71545d9a388346b3432e62f400c7aa93fcddcb1117723597b5dce4e8fef2f8a9

Resubmissions

26/06/2026, 18:16

260626-wwk5kadz7q

26/06/2026, 18:12

260626-wtb4wadt617

Sharing

Copy URL Twitter E-mail

General

Target
Level.Devil-SteamRIP.com.rar
Size 53.1MB
Sample260626-wtb4wadt61
SHA256 71545d9a388346b3432e62f400c7aa93fcddcb1117723597b5dce4e8fef2f8a9
MD5 bc2e9a114a811e7636b2b305a4910374
SHA1 0794bc5772a2bd46b8ab037e92aa91dadb118bd0
SHA512 684d0892bd21f8c29aaa5f3cae9e6ed82f402e4d4a78b8ebc7f5f7a92100afa65e3cf6769d12e52c918efe3bfda23374974cf0edb310d594fcfdc07ac6865b83
SSDEEP 1572864:pIs9bYtA9BoIjR/tl96iTVOQSOyqJ0Dk4zaq71dZrT0q:6s9ctEBdtlQixOXO6bzaq7jV0q
TLSH
T1F4C7335A1363951A79E61274A36EB29CDE30B18E2F7202D7E0DD1856382C437DF6EC1E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  Level.Devil-SteamRIP.com.rar
- Size 53.1MB
- SHA256 71545d9a388346b3432e62f400c7aa93fcddcb1117723597b5dce4e8fef2f8a9
- MD5 bc2e9a114a811e7636b2b305a4910374
- SHA1 0794bc5772a2bd46b8ab037e92aa91dadb118bd0
- SHA512 684d0892bd21f8c29aaa5f3cae9e6ed82f402e4d4a78b8ebc7f5f7a92100afa65e3cf6769d12e52c918efe3bfda23374974cf0edb310d594fcfdc07ac6865b83
- SSDEEP 1572864:pIs9bYtA9BoIjR/tl96iTVOQSOyqJ0Dk4zaq71dZrT0q:6s9ctEBdtlQixOXO6bzaq7jV0q
- TLSH
  T1F4C7335A1363951A79E61274A36EB29CDE30B18E2F7202D7E0DD1856382C437DF6EC1E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1
- Target
  Level Devil/Level Devil.exe
- Size 6.0MB
- SHA256 a99fce19ed0483b9e1a8624ab23ffa0a8f6de5d261e06f9ef396e594b3b0e025
- MD5 9dd765a9492d87a7806e310305ce9462
- SHA1 98264e34446055aea3428daf2a3452a9a491b673
- SHA512 06693ece3510d6f60a596a1afd19aa44f5e05bcfeb0fa26a268c2f9ac409bfd061621c8b55434ddf3922239ce75a11d14d381b70d166bbc07b45c8b3ee6e829a
- SSDEEP 98304:fW299s6IwDyVVcPoZUDuobbocUth7ZpMcRAO:fW299s6IwDUVcPaUDEcUthrP
- TLSH
  T14456388572BDC19ADB27803BC656BF2BF5727854076057CB02E0469BAEE3FD04A3A711
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral2
- Target
  Level Devil/dmengine.pdb
- Size 34.8MB
- SHA256 c2ce837b52c1e87ad6d6b44fc55a73dcdff1cb09ed9318703e235bac517a69b7
- MD5 62a2c0f37c4faf2bd4032ba8cfec5f08
- SHA1 b7b5633af40bcbc8af3e727516c98005fef7cb8e
- SHA512 a02f5ef5a7a0d97f7382897de36aaaaf7f1db56a2535c3f3ddb0cd25303839a960033fb70a9ff54e0b386e89bd1308fc35f7f7356b9c171ef50a616fc288ba6c
- SSDEEP 196608:OxTllBw1iLF+Ic+LZJInFJx6pEIMLZJFnHrMruFYhynj/XqBGxzLMPBYV5FaWWtT:6TWrMruFYhyEewqjpWcuqcCMBH1T
- TLSH
  T12A876B12BB499D63C82E433AB1DB0F2C52A5C54287DF8B4B4E4CD3AE9DD6390DE1E641
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral3
- Target
  Level Devil/game.arcd
- Size 4.4MB
- SHA256 10be19b84f34035069f8f6364b1cea5f2b389f0562b40152505058fca377ed1a
- MD5 3c2e0538428edc4720f687a4f8b2ca3a
- SHA1 2f99af2b5c6f40440d2c90507e27dad2cb063d19
- SHA512 73e93e03c4babe789ab087f2cdf008dcf76aca96096b4623ab70503f6af58315b02310175f7f55c11158f26095cc61f8562ce2182c35e37365458949eca31f0b
- SSDEEP 98304:+ExbICR/itUQ/YbwNuIxePBzI18qiC+wUIZC:+ExbQAYFxem6g+HIZC
- TLSH
  T12226230AE4E0AE9BC69DD8741865651134A08DA84EFEB4F0A275F32C2DFAD1D007F776
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral4
- Target
  Level Devil/game.arci
- Size 51KB
- SHA256 6866722c962154c9d84203135964c0d8a5e2ae6faf5cd69058144b3fe819509e
- MD5 a9e4d9f232892285867e7a6ee18cc203
- SHA1 1e8a228d515479a958baf00424559ef6069bc55a
- SHA512 90bfa2d170a2956f38f194dd768f1208ae58b8056e84e2b3f3faed21d84567a8a00198d25f46e3bcc17e343c849ffe8d436c7b9651a3778f2f8953e53eb6722d
- SSDEEP 768:QDIl8FLSjGz3thtj1xaiZ2XP2ldaz1ytsbKCYsRM:MFLS8dbj1Iqoe2hyOjYX
- TLSH
