5004c89dd1cd284d01f45f68bd9b1f6e4f9ba49166cc5e1aa86d20af9b4302b9

Sharing

Copy URL Twitter E-mail

General

Target
SaigeCraft.zip
Size 113.6MB
Sample260625-t7capadx6j
SHA256 5004c89dd1cd284d01f45f68bd9b1f6e4f9ba49166cc5e1aa86d20af9b4302b9
MD5 9df991909466f3b4a844693addfe2c23
SHA1 934ab330ec8c8bb0522318a17054bc27b91495ae
SHA512 e46b4591470eb706a5bd78b7c90419b38dd3353640aa64baea11160f988ae0bd962efb5a24aa4e0f606624cd370f54bb769cfe38c95c1a4021058000c328ffac
SSDEEP 3145728:m4OKtRHGX9C+SSkwAddFoVA6nuvnJjHzqXjCghXhnIvkwAddFoVA6nuvnJnRlA:m4OKtRHGgNLvFyrnIjHzqXjT9hnLvFyL
TLSH
T123483396CB94871A8C36BC3E4C7709CB29B7B1C16ED6A110981A5FE370393D7638275B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Game/MonoBleedingEdge/etc/mono/4.0/DefaultWsdlHelpGenerator.aspx
- Size 59KB
- SHA256 751861040b69ea63a3827507b7c8da9c7f549dc181c1c8af4b7ca78cc97d710a
- MD5 f7be9f1841ff92f9d4040aed832e0c79
- SHA1 b3e4b508aab3cf201c06892713b43ddb0c43b7ae
- SHA512 380e97f7c17ee0fdf6177ed65f6e30de662a33a8a727d9f1874e9f26bd573434c3dedd655b47a21b998d32aaa72a0566df37e901fd6c618854039d5e0cbef3f5
- SSDEEP 768:6CEPutHjvpMgMwP9h5Ij7khsp/6JtEZwMXVtkUI3t3CXyEyk3VbNbqDvJ4oT1y:/r6CdsCOZwMX3k5dWyklh+Dvbw
- TLSH
  T18C43C4A0EE5C8D36499B52D9F48140DCB9BCC43191299CF3FCDDA12AF09CC6DA278676
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral1 behavioral2
- Target
  Game/MonoBleedingEdge/etc/mono/4.5/DefaultWsdlHelpGenerator.aspx
- Size 59KB
- SHA256 751861040b69ea63a3827507b7c8da9c7f549dc181c1c8af4b7ca78cc97d710a
- MD5 f7be9f1841ff92f9d4040aed832e0c79
- SHA1 b3e4b508aab3cf201c06892713b43ddb0c43b7ae
- SHA512 380e97f7c17ee0fdf6177ed65f6e30de662a33a8a727d9f1874e9f26bd573434c3dedd655b47a21b998d32aaa72a0566df37e901fd6c618854039d5e0cbef3f5
- SSDEEP 768:6CEPutHjvpMgMwP9h5Ij7khsp/6JtEZwMXVtkUI3t3CXyEyk3VbNbqDvJ4oT1y:/r6CdsCOZwMX3k5dWyklh+Dvbw
- TLSH
  T18C43C4A0EE5C8D36499B52D9F48140DCB9BCC43191299CF3FCDDA12AF09CC6DA278676
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral3 behavioral4
- Target
  Game/SaigeCraft.exe
- Size 651KB
- SHA256 8d3464ffe305e8d5a7a2e9edfed9418c8eceb95a9e795ea04ef4380f6d92a4ca
- MD5 40b3954aa6ff3880330672159c5a3339
- SHA1 1dfd685708b186ae50e1c4f61dcb62fa12ec306c
- SHA512 dbffced3cc73f2a3d70e89c6caba9d52c8f41135d7e3892fbaa69cac14ef8a2af1bcc41d4f29ffd2cfe8d7dbfb9f8d4ad157c498d6fa2674b2c169ff697b4c66
- SSDEEP 6144:I/7FG9mpcJ/OD8JqV8LsoFQqXTFN9H3d4+5yFE/41L/iuXGXJDu1jkL2rj8IuIFu:I/744aOD8y88bRw273qOn8
- TLSH
  T177E48E551AEF6AC8C1562CBC50912362E79D86E31573BB8BC876483F9E3CD841E4AC3D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  Game/SaigeCraft_Data/Managed/Assembly-CSharp.dll
