c7af5d68b0b68e4faee7d6aa78ab666faae3c65a3d58505838b35385d2b2b16b

Sharing

Copy URL Twitter E-mail

General

Target
Oneshot v1.03 en.7z
Size 34.1MB
Sample260625-p8c66act3p
SHA256 c7af5d68b0b68e4faee7d6aa78ab666faae3c65a3d58505838b35385d2b2b16b
MD5 97e5a7d82360e7088cf4b9b5b2862f97
SHA1 8ffdcde7d35c4d9ce774734c9d5c6ac5c99871a9
SHA512 ec216bf06ba4ead6014006139256b791e4e643ac2083b1acbfb0ead70dfbb4d41f2277f08b1708bac4fb771a5a00bf1af743dc2d3cd716a2863070311dd940a7
SSDEEP 786432:EqyRyHiP1SWoY0knzsCRoRPZRBDYT67H0hJxeIUnWXrYjhhi:ykHiN1V0kQmahTDYTE05eIU5Pi
TLSH
T110773325C50EBAC39ECE574E1A2F12DC1ABABAC4B1C9BC8B18D5A510CB30773D165C79
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Oneshot v1.03 en.7z
- Size 34.1MB
- SHA256 c7af5d68b0b68e4faee7d6aa78ab666faae3c65a3d58505838b35385d2b2b16b
- MD5 97e5a7d82360e7088cf4b9b5b2862f97
- SHA1 8ffdcde7d35c4d9ce774734c9d5c6ac5c99871a9
- SHA512 ec216bf06ba4ead6014006139256b791e4e643ac2083b1acbfb0ead70dfbb4d41f2277f08b1708bac4fb771a5a00bf1af743dc2d3cd716a2863070311dd940a7
- SSDEEP 786432:EqyRyHiP1SWoY0knzsCRoRPZRBDYT67H0hJxeIUnWXrYjhhi:ykHiN1V0kQmahTDYTE05eIU5Pi
- TLSH
  T110773325C50EBAC39ECE574E1A2F12DC1ABABAC4B1C9BC8B18D5A510CB30773D165C79
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery upx
- Executes dropped EXE
- Loads dropped DLL
- Drops desktop.ini file(s)
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2
- Target
  Oneshot/Battle/anim1.xyz
- Size 521B
- SHA256 c8d6f171fd7454e186a81f94bd239c7cf4b647343ccee67df0d9709870183f18
- MD5 b0c056aa84111db34232fc1a4fe6029c
- SHA1 8374fd2cbba66c30b149c40cb01cbe86138603dd
- SHA512 dc5443f3f66224cf29299afac64ee316e852433fd425bbce985457336c5637aefd03de6d67d779092c28c678355de19adf9ab5086809b346b8902eb1a8ecbe45
- TLSH
  T17AF0F14D10DC0187E37E883C545A41D2E500C4F646F43CE2F641092043734A4F514A87
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral3 behavioral4
- Target
  Oneshot/CharSet/GreenNPCs.xyz
- Size 9KB
- SHA256 19a9d63f8826779b2d008e579fe20a7284828814db39879363cd7725160fdf02
- MD5 809fdae0c220c1225b364789a6e99ee4
- SHA1 64b7059556c5cc1f20c37c9912983b0970271e63
- SHA512 32f886412a8d6147550114b10c454d75cdbdaac509f1311b7d6c04f31ddfb0426c80a453e855cb800b09799207ae992e611ffd40c61dfaa83c55cbd752d2d001
- SSDEEP 192:ImhQrW+Ms2FAXmuYOSyarHGkr9FJItZT+YWSeizmrP2T:IeXsN2uFSNrHGhwSeImC
- TLSH
  T1D522BF59717535C132AE1788E059052A20CBC3EF8F7B791DED9E6818B437902F406D9F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral5 behavioral6
- Target
  Oneshot/CharSet/GreenNPCs2.xyz
- Size 3KB
- SHA256 7a8a56ca5b3660da376aa2b882e719a0ed27c3ba7c4297c06ca888e67a5f445c
- MD5 1edfe85d275e32fe0531479d2d3e2045
- SHA1 97f671599d5d64a6664c07dfd5152d511b5cfe34
- SHA512 700658d0005b00805cb305bca26743b0c642f8cd4016b895922bc712f65988d714c5fd2621c8397da1b5ccee2f4e3d36221d49acc3ecb29f861270f82e90b746
- TLSH
  T106715C1D97D651F9400144F8C42EE718E20891D5CC7B01BB22AE7ED16739E1F41E3E66
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral7 behavioral8
- Target
  Oneshot/CharSet/area1 objects5.xyz
- Size 3KB
- SHA256 8c8d0c372914bf5c573f0bbd0f39a37729792bb88a56ee35edb0177d37f14e6f