  T162335B4AB2A2C907C1640772DE93C7AD277531449F671B8BB2DD772F18B23B839449E8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral5
- Target
  Level Devil/game.dmanifest
- Size 30KB
- SHA256 09ae79f90d14570ef2f030d4ab02479ff288df2eeb415d9243f4aac7b391154c
- MD5 0fa510360befd82cb0cb8bf7ccf038e5
- SHA1 eed5bd39c9822c18ad614552445029f9b38cdec2
- SHA512 efa2a5d9e96b266c915874c15ce532b7d51496e035982b478f4e2860b9d54ab828b85c525465300047d7edf8b7de6faaf8ed3a6aaaa67d79bea38de821b7734b
- SSDEEP 768:JUoY4huT0lfqDtv9ZmUX2rxnPaGh/ATLGit0d3zAYmvF8MR2a:uoYGCDt1ZmUGrAGgYAYmv7RF
- TLSH
  T19CE2280BC76089F9C3DB80ADFB6181E4FAC5A6C17D6A50E821F9F553C4A91FE264B074
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral6
- Target
  Level Devil/game.projectc
- Size 5KB
- SHA256 38cf8c340610a70d72bdd0d771f1c653d1837a76b645c2709e9f661181636a17
- MD5 561262a3f26070b56d81d925227a5ecd
- SHA1 b9f921607d08954304a85fb5f04ee077261b5095
- SHA512 ef29204f771f312c88a8a5fb07ec9d156a0d704b72e7282ae2473bd35401c40e52e8e2a03e832ca28e7fca0b592e4e26bcc3ab804e1efc706b7b31a1dfe45d88
- SSDEEP 96:ygV+REglpKYBiStYM36q96oxRF2Hblu1e4CtHHDcR4spxl7TUp8KtKd9zJ8:H+REIBiStYMgb9HHDELpx6p8KtKjJ8
- TLSH
  T125C196759D95BC0D469E7F26639812A374F5F5408A23B8A4B3B48D8CA0A1C5C82CAF1F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral7
- Target
  Level Devil/game.public.der
- Size 162B
- SHA256 7e23ed57030ca2b5fdc57248811fbccddb93d817131694b87294e71082328df3
- MD5 9555ff8c09cd1db7ffa25864d9aeda20
- SHA1 03de058fcbd21a2f752acb4735c9ac584a12a482
- SHA512 34abd6da0ddc92eae281c6552de20440b1ece19248acc1172ed6362253d6b3bf99188d3e441a7da2c2ac9c26097bc54de88efc3abcc55c0b30f0cb97571478e0
- TLSH
  T117C02B632F6EB050B0532CB067645D47E840F96D8454C93AFBEAD7F4E25A7F6C001358
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral8
- Target
  Level Devil/sdkencryptedappticket64.dll
- Size 1001KB
- SHA256 e300ec5111d6d7c82467ff0d9eb80f93919903c7ad5d7a0d667d9851fbb79478
- MD5 d120a3b5bf0d3a1dd37de0e7c818f2cb
- SHA1 638d948f23dc7c22b1ce371d823f113caf2a1852
- SHA512 ebb38154bb0e8628dd9b9c8d7a8e13b181959f5fb2833c9293fb27cdeeada3eda927606c4b34443d7aaa84c70879d2e48f827671f159bc12e121dc6cc258d727
- SSDEEP 24576:72IjlLNtmwac/eAsc9IoYAldMYZtikNPxhzTuPjVpM:7TpNtmwL/eAsc9IoYAldMYZtikNphzyU
- TLSH
  T117257D1A66A801ADD8BBD07C96179907FBB1780603B18EDF07A1466A2F237F15F3E711
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral9
- Target
  Level Devil/sdkencryptedappticket64.lib
- Size 5KB
- SHA256 d77f4e63d1f222de7d9088704cff5fe65179e94580ee55e252ac9beb7da2b231
- MD5 80a77a7f773b9eb945e8d38465a71182
- SHA1 88e6234805b369ebd7c7190448b7404c69ba6f79
- SHA512 0187af7d61a30eab69f7113971ebe6e2d61517ef451ba2efe0e06f638e0fa150ab2d8852d3c9d1396ad2f5a2a7465cc6d5c5ea79b4ad8021e1adad036338f11c
- SSDEEP 96:Awshaq9ask5geGgia1j5CQ9aq1BKjKLKrIOxDafXf:rshd9Dk5geGgiqj5d9d1hOxDqXf
- TLSH
  T142C183E03E918C3ADA3B86F4BCE59967785E5E9E1205AF62B04DB463833BD5453F2C10
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral10
- Target
  Level Devil/steam_api64.dll
- Size 10.9MB
- SHA256 42b8d7211866d060f342e382168f7a7bf660c9e8a294bc5028b15372a3161431
- MD5 898c7fcab03efc3309078409047c17fc
- SHA1 eaa0ed560b1b60d3313d54565bc1f81595a68323
- SHA512 cf66288bf3e6888df187b04f7d5001ca5d35a3f4851cf76da82fbbe3d8eebd6ae6fd449eecf335cef8b124d22ab69b0d33532bd943e7cc337179377c97a286ec
- SSDEEP 98304:hxDQAKHobcOdF0UGoYHigBqD/TeEsSfWjrWHVAPv1V7:hxD0UGATepSOj61APvj
- TLSH
  T125B6F917E7BA01E4E1FAC1789663623BFDB13495933497DB9A80560B1B32BE0E93D740
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11
- Target
  Level Devil/steam_api64.lib
- Size 371KB
- SHA256 65109494d65ccb5bababca45a8129caf8799f1356edde74ec23387479833a614
- MD5 6dc36d314816ab8b9586b8e8565e8013
- SHA1 f8a6f9ec7de1917c1332a2d63f91c72c243a3f2d
- SHA512 a567461197b45570787d2c03ca527aeec8af9a92d1d8059129b01765b6df8b7a48ef8cce3dc1937e353088a5e321edb92d06e9faa7770cb74e297294bc5f72c1
- SSDEEP 6144:QAsIgGfgGnn30pb41by0O2CLvHJMcnK4cUJR57Nn:DsIgGfgGnnN1byh2CLHucn5cw57t
- TLSH
  T1A184A976005558FF92B6E109DC99AD9FA159009F3602ADBF310C8A73DBAF8935E730C9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral12
- Target
  Level Devil/steam_api64_o.dll
- Size 312KB
- SHA256 e082bf5c9f881c822b1540a76b74f9d15e18019a73ebd206a559595badcb7f65
- MD5 3bae3a5ecad22eec751e154f68e09361
- SHA1 a951d17a2d9a9980c383db77e2ce688cb788b5e3
- SHA512 89a4af236cee7a6a93131288bb700827280f9f7d433ed1ec6c852efc60cc752ad4c3559909238e74d365459a0d4cf95411265339ceca19430f1698b605b96551
- SSDEEP 3072:Uf1NIIMByoNLNnLi+2qCPAgAU5gVsSleswKC+nQBx5lhTbC6Cy8iODQyN+7eiUMQ:sBMB/W+2qC4gAIuesBzOY0y0O2CL2U
- TLSH
  T1EF645B3962750CF4E077C13A88565E0FFA79344B23219EEF226062769E177C21EBB791
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13
- Target
  Level Devil/steam_settings/branches.json
- Size 347B
- SHA256 1797f0f28d6551e1300f9f8b1bc0d683b0ce1da44ef3fc262ebccd0f6a46a0c9
- MD5 55a3d9eb9d26b571d24b03b25152ed97
- SHA1 1ebfc9786f52b6f3f695824b7deed415ca024d84
- SHA512 361550ed3da755608015a421a344c66cbebd01087b1f27959a90522cb49a92048d78cb4ce1936af3766d0b4c7a196f679140d9c08ad52ac0ecea27e0f41d2994
- TLSH
  T16EE0867AC954ACAB14F503A85D395657F364233B10444807B4B5C48C2F36951AA95957
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral14
- Target
  Level Devil/steam_settings/configs.main.ini
- Size 681B
- SHA256 a78aa33ac06b354e520885a7214517db3a8e1a5a4c59f4d5d6a535ad4830bda4
- MD5 ef6dcccf0659b958b17509307d78bc41
- SHA1 a09cc019e55b9a0cee9b9840c11f47a5a72661f7
- SHA512 7fb7780e0e41124d7c341f46854b927427e239fa3eb1950fad01306f58c467672562751e4133564f75e92449d5f708f5e701a9f72ea06d26b6bb0cdc0d4d53f7
- TLSH
  T19A01441360B1B422063771725B2FEEC2E358C9F61311245C62E41FCC2B31D1CB019E9E
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral15
- Target
  Level Devil/steam_settings/configs.overlay.ini
- Size 120B
- SHA256 05965a56b54d8b78f3d2d9fbfd4f08f2e85ec9001bd122eecc12109a4f28a346
- MD5 072429540c3ee1cb28f56b90fe68a8b6
- SHA1 216fd8b3da30544f8f4bcd9078e42daca8505789
- SHA512 114f965044d65ee68ef1e6ca2187ce4b25258c55f9fb6c085942c048761f7868273f932a21938f46684e0a5d241cfaa5c2284283389983eb011c775c252d475d
- TLSH
  T1E6B092283916B168A29B41810B73CA8612404A42E137A49232E8972F6E04F1C2F4EB5C
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral16
- Target
  Level Devil/steam_settings/configs.user.ini
- Size 601B
- SHA256 0bfd4f76f3aca542531c84ed04101ab86c0340bde10c5d4a433a6326ab3a9549
- MD5 4c6849b8f4fa858f7098c3ec2a933e06
- SHA1 2e314ac5cb5c46d55114c3a1ddf576fffccc92f7
- SHA512 b9e4af4582565cbc91f8e916d4320c892193b4caaac3b7a81055d17afe77405d27240f1c238e27f2ab8a940c22d283f266d2f380c04eab507716b962c0696718
- TLSH
  T169F0A261590902393E3508E6F8CFEED6D368E3D915777F1C37D54145F1E29A20815BD0
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral17
- Target
  Level Devil/steam_settings/depots.txt
- Size 25B
- SHA256 5d2bdc0d55498de35ce0ad47f081af470750875e19729bd78cbd462429cd8132
- MD5 954bd87f8d033227ca6714139c393d08
- SHA1 add7554fb8e229644d12bcd9fe687c794eb90aed
- SHA512 958734a637b0421467bc0e8d08a693eeb339f005b472a4e76ba27f12ca19b21583ba8bba23186f1555b26491973617735aa94ec0d594848a1a242b7518e3f072
- MD5 SHA1 SHA512
Score

