d7c75b2f9b184ae46db46679c9267ca5b918534ba58b4553a9b151a633070ad3

Sharing

Copy URL Twitter E-mail

General

Target
The walking zombie Dead city.rar
Size 72.8MB
Sample260627-ebsv8sht2n
SHA256 d7c75b2f9b184ae46db46679c9267ca5b918534ba58b4553a9b151a633070ad3
MD5 1f03a24c8caa4194bd46b3caf01297ee
SHA1 b6928eaed9d5268f02a7cc6592d7754f32d45c63
SHA512 33d0376a9d2f76b0b14cbccd853d18a669392f103397c1a5bb5478bc4f5d9e7023a5625cbc8a8f8ef0c60fd72882992834ace86fa4a50969c3f9615e31122449
SSDEEP 1572864:89URIBjTOZOyAe0vVChr0SmGRQZYzUIEHT3p5t6/VJH8pQWOCt+QSIPSY4:mUWHOcy0vVChr0GRQZYwfD6ApQXCtlSh
TLSH
T130F7332A80D481E084B4AADB51FE787E3017975E64B8191FD2E3A3E17256DBCCCC85DB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  The walking zombie Dead city/DESCARGA JUEGOS GRATIS - PiviGames.blog.url
- Size 113B
- SHA256 96a001f21ba2aa780ca1b0aad681724e5554d9275dc6888188c405ef70b382db
- MD5 438433a51e67896ebdb909226217830a
- SHA1 867df7e8d986eadbab203b98b2c0dec77a833df1
- SHA512 d2cff74b3513ca9105af44c49c66dfaaa7793a8720c136a1bc7e595a3d1f17c70269c3d20ca139e899d4aa3af8c8c8b498a39a8cfa24eeb6b92130bfe47ab697
- TLSH
  T136B092AE500A8699D161441A8070F848980FBAA408E2D05CA249DE9B0C080D2C454B66
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral1
- Target
  The walking zombie Dead city/UnityPlayer.dll
- Size 16.3MB
- SHA256 ba18c424521166fbd53d75ae4ec6f281a97ed06711e09abf5d88bd5190f9d724
- MD5 63ced32577ea2d01b37e892c0c17b653
- SHA1 00f50837b10bf5f3ce3e60122b6863245e68f0f1
- SHA512 f17a40c2f19a1e1a065da5e7adce3ab329746045081dc025b344891a958fb6577500d62bf056b6f5ed629f53241d352679a5ec89842d2cf045ef7b396549e144
- SSDEEP 196608:QvVQ25AWDY2ZFPBA3jgsQLbJdhaUEeO9srwSOq:MAg/BA3YZaUEdZSOq
- TLSH
  T16D07AE217864C0B6E8D601B2F67E7ABF69784A15032C44D393D41898ED745E33BFA7A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral2
- Target
  The walking zombie Dead city/zk.exe
- Size 624KB
- SHA256 d0c261d36f5a88c8df18be907521ff73fd0d2c9cfe81b8e346e2b25e41a5dccf
- MD5 56e5de9d79aab47cc50c393025238aca
- SHA1 2e3ccc0a23aa89ef4501a1189c7d8db85843e8c6
- SHA512 e76a168fa37e7dfd42451e97eb1b4cf0b5e378408535df2019ba170f3b8ae9d8d4f0d33b17e4dd014f963325f0bd860af23530eca9d761e17eb57c74817edba5
- SSDEEP 12288:1/Uj6+5TRxoGHzRWe0eqR/n4fFqtNuEOT:pQ6YgGToe5qRn4to1O
- TLSH
  T1C0D43CF95DD608EEE0C1FC3B333145BCD166EC3505BA9325B92A792AADB13C16F40992
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware discovery persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3
- Target
  The walking zombie Dead city/zk_Data/Managed/AmplifyOcclusion.dll
- Size 3KB
- SHA256 db299fef58132d7579f2bd84908de6e0ba7d5b840e72b2b0c9751531d4b75e8c
- MD5 533f35098c7eccdc859ed5e520042eca
- SHA1 c567247029bbab009df3005bd8df18cd01d84c26
- SHA512 646005071963bc12155c1d9d0785fd0e2d97e1a0772d6d89caf3b8aa9cae5de36cca5087aea8677b351390f64a65024033f397f4841680377fa414afd1fc7c1c
- TLSH
  T11F71BD2393F4026BF0AB4B35BFE707522664FC209F6253BE5D9043297C21A204971F71
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral4
- Target
  The walking zombie Dead city/zk_Data/Managed/Apple.dll
- Size 5KB
- SHA256 a5e026adb5535bbf4a57212eb43bdc55c264bc973c2ce47eb1322542978ae187
- MD5 b2b2df620a979e7b10f8917be553f716
- SHA1 1b0274e4828514b85898c64174dc3593ed8a0b8d
- SHA512 4d1a7ea06560ee1e894b03088571b9e2d282cbb29c65ddf2b9b4aab8aef1a2442af9b87691eed671344600f74edef6afcff18a7426a1b110dafe9bb4aa5926ac
