c2ae8994ae52a2ff9f2a43f03dc78e464560c7741305e1b6221ff2084ffdb58e

Sharing

Copy URL Twitter E-mail

General

Target
Counter-Strike 1.6 Protocol 48 (8684).zip
Size 419.5MB
Sample260626-ynfk8ae17r
SHA256 c2ae8994ae52a2ff9f2a43f03dc78e464560c7741305e1b6221ff2084ffdb58e
MD5 90926ca6520273326de53dd5bfa066a5
SHA1 1bd420d6d52f3b93d3c0bde1d7f687c3041f8e81
SHA512 bc58e03f2ff0ae7f105d873b8167c1080ec14ce02c6c331795f7e6c412b3fa80bd2025ef92a97c9d79eea4178ae24abb3d673be6b19301b504d2d8da246a2243
SSDEEP 12582912:lhEBk837XsC0I5b0S2PxeO5DZdXpXLUh1valLQFfbQqp1PwsH:cBk8LXb0hPxbdXpbB0b9p1osH
TLSH
T1B129335CDC467ADEE05FF23DA2701F50DA99020CA56CE4DD42C6088C1AD79BB2FA5B87
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Counter-Strike 1.6 Protocol 48 (8684).zip
- Size 419.5MB
- SHA256 c2ae8994ae52a2ff9f2a43f03dc78e464560c7741305e1b6221ff2084ffdb58e
- MD5 90926ca6520273326de53dd5bfa066a5
- SHA1 1bd420d6d52f3b93d3c0bde1d7f687c3041f8e81
- SHA512 bc58e03f2ff0ae7f105d873b8167c1080ec14ce02c6c331795f7e6c412b3fa80bd2025ef92a97c9d79eea4178ae24abb3d673be6b19301b504d2d8da246a2243
- SSDEEP 12582912:lhEBk837XsC0I5b0S2PxeO5DZdXpXLUh1valLQFfbQqp1PwsH:cBk8LXb0hPxbdXpbB0b9p1osH
- TLSH
  T1B129335CDC467ADEE05FF23DA2701F50DA99020CA56CE4DD42C6088C1AD79BB2FA5B87
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2
- Target
  Counter-Strike 1.6/SmartSteamEmu.ini
- Size 934B
- SHA256 de42b882befe7157c8e3345a2b3ddbe36df17156e6c544b86cf596c3010e3828
- MD5 20fd56094784e82a31e4aa1541e44d0a
- SHA1 41b4027f6bff87ee0bee749dce8ce92e9576b214
- SHA512 1a2ec72a281c93129deeeebd71f6697c3d3845755c1c5c3b8065b70fadce053dca16a2789da1de8ef9ac0db728501b5694017061d510cda8b43207ae670034bb
- TLSH
  T12B11253C4503767F094A7369E8466803CFE57583A3441CAE3695C54B13A3E49A7EAD4A
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  Counter-Strike 1.6/cstrike/GameServerConfig.vdf
- Size 1KB
- SHA256 b578d57a1b373ccae6f5c3a300df555a795565196c085a6b15e572934947d2a3
- MD5 6330a74c8b639027098356beafb2403c
- SHA1 a24ee08adac19a605bc02d631b74647536e22404
- SHA512 8b5eaa57b0c469b191a34d4667d09eaae12fbc120e11dc0ebc27353c39453bd92e4c88d1ba4223238b66bee25d20caa2b32463a60effabf1f5cbc2157d40f968
- TLSH
  T12E313BA736825DCABBD35517D1344CC8AFADC5B680ED8EF59CC96435C02C220641D7FA
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral5 behavioral6
- Target
  Counter-Strike 1.6/cstrike/ajawad.wad
- Size 47KB
- SHA256 00de8c1675d9e450fe8180aa0cd0e7bc165c0731bf24e8e138cce8b47567714c
- MD5 400ca686fc962aa9265a7e674cef4235
- SHA1 3462a26c8933c38c48a07ddffb433619c252b488
- SHA512 a4fc8cc38553b70ff1e4189571127801241579791c35d3ede872e352667df92ce60c0f2679d167a20ce4d887dae5956552bd12e75cbe010a4d42e1488fedca7a
- SSDEEP 768:sSp5kBU7yM6GAt2CKXVvsMVb2/EhMxamHGOBucQJ5EiTgZTyvD:sSp5kBu6GAEVsMVb2cGVmfoTS
- TLSH
  T1172339E1B1938D56F6118FB10D343529937A6FCCA9A2A51FF91AF0C8EFB3390055D9A0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral7 behavioral8
- Target
  Counter-Strike 1.6/cstrike/autobuy.txt
- Size 2KB
- SHA256 bc167758d54b394bf5ef66413223469e670c5ddea9389d4c464ca8e8431a89cc
- MD5 c299d179793d5e0c0a6ff42634221b50
- SHA1 6b3beb12b1f5705af8736434f5fad39663727a67
- SHA512 612e37d4f3f6df2a2247e12bc0eb5ee0adcee1dda8227b9bd2d649d6236b37e5befb26158b449d7f0569c73590616dd94fd8e02b39054dc51c90062430c106f9