3^/10
behavioral18
- Target
  Level Devil/steam_settings/steam_appid.txt
- Size 7B
- SHA256 337944961a8483160fa64a2ded58ae9ac2290dccaabc2959965d3806c3c9e193
- MD5 c7b056a6a06cad14ffaf079b0c9d91a5
- SHA1 5695a790a423cf247df0671cb9224a8b37e35c60
- SHA512 14e6a0a42597c9dea5cddd3dff6b5abf74a4ea7b2e23c35aa7660a0886ca34c14a3c1561b90a771dbcbf572dc96e210ba24537ea71181aca91ec1e9d6f408880
- MD5 SHA1 SHA512
Score

3^/10
behavioral19
- Target
  Level Devil/steam_settings/supported_languages.txt
- Size 92B
- SHA256 efe20bb0c19ca97b39534b5a1586d9d4fe9b38e72fb26b20976a78a921f930d6
- MD5 e4201b69389dde29a7127df5ed325c94
- SHA1 a14166ba101fb692c84af263ff2bd1e9b0c72607
- SHA512 5339b9497e24b0a4d5b31004cfeb7539151a76e679ca57d67ec93f6567c6d7e016dd588aab5c677b83fe3cba5e5b4d4892edb4a104eaa82ecd520c133efbb09e
- TLSH
  T1FAB01213DC04B4D3903C40885853848387C075EF1443B2CF03CF33080609E9C3200CA0
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral20
- Target
  Read_Me_Instructions.txt
- Size 2KB
- SHA256 4334c752a531140bb4c2f44278016e233a6412b78c5f1070ce71ee58672b33f7
- MD5 2a323f6236e4f2220dbcb42283ffd6a7
- SHA1 ad349675ef396ae2eeb631eebb74a7f0d6025337
- SHA512 764efa0f1b31111347eda91c375c14f7d55fb566d45867f7b6894017a1f8720c53108796a008dca8e1121116505f0cbf9be0ef62d9ace935263e13da12c12122
- TLSH
  T15C51757697C64BAD042C4D2309B5FD9C635694C9DE361460F7EC81E46F269708F248FB
- MD5 SHA1 SHA512 TLSH
Score

