1b0cc8903f8ba1a61b4d12f3bd2f8afc58328c8c9f6d302a3278e95f21847bd0

Sharing

Copy URL Twitter E-mail

General

Target
DPew_Fem_Fondling_-sexy_sexy_massage_parlor-_v1.0.0-win.zip
Size 85.7MB
Sample260626-sgathact6w
SHA256 1b0cc8903f8ba1a61b4d12f3bd2f8afc58328c8c9f6d302a3278e95f21847bd0
MD5 b6603e6b6916d906b0e2f8a452d7d6c1
SHA1 bb7feba63a24b0f54618eddb62cef7bc8bb2fc2b
SHA512 57479a8f43dbe2eb70fbb2ac51145df425039ea14f7c176ebef3d1cdee05e986c0bf79c9c0eb33bfa6a90a068567071f2914ed3c39b07b3ad88a81a57dc670a1
SSDEEP 1572864:ibYyb0x2SAVLIeH3hzq/RGxWfUomFdA9xEodfdmXl6960kRDRvB+XRYf+9z2Nsym:ibWSIEJDXY9xE0fgV6960kRDxB+XRa+B
TLSH
T14E18338540B7D809EDCF903196533F4776725C22AEC58EFB822AB908F537EE2516874B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  massage/massage_Data/Managed/UnityEngine.TextCoreFontEngineModule.dll
- Size 70KB
- SHA256 5c6c8d96b33a1f94177fdd68a1340fad09599441b9eb3c0a789cfcb5d3fc4a11
- MD5 01c2ac045804723ee790c79e9f02646f
- SHA1 e506a874e994877cea631e3112d385f6245dc330
- SHA512 26a260edef17af3b0cf0614d810eeb4452fba98b4ea5e2c4fb236fc357cf13440d3af65358218983c8e8752372ccae657eeef65915ad36da92bdd669b4bb6f79
- SSDEEP 1536:0eTn+W/GWD3oD0AzdbOm+yz1PGFuCb0UAEl8thjMXehpE7TPx3k3DmI:0eTn/J45dbOm+yz1PGFu3UA1Efxe
- TLSH
  T100631BB8B689782BCC5A0F3AA0A092245B20C006C993F747578C65F47CF77F86D666DC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  massage/massage_Data/Managed/UnityEngine.TextCoreTextEngineModule.dll
- Size 192KB
- SHA256 7d4483b11359dbf2037d94e2d94f4462dd13cc066332c29b3a5add3b83d34cb8
- MD5 a865bcfe89ebe65b62febace6b9209ac
- SHA1 bff9007d48d7762a43531c14f1e97ec2ebb6bb93
- SHA512 c2b2fc7a157c7dbc1b0f17ec663e3407f9e36528afd043fbd760edf6e1fb6027f46fa15c47bb748d2e9a786d73cf83b29b3cf8c3a27a27148bce13e171e56c58
- SSDEEP 6144:x7hi0yg8Arg5peL5Kmk1G4W2UJ8E0Th6/vy3knmnjnnnnnUulAi:W0ybck1G4WKAU
- TLSH
  T131145B2817C98D56DC3EDBFF60B991927374A101E52EDF8F0ECDA0EF28957A148046A7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3 behavioral4
- Target
  massage/massage_Data/Managed/UnityEngine.TextRenderingModule.dll
- Size 38KB
- SHA256 5ff298cb74b04d1acdc145a8479c70abd90ed82c91f357dddd101168286d775b
- MD5 96b71760c6a37c769f048392a02aa8a6
- SHA1 b83cb8f6fc7546db0cd66a92389164c0e2b9fa48
- SHA512 3a98e45016a8829e2d6195788f7fb70e97d76e7f0c51d924b80e1ba5334e3e6e9a6672b4bad36316a7d1c751495148930e92009eb189a08d329c116c06e260ee
- SSDEEP 768:yK0L/S67fSFaRfNWUAEl8thjMXehgMEpYiTPx3kI5w:wzS6DSFeNWUAEl8thjMXehgF7TPx3kIw
- TLSH
  T17D0308F86AC4541FDC5A0F36F46443516BB4C1038AF3DBA2434E906475BA3D9AE327EA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  massage/massage_Data/Managed/UnityEngine.TilemapModule.dll
- Size 41KB
- SHA256 f711ccd103fbc3921d6bc18fd1bd355b1ca9a18255e40d1ecbaa4dbc5f80a390
- MD5 8df09e53e1fa23cc5d9be40274f9ebc4
- SHA1 3819c5283a1c3d950f0d4b73783c5827a027445f
- SHA512 8db11ed0c5b7a7041f3ca27b8e69b6f5e6ff6fe8d6e790aff40be7d5cb2128fd3d4f1cd7cd57f05624720d01256327c5102de555d6bcec0784fcfb985a562532
- SSDEEP 768:LmxSdIsFwfrzCq+IcDLB79JFYmhUAEl8thjMXehLfEpYiTPx3kiZN:SSdIsFKzCqVaPYmhUAEl8thjMXehLY73
- TLSH
  T131132BF86B94502FDF8D0F76F09847407B30C2128AA3D791671D52B86E3A3DDAB216E5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  massage/massage_Data/Managed/UnityEngine.UI.dll
- Size 242KB
- SHA256 481feca01d2feb41dee96cd840d8102f2246a4cc91d683dab627994d0f1866f9
- MD5 55dbdf4db3207d0475f0b3badcaedb3e
- SHA1 b3d8a65dfa667396345480b8f71582278606facc
- SHA512 a05b5cab737e125a6348a4ffd0c2154d2b1d0d3524848a0fd89645e2ac7740938be16d0d020883221b4f1f09bc0685517244fb66a57a7098e5c95093ed4e6b81
- SSDEEP 6144:w2APJmCuQZP2AhBUx/imnAekYCt0m2yQYD2jybqF2o1x0:sPJHbPJBUx/TAnqz
- TLSH
  T1F3344A2523A8CEABD6BF173AF478040593F18257B6CAE7D95E84E8FD2C433905A11763
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  massage/massage_Data/Managed/UnityEngine.UIElementsModule.dll
- Size 1.2MB
- SHA256 d75d137260358666a8f1076b0b0961b287609205a003398bb94b9b11dc5b1538
- MD5 cccb6ae59dde7791e365b5bac050bd8d
- SHA1 74912d264c7a255c255624db4a329a33aa75f067
- SHA512 775b826a9e38db41dd78e92a6c9c585a49bb5de914f7a30fd4394830628d38261f0ae2b21bc162498676a96f1fa00931389b8acfb484fb0f803454a4bbb38ac5
- SSDEEP 12288:DQtaQ86Y9/ofsf0qHW2+qxJLD2/XzfnwtjchwfbQSFMwqDEQVcIUGfW:MgQQ3PFD2/XzIiNSNqDEQVcLGfW
- TLSH
  T16945595426E49B26C6DE9B3FA0F2081513F5E005A7A7F74F6795E6B82CB3360DC08A53
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  massage/massage_Data/Managed/UnityEngine.UIElementsNativeModule.dll
- Size 57KB
- SHA256 d2f3b09e4d26342774ef2ab6ce7b9974e286e84c78b09a115a7ad6b3bdcb7554
- MD5 02786151a3c76b705a08693eeafc633f
- SHA1 9be81224477d7efe125dde3c86a11644f642d0d1
- SHA512 59b2e477277bc2b8ef1fda626714f723dc4c01a9f73725995eb3f6fcbf7be7dc3e180d5694e6c574d5ac393616c09fb897347b0bce4e7b8a14628adf7b4647c1
- SSDEEP 1536:ipVRsaBm8eBh78N/UPNjHRE1y4idFSSyj3N5ueeag2eoO2D0pLMcUAEl8thjMXex:ipVRsaBmvBh73F5xUAa8fxf
- TLSH
  T1CD4309BC2F91A81FD84A1B3BF0E00500B730C0559913D347A759B175A9777AC9AA2AEF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  massage/massage_Data/Managed/UnityEngine.UIModule.dll
- Size 35KB
- SHA256 117be23c29c718e3a616646634b159961007baf082ba70abe2853d525c119573
- MD5 6516a0e69c49bce41dd089753df25e56
- SHA1 80f3cd40b66978ff944841afd6cfc4e20d1e073b