- TLSH
  T17141A5963D320375788320EB93947945E16BC11397664301F18FE24DE25B8AEB21EBBB
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral10 behavioral9
- Target
  Counter-Strike 1.6/cstrike/cached.wad
- Size 126KB
- SHA256 2d766ef964049f0a6be6644b12c5d2f628cbfc63cfb8106e7df01caa31f90588
- MD5 a44390e6b4823cdf41c8b10b7aa6df06
- SHA1 009147e7d741325066bb5b0cf9956d373c051d52
- SHA512 04fbfc8d80cb2f88d75296ed69a7a356b4cfc773b7b437aa063dad80608d79236ecbf7b99d07c58b46cc92db737413f52ed835d3dd642e08732caf201e4ef82c
- SSDEEP 1536:5E9nhc+XGCPcpXbt6E9nhc+XGCPcpXbt:5ihAPVbt6ihAPVbt
- TLSH
  T11EC37C227EE59D17C3C119324D61E2919692B1FF939B71763880A24CF4DF8E13E6DAC8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral11 behavioral12
- Target
  Counter-Strike 1.6/cstrike/chateau.wad
- Size 7.3MB
- SHA256 c236931e1f8ed1d62006e329e5e944ad6cb72dc790d7a4938c7a29e5d446041c
- MD5 e3256160770cf3af8d0b5c72b971972e
- SHA1 7d85373170eb7d8875e38bb0081f499f0eed0828
- SHA512 a15e2b1fe84f51a69dcb44430043f8ebdcf15540b3eef63f33891dde2d46fe441bd96c229e095463b37db7d759e8246f02d50a1245d94866b8830bbb4f8002d8
- SSDEEP 196608:GzVSLaTVZqiy98cyUhVt3YMp+2QQKp5A/Vq06ncpCn:cnTVZqFqgfBY6+2Q7A9qIC
- TLSH
  T13C7633D0B973E483E227AE30161AB5A9E2A04F56D77B583C7098F86051F3747A39C79C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral13 behavioral14
- Target
  Counter-Strike 1.6/cstrike/classes/ak47.res
- Size 6KB
- SHA256 6a6e73e6a54e951304e359a553e89b4ebdd476229820f3d54b07130326ff8609
- MD5 9ba15b0ade9ef03c9dcd3de779c80c05
- SHA1 e3dc27da7eafa26cb6ea5bba336a3c94d380c8f5
- SHA512 62b309875b0be35bfb459045f663ab55dda37c6e0d4871dffa2439327428092f7ad28ede3d0c8b78422b5d0d4753dee02763afa7125d60cb0d41ae5485451082
- SSDEEP 96:vDWA+DTWA/WA6WA/WATuaWAEi3WA+WAiWAUWkdW+WxWIWYWWWdWpWM9S7dBqZv9w:vD0rGbnuarKGYbhiv/hOCh9g2v9w
- TLSH
  T105E1C31FB2227CF4D2889B9BA6B488D58B99241D06AFEDDFFD464E2C45A4D2423D53C0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral15 behavioral16
- Target
  Counter-Strike 1.6/cstrike/classes/arctic.res
- Size 1KB
- SHA256 61d1be4c183a726041952bc218c7454b17ee3a3b365ebacce2bf931111d2dfbe
- MD5 89cf00d5e4dc07165a4d6f892fc7c902
- SHA1 0d623f4cfe4588e0f2bafb8c5198d65a1d55abf3
- SHA512 c1e1c3e00e80cb4f68b8a58399a23fde222a0c14e8c483276514410b108c3f76e4ef596aceefee3351b91c302bf3d9ab09ce405a90cd0492adfd5af87726c93a
- TLSH
  T13C31021F71536CF6D288975B65B848C94F89242C079F9FEBFD83486C42B0E2527A53C0
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral17 behavioral18
- Target
  Counter-Strike 1.6/cstrike/classes/aug.res
- Size 6KB
- SHA256 43aa2dbb5115e63c2478366cbb1f7a959d041ab924c96ad94479c5372054727b
- MD5 695348080929caa60ec92c5961ba33fb
- SHA1 2979ee02565bd0e3436225d9fde8161a7b491e7d
- SHA512 5939c43bb9bc575f7ea8908d7d4e25f02dbea3387688f80f8f642e324f93c3b7577ef4f0ddfb5ddc81b2791fb1b2fb68a0b85acfc592f9f1d966b10a1f60434c
- SSDEEP 96:RWA+DTWA/WA6WA/WATuaWAEi3WA+WAiWAUW0WEWfWirWE7WMWLW/Wi9S7dBqPv9w:R0rGbnuarKGYTp6HXJmap9gWv9w
- TLSH
  T192E1C61FB2227CF4D2889B9BA6B488C99B99141D06AFDDDFFD464A2C42A4D2427D53C0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral19 behavioral20
- Target
  Counter-Strike 1.6/cstrike/classes/autoselect_ct.res
- Size 1KB
- SHA256 6aeafb4ac12953bdc1542bcb68b532e12ecd7d34bddb03e5102c53cd3cdd4510
- MD5 b3d29b7194e8ec6ede8edfabe2885d54
- SHA1 a0ef3a0d764d22e06177fe253821b53779eef48c
- SHA512 a2930d89794f5cd93634e80c53fd341c0b89f2c6d26ae8878db495c59e0c77f49333d693d3de710e73a35bb724610bf37e861cfb42275be6b7428d32812c823d
- TLSH
  T10B31F31F71626CF5D289975B65B849C94B89242C039FDEEAFD834C6C82B0D2527A63C0
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral21 behavioral22
- Target
  Counter-Strike 1.6/cstrike/classes/autoselect_t.res
- Size 1KB
- SHA256 778a59fed4fee1a10dc76b2a3b8f33e5a35a5af9a0ebdc0ffd6b142d51b95c34
- MD5 d4386356b9a375e93b11c71f8e37e8c9
- SHA1 b3cb6c9d278e20c4dc469adf09df862f3ee152d6
- SHA512 40fbc35b08c9c8b45678eaa6a2a4f42dfaa7789d93a3a80836b452fcbcfba31120b14f2581de287d3a9b879849f2737c2321d742f7aac92b973619269f336b8a
- TLSH
  T17331F11F71626CF5D289975B65B848C94B89242C079FDEEBFD834C6C82B0D2527A63C0
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral23 behavioral24
- Target
  Counter-Strike 1.6/cstrike/classes/awp.res
- Size 6KB
- SHA256 c8b9ec29c7f6ef3992f44787792bb5106e7e5aed622c540916558d654fca6299
- MD5 1d8716753253f50f58872478b194505e
- SHA1 feb4035fb015ee5340437e7ef1c0243f19cdfd55
- SHA512 3ba419b925f1e3ab19b9fc2d8cc1cf8ded1be5bcbf49e185ecc0aae2294029f30162334ede7f46113408ffedc692774b155cfdaff6f936fbabdeeecddda31bab
- SSDEEP 96:qWA+DTWA/WA6WA/WATuaWAEi3WA+WAiWAUWA0WAEWAfWAirWA6WAMWALWA/WAi99:q0rGbnuarKGYAIDmrWw/ru9gnv9w
- TLSH
  T17EE1C31FB2227CF4D2889B9BA6B488C59F99241D06AFDDEFFD464A3C41A4D2427D53C0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral25 behavioral26
- Target
  Counter-Strike 1.6/cstrike/classes/cancelbutton.res
- Size 354B
- SHA256 dd3839b341f4780f72ec8b6cf9901e9993fac3fb70188ed45446e53a79285db5
- MD5 5dcf2066d55d5728c186faf2ae1ae0e2
- SHA1 4e33ea4a87136f0d1fbc484b4a2dec7dcb76e19b
- SHA512 11325edc64310eb0d1141acf4fa479c3c303932c2a79f457f4dac9f4c607417930485b4760f14ee2105a9e22d4d24b5893b6ce62de7903ac4c1e32d37ce836b9
- TLSH
  T1BDE0208FB311A4F0CA444B0791F045C2AB451028815FDEEBFD421C2C16F4D3023D43D1
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral27 behavioral28
- Target
  Counter-Strike 1.6/cstrike/classes/default.res
- Size 667B
- SHA256 7e3c83f913e52ac2a1f5df62f422302232f6e395f1d338c2e731904fbc251af9
- MD5 4b78e37307ffe4c09351d78f9609c162
- SHA1 780eed5f7a966671a91f963ae7220bb01f97237c
- SHA512 57201fbbb837b36e0acbe0338c11158653d1d1cdd664a71e83085b44126603def18153b12cde97ae700e33138de0fd8e69d448dcfa9d47012ef08d8ebac32cdf
- TLSH
  T19B01810F71536CF5D189965BA1B889D99B49592C43AFAFEEFD875D2C01A0D2123A13C0
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral29 behavioral30
- Target
  Counter-Strike 1.6/cstrike/classes/defuser.res
- Size 2KB
- SHA256 4d4e065b71f8c4fa73b060d78e5cca7929030b375de1bd5bfb80e9c035d94953
- MD5 1c35d5aa052f9ea18bb41d11d421c43b
- SHA1 8f5409e66b07c293baa5425ec039538e1c28c89d
- SHA512 2a7a0689e28d30810d384c0c860534be72a65f3aca5b1725a2766773b2e109390e1377b8438a133772e655bcdecf29a7441225abb38b7470725081a310a8a71d
- TLSH
  T13541131F7513A8F4D1C8979BAAB488C94F59152C039FDEDBFD83492C42E4E2567A63C0
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32