4b0cb71d7effe74370295cdbe606c60f94649839cb6bf73dbd1c150573b1ae35

Sharing

Copy URL Twitter E-mail

General

Target
MeowClient-windows.zip
Size 67.1MB
Sample260626-12acgae15v
SHA256 4b0cb71d7effe74370295cdbe606c60f94649839cb6bf73dbd1c150573b1ae35
MD5 05df48957fc10da8f9618320701d567e
SHA1 8976ea381e9b8bb969f9fad1f32331d36a16d026
SHA512 b308347ff23d3084a1d4bdb90008275089881b88f00f81c349beeb678b1f839804faefcd01c09285f89d935ea872c26436129fa347a2d57f35b348d094eb9309
SSDEEP 1572864:61wjrNhLibc7armIc1VkyQJBzsrBoseA9jlivKAZSZptV6zzQUgSu1:x3Kkay51CyWBzsri09UShZTVbUgSu1
TLSH
T1F8F733D8F785266DC975EB3FE2C8D646F559A81B103246090FBC1AA8D947BC39FCC206
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  MeowClient/DDNet-Server.exe
- Size 1.8MB
- SHA256 af6e81949488a464430048e1efd888e49e5f1cfd16685320da27e457a9617f2e
- MD5 d9737149e58fdafb041e654b4c88243a
- SHA1 72b3d69422158ae54723a85acd5d442178096f07
- SHA512 6e0e487b18c8511a8b6b658d19f190ec77d8b1d1fb44914ee96ee7455b4bd06ed8e160087f02dc59abd31c956bfbdfe4372d03ddb6da7cee7957b28e292103ac
- SSDEEP 24576:FkmXKBqvtKNgR5dHYcioHgjK5525Q7onQoYOsSieLNJOiDDzvK6oDhd:uoqqvtKNgRjHpb5525EOsT8HoDH
- TLSH
  T163958D0677A210EDC57AC03CCB837627FAB6742803257AEB1AA095571F27FE41A7F215
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  MeowClient/DDNet.exe
- Size 20.8MB
- SHA256 f11bb058c736409908abf6ba25e925aaf61cfb6e28b47e14a29ac320ac8a07eb
- MD5 98054de11ffa8555bdd44a9a293cee8d
- SHA1 1e42bd4c8ee26a9719504b7402d5e96cc786cda2
- SHA512 4b26bf2665256a03c4af39c71afbec4fce387ab0db44548f81620121b75761489c093b95ead66ca057268466420519af75da95373acfdda98516e72f9e2187b0
- SSDEEP 393216:PCOg8NKMwt/SOO5yB/gT/Vw9MANAMxMcwJG+tefR32EBDMzmvXL5J+rqhNQlkmcd:Pnw5SO9mYLXoef922iWXz++hYkNu74J6
- TLSH
  T1EA27022272A501EEE07AD0788757A813FBB2F4560331ABDF02D085561F7BAE16E7F611
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
behavioral3 behavioral4
- Target
  MeowClient/SDL2.dll
- Size 2.2MB
- SHA256 d0ac4e209a78ad56d53af2df40a51ae9e4043704efbed5b46bf75a57ec92ab1b
- MD5 9f2509c44faa79c87382855d4a94966b
- SHA1 4474c7d2923dd0a535c01612c6bd2c0e1f1faef3
- SHA512 fb5f407af1020109acdf693f5391cdf7905a99d0d09628bf066f459caa36cd2e296adb623a60950191e4e3395501c332b672ecc219bdc02415013dba42d6ccb3
- SSDEEP 49152:5L6mcGjDqleTVMEGol1sEQf21L1gz6vr//uw0508uLMDpYwvuIBxV:F6QHpQO1L1jvrXuw0S8DpD2IBxV
- TLSH
  T1E3B57E5FF2A365ECC717C031836BE772A93178180254ADBB26949B716E32F904B5AF34
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  MeowClient/avcodec-61.dll
- Size 2.7MB
- SHA256 58c71baa592da746c9c5e30fdd41814a2736454b2b7168da4ab88585758d4786
- MD5 ae6632db7de61ef9a0e1045b829502dc
- SHA1 e4c9eae709c3b3f415f9183e2e45292c14b9d5e2
- SHA512 37d112a490105d11283fab5a2febb618305919932bc18b55b79bc0d3ef862791d3f6f8cc6dfc57b00ce1fb7dc576c724dafbff84144212b247e51e265904c28f
- SSDEEP 49152:sG89fcQ/HjCDvYceJirwiucX2bpbsyt7U9gkUObKPHv5bW:he0Q/jYv8/NR1TdW
- TLSH
  T11ED59E4AE2B325ECC567C170976FE723FA70782C40247DBB5A90D6312E63F90661AF19
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  MeowClient/avformat-61.dll
- Size 502KB
- SHA256 b72292ed8140957752e45880b597b6e1a673fb66e740379d29614dee1454d3a2
- MD5 179f9ae9eb9e05411966a0d943e75360
- SHA1 a543163fbea7ba8061da700133cc97e9ebcda589
