b5808a1d5d184519a961bc60e0a35f0b05e492cd60c7758162471f428e617afd

Sharing

Copy URL Twitter E-mail

General

Target
granny-legacy-v1.8.8.zip
Size 637.7MB
Sample260625-pvlldacs2m
SHA256 b5808a1d5d184519a961bc60e0a35f0b05e492cd60c7758162471f428e617afd
MD5 2ea64f5ca452d6ff64883e9dca94458b
SHA1 40eb866f5d6636893cba1d53d9b9cf2cff003e89
SHA512 2b4bbd3b4ed3a6b36673b2e0ab17a13856aabcf309727ffd4c3b77c717f30026fd47fd384f92d432bfef75ea6ddf0c97b2acbf22c1b33a30468cff62a5735397
SSDEEP 12582912:10iAoPmHuS0zHnbSKgC5lgjZqiN5ZExbYuIANeyDVIkNXDV3vOhbYXEmU7j93cZZ:Ba0z7JgA6Ny8uVUym23vOFYXEBMY+Hpp
TLSH
T16D693396B12ACD0EF58F703A94313A876526C870BBC5DDF2A213D3B59B54AD0983439F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  granny-legacy-v1.8.8.zip
- Size 637.7MB
- SHA256 b5808a1d5d184519a961bc60e0a35f0b05e492cd60c7758162471f428e617afd
- MD5 2ea64f5ca452d6ff64883e9dca94458b
- SHA1 40eb866f5d6636893cba1d53d9b9cf2cff003e89
- SHA512 2b4bbd3b4ed3a6b36673b2e0ab17a13856aabcf309727ffd4c3b77c717f30026fd47fd384f92d432bfef75ea6ddf0c97b2acbf22c1b33a30468cff62a5735397
- SSDEEP 12582912:10iAoPmHuS0zHnbSKgC5lgjZqiN5ZExbYuIANeyDVIkNXDV3vOhbYXEmU7j93cZZ:Ba0z7JgA6Ny8uVUym23vOFYXEBMY+Hpp
- TLSH
  T16D693396B12ACD0EF58F703A94313A876526C870BBC5DDF2A213D3B59B54AD0983439F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  Granny_Legacy/GameAssembly.dll
- Size 13.5MB
- SHA256 421ba11f8a9450c65c31f0eb397dffbb5e6358d387961afd52a2eb0b28748258
- MD5 1cfc0c8542a5355089658575392b99f3
- SHA1 80cdf27713032b35941651db64994cf372628ef4
- SHA512 3884d85816d54d855c1fea69cb8b7a45bbaaac31b8a016cf898a96525a5726a0b28bb1389f0defe4ea905f00ddfa8bb78f5c838f7fb333ab1a162e9375eb7d34
- SSDEEP 98304:mr+1PzKF1Hp5Bq5WbF73KEEbDgEWT/+NP7Sl0NvZGG06/zP3oT:mr+aNp5BuwF7aEEbDtslmGGj
- TLSH
  T1E7E65B5AA6B58048C4BBD278C913555BDBF238002F3897DB13544A9E2F737E8A17BB70
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  Granny_Legacy/Granny Legacy.exe
- Size 651KB
- SHA256 48add92dcae75be46eb8e9b748e61d9f9aeecf57874fbb01a360af7195d11696
- MD5 4e8d7e5bce4137b3a8b519008190bbbe
- SHA1 de49c507a6ee5a37589fa86fcad2f5309e44e691
- SHA512 5476296a43dd11b0716d1983953ea5476d4997c77dd7bbe6502664c0b195d152625335576ce128a5ffffc0b12e04b6eb1f0f1c2e417231186a96c781533bd282
- SSDEEP 12288:R/7g4aOD8L3zuAxevoqkRseq3b1knM4mVnqrRyGE1:JFaOK3SAxevoq1F3anM4rRyD
- TLSH
  T114E47C584F5889CFC15206780961F33A72B45DB22B6B97A3EBF18D733E25B471C4A4B8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  Granny_Legacy/Granny Legacy_Data/Plugins/x86_64/steam_api64.dll