- Size 85KB
- SHA256 4020cca1e1b0247e0dee23a900f64ef92869a84344f9a92bd43e5f599b6da748
- MD5 fa77170c1b05263873961de282e3933f
- SHA1 fbafdfea9f34b8b211ad1314dec3c3a194aa5080
- SHA512 65c269eb18ce63b61e37e6116e9eba0f6779a31001437ec4451976814c8a71b76538c7dd4b57768fc482db89fb4e9b062a7bb5cef966836e7064f0d8fe9982c1
- SSDEEP 1536:wsRJ0DwU3bVS6fnvEV/8o45mlVG/0JaiFFfL9QBoCkC6WZucengsW65fKdiXTJBf:wsRJhU3bY6nvEV/8o45sQ1n8JHfKdijj
- TLSH
  T14B83391073B8DB63C5BF06BF6472869693B05227B56EE7896DC4B8DE09D274024037AF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  Game/SaigeCraft_Data/Managed/Mono.Security.dll
- Size 235KB
- SHA256 481dfc9edf2788f82b59378728fb46f85488bd0c68f2a24979f674ee64e32611
- MD5 966b0175ef8913d04464a823d7aa81db
- SHA1 4c69be4721b0581ff7aa58452f27d3cee9c60000
- SHA512 91dd5c5e0a734fde79889732ecce7c924a179f8a61b1fb7ee0124992f8aeeccb32e05345ba8975eede61d46ae352ea8abb906c604d2917ca32983c88d2c1b1b4
- SSDEEP 6144:4UjTQ70cnf8MoVRxS9iJdBF119RJXG2yL+Q:JEiH119RJX43
- TLSH
  T13B344A1863F9531AF6EE8779D4B15019C3F4F50BB9AAEB4E5C8282AD1C027918C41BF7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral10 behavioral9
- Target
  Game/SaigeCraft_Data/Managed/Newtonsoft.Json.dll
- Size 670KB
- SHA256 87fa9a30e8406b0ccee1ac7f44b529228b4d76f7a3549b1a3817fdda0f5b5b2a
- MD5 95fabcecebe498f780caaaa33483bb2f
- SHA1 c994bc5f781df8fcc8aed36f7858c9e647942000
- SHA512 9b4ada10114c8c5c6d99aab1832682ec8bb9c9f95c0310648b1defba2873e732af70cc6f0a2c1abc23f2170073408120020feaf2b08441f137d4f590572d340d
- SSDEEP 12288:judT4rkEdatCiMGYBsq85XrWIhf8vbTB8jx6nws:j84rddkCTGN7H0vXB8jxGws
- TLSH
  T1C9E4492523F88B26D29F6370F874491847F2F416AAF6EB4F4908A8F91C53B94CD447A7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  Game/SaigeCraft_Data/Managed/Photon3Unity3D.dll
- Size 227KB
- SHA256 6e9aae4ce9a47c27cb6d9d1d8ed5dca6f5e5b29755cea628270f544041738e25
- MD5 f48cf41d7753c16c029057400655d8a5
- SHA1 25252d3653df03a65eff7936210b2274b6c965c6
- SHA512 b865f888c8eb14c8526a7f9d862b0d0dd83b5ae6bd69de731403816325a05df9a9114181c92b578ba8b7307fc5e706d73dcbfe93e1e03a2064870dc554f99c44
- SSDEEP 3072:qzFkuFtWiDnv4vb3WLmOOl6V7HOUzVM63DYKW+mteDi+D08fyeXG7DJlMSei7J1N:qzhzDQvvcJfyEGXfNX3
- TLSH
  T11D34291997F80A16E6BF1B7EC8B551410774F92AA417E35E2AD064FA1DE37C2CC00B6B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  Game/SaigeCraft_Data/Managed/PhotonChat.dll
- Size 32KB
- SHA256 15d27b58bdd973aa529823244e95a20d1f84441f090af8d4b4319a852461f9de
- MD5 09501d88e8003cfb514d570b2db964c6
- SHA1 238d6733524cfc5a4573b055350cecb0aee6aaa2
- SHA512 90fe8b8cf96a4542d149429de0ea540b608a7f9500c4ffe1f0883c8c0e859a412bdfe2a29fc5070ca14af8630fd901fbf58c66a2f9ecc1ebe3cd7680b225dfb5
- SSDEEP 768:QYdpC5OUvCnCfI/+j0wuvLN2p1OAvPBrFSoi/H4N:9w5JfImjs5erDSoi/8
- TLSH
  T191E2C6504BE81A2BFAFF2B75687145000BB6BC52BA31D75C4E8464AE1C72BD8CD21B77
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral15 behavioral16
- Target
  Game/SaigeCraft_Data/Managed/PhotonRealtime.dll
- Size 98KB
- SHA256 823cd6cd358f056a5fa031ed2eb60bb2896e1b0d8fc0500a5acccd465ed263f8
- MD5 77738414d886d6c53d431c204285c1ad
- SHA1 80c415560c3462c53583561c4e5e98fa012748b9
- SHA512 f60e7f38f2534d52675a13436a00c668c9e14b3229f03ad104ed9c99c059a427724b6c9bffc3c1f0b25b7bcd9480be34004b8132d8b3edf31157ebd2c5d624f7
- SSDEEP 3072:jLCnvbs++4ZC/NmMT6wwDnNvchK0oTio:/2bs++4ZCIMTAvHD
- TLSH
  T19DA32A2263FC0A5AE3FE1B74E4B104050BB6F916B972D7DE9E48A4DF0562BC08A15773
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  Game/SaigeCraft_Data/Managed/PhotonUnityNetworking.Utilities.dll
- Size 55KB
- SHA256 7e0b69673e6d99dc80232a5003fa2e0bc1f2d87de939e3c61c8caeb674a0b862
- MD5 f67985212bd8a9630008aae5d50cb952
- SHA1 15a2f783988940ad50b54c9fc35bb3c766d44ad9
- SHA512 d2bed68247afae988d684094ba9e06c3c76140673ee61930d9329bdce56b987cfd7316d5091e15ca6f365de24026678f65cef88e947e8690bf67154655a41734
- SSDEEP 768:CHrMYy6V/7BuwSEbxyvqFK4hhx18OItvuaqQiCyaUG1G0WxKY5WrO9VVJdl:TYy6N7BRSEtZhRhItvuaXiRi1zWxm63
- TLSH
  T19643190057EC0D7BD9FF1FBAB87001421770AA53B572E79E69C4A0EE4C627850A663E7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  Game/SaigeCraft_Data/Managed/PhotonUnityNetworking.dll
- Size 107KB
- SHA256 5149b9f641c670158de043fa4d33e801034bf627235be2cd9316a35131394c76
- MD5 3508be33e0c52a617f940285f5ffd8ab
- SHA1 c1bb322f4a36aeac1d7b028833646288e0038de0
- SHA512 f2894d2587e16a85a40765fdca5b9ce1b5c49ecace631cf80ca240e8926e76414d232ad2824dd20cf1b6730e851d395ef2e2f87d6dae4a2b1cfd0df4e4f906d8
- SSDEEP 1536:0fHKwcrttuSenZvpxr5tssxnDw/VpJEsKHWGvn2+/4ZsJpgJPLVbF1I:rrtNwvpxVts6kJK2t+/AsJpgJP2
- TLSH
  T140B3191017FD461AEAFF2B78787511544B72BD53E932E78E198060EE09A37C0CA667B3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  Game/SaigeCraft_Data/Managed/Purchasing.Common.dll
- Size 12KB
- SHA256 c8c0211a823a4d18113e205f4fbb6a41d43573f8bc444ff972e657f5b1470fae
- MD5 a3b95b1390ff785cd3e7479b19e28ca7
- SHA1 142e59628155db516c88201ed9dcd0448628b77d
- SHA512 1821976a80c7bd838b3686c2431416f59751d788259eb12b607ad7d47fbc1a704c7270d7e34680260096e7fffbd00a25067a9ead678fffdb9f3d8355140a698c
