d2401169fb5a284f7ec2f9b6b715727e640dc88a7c9fc6805b8b37a5574373eb

Resubmissions

27/06/2026, 21:49

260627-1ppxdsdy3x8

27/06/2026, 21:44

260627-1lrltady2t8

Sharing

Copy URL Twitter E-mail

General

Target
Undertale-SteamRIP.com.rar
Size 166.6MB
Sample260627-1lrltady2t
SHA256 d2401169fb5a284f7ec2f9b6b715727e640dc88a7c9fc6805b8b37a5574373eb
MD5 c53ce2b90be03aa48049a59150c6bad8
SHA1 ba7b10a88f3df9d228f559d01f8f30775c521b8c
SHA512 87ca541a7dfabf27879284a12168241676e7edc3673ad75b289f600f1cc681e0d5599bb9b2868a702f492bfab97e1402a57ec8fb912958ec5a53831745d785f6
SSDEEP 3145728:u/nnl5iQtzmu2SHbhTtuU+i185BxseS1SNyYbsQqRFRc4nVZZXzcD+XiTkKBE:eB5fB5b1wBvm0yWGRFhVZhEZTkK+
TLSH
T165883318B3B946C0A4517E3A029269C963CEFBA92CB794F7041E05F587E75A7303396F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  STEAMRIP » Free Pre-installed Steam Games.url
- Size 121B
- SHA256 83b3dea5feeb0e8b98b33b647634264abeb7a069801833bf3d80836405921786
- MD5 2c50d64e61fd60b0071ca34e7f2c21a0
- SHA1 f7eb323fa0a8634535678b072dc1247a679cd0f2
- SHA512 ceee0f559b04b85951e2e52b4db05b8e6ffabf7fc0692be19787b0dadb247ffb667550ba0dd052facdc4f4b9b0ff97bfdd2497fbf2ece37dffe09eb67abe9186
- TLSH
  T126B012AD5345C18ED361981A70B0FC08A84F7AA50CD6D0BC6694DE9B1C890D1C4A9F3A
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral1
- Target
  Undertale/D3DX9_43.dll
- Size 1.9MB
- SHA256 0b28546be22c71834501f7d7185ede5d79742457331c7ee09efc14490dd64f5f
- MD5 86e39e9161c3d930d93822f1563c280d
- SHA1 f5944df4142983714a6d9955e6e393d9876c1e11
- SHA512 0a3e311c4fd5c2194a8807469e47156af35502e10aeb8a3f64a01ff802cd8669c7e668cc87b593b182fd830a126d002b5d5d7b6c77991158bffdb0b5b997f6b3
- SSDEEP 24576:8UtU6OIyl2Wy9M3bJ45fPS0zFZghQ6aOiFaKOE31GrvFXl74YZ29X1MDd6olmrBs:8566l2u45BiNYFrz31Cv3D29kd6kWa
- TLSH
  T14895AF51C5191075FDE69030110D32B2219C9B316391ABCF665E2ED9FFB8BE1EAB8387
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral2
- Target
  Undertale/GameOverlayRenderer.dll
- Size 1.2MB
- SHA256 ad143640b71a36b45dadbe1b68096e9ca6e4fd0af69b6e3e50b90ea98bab5700
- MD5 0ec731067f6886b526eb75ff94177bba
- SHA1 5ada34244869985cf941fc08937142a521adadd6
- SHA512 3bf15f43e451a2f19491353e10c116a92deec6b9c372a9924e7205e33fb4bb2e1c437ca8c88992ef9fd836539d91c744e905480cde48d85afebcf66c1bf2be16
- SSDEEP 24576:fQZ4H9hYmdtVPtlD25KtGJFwLpK6S0QIwRDyiGO:C4dhYMtVPDdOFN6S0QIwRDyiGO
- TLSH
  T132556B51F2E18267EB8A93F1D6B46A783C3DACA10B2102E7A2C47FDD15702E37735949
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3
- Target
  Undertale/Undertale.exe
- Size 3.9MB