- Size 256KB
- SHA256 473f5a312b56519f347741b63f3dea590946b96ea40ef3803d5f452c39af2f1e
- MD5 8afde2d19c89d0bf1a9f6ec475aa0ebb
- SHA1 7d1453b841dfb1101ab45f63d3b4294b6c5d0cb6
- SHA512 4166361eead938b1a01f110ae3acd3660f5123ccf97b4504ed0577b3eedbe57cee5222aef037524de6051a6727c88161a4aa250b4ae60fd84ccfb2591d1b2090
- SSDEEP 3072:NfpmprkbwQzAVsCeOTdmTxMezfOLgSbew/N65lhTbC66rpFvwLdyN+Qe2UvMxCbh:mprksQUVsCeOTdmTxDSLGnpynxCbmyx
- TLSH
  T19744283A72710CF5D176C139C8965E0FF571304B23219EFF226053369E676E22A3BA96
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral7 behavioral8
- Target
  Granny_Legacy/Granny Legacy_Data/Resources/unity default resources
- Size 1.5MB
- SHA256 a11e3e24520676183b3750564b4d9f5a90e8f41fd3523cbfb0c49f3989453da2
- MD5 c9730fe286df07729a2811fbe1dfbede
- SHA1 6f5ea5605cb6771e20ab6d75e448b75307e21ec7
- SHA512 387ef73b2ad58786aac05cbf418a211664f0f0dc24aefff3af8acd83cdbbd072c7dfa6154464eb49218f7b03af62536b1a38c42e5df9f50b96d705c0e8f500bf
- SSDEEP 6144:h8g9JxVJ0aYR1CCVX8BAiZahi3YW+/OJ9WqCmKISHCkcCVw:hD8TpQahXvOjdCTBw
- TLSH
  T197755315A2A1153DEC5E053987A31E61E3BDE99C1BEB8B133B1C321CBF617488A77274
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral10 behavioral9
- Target
  Granny_Legacy/Granny Legacy_Data/Resources/unity_builtin_extra
- Size 513KB
- SHA256 3e23b30d9039cdc35801d4741a0df4cb4b3eaa1575a92a185166d88ef1001c29
- MD5 951a4b160681f6ec35ea59f0f0a7a88b
- SHA1 f3f84231ffeec9111cffd8370ae4d3c9e00df8dc
- SHA512 60c1eab01e65251176af5807db6aadba9cecdd2c2a3c4877392b7e14ce1cdabe051f1b7b05446b5479a21c2203da3c21ed32d1edb1bbfcbe8cb05e3c00ab04f0
- SSDEEP 3072:bGE0sSXB7+Dvsc3M0xxNtUItygoYf3S0AOal3BsdNi7ELGbGlIVF0iP:bTJGByYMpxxb43Yf3S0AOG4k7PY7iP
- TLSH
  T17DB491796357583FCC21153748BA0B739331A9F81BEE0F236E6C6F6C28E5298AB11754
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  Granny_Legacy/Granny Legacy_Data/RuntimeInitializeOnLoads.json
- Size 218B
- SHA256 f5a94a0279c5a6dffc0f979f7349d69a9e1cebf8414dedb60168dbbe558e8580
- MD5 409bf9d072427bdfc74455dab843fb2c
- SHA1 fd9ec67aab95b792bb3d0386685be06892e189fa
- SHA512 6b7a2e71a076e1af36e987e41e0badf7f2bc6357a0fd1f850957793e215aba3e51d4180748dbcfcae5525567942918f55485c122164b27d2005c0d409a6492cd
- TLSH
  T126D0A94D9AC58EAF8B5202877976238E2020AA0B0BC0984498350E2E89203008C0A02A
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral13 behavioral14
- Target
  Granny_Legacy/Granny Legacy_Data/ScriptingAssemblies.json
- Size 3KB
- SHA256 cd5a1f0148ef7d6747937aa488fa4b41132a0cc4667a156b50b7cb6dfcfb341e
