7a2245a72cdaec03cf73b22140003ce3c53dbfacc1cd5da745297ea1ded17799

Sharing

Copy URL Twitter E-mail

General

Target
codenameengine-windows_8c389.zip
Size 238.7MB
Sample260626-e2r2mahw5r
SHA256 7a2245a72cdaec03cf73b22140003ce3c53dbfacc1cd5da745297ea1ded17799
MD5 c36e55fb073e17b78152211c84fd78a9
SHA1 536698a1e7509cc7c65a5fa32cbd9b39a7126c89
SHA512 98369580ed5dff400a38541671c099b64330f8de56ddc257b95626a7ceda9e2a6e7c553ac8cc19bd682b39c5bb75cf922c8f754b94e6bdfba9e4f0d25ea0f720
SSDEEP 6291456:/Y5fK2NssiVAmI9i1skNY4lBts6oUHfAOxHQ5ZDMSZpL1:w/mGmvNY4lBtnRJADfZV1
TLSH
T11DC8338CEA502E9FC01E533AF397A865BD6803075703CA7BA698F35D3AC15870697D8D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  assets/data/characters/pico-speakers.hx
- Size 444B
- SHA256 8a2bc24f75d60bbd10367e63ccb67d43049ff2beabea81611c441931c7ead376
- MD5 0fb894c7c2c5e50b2521782567954379
- SHA1 882645ea01da60747ea9317936b42da70a155286
- SHA512 eccaf5d8c05eb6326dcf65c887582bf9965549196e0ffd350f86384c17f4d3232268f81eb234da747b8d280cef982f6eb6dbddc61e89b9ee6d8d635124ab72ce
- TLSH
  T1F5F05591B282262C4B0E8BA862734006AF3306B1521C4728FACA8FCC34203372BF605D
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral1 behavioral2
- Target
  assets/data/discord.hx
- Size 1KB
- SHA256 ffa523d4b77a4c86930bae2f349ead2e1bf3ed9d5dd148dfc6e196bf015827b1
- MD5 ecb122f3be7b1a25f407d93b598e27e8
- SHA1 843369ef2368ee799525041fd5c609875230fd86
- SHA512 0740e54a5fd1df4703f9da16e7ce2e6cf928d7001630655660122e5806c934fe6f28555c3e5ac1b208a3e1403b1709d441ada6959a50baa577b2ce2e32e93c10
- TLSH
  T185316EEB79551D1E4BC29A011A6F01860F3880FCBB1ED816684D4C986A4E18BB27BDB7
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3 behavioral4
- Target
  assets/data/scripts/pixel.hx
- Size 4KB
- SHA256 0b0ab60cc359b66e4a812067a370ad61303fc290d91354d24a2f2290d62c3a2a
- MD5 538e645a1ad0fe23021d05a0e136e918
- SHA1 722394c6e088a853d867e8c255836b09e0c6a843
- SHA512 39322c4d54930fd96b8e831c437bd111d4306cafc6504dc69a29338dd22aacc9cbedeb5ec162d95368a1ac492f694e3c5e87a577b3de2758121754dd366500f6
- SSDEEP 96:pEI+frEvECO3KS3ueb+IDwPQizItuwwI++7xL4Rn:ph+jUeayp3Dw4jd+kY
- TLSH
  T160A131FC31C7352F4AA803585F7D00843A7584B02907A46AB46F8DBD7CA496E7BB897C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral5 behavioral6
- Target
  assets/data/scripts/week6-pause.hx
- Size 3KB
- SHA256 0898ff554b97a788510ca7ae1ac76fabac59e51a0e80d1ec9148ad4b76c5680d
- MD5 9b74f94c0006954d39d56326e83dc588
- SHA1 177e2454316f7e00184a2c20ffb0cad45f92f18d
- SHA512 45060ee30aeef7c14c258be7320e2aa193c7d18686cb003732367e65895465af58305e9089cf46c63ba7d588f29f4e13c681f0899c3226cecc734f8420117b72
- TLSH
  T1E761949C65CBF17E8CE5650AC87A44204B798978460FC68FB85CEDD83F9405E29B6CBC
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral7 behavioral8
- Target
  assets/data/stages/limo.hx
- Size 967B
- SHA256 3e494d334c18d8c67b29e68dbc695c9ff9889d243ce8666c6293c331a12df55e
- MD5 1cb10112129f5659296bf5de9f17a4e5
- SHA1 92361a6c5771d51e0090c7cf789ef3b65e690aaf
- SHA512 12b2855f711bd953298d2f7bb95270a7f3de2c280b0ca40cccc15ba57b57feb266d6cb8fc070d398d88dfa3067f1311bba5a9b017ae97517b03e07d0ce062a94
- TLSH
  T18911BA2C730A123CC6B4630D303BD5134D789013A6A2A7A694AC02B03C6C73DD957D7A
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral10 behavioral9
- Target
  assets/data/stages/philly.hx
- Size 2KB
- SHA256 a1d3812d755e216b770ac3f4784599e36d5743ad245cd4f8436d5355a93e0284
- MD5 35c5ff9f3d2df765b6bb7881a66480ab
- SHA1 81903d32be4a9671a99977b76312e9bdf8b48eb2
- SHA512 cfdd40801a8be4794c4c86e8f17507f9044518e4229eb923fc543128871eed1bccacb7119268e04a1c0ddcc30e0deceb37e5e280b0ac291bae30ef95dc9b7da4
- TLSH
  T17341FE1DF147613CEF75341C847A50AD1AF1A8600B2BB3E87FDE82A0786099D84BED59
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  assets/data/states/StageEditor.hx
- Size 9KB
- SHA256 e0fede1be1ce9f729e5b6921cf325b78ff05e9ec79bfc315455fb7015d5d312d
- MD5 17a0447f3eaea039808177e4fc8c58ef
- SHA1 c07b3f487f1e520eb2d164a873b82c61927dd80e
- SHA512 cfbd6781786b36260aa3c93e52883dccba10771bff46f1da0e9f2a8000003635ea59839bad33d6dcd48a3be0c94b620e9acb349c2b4ba776c16aa5ad8a0620c1
- SSDEEP 96:3Wn4q7DOj7w3vEAgRvR23tdW/4muyfo8kIsahKjiFOT7Sh56KBo054KbqcpAKjaJ:2DOA3s75eW0otjRFOT7SS8m3xiiP
- TLSH
  T16E120EE93333066D4F612728F139C4819BE18618C973A4E9BBC4D34C32A4D6D1B65A6F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral13 behavioral14
- Target
  assets/songs/guns/cutscene.hx
- Size 2KB
- SHA256 cfde337b4ca6e50851c8c2e454876920019cb15c950296e5ecc2924f0089706f
- MD5 02eb90bc33fc5618766c199d7545aa2f
- SHA1 7847b44c3567cfa34d48dcd2e74d66977259fe74
- SHA512 033d9decbad0ee803692e7c4432c00e8d51f088d4173b65f389af95b51ad87527f07ff84ce7714d9b20b6f0cd85bd890e977b4d0281ecb94e39fd237cbc8bc48
- TLSH
  T17241220E56C6153A4CF0335C447927422B381560EC0E6B39E45D8A94BDBA16AF7B3C78
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral15 behavioral16
- Target
  assets/songs/roses/dialogue.hx
- Size 346B
- SHA256 a9c175b0f7c7dbf5b5f15db23bf6c5b250a043edc9d4b108db407c0eaa21efc5
- MD5 990f316b663d60776cf1589a20a7f0e8
- SHA1 5a330f8888af75643928b17d55a50311ed1c0117
- SHA512 13fed57da51704d64d9a7a138f79d5a16d6d81d097b383205afd605ce636a1e9b4aff19813013d9cd1d8fc5d44c71bfc838972e66cefb1d58f56773dbdf54c57
- TLSH
  T156E02098321D477D4C8D06953D3F00B0837542D51EA773BA551E5DD9205505A2673DD2
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  assets/songs/roses/end-cutscene.hx
- Size 1KB
- SHA256 c40ed61db479b7b7217b5abd48e7499f5d00516e47f85a6dd822ca51651e54e0
- MD5 da0e98b1f5dc44f73909e66a60283da0
- SHA1 9c925b7f1efb1a255b61a5e75a3180f8c0f1d89f
- SHA512 10f4b0bae54cb331ef2bd4475bd78baaeb8a0401e6d7a52279e44f018194a9512e8b877a4bdcbbf002636f8c0901618396e22bc7270f9c7b846e5c0482d81b97
- TLSH
  T1AC3143CA300E0458DFD3A76B843816008E3CD4B186A9A27E746EADCD96E98551B1BDFC
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral19 behavioral20
- Target
  assets/songs/stress/cutscene.hx
- Size 4KB
- SHA256 c1c4bd3fc4ff726559b7f4cd8a5135253ef1e90d27c02f2145f834d379ba2481
- MD5 b02faf551c57078d22b923bfe3a6c8cf
- SHA1 1814452d912a0ce673bbe9e74f3c706b349e6876
- SHA512 e40b40ce0756200f54bf11e87e24ff3068e791edb857eedc2860698e3aa59194a0dd15bd95e40b18b0b246619a0802df67f61147f52b7a43d99ea3c2304f641d