- SHA256 c8c4191026bf5587a6fad120855b8b82ffb4fa0c3eaf10515be472ad84248e58
- MD5 8741fe2075cfbb8070ff1ccb7468981a
- SHA1 9ff96c296cc555a6a000133e07fb3f4ab92811c4
- SHA512 c5e424cece81a4dad5f4e66e6e00b19d0ce014853f4dcd1a45d16e8d4321ba33f6333e2ebaf2dba3152e0fb22f942749664f231e6df5982e4511788a30d7e655
- SSDEEP 49152:XAt4d/SmMp/luXDffWTCcAt0ZqJEK8AbYMsYVOMsT49:iN/UcAt0oJ0A3sYEM99
- TLSH
  T121166D807B82D1B1D0026278A8AAD7EB16397F118F24D6C3F7E13F2D5E709D45AB7189
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery
- Drops desktop.ini file(s)
- Network Service Discovery
  Attempt to gather information on host's network.
  discovery
behavioral4
- Target
  Undertale/codex.dll
- Size 103KB
- SHA256 382a95940910172335a3f6356671e3cf6e514ec95b98faf5d943b23870164afc
- MD5 7b8887951d5834203f155e1f16005da5
- SHA1 e199242e51d816b1abc3e4091c429a22175b1ac6
- SHA512 bf849ce862aeba8b0782997fa5ad2adc27644c37e080bf3b52d6ebe3a33dfed48b781d6c021c20164fd1d1a058fa00b1cf5bf5745a012947739f364f9fc7539c
- SSDEEP 3072:zI3fhg4ZOSLv33g58RD7IE7ZsV0/pNDWItqcD/3lGbal:zI3ZQqv3w58ZIEyV0/baajVG8
- TLSH
  T1B8A312912BED4421FD0DA377919FF093FC7B98E92975541E5F2E290B6FE0B20990AB01
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware discovery persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral5
- Target
  Undertale/steam_api.cdx
- Size 210KB
- SHA256 64eb5531bbee05db713dcd47e4a74c59e27bf067b0cfe9603eeaea5a4601fe90
- MD5 111b4505eab5f342d9292dd592e6940c
- SHA1 6562c7f856f5ba1bb390474d925f7a79ae432122
- SHA512 176ae878132081037a81d313407cdb99b66a1a79ea86d79ccc7cf0dad333cf21753b0e885af06ec3e9e5084315ae645c9184bee46eeff0fb487545d55b60aaeb
- SSDEEP 3072:1GqYVbRkudWS/0AvM/29pNpeAA+2C+48IaD7+drNVRICcCB7Pa7Orx4I:1GqYVVk4Wa0Ke290xUXqCcm7v6I
- TLSH
  T11F243A3139B051B2D5E3823591A4DE1B3BF9756B27384CEB7B88073988665C32B3718B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral6
- Target
  Undertale/steam_api.dll
- Size 210KB
- SHA256 dfa223f72fe3b975b5033ec03d505e5a702bf4ff632bce7ba1b8a5ff411f0245
- MD5 30ae1db76c1af7f46e6f41c375e1b9b0
- SHA1 5e30d08ae301bb866a8856b4ef2c57d788bcda4a
- SHA512 2a4239ffb214341b9495ae02fae90785b9a8f2712fa91a59730b1a9778aaa35b6c8cb88cb57f19c34a131a2bfecaef71c4b56a26fac4bbf6e1a3d8748d8f7b70
- SSDEEP 3072:1GqYVbRkudWS/0AvM/29pNpeAA+2C+48IaD7+drNVRICc/B7Pa7Orx4I:1GqYVVk4Wa0Ke290xUXqCcZ7v6I
- TLSH
  T148243A3179B051B2D5E3823591A4DE1B3BF9756B27384CEB7B88073988665C32B3718B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7
- Target
  Undertale/steamclient.dll
- Size 255KB