3^/10

ransomware
behavioral21
- Target
  STEAMRIP » Free Pre-installed Steam Games.url
- Size 219B
- SHA256 4572f3812daf7bcd347d1a36834c5a9fec1f530093adf688a6ecd9e6092cbf76
- MD5 bb3af69a2e7704bc210886920ff7681f
- SHA1 42fa4a09d62cce1c0d70a63e0816135fd6b410e3
- SHA512 4f86d06f06859ed87d5f5353de9971c118477c956a8e0e0019b275f6eb035b2841c7cb959c9f4823a599ca7e73f6a0ed320207d917e8f4ab2a9b20e732551839
- TLSH
  T119D0A9BA0B58900AD321C81AE030BC08E44E75568CDED0B932C4CA8A4D96481C8A6BA8
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral22
- Target
  _CommonRedist/VisualCppRedist_AIO_x86_x64.exe
- Size 30.1MB
- SHA256 3c188e4651bcc07df2bdb06d69585158797b1bafb91557b09217621628cd5b23
- MD5 1a7523d92b573859df4cbe8e75509b9e
- SHA1 65b0ccf1fe1f23c4a0557b8a30251cc7e70a1f73
- SHA512 f7c684c00265402876a4159869774096090c7482358fa1882a50468c89483c9a30066667418d510dcc5b9780fbdfd1bcc6672f92ec53cb933c0b36292c6ec40b
- SSDEEP 786432:4JVdGL3z5NXeyQIwJtNYUJwif0nOJa9WEWRIOG5B7DVGLhYNBFv3cnZCa:gjOLXelIMjJwi0wMVW6n7ShYWCa
- TLSH
  T10E6733B51858C4B8E7E0B1F00807F5E1769AF9BCE9C5CC46B1F4BC99A19E4618FE612C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery persistence ransomware
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral23
- Target
  _CommonRedist/_redist_readme.txt
- Size 1KB
- SHA256 b9ff3c3422e06fb509f4d9ea3ae4493ee804a7efdd1297fbff8eceed40b6c403
- MD5 c4f016cdab6a3015ed1eb6e48636f97d
- SHA1 d37f4aab46e9a71c5637f826e2ef140c0b8d10a9
- SHA512 34cf5a003d6da2637cb6b56713a817399fa0f774b6d99fdb1bbc104d949030d2f110bbd7a4ba8d5fc887d2a94be1ab65f9f34556d2a11e9f9575bf0ee05b549f
- TLSH
  T14341CA3AA3C947AE482C0E6319F0FD9C636555C2CE320450F2ED90E86F768758E199F7
- MD5 SHA1 SHA512 TLSH
Score