- MD5 48e39ebb2f335222d172759ea37e1439
- SHA1 ca30d35e3bb97178a354c1f90c1724eca89aff49
- SHA512 8a5c9e5727613bbde804343b748895d524af67091f429e166b88066597fc001ba11802cefde01debbb00b78327ab11e037a3ffb080775619d104643eff8aba82
- TLSH
  T12B61AAB6C58B66C71ECD5EC38C389DCD39D350A20E60D0240EAEA79FA978CD63D085D5
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral15 behavioral16
- Target
  Granny_Legacy/Granny Legacy_Data/app.info
- Size 36B
- SHA256 3228ac7a4f46c2f823dae9181d418af34a5499f82fe72be8ff548dff738e700e
- MD5 eb60e8dec2e406f907635448a7ee7f27
- SHA1 cfc913f879690fd1b208f9e8b8a77c9a6e3bb82b
- SHA512 c00113ee28773f8ac831118f44780817b5cacad475fcffae000eb541cd841ff3e08a5b7f6f01f599df5e2f42fbd547c81052ca07abe7ac307258e0aaf087f75b
- MD5 SHA1 SHA512
Score

3^/10
behavioral17 behavioral18
- Target
  Granny_Legacy/Granny Legacy_Data/boot.config
- Size 144B
- SHA256 fa852e1f863135dfb9c4188da4154748158aa49f368a5011a5cf9e2c3bcd670b
- MD5 fd7e8bada06bd20ad97e80dd51a10592
- SHA1 6d0ebcd2ad8fb7a0e67959e5d1e3cb337b5da5c6
- SHA512 aaa6ec9a8af400dbe00280f9f111633010dbdd34bbd9137b58f9935c7a468dafe7617ebcfe94d8877de2dff2969aa5554b435af167f45872dfbdf7f7a052bd2f
- TLSH
  T1D9C08C20C2FA3183E64E8000E8BE0FC3D22245258002A6B9F2D12865733C4EA0702891
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral19 behavioral20
- Target
  Granny_Legacy/Granny Legacy_Data/globalgamemanagers
- Size 110KB
- SHA256 e87ddc1d7af9a71ce3424f2d3c3314419a13c8f5ff5ef93ac147af9c9ac295a3
- MD5 76684910976471e2ef6b4eebfa9e7fc1
- SHA1 21c44d7c9ee830ba47e47415d47e9d24869934c3
- SHA512 4171ef0ac222bc7f113775021477a5203a9299edb7d915f9599a1618531b225a93cf4bcfb4bc8e0ab4f88a7fff3181cc7e39b0a426572401c7f3df0a09eb22bd
- SSDEEP 1536:mJSqv8d6vVZih2mFDAnQQzj4MOXaHDBw0uqln+Xg0ONXZNfgCYq:TdD2lzn1fPln+Q0ONXnsq
- TLSH
  T14FB34844CFD2CE27C963967288B30B027B31F5CE6712D3574228B9BCACEB3915E84249
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  Granny_Legacy/Granny Legacy_Data/globalgamemanagers.assets
- Size 330KB
- SHA256 460736dbaace78fac5d4637a46eecea40bd8f9a9cb577bad568fbc1525b35230
- MD5 32a796c3a79075346509f3c4ade57f95
- SHA1 29fc2a15ef04a5f7a42f32a118950ebd25b8b28f
- SHA512 49f893af01812f88f111c9106096a9b9bd2a1f8db1f6652a4603827178e588eea79ddd013584fe63c566bd0da8d0596de0211c88589b52d60f0b46cdf37cbf15
- SSDEEP 3072:oY36DqjtVCK4lRX43LGfp8gRfmgQMSPeUoYdbGlIVF0isIn2aCB1ez9PD:DjtVwX43LGfpegTSPeUoYdY7isInNCy
- TLSH
  T10C7472B8C8689CA7EC94253B8C72830E3230BFD64FF2D556A9D07954E47A39C5F1D60A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral23 behavioral24
