFAF02A0425E1F777D19D3AF72
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  steamclient.dll
- Size 14.4MB
- SHA256 78faffb00d11d8da0a1fed737299a9e9eb61217392bbdf0b63b268c41bb45f8b
- MD5 4612c3aaa11e0faed5a6a951ea2f044c
- SHA1 7311b5e7aa57993cffc916fa3334e15d712dde7e
- SHA512 c9f90639bc7afa10b69be6120c14a7500396f78ecb0c186c9931b81d7385fe635cfbfc70852659ade21ab704a9a67e7b8b17379aa6f0dc16c62f283e3da6a119
- SSDEEP 196608:XgmotwDGpy3MZw6OJGQnh/7H5NyeP7wciZgA72D8UhsQ:wmotwDAOJd/rvHwcIgA72tsQ
- TLSH
  T1A6E6BF02E751D125FBBB01F68AF9167A5B3C9FA02B1102D772C47A598A36AC1FE31713
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral17 behavioral18
- Target
  steamclient64.dll
- Size 16.0MB
- SHA256 be2eb42d2e182aab3c3517afb110ebf18615465a69ce0706de74ca7c69001f86
- MD5 e9169c0d1f3b0244dabad2263b321caf
- SHA1 4460324a00a3b7133e94c947aa3b82b859e14cc1
- SHA512 1dd2c1e46a741904bebedb4f2be766dde6f4c429b75bf878129558fb7e8a49f656df5be3d1e992d574d4f715d505b1d904b3d684bb041439b2d84c70071bc897
- SSDEEP 98304:NKUzN/RBQOkT5+UnFYC6Fc1Bb71y+4AxYZgAE6EZDi7QZaySJWPch2HwaaM8Cakt:Ndw+U+kbb7wciZgA72D8Ul5or8
- TLSH
  T1F3F66A47E7BB11E5D6B6C03896F36227FA7174A9833097D7A6C0560A4F62BE0E93D700
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral19 behavioral20

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20