- SHA256 6b8411ea4559e739995beab3f8fc26a9c590291a5338a642d7ecb2f38a833950
- MD5 2e5c2c249c56a6bd8b374e8d32b2abe7
- SHA1 116f109add3102e64ca3ac435b734c695737f6d5
- SHA512 10b5c80c3c666d7c2a9b9f3ee5242cc5defee3008b7c9c687b8835afa3ca0ba00d69662852d0544d845a0d59c9b7a1e7fe595e9883c0288eca71cb854193484d
- SSDEEP 6144:c3NY4YUfQVKLb0ZC9RmqdzANCNxAd8CGyCvBG6Vdq:c3VYnVfC9R9EkxkIyeXVdq
- TLSH
  T1AE44238B682492A3F13AE3794A9C37863E50F4B6EDEC231C5E50797D54E1B352A003B7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral8
- Target
  _CommonRedist/dxwebsetup.exe
- Size 281KB
- SHA256 111aeddc6a6dbf64b28cb565aa12af9ee3cc0a56ce31e4da0068cf6b474c3288
- MD5 fd6057b33e15a553ddc5d9873723ce8f
- SHA1 f90efb623b5abea70af63c470daa8674444fb1df
- SHA512 d894630c9a4bdb767e9f16d1b701acbdf011e721768ba0dc7a24e6d82a4d062a7ca253b1b334edba38c06187104351203a92c017838bdd9f13905cde30f7d94d
- SSDEEP 6144:pWK8EGMUjp5cGQ3Mek1B3B9h8Ins3i8AEYBSawz1YSc:JGvjp5cj35kDB9hrs3zARBSaJSc
- TLSH
  T1F154F11267D9853BE0F56B705DF341236B75BCA15E7AF32E5246A88C0C32784B83A727
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Drops file in System32 directory
behavioral9
- Target
  _CommonRedist/oalinst.exe
- Size 790KB
- SHA256 b8f39714d41e009f75efb183c37100f2cbabb71784bbd243be881ac5b42d86fd
- MD5 694f54bd227916b89fc3eb1db53f0685
- SHA1 21fdc367291bbef14dac27925cae698d3928eead
- SHA512 55bc0de75a7f27f11eb8f4ee8c9934dfe1acd044d8b7b2151c506bdcbead3ab179df7023f699c9139c77541bbc4b1c0657e93c34a6bc4309b665c6cb7636a7e5
- SSDEEP 12288:0s1yfEcpPzdv+t4cRIy3ze3SUN0PXGTjiqRy2p3kwzjGHTkV:NwfLrvi4cRIyDe3SUNaXy+WypoGHgV
- TLSH
  T1E005F10020D5CC73E4EB32B3843586746EBA7E912F0A285B7FC476AEE673176DA71215
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware discovery persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral10
- Target
  _CommonRedist/vcredist_2015-2019_x64.exe
- Size 14.3MB
- SHA256 b6c82087a2c443db859fdbeaae7f46244d06c3f2a7f71c35e50358066253de52
- MD5 f0248d477e74687c5619ae16498b13d4
- SHA1 9ed4b091148c9b53f66b3f2c69be7e60e74c486a
- SHA512 0c373b06ffe84f3e803831e90f22d7d73304e47a47839db614f63399ff1b7fcf33153bf3d23998877c96d2a75e316291a219fdd12358ca48928526284b802591
- SSDEEP 393216:q5lptVYmfr7yBG/4WoI+j6LTinXKSf0fzTDv8:q7pttD7yBG/uljIinXj0fQ
- TLSH
  T1AFE63332A598402BDBF20473EA94F9242E3DD119735589BBE2DCDD0E1F7818217FBA16
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware discovery persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral11
- Target
  _CommonRedist/vcredist_2015-2019_x86.exe
- Size 13.7MB
- SHA256 ac96016f1511ae3eb5ec9de04551146fe351b7f97858dcd67163912e2302f5d6