- SHA512 5b22bb07fa9f3c8880226eeccd93f8cf20b2eba958bac5dcf877c1a1315c79acec32d3223315d6490b18fcf38e3896ca8764e2124f75f1544c6103666dd5f091
- SSDEEP 768:9JXBI1zyL0uUAEl8thjMXehe2EpYiTPx3kkiP:P+oYuUAEl8thjMXehe37TPx3khP
- TLSH
  T11AF218B16294985FDC8A0F32E4B807517AB0C117CDF2D3D24B9E5168793A3D97E226E8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral15 behavioral16
- Target
  massage/massage_Data/Managed/UnityEngine.UNETModule.dll
- Size 87KB
- SHA256 35635e43a71c37ae84775d2b60fcd398e06eef2007e40440cf56876b456a11ad
- MD5 b79722cc0ca5a1e50fdfdb6369f18e16
- SHA1 2161ddb0623ee6a157d084f8ac58345054f12c00
- SHA512 0997382be83153e65ccd0eb416578daccea34bf8447a28d20c5b801e68fe93962a8cf59968d87601698e8b7473e18d611c6897701eec0f11b4bc0ded4104e459
- SSDEEP 1536:e/s7yGjJ4R939MQ+myO3XT42Pxdx7ez+Xl0aaxgbKWt+zdUAEl8thjMXeh6I7TPA:l2GUtMQ73XT42Pxdx7ez+Xl0aaxgbKWb
- TLSH
  T193933BB567DC592FEAAF2B7EE87001002775F9126622D39E0244817A3D7B782D9207F7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  massage/massage_Data/Managed/UnityEngine.UmbraModule.dll
- Size 19KB
- SHA256 687acc8a9ae7ebddf74ecafe877ed2313b98af2a89b4b892e1b247956e20d244
- MD5 264a4bfe5035e7f08ba4546558e3aacf
- SHA1 e7f7435aaf85b0bc08670cea8d2dfbf0416926f3
- SHA512 5f03affe4188862a888dfb8bb5d12d88b8873c610d1a74256fa529bee90f8e4ccc0055aa571dccbb3addd4ec3362441f19b371de94e8bfd11fa12037a6b68ef6
- SSDEEP 384:ZITUAEl8taz2hjMXecjOTzNyb8E9VF6IYiTPx3nkZCOlOrW:ZITUAEl8thjMXehTvEpYiTPx3kIOR
- TLSH
  T1C992B7F17A8828D7EC464F33A06893513DA0D517CFB1D391428E92A4B67D2DE7F612E4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  massage/massage_Data/Managed/UnityEngine.UnityAnalyticsCommonModule.dll
- Size 20KB
- SHA256 cc9898d35bc95e902138533cee6870f345342f2ef620909c39a9b15fa463639e
- MD5 1395e0b1ead0a913487f19270a0a9d3e
- SHA1 73188a02c3a96d412e336c0ef4e5852923df33a4
- SHA512 55a5b158fee3a07944912cb2e0a7db190bbc3b2a1bdb9c9308875b44c2e5f592f3f67b942226e764e25effdb29deff225ef111d12109f9b7b82669a8d2bb7d1d
- SSDEEP 384:YY0HUAEl8taz2hjMXecjOwvNyb8E9VF6IYiTPx3nkzqjrN:YY0HUAEl8thjMXehwTEpYiTPx3kWjR
- TLSH
  T1A392D7F27A86285BEC464F7360A883517DA0D517CEB1C3A2534E9264B67C2CE7F612F4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral21 behavioral22
- Target
  massage/massage_Data/Managed/UnityEngine.UnityAnalyticsModule.dll
- Size 43KB
- SHA256 5f1d6b0bea5d2c9f99fff51d2b52a6cd389a6b6e994f3866ac437350d4450334
- MD5 199a16d1506bb50cc6a20968e4c0fc6a
- SHA1 546d1763a47934c2526b8c2018c308efc870d4b4
- SHA512 0e622184d77143117bef8da5384d4c160046a36c4ec77223982598e3879da7ab5a1868ed1a63285d9dd9bc3db0211460413c81087ed174681ae03e0c8a44ccfd
- SSDEEP 768:6cyQsbOxUgjm8k0OMe4cggiUAEl8thjMXehIYEpYiTPx3kL1:b1xUgjtk0XRgiUAEl8thjMXehIh7TPxe