3^/10

ransomware
behavioral24
- Target
  _CommonRedist/dotNetFx40_Full_setup.exe
- Size 868KB
- SHA256 fa1afff978325f8818ce3a559d67a58297d9154674de7fd8eb03656d93104425
- MD5 53406e9988306cbd4537677c5336aba4
- SHA1 06becadb92a5fcca2529c0b93687c2a0c6d0d610
- SHA512 4f89da81b5a3800aa16ff33cc4a42dbb17d4c698a5e2983b88c32738decb57e3088a1da444ad0ec0d745c3c6b6b8b9b86d3f19909142f9e51f513748c0274a99
- SSDEEP 24576:+tW4x8xAxCdUcyezFSjaBHFaNlsqK5/oh6iZf1LUXw/vxNI:d4x8xqCGexm8FCspg0iZf1LUXD
- TLSH
  T1F2151232ABA0C133D4DB28B48ADDB6B2657DE6610374C4C7B7440BEEAC307D1697964B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Executes dropped EXE
- Loads dropped DLL
behavioral25
- Target
  _CommonRedist/dxwebsetup.exe
- Size 288KB
- SHA256 2cf71d098c608c56e07f4655855a886c3102553f648df88458df616b26fd612f
- MD5 2cbd6ad183914a0c554f0739069e77d7
- SHA1 7bf35f2afca666078db35ca95130beb2e3782212
- SHA512 ff1af2d2a883865f2412dddcd68006d1907a719fe833319c833f897c93ee750bac494c0991170dc1cf726b3f0406707daa361d06568cd610eeb4ed1d9c0fbb10
- SSDEEP 6144:kWK8fc2liXmrLxcdRDLiH1vVRGVOhMp421/7YQV:VcvgLARDI1KIOzO0
- TLSH
  T19654F15197E4817BE4FA1B311DF2025327797DE86CB9E32E838658881D71780BE35B27
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery persistence
- Adds Run key to start application
  persistence
- Drops file in System32 directory
behavioral26
- Target
  _CommonRedist/oalinst.exe
- Size 790KB
- SHA256 b8f39714d41e009f75efb183c37100f2cbabb71784bbd243be881ac5b42d86fd
- MD5 694f54bd227916b89fc3eb1db53f0685
- SHA1 21fdc367291bbef14dac27925cae698d3928eead
- SHA512 55bc0de75a7f27f11eb8f4ee8c9934dfe1acd044d8b7b2151c506bdcbead3ab179df7023f699c9139c77541bbc4b1c0657e93c34a6bc4309b665c6cb7636a7e5
- SSDEEP 12288:0s1yfEcpPzdv+t4cRIy3ze3SUN0PXGTjiqRy2p3kwzjGHTkV:NwfLrvi4cRIyDe3SUNaXy+WypoGHgV
- TLSH
  T1E005F10020D5CC73E4EB32B3843586746EBA7E912F0A285B7FC476AEE673176DA71215
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops file in System32 directory
behavioral27
- Target
  _CommonRedist/xnafx40_redist.msi
- Size 6.7MB
- SHA256 47260420773a20443fb1e38a89b7f39c5237a80a842de598e6c8f7f90a3bbd6d
- MD5 ff1c0202ab7147c9dfd34b582f1da13f
- SHA1 5fc95a9ad87a38e71a953af116fd1f1cbe46a3e7
- SHA512 9a233fd33fa535d0783ac4a97108166b860d7647998ce184e6e5103200a6c8522a5e4d035b85e02280f5176c092e0d3e61a60f228d7ca17f09fcf2fc5cdf5253
- SSDEEP 98304:synfL329J1XswfXO6wiBB+4RZg6aENaCZAU5PMO0MntfERyJGH2YPq/:sYD3C1XXfzH+4cLHU5PM/Mnt+YGlq
- TLSH
  T1D06622A2751AFF41DDB406FCD970CA490925CF3B82274C686929356A7BF7E0202E9D4F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery persistence privilege_escalation ransomware
- Executes dropped EXE
- Loads dropped DLL
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral28

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

Modify Registry

T1112

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Resubmissions

Sharing

General

Malware Config

Targets

Loads dropped DLL

Adds Run key to start application

Enumerates connected drives

Drops file in System32 directory

Executes dropped EXE

Loads dropped DLL

Adds Run key to start application

Drops file in System32 directory

Checks installed software on the system

Drops file in System32 directory

Executes dropped EXE

Loads dropped DLL

Badlisted process makes network request

Enumerates connected drives

Drops file in System32 directory

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28