- SSDEEP 96:ZLfG81E81JG0ngkaoGV1g1SrNUA+09N8M23BFx2LB2H4EugYA:Z681E81lS1g1W1H23BFxDYEugb
- TLSH
  T1FBA1530E235F262747F8771A443E3A104D7DE4E0AE89A572F05C4A16BDB532A4B7B938
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral21 behavioral22
- Target
  assets/songs/stress/scripts/tankmenRun.hx
- Size 3KB
- SHA256 f3797daa3851510ed74e5bc55294eb207465e7589fdf4f91aeb7d6710bd310c2
- MD5 4e7380f45904e208699d55217bae82c1
- SHA1 b2377327a361b7dca7ceff3c2e10d0b547c49b5f
- SHA512 a8bfc065c4cbc0ff09d4e56b5d02e07d40d74bbc839fe2ebe0603709d28a584cb1203086de80d99861b50e5496f39041b3e6d89be831dd22f5fb76f7d3075608
- TLSH
  T1EA81FBE5329B361DC3B2B365C07E9E058F709460CE45E1EEA4F9C105182261EF7DA97D
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral23 behavioral24
- Target
  assets/songs/test/scripts/modchart.hx
- Size 722B
- SHA256 19ad1e1182c79138c973e00c069f21b4d06bd99d32757db5f028a43d17bdcb27
- MD5 5da31d8bc83b3f132c8b7807eda76a79
- SHA1 8fa7b48aca18d4ab2ef8f3193adcdc97a4ee378d
- SHA512 21738db30d15987ce73d1bf12743eaf997168b4902f6b29b2eb16205350bca1211906de735fe957157ed8010ec64e364b43695904cb659dbd701d30f27d75b61
- TLSH
  T1C201C0187246342D8190B760453B105B5F749A204212E33ABF9CD73C4EEA7F42639D7F
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral25 behavioral26
- Target
  assets/songs/thorns/cutscene.hx
- Size 2KB
- SHA256 3a8f6ea5789a3ff9d8d0402b263f31c76e17101e7fe5b1e5bf01e4aaf763345a
- MD5 7668f898fd7efe923f20a6a1cbba955c
- SHA1 1cd6db556dfa2411a48a7033ff76dc215accd757
- SHA512 8c44bfc26df141e749507b2763d08fdc5720cb33bfaf7e647b552616649b313be7b2662c99ef320ee31cff95212ce414129164ae0512b983fe7e1bfa043e8168
- TLSH
  T19E41329CF8C117389AD43194D6BC62CC4F6882A1C50AD9F9F8AA9D79BD5421F0F60CBD
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral27 behavioral28
- Target
  lua/playlist/youtube.luac
- Size 32KB
- SHA256 b3b55554894b0367d9d1e6ac1dd1a0b18e1b043810dae0c0fd79518dec8b9587
- MD5 5de2a1054a3abaf6e900084a427bac6a
- SHA1 d625024e4592020bb516bf89d13faeddceb0af6f
- SHA512 73a8c30dd2bf7ebd491b657927430390a9b3bdec139867eaeb731b8e433e0597f05f8a59c321b06ad8e1cbb873e87cd6e91eeea6fd121ee06b319b9498141162
- SSDEEP 384:Reg11qGNDUvLAaZo3sAtEuMppppppH2v3ZwKnFe3knEI5Nmn6AAAAArhfAAAAM:Reg1p2TAaZKswEuWYZFno3kEI5NmFhE
- TLSH
  T154E20852FFD10F93C4530870A6E74B881B28CBC16B64DA238B8D819169197FB7ACB1DD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral29 behavioral30
- Target
  plugins/audio_filter/libaudio_format_plugin.dll
- Size 67KB
- SHA256 055c76dd0cb6ad4350a8b4a56250964db487062be893519438b24de40310cae0
- MD5 f9348f6400aaec1ddfde195500446b1f
- SHA1 d7a49cf9b0c63c972bf7992f64292ef6fb26ca54
- SHA512 c56162f24edb70f7dddbd3c190cd1c5c3aa715c08b621791e623467b69779b810668d2baa5c3bec5cef304177c9a69df160a2278d28bf99db37991f3aff66216
- SSDEEP 768:LeI/oM7Qc8yKY7I1tW6vv8GodwpJm9kfiyWH+wl5YioFENAMxfOz5YioFENAMxRU:J/oM3OFv0kg9/yWewr7oGxfO97oGxRU
- TLSH
  T19F638EC765C0BC8DD90F8574A1F9AE3BB232F95A05E046F65264D5340F63A423E8F2A8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32