- TLSH
  T1EC135C796BD4A92BCC6D1F36E87842103B70D1538623D396164ED178793E2EC2E71BE8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  massage/massage_Data/Managed/UnityEngine.UnityConnectModule.dll
- Size 21KB
- SHA256 6ab761ac80acb8352f6cab84b2ee05912cd563d781d9d37858d0e175e612b662
- MD5 368a430febf975f9d9a24ec05e9ae874
- SHA1 84905c784025eae73e61687cbc27fc37d19b2f7b
- SHA512 80be8bfd7ddc51692fa391b816f23e2900a01e965235616636570d5940038a08e4dc3907f7abecd4c7fd1fa20667e2e6784e38266c2efcb012e79c47a05c6bea
- SSDEEP 384:3CX7TUAEl8taz2hjMXecjO4UNyb8E9VF6IYiTPx3nkPSfBBNk:87TUAEl8thjMXeh4UEpYiTPx3kafB0
- TLSH
  T1ACA2B5F236842857EC454F33A0A883507EA0D417CEF2D29E434E9164B67D2DE7F602E5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  massage/massage_Data/Managed/UnityEngine.UnityCurlModule.dll
- Size 21KB
- SHA256 fa51a38d5ae1ae5220fcfe9957341f4d8dff79d7e7363598b0b27b7fa66b93fd
- MD5 358f385660c8b9114e9b55b91a7faa56
- SHA1 03751d71a0d4b2c7be1de4f8da4deca7ca4008f4
- SHA512 035ecc42e0b506a539238909c707821f6760820bf2e797580e57a357ca2700693d037bd3857672870cdbb1bc337d62432f630c082e92670a31f16e33b96d0ff5
- SSDEEP 384:65LlulV2BUAEl8taz2hjMXecjOKwaNyb8E9VF6IYiTPx3nkAeciDk:65LQ2BUAEl8thjMXehKw6EpYiTPx3kPG
- TLSH
  T1D6A2C6F17A882857EC064F33A06893413DA0D533CEB2D296578F91A4B67C3DE7F612A5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral27 behavioral28
- Target
  massage/massage_Data/Managed/UnityEngine.UnityTestProtocolModule.dll
- Size 19KB
- SHA256 bddd3b6e29a9cdfaa63ae1f8bf463cfbb26e25d6648eaa6ce500c88b403247b6
- MD5 9909db9a70a221378c94408c0fe614e2
- SHA1 47831ccb57e77bbfc87cc4173ba9e55a7c1e4a67
- SHA512 d821dcbae9f6593eeb2a765a25b216004bf9e783c391ed7e901c48bc139762615ca75a39b51dd0ec2a4cedbdbb1d67f86884f469c054f03a8f95c34b87e518e2
- SSDEEP 384:MYfUAEl8taz2hjMXecjO9NZNyb8E9VF6IYiTPx3nkmJKb6N4GM:MYfUAEl8thjMXeh9N9EpYiTPx3kWK2M
- TLSH
  T1E792A4F1798428DBEC4A4F73A06893517DA0D017CFB1D292424EA2A4B67C2DE7F612E4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  massage/massage_Data/Managed/UnityEngine.UnityWebRequestAssetBundleModule.dll
- Size 22KB
- SHA256 8e33b542cc83642055c9cd6b007cd44da4e24790f98f05b3fd76012699f0eb85
- MD5 bafa887140878f9653c3c1b5ef5b5979
- SHA1 4c571d347ca184fb27408c9c038da739797ef778
- SHA512 dd98400b290d31f28925e527b18b6564bd0a86a7d358176f318f4290b28a082726ec4a5f63c9d03922af83fbf29be12199117ccd42c9bb24d3b2f519549940ba
- SSDEEP 384:SepYGzM13zUAEl8taz2hjMXecjO1ANyb8E9VF6IYiTPx3nkkInw3Q:npYqM13zUAEl8thjMXeh14EpYiTPx3kJ
- TLSH
  T1FFA2A4F67684281BEC464F73A0B883417EA0D517CE71D2A6424E52A4B67D3DABF603F4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32