- SHA512 ca77ce3fb5e345ea6304c9d405de577b164224df01ca25ce1ae560ab82463dfa6b0dacd6880d8d8821b15d3892f8d12bbee76832dee1cfef083b74f127949fc0
- SSDEEP 12288:vHoTMfa6+pLH1SicSrISTE6bj3tZEdEyd:vHp0HnHASfyd
- TLSH
  T15CB45A17D6A315ECC66BC13043ABA772BA31786511307DBE2794D7312F02FA0A75EB68
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  MeowClient/avutil-59.dll
- Size 1000KB
- SHA256 cd256113d455d362d769a859d2214b9f672be8d2692eebd7539675d31620ca6b
- MD5 9f4e1d61cf779052fed243c2142495b2
- SHA1 246b28f23c542ba6f38767ad420fc4b6f716c8af
- SHA512 f3059d52d93731fee5fc03af389ea08f85f449caadc79a0021fe3da2234648ad3bbf012d96eddd2de161bab062bb8be3a9bc98114cb941bb46c1e0117c241593
- SSDEEP 12288:4wCIUQiy/TXud3kOo09O11s5mbxZnBR2XoR6nP3J:4uioXud3kOn9x8fqYRoJ
- TLSH
  T190256C01A6E3187EC16B913046AB7657B6313452CA64BE2F67A14D343F34F916CCFA3A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  MeowClient/config_directory.bat
- Size 236B
- SHA256 ac9fd0ac986f58dc46c8e52e36807c3c7c6ae3b85da7f32b85166ef1bc462e30
- MD5 e23d42a6bbf42bbb92b18a90ecebc24e
- SHA1 90ec9fe52626746da5799ebf4305b3f1fcb7028b
- SHA512 d106003e38a664278159e71811430b9fe235feb1f8ba0918a2f49405757c7c12a2252a495f4841a866f6a7f851f7592320510c2a2d481257d0a33e29c1210329
- TLSH
  T1D9D0A7F3400C0025C7B602C83E695997604997E0452F2AED786F91E8B424DFF43C7740
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  MeowClient/data/tclient/builtinscripts/sayemoticon.chai
- Size 188B
- SHA256 cf491568384e78778b21dd882798a84e7556e40b2bf6323c8364242fd97ecc2e
- MD5 350790b867b3fb4fae0ff38408519484
- SHA1 32dbbddf682e9061f0a35a59efc68ceb0ef15bd4
- SHA512 cdec1138ea9c9c943e2b74458e60b7292007d59de1261d85480c9086c421b9adc15b3f44526c33bc41f5a291a1ff133f2d9437c123ca6a7a8bb3931ec99d87ac
- TLSH
  T128C013211A50576C97C0DDC169C95C0FD4B735B63F3D4C6C531DC56065FD2E475640B0
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral15 behavioral16
- Target
  MeowClient/data/wordlist.txt
- Size 14KB
- SHA256 bded01753b3137270eaec22800c43a269aa121c5bf254b8f0ae487c8ac4b9cdb
- MD5 c5ca8030f935d6ee878fd41dd6df33f3
- SHA1 78550e86e9eaa25d85fee8e521694f398918fb67
- SHA512 3a1ec234d16254822379afc56a07d08c549b905af07de3b999bee460fe58a3a3ac00651a740bbdae88c0dcc78aa9d616223a20cfd0d9cfe6ffbf6bdd678bf02a
- SSDEEP 384:URFKGC1Mv79nJwX8YqAgKN4kmcDjnZAOflGOF:UO/4FDukcDjn6WMOF
- TLSH
  T1506262986886809258ACF7B0D11B2D9DF12FA76128131D2F8D3ABB5432177BEFF54482
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  MeowClient/discord_game_sdk.dll
- Size 3.3MB
- SHA256 a6b6d7df00a58dc50248d91048578d0fe52182286b487ef89a961fd10467dbd1
- MD5 4402cd4891c256ee40046c6092afdcbf
- SHA1 914e01743c7591beb79a61417b262caeb23e2c20
- SHA512 78da4181132a02d7d17ba4b2839018dc43d7d691c8bb01d34e5f7439df9c92951ce687e9487df158c44e764275b45d6800f6629ec2a175cc4ecdf868292291e5
- SSDEEP 24576:Q/NGmO/w02OFM7zWIyjQYS2tBMPfL+8T14rbXojA4F8eEcu2sqhA+cGRlZVIH06R:3oOiaQAtBMPfCn/WDcGRxIU6iIdAk
- TLSH
  T1E8F539217A5A646CC0AAC474838B4A722A3138CB1F35BDFF04D595793F69AF46F3D218
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  MeowClient/libcurl.dll
- Size 586KB
- SHA256 8d361a28685bdca7f0264f94dca8a8a2d3174465ee1ad5fed69c80120f607035
- MD5 6070f99936087cabff52bafaf04dd3f6
- SHA1 0b7c4d0a425f3d69802abd5d78be984e298d0272
- SHA512 f53809cad876c0a139582f6209d71c886c864208d913b383b6268415196eb1fce0c4d972184787163cdb992a8ad2c7e72ef8452b2aaae7189b8724aed6e2f767
- SSDEEP 12288:tEq4fb+EFEv5dwBSFNsvMt85VIWO7ZIqSE+:tENfb+EFgwKtSSWfK+
- TLSH
  T18AD45B27E2A328FCC16BC27482A79772B972F4251130BD7F6250DB313E51E506B6EB64
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  MeowClient/libfreetype.dll
- Size 665KB
- SHA256 5da185332bcf920ff8f3d649b536e44105b914118b33f90a631350e6e813277b
- MD5 564ab421c4f3ecce01d087d4bc28e8c6
- SHA1 3b4e992448c47267de0201ef6b5db0979f8dc192
- SHA512 8dfe5bf1a846fc14c837520bcfe02cef124f1ef49a694b507bbe7d5213e3ba3175c11be5e7189db9f86e90e0e14cebd1dfa60b657bff2eed843e5028a71eb85b
- SSDEEP 12288:pRvw8ezpMBHwZheKGhogg4ywbx7KujYoo0ASAcglfEWmXWF:pRvwTFE+cKGeh4fx7Dkoo0nJZQ
- TLSH
  T1DAE45C57D3E351FDC66BC2344367D772BA31B4201124AEBF42A8DB312E21E90671DBA9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  MeowClient/libogg.dll
- Size 33KB
- SHA256 5187cbb032ccba2ec40f460572576e964d6e089f0b9ec75d975f4a24c7f45ef9
- MD5 5ea985fe0821b513fb4d002514f0be00
- SHA1 d3ddb70c56546d53224e0e742c13e630a86c6f21
- SHA512 2a7bead202c013981bbc5ec505e36f3ab898d88c971a3a5efd21862470579b20769ebb5241e4854a2ed192fb1e9b7a0c8473bf3669cfefd67ff42c780bd88276
- SSDEEP 384:vhge09sMsINs0b4WwuKVuY82NNv8j9JOoXQ8nR0LRRCppImMAYnQcg6FSsTq6dB8:vhd09sVI20vwjOj9JnnGtUplYXosS
- TLSH
  T1DDF27D0F77A3A8ADC81AE13444AFA332F4B7B831A9625D7A0350D7311D70DE46A3DD69
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral25 behavioral26
- Target
  MeowClient/libopus.dll
- Size 544KB
- SHA256 55a25a986ef2bf874503e9800668fc5292a9ebe3b011cb3569706c8629d0dd95
- MD5 d1e88f2125d7bd8b1d375aedcf1fdebc
- SHA1 39f1dd204db03aa2194ff07d29a149377b04b9b8
- SHA512 f538b0b192be0218e22847e79c398a2232aa59dcf4a97827511c1d296b8fc68f3988e63123e28d94018cf55c0ee771cbf56958e345ba3762056ec1ba760d478f
- SSDEEP 12288:RYdxjSKUT0qanhlN5FRYTLHED2KX4FKbgYWzzKyfo:RYjjSKUT0qanhlN5ITLs2eDc5Q
- TLSH
  T19BC4F729C7FB94ADC27BC1B84B0B5B775830BC5D5178A43B4AE445C13B761309BEA3A2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  MeowClient/libopusfile.dll
- Size 49KB
- SHA256 5f25c3fa2feaae3d6e7c129b043b1a5b51ae4db1bdfc2c9d4f77030e24bd8f74
- MD5 f69a5de7fad79e0cbac3909d71e06acf
- SHA1 03342585c470080703b0aeedd28143cbcb37e8ff
- SHA512 315df87137af0befe212e779a8daab0e1857e18422219bc389123ab2d3b50e2e9f074c57c7d13d61e23ff93eec58e31257d2bce4292e25cea025ed0eb278e208
- SSDEEP 768:lQb9+k5Joapi+J15CJ/l7R/LCyC00JuqV5JRttx8WCDx:l2Ik5Jp4K15CJd1XCJJuGJRX/Ox
- TLSH
  T1C233390BF2A325FCC567C07057EB9733BA71B8214630AB6E4794DB382E64D506B2E719
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  MeowClient/libpng16-16.dll
- Size 278KB
- SHA256 d6b01790f7cd91518436fd84d98a43919726cbf7783c5b6314014e4837fbadf0
- MD5 d67636715ff72454be4439dde2af829a
- SHA1 adfa6cc1b2aa436ab12d87524bc7fe87944ba145
- SHA512 c63332a885364baf8e48b9be23f701682ee4e7b028aeff2f70c727a53ac47cae6451a34184a5ca06e058dcb7c458d9d64c6268668f9a9cc6e4b2dacb40a35c44
- SSDEEP 6144:JrXVb288kcpHH98Ry0zI0mscZ6pRERo/as7I4j36R109m7w8EA0WpEj:5zERo/J7IQ3mXw8zO
- TLSH
  T1B854E73BD7B3C86DC5DB81B17F8399D42570BD381335E44F02846A51BB2B9707BAA1A2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Contacts third-party web service commonly abused for C2

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32