- Target
  Granny_Legacy/Granny Legacy_Data/globalgamemanagers.assets.resS
- Size 16.7MB
- SHA256 b808e22b44e0b028632bfc377fe7787ec916845630f7ad02dd8126074326690e
- MD5 3c52f3de7f1eb14b0079b537b029047c
- SHA1 f4366c4d41af48fe1421b7860b5c55df0106057e
- SHA512 5f2d4601f29ab3275a018748544fb42c658982fdeba3693b627dd16ef9b79bce238cee672e5ae5a273e3d267b69057201693932f2f528d2da2e0f53b2c7463ec
- SSDEEP 49152:v7byVdgTTTTwGBpqq+TGcEmH6KcLK7ZCAL5niyn:v7byV6TTTTwGBpN+TjEirqK7ZCANiyn
- TLSH
  T165079C13C5A2D6DEC4E924BEC43B2AE5D19F5DB8D7824FCE896B3D10A6731762B014C8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral25 behavioral26
- Target
  Granny_Legacy/Granny Legacy_Data/il2cpp_data/Metadata/global-metadata.dat
- Size 4.1MB
- SHA256 5705d30855dac4eb3db6068faf9c1f96fb2a2820050d3f8a2945ac2be703f0c3
- MD5 a1fbce308aefc2db343650f7cc3fe599
- SHA1 b91431f980d024724bdf6a777c2989c4efe4bd32
- SHA512 6f111a5033f78437721daf6d6ace36e0bdaeacfeb3d9a56f378f8b8cc38689a9ae9195bd7b2406d96678858fde7232140836f9adb489e6f107134923b37b7129
- SSDEEP 49152:RBbx2RPgArPp7GfHLSUJChcYxlTjO/eynFGrj1:dArOH+2zG1
- TLSH
  T18116C661FABCCA2ED56BA136885686F11B20EF458E01D337734DB76DB0F166529033E8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral27 behavioral28
- Target
  Granny_Legacy/Granny Legacy_Data/il2cpp_data/Resources/mscorlib.dll-resources.dat
- Size 329KB
- SHA256 c5baa176a5b72cd545266340e42102d393a5e43d38c95796bc828918bb95277f
- MD5 21d06dbc8af6432b2b49536ed30609af
- SHA1 11a1c0e2ab2f8c06fe4507535ed47e0dd279a60d
- SHA512 2971f54eaa14c3ce6e2352e5a1aea5b044f0894bf4eac92de8cd92515b6473b5ca56ebfcad4369a9d4935cbefea2540a83f332fd4d832c37768310e8776ceb5e
- SSDEEP 3072:c5j+evAPQ48RhHkXKSmLZsumnWpevI1kMqXkD3by+BEL:crvS8rHXSmJmnjvXkSr
- TLSH
  T1F7746CD8B5728E76FE57A9BCE85E928D43D9C1E2C182523B3D75C2E04D52386181EE3C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral29 behavioral30
- Target
  Granny_Legacy/Granny Legacy_Data/level0
- Size 2.3MB
- SHA256 9fd0638a522c85d1cc073e4376ee5e8d52f0b5a7a71b25481719d597fba75868
- MD5 e2eb4cafc54ff7f367af5b53127dc384
- SHA1 3b9ffedcedf98cc48ea7ad31baa0d19e5cf5ec68
- SHA512 e6c04c89b957d0b0bf292ddce474aa3e5cc60563283eab11fb57ca10ef7159278406cb10d16daa3afa61d30fd7da12b6590f6fa5ecb2a1a2db847ecde1cfc9f1
- SSDEEP 49152:nm8KasfhAl4wXEDsnyi0hR0t/wcmLkAIAp3bo:nm8KLfhBwXEDseR0/Uk0L
- TLSH
  T1C6B5F646B6869B4AD8B2333744E36FA6E335C9C81B3E4733237456AD3CD23E86D42165
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32