- SSDEEP 192:Uy56RIAnnriebwzCJrvG4uPdWgqzkcql1fDxziC75I6DPkPWe+R4:U6QbbwzirvG92kxllxzN75nb0/+R4
- TLSH
  T19D424B98ABA59727C94D27B2403303C36334D215A653DB5F3D9852E37E673860E82F6A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  Game/SaigeCraft_Data/Managed/System.ComponentModel.Composition.dll
- Size 251KB
- SHA256 40a52836a67bbd07af5449844dbc27adf652df5589d47fc504e59e33fe311508
- MD5 f93636b28134c3a66b6bc3ce314debf5
- SHA1 e3c0293770e5dae365907d496d2aa257c3bc6317
- SHA512 9bdf06c8e9ee106c0a73a43996bcb121b79aaee6f586f5ded5a42236074c0847f72ee0c686cea1478901faa79afdf4fc0e035708643d50a89987a29416a9fbf6
- SSDEEP 6144:ikwkYfxuS0ZNORl1X1XYZGFU+22kUgUlAwU5e81hXJXee4jsURlXXMAX8O33iEP3:ikwkYfx8ZNCxL
- TLSH
  T16F44281533FD0366EAEF0F78B5B480148BBAFA06B95AE71C2C8951FE091379499117B3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  Game/SaigeCraft_Data/Managed/System.Configuration.dll
- Size 122KB
- SHA256 75a4bfcb526281d82d7011f70b495ac755a571684c93af3d564a9af4cc202b1d
- MD5 63b88f24548d7cf5b2808220c5161b19
- SHA1 5c311ce4d287158aadcc7193e1442e6b0e376dd0
- SHA512 4b2ebab70fc9e1bd0e2b9869aebb77a56e7010972a2017b5cc8b49dd565c4d0d6bbc1a7562d903c465bea35856eb9cacad9d2d203d00c57eff184060b1d2a3ca
- SSDEEP 3072:bGHTFkizuGCOE/htnREcacWown5WJGL0MIelgNe:bGHT5+H/33vJN
- TLSH
  T180C3F92563EC872BE2EE177EF8B515110FF1FA0AA436D74C5D89B0ED1827B804662367
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  Game/SaigeCraft_Data/Managed/System.Core.dll
- Size 1.1MB
- SHA256 78a129e716f2e405cd05b02bb9004b0f7003b3402f57d4ea1d0e6ab0d8720d92
- MD5 9d04835046ab7ea77a7258bf5947c14d
- SHA1 031746b8b65d9aebc9bb21877e4468432b8f7876
- SHA512 a841f5104150c193f7f8fb6f77ede9343567fbbef36003a268c40d51ec4bebb246bf5aaab2de2120b0049d557372a20149e58dd63d4f08aa7f04daef990e36a9
- SSDEEP 12288:SWK8Xi19FV57751umv0RX15PgLdfJ18VXjvM44uvetIX6e+ixHzR:4l/umv0Z15PyCpvMNM1+iF
- TLSH
  T140354C01B3EC9B27D5FF7776A4B442A007B6FC46AB3BD78F104891A95D56B008D887A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  Game/SaigeCraft_Data/Managed/System.Data.DataSetExtensions.dll
- Size 29KB
- SHA256 ee4fc334fd1f477dff43df55bb0b65f79de4a898273cbb75590df9fa118549ce
- MD5 96a2ad328abd2c129f9d1642ed2362d7
- SHA1 94de67b8a99cb8e7a8efede206f6210d3680f269
- SHA512 e84ce8c68affd5abd277c2dd7a51651366632ed22a06981cee2b1e74baa33da602f40998e8df0b36b6199532c810b528389d7577214dad35ed3f1c075b2d7b04
- SSDEEP 384:LEAjm7aELetOdc8l4LodMqokNv2Y2rsFKOlIcMYOxtsnRbli3ESmMadMkrVr5UhH:LcZC8Ll4LiMXkv2Y2McdDsj5Q
- TLSH
  T132D2C915D3EC4311E3B727B57CF551868AB2B913AD35D79D288E23CE18127804D62B77
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32