- MD5 eeac03ce468a822f514a505f96c02703
- SHA1 e5c1cf12e3f32e3403bdf829d1ecfd41b8f2641c
- SHA512 ee226ddb877c4873a2cdfcabe462e6b2312e46d46fbd1bcf9faa2a38622dfe6b7ce5c2d46318ce1e53bf04a13287677d613af551e9d6af7fc0d0e226f4b9ed34
- TLSH
  T1EC718ECFA14708A84EA3D2F55A9DC0A1C21E75DB2F0390A95E0C67AE416D1C807F1D33
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral10 behavioral9
- Target
  Oneshot/CharSet/area1-objects.xyz
- Size 3KB
- SHA256 a5d26e8307a3aad3fb57757b5cb619b051d8ab15f6de836a7f05eee67471355a
- MD5 391d3e6fe8dbd4fa9cb8c4e9b61477bc
- SHA1 47ad598824dd597da94cfc24cad3f138eb17f0f7
- SHA512 08d4c5a3a68be911a1a72404fe0c55b56f6443637a055094fed1d1d7104e5217597be6697a40572ba9e26e0d30a30c61d9d543950f105c0a5be0f2408a159646
- TLSH
  T10B617C710CAEEF6760DC9B07AB8287FEA510EAED956F1F952D3563E9013012A77120D0
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral11 behavioral12
- Target
  Oneshot/CharSet/area1-objects2.xyz
- Size 1KB
- SHA256 2b1c58a7a95ce363fd74ca933e13102a448355c3a118e57ae8f53f8cd19f3190
- MD5 9c9d0e00d5bc83a984a9d8855747794f
- SHA1 a15b7c6d75ad141b91f216ad8b1c59c047d1625f
- SHA512 577686bc3f8d2d4bccd6d143808f20a9392ff9d203ec816365fb678e69f8c1658ea605f33c853646ba6c613b7d90e10251c96e43378301de98b3c1b0a13bcdce
- TLSH
  T15441F694C833C6DA8A0135C367B7865E812EB86592A42100DD177F69E1A9E9D03508D9
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral13 behavioral14
- Target
  Oneshot/CharSet/area1-objects3.xyz
- Size 1KB
- SHA256 087c2677fe541e4a4427584a871b6bbaa27cc3414cefe33b8c258c6f3cce8e40
- MD5 26824af3ae22bd9b21e5eecaba1a9279
- SHA1 540940c10c71cce4323cbcd46e19f752902e777f
- SHA512 00788d8624103e52c313c64184882622f99aeeaa8236c3029fc41aeafbd882a03e0f8200d78b23c96e5eed4f7cbf9368ae0ca1061aa1e02c1a9db9f1c4e83fa6
- TLSH
  T1C131F837E47075BAF24AFB7202D5CD87DBB21CD478461BC320D801883A8008281DDC67
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral15 behavioral16
- Target
  Oneshot/CharSet/area1-objects4.xyz
- Size 1KB
- SHA256 dc16a7971c4b8fc41e23eb45f52b5b028ef2dd0d0c01ebc4d258b25021ce201f
- MD5 a4e42a85bb50aefe9ff6c2cafa7f2c10
- SHA1 d985d83fbb138fc3ce28d094b2998c98d910be57
- SHA512 85694279a47eb1c0174ee0feaabbf85cbb000690915c921b67541c292df88e008d603cbec2106e4af7b904cd243978999b1981ffc67ed714b00dc594dbd5a3d0
- TLSH
  T19C410A7EF7BDB399D39002000D73CA28AF8A97C39E57DD6578513D4A7E915098708C5E
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral17 behavioral18
- Target
  Oneshot/CharSet/area2 fireflies.xyz
- Size 733B
- SHA256 5aa2b1d494e7a5f10be36ce50dfc45d2ee2f7e5e0cd9ef78b9f0dfb4a1c19c03
- MD5 745eb704876ca1a3b5580663fa7727d9
- SHA1 26063e247067983ab016446d24a12f70895c8a34
- SHA512 52f229ec70f5d0b6469edd3e26cdaa10c922be5f652d5ef6bc26c473e3105665f4bf9ed1b0f5cb0e41273abdd9e198caa5220017059e3ad4b7bb1abfadd61d06
- TLSH
  T1A301200A06502584DA5047A7BAEB8D5B20D036097896671553264829DAA329CE044AFD
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral19 behavioral20
- Target
  Oneshot/CharSet/area2 objects.xyz
- Size 3KB
- SHA256 4fe21cba91151a3bf6274e7855a590080651a40218d5701a3554aff63bf4364b
- MD5 7808b263af08ab9004a50c64db0fb627
- SHA1 6a214430e40d873d33032f5372334a863b79cc80
- SHA512 32c96189f035e29ec1b9545ea0597418c15e0aaedb7af2d167162eb4f4195b87732876dc19a236a0a95fbc8db7dc3f84d8514a17c1a1423dfb95b24ffc3103e4
- TLSH
  T132715B9617B223892500A661A9518F32C77FE3B1BFB411E40BF8913A1A1F3440DEF94E
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral21 behavioral22
- Target
  Oneshot/CharSet/area3 objects.xyz
- Size 2KB
- SHA256 27f2209e0068e62dc3319b7d553df2b75687a8bc62fe187daf8befd642f099e1
- MD5 c399bfc58bcf2a1bb7b2bb004dcb12f9
- SHA1 08fc60db3cf1e79599f7e93aeec909aaf2395c7e
- SHA512 f7e1f1de21d64c80e497b557239873e9286ea08beda0533316ced1898568ad61592a557f9f6b81c806870e84b23e64aa43f9bd82251ba02cba01b843f066c1fa
- TLSH
  T115514B2099D7EC65DF8D3B606E1A24AB7120F76133D0259BDC8A0E86C799E54C62C19B
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral23 behavioral24
- Target
  Oneshot/CharSet/george.xyz
- Size 2KB
- SHA256 307010c9a2c2d6261c82c35e0fcc6fdd496c707b6bd9a0521af37ca7ee40c8eb
- MD5 6ec757513a85797cf31f37c534298cce
- SHA1 541d3073468c12ca816f53d5fe17669cc2fbf9c8
- SHA512 b63bacbd0156e63f1b8c1679af002cc290254d2fa424d3af026888aef10b692a3c9c2161d01b923234e7a93ee429834f1f5f0dea8f1baff28b99bdbe0f75143d
- TLSH
  T12F411B277D837B4AB17536F56552A2F1B46130910F4FD91D4B231EE8504C315A698E92
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral25 behavioral26
- Target
  Oneshot/CharSet/greenObjects1.xyz
- Size 2KB
- SHA256 75b340d9877416f0bd0fd5b8637e95eb7f6585b11a25d14fcd7c2e102b616826
- MD5 b6dc2f526f9aa24ccd81ed2efa3f11bc
- SHA1 930c20d9553473f4760cbde3472c8fd6d26a79bc
- SHA512 554fa8216f58d02a4ae57c4c4cc764c26e62ce27a0a4136c5f751f11f9c64ef51cb5d9b0b896ce298aa3f9a52fb6afc7e1e9c103a41a78aebfa966fa5a683c41
- TLSH
  T1A6412D827DA32FA84511E9EB0D1221F38DAAAC2FC779DF1091545BC15543DEDE2220EE
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral27 behavioral28
- Target
  Oneshot/CharSet/niko1.xyz
- Size 6KB
- SHA256 3f4c3bab7631619dc01f41c4949c6905353e522e501487372a19165d4fc4bad5
- MD5 61a07ae9c24d602f143d735359a07b64
- SHA1 1d516dce6a473ce68cb5cd6fbea781b04184aafd
- SHA512 2aba8b73c3a8ac49d6e927ab903c3fa9ed6c403570e5fe91f77ee9cbd925cbcbac1b0b9438439b9ba86b891cb4d01cc3e6c06e2044698e9ffbb20f33b8620c3e
- SSDEEP 96:ICdrz86SU9c1yXiiipzRkXMc3d2qZyHt+GhdHDxqthAsoawsNLkXZ4QdZHW9z:IizG1yXiiCP0LIbaisjVNLkuMZc
- TLSH
  T184E19EF5D4492BAAF750721288BD2B032BE9B7D3375B317989AE07173103B2E2510D4A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral29 behavioral30
- Target
  Oneshot/CharSet/npcs1.xyz
- Size 2KB
- SHA256 4a95d163056852b2fd0f5d589c71be603c12cdbe13fc53883fcf4ce3cc27011d
- MD5 8852427c806844f2b89ef4e7dbc880ac
- SHA1 414ddafd61fc598ac5586bc763d48be7104bfc7a
- SHA512 ec4bfdfdd191ffc707fab3ccefe58d4c5e54c532519c41a04607451d7e7dfd4e90721de9093063afdbf01af86e863e6a805605311c4003282e838eea183b9f70
- TLSH
  T1F2514B22B43274CC1791C42F9CD0C703AE21F4996C7E16F2DBB9906F742802D2616FA3
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Executes dropped EXE

Loads dropped DLL

Drops desktop.ini file(s)

UPX packed file

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32