- MD5 de34b1c517e0463602624bbc8294c08d
- SHA1 5ce7923ffea712468c05e7ac376dd9c29ea9f6be
- SHA512 114bca1ecd17e419ad617a1a4341e607250bcb02626cdc0670eb60be734bbad1f3c84e38f077af9a32a6b1607b8ce6e4b3641c0faefaa779c0fec0d3ac022dac
- SSDEEP 393216:/d/FlptVYmfr7yBG/4JU4TRjtjUMy4i6kgsY7i:/1PpttD7yBG/QHTJtYMyke9
- TLSH
  T134E633326554402AEBF20573AAA4F5342E7DE62D230449AEE3DCEC0D2FB919357F7612
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral12
- Target
  _CommonRedist/vcredist_x64.exe
- Size 5.5MB
- SHA256 b06546ddc8ca1e3d532f3f2593e88a6f49e81b66a9c2051d58508cc97b6a2023
- MD5 630d75210b325a280c3352f879297ed5
- SHA1 b330b760a8f16d5a31c2dc815627f5eb40861008
- SHA512 b6e107fa34764d336c9b59802c858845df9f8661a1beb41436fd638a044580557921e69883ed32737f853e203f0083358f642f3efe0a80fae7932c5e6137331f
- SSDEEP 98304:EuLgywiNHBeSLxYK/bxE3q/BlZkWMGPQflVJ/EK1sLyzs2T2Q1mOjq4/:V7wqheSVYK/bua/BlWWnuVhsus8nm+qi
- TLSH
  T19A4633229343E243EC97FEB8E16E484FDD65C2B31736D6677326848D9D3DB1848A0399
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Executes dropped EXE
- Loads dropped DLL
behavioral13
- Target
  _CommonRedist/vcredist_x86.exe
- Size 4.8MB
- SHA256 8162b2d665ca52884507ede19549e99939ce4ea4a638c537fa653539819138c8
- MD5 b88228d5fef4b6dc019d69d4471f23ec
- SHA1 372d9c1670343d3fb252209ba210d4dc4d67d358
- SHA512 cdd218d211a687dde519719553748f3fb36d4ac618670986a6dadb4c45b34a9c6262ba7bab243a242f91d867b041721f22330170a74d4d0b2c354aec999dbff8
- SSDEEP 98304:RuLgywiN1ah6HcG0UJrN7SDgndrHZDMeaNNjt0CKKBgY2r71pZ/APaOR72HgQo0z:I7wq1W6HqULS8djZDTaNNeCKVP5ORsg0
- TLSH
  T1D3363341B7A660F9D20778B256377FDB1C28C2CC7B28130AA365E5E87ADB7C08355798
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Executes dropped EXE
- Loads dropped DLL
behavioral14
- Target
  _CommonRedist/xnafx40_redist.msi
- Size 6.7MB
- SHA256 e6c41d692ebcba854dad4b1c52bb7ddd05926bad3105595d6596b8bab01c25e7
- MD5 97c2eebb30c5a88c68c8f24f37183f1d
- SHA1 49efdc29f65fc8263c196338552c7009fc96c5de
- SHA512 c9d1017b274ceb1b4ee624cf7e628787c32a727c64f715fbce1f1ae929d9114f8fe1291e34583cec615619b0128c01206b07efc878e7a5c57b792453f73fd0da
- SSDEEP 98304:wynfL329J1XswfXO6wiBB+4RZg6aENaCZAU5PMO0MntfERyJGH2YPq/:wYD3C1XXfzH+4cLHU5PM/Mnt+YGlq
- TLSH
  T1906622A2751AFF41DDF406BCE970CA490925CF3782270C686929356A7BF7E1202E9D4F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery persistence privilege_escalation ransomware
- Executes dropped EXE
- Loads dropped DLL
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral15