698ad42aa43b5219a290f833691b8f1e6cdd8437d54a95347f04bd7305f5cf42

General

Target
Among Us.zip
Size 53.0MB
Sample260623-xdgj4afv2m
SHA256 698ad42aa43b5219a290f833691b8f1e6cdd8437d54a95347f04bd7305f5cf42
MD5 f37593cb9f8183f0cc2483e510c7e013
SHA1 a55c706f4b6e99147667be573b089439d298bda7
SHA512 5e2900f02aaf66b0fc298301024236dbf8b52c44340c54eebd95b0b307867d56840823300f75a0ef3fc79ac56faf62ab6a3d4228c793f161f8a745d46c48a84c
SSDEEP 1572864:zyZ26NI66vHSrAlvLBnvpXfD4Yq4WdsCcEMkBev1CMCR4ip:zkN2yrAlvLBnvtcn4djMetqB
TLSH
T120C733AFA07F4E5E3010ED9FF7469DDB27C808E919A107596AE26F13B5830D6758D00B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  Among.Us/Nblog.url
- Size 108B
- SHA256 a98fd54e0d0b25160e4fe026216b9db0e2b5a62ebaa73b21c269693a5e3dee2e
- MD5 05e54e7120da01222fc3e481dc472308
- SHA1 cae53269698bca9d3a092c3d8944e7933e6bc047
- SHA512 082d4ebabbd522008ec5e073503cfd1a87e7dc4abbc72bfba499e0a9d99b834c301dc85f4d8e5b52c1c3d89a9990fc7152bb5e8c2747039d38d667323dc61ab7
- TLSH
  T17CB012AE54098699D241454E8071F808880F79A00CD3D06CA14CDEEB1C080E5C448B36
- MD5 SHA1 SHA512 TLSH
Score

7^/10

discovery
- Loads dropped DLL
behavioral1 behavioral2
- Target
  Among.Us/Setup.exe
- Size 3.5MB
- SHA256 8f52e60c9dacbf73f42b9fb2ac9cc921e9283b68be47231c45bf8c2a40512d6b
- MD5 8bc0a1ecc1743c6cabdc52af47cf842d
- SHA1 79dac6387b780f37a4c5b4050068c30cea2ddaef
- SHA512 dbb559e9cc2174fadf22bc41630477129adaa050ffb9f74c8c56f30a1026a8309cf79576a09968b0f4426685934e5b743524bce1c20b688afaae578a538ce48d
- SSDEEP 49152:QqeNVqWyLY3bNb2EnRYTVVYPEWkT/RL07mwDJ7dTEFO12iHZMaeXh+OirT2:lEIWyLY3bUERYAEdKzEFO1xMaCFiu
- TLSH
  T15A06013FB268A53ED4AB4B3245739260997BBB61781A8C2E47F0091DCF265702F3F615
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery installer persistence ransomware upx
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Drops desktop.ini file(s)
- Network Service Discovery
  Attempt to gather information on host's network.
  discovery
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral3 behavioral4
- Target
  Among.Us/Verify.exe
- Size 434KB
- SHA256 5a4ff12db1afa44e54bd900d7c0dd7e3b7aeaf5a64e534434729a8a4c55afd82
- MD5 bc801d5d6c76a489430e506e82524d2a
- SHA1 1c6f0583c8974504f45732b0d84619017423c780
- SHA512 fa5a65e45a093e711d18a02a3af6866a2653e9b55e6396389c8b422d3504b0ec0ca651e4eea68109dd3cf1e0e70546df2b99d5c9b3581e5f8a3d9300498d080d
- SSDEEP 12288:cNeaqrxKiF0HPCbszkwaJyK6Q32NUk18JRbmy/ziVPsIP0:p/K40vR2JyKmNUVJR6aiK
- TLSH
  T1589412DCA88B0C6EC4F87C3135696AFE46943942CE5922C2CED3EF75C831586A9D3652
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

discovery upx
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral5 behavioral6