- SSDEEP 48:6py4zW5VVVnJOF0W7+3IGU8WlcJDfRRHq5ujPRlXDv1ulGRyTERZq:f6W5VVPOF0W7NSWlmKsDRlcSyTG
- TLSH
  T142B1313563929277D82B477179F713012FB8F8278B57579FD6C0A2296CA32204F22E35
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5
- Target
  The walking zombie Dead city/zk_Data/Managed/Assembly-CSharp-firstpass.dll
- Size 189KB
- SHA256 297caf1ad092bd4b5de8e192b241fe4edf1a17a934470e06c0b12044588dd0c4
- MD5 0ab2e5a9f8d4095a3b32047323b9d1ef
- SHA1 6b11d961ec48ee900e4f75f8f04930a2484d1df2
- SHA512 224497ba5a2974318d8c030f040dbc2cde09e2872521f80613553dce06fdfe7e3680d1a22ac0308c1663815d7044effe6ef407147b13ff962ca24de703fe7f0a
- SSDEEP 3072:Sca7UIBKru74hOD/qKCOGCYkqYkU2CPIULDPTJWajRPcPtOM7zyW5RVijKYL:ZoqbhsnYkqYkULZTHhcPMMnBkt
- TLSH
  T14C14296027A8CA7BE57F17F995B10801DB726203E5AEC78C1DC060FD1E96BA1690736F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral6
- Target
  The walking zombie Dead city/zk_Data/Managed/Assembly-CSharp.dll
- Size 10.1MB
- SHA256 b380baf61761aca2ec13d0c818732f22bb37550041ce2e6a6fc2f5610ba028e5
- MD5 cec09fded156d28193201a6f6dff84a9
- SHA1 adf4eb793f64dd8d90d93d0df0f1d2dc327cffb5
- SHA512 458efa95d169f8e74eb7e29c4b998e958e852ee4c008e0250e45affed8db1f2c08a5838b87ac37c5584c74c3a65863e30c434a3b3cba528321ecf3bf7bc6bf21
- SSDEEP 98304:/SV9ikojMwPKWh8awwxzJo4eZWyezGl4wK6VViw2DGLuMGEV8GMI8zE7XwK5uUL:jDGLuMGEV8GMI8zEkK5u
- TLSH
  T1FDB6C55069649A33D56E0BFA614209134BF24D82FBCEF78D9AF2A0F918877D81C4947F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7
- Target
  The walking zombie Dead city/zk_Data/Managed/ChannelPurchase.dll
- Size 8KB
- SHA256 23f98615e6ae27a1d9c08a5a95f835c559c34bc122b899c6430f17b230572aa9
- MD5 401afc1e2a65dfa1317f30796faee454
- SHA1 a24f33cde864abe22b88e5cd87b68b08c6aa14ba
- SHA512 98b9b0297d92d66e4e1fb30f2966c2fa70aab63e1a880ca7e69905f1dce31d19865d661235d91b44d680fb87f52183a6fee5ef373387058755db2afbeb8b67e6
- SSDEEP 96:660/UolDLLIF2/lfCMKEsvGyxy0jL5uNANyfkxE+3owPlizwplLa+WW0TQOBK0C:s/blb1tWxggVAAMcxE+YwNiyLZ
- TLSH
  T1CA02B85193DC439AED7A07B064F703600B71F7627A21CBDF1A4461A8BD6E7804AD6B21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral8
- Target
  The walking zombie Dead city/zk_Data/Managed/Facebook.Unity.Arcade.dll
- Size 6KB
- SHA256 2df2b1acfffffc04cbdceda078f20a796af95eedb894a28f6bcaf5dbe0bb746b
- MD5 ebcd79123ad0fd12ab87418a90a9ba62
- SHA1 ed53ef04276f25bfb74a6c0ac4663159f49f8e47
- SHA512 c9523cb653cf75f8acd935f4934aa7e51d0547adde5eb78f15732f8d40c965019e5c28e92805b2f4213acdb3e19bd183b8432b8c5473ee7b1c3da62f44fdce72
- SSDEEP 48:6BlmN0bqHlV9epvDpBAWOnxx9XI3p6sj/SS5HFCpYIKYKK61tKYwhDKKe+OPulU6:4mN0byVkbPQY8sTVlCH26Ti0c
- TLSH
  T1F3C12E176BE40A22E6BB1B79ED7217146B79BD109A37E73F25445079AC10B84CD21B23
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral9
- Target
  The walking zombie Dead city/zk_Data/Managed/Facebook.Unity.Settings.dll
- Size 7KB
- SHA256 69cfabe94f4b81a48c9de683ea64bbbc78faabd5e4b7d3ffef6fb18a2fce7eef
- MD5 aa4cb83f568a65d8fb692f17cfe15cfc
- SHA1 ac4376590a82e699a85ffbeff379b8c24a421406
- SHA512 3c204b383abea0a3275f0eae68dc65356c2b1a1d587dcfecc09409378ca1a1616f86106f59f9ed7fdbd8d3a5a57540bedb784ac189470f9b80a927adebb772f6
- SSDEEP 192:0gCIE8/zDMKyFI9YKUiZIBHGNi32cGSB+MSHO:0/8dyFIOhi+gi3b+hO
- TLSH
  T1D9F1A645B7F8553FC66E07B839F343619170F6A28613F72F094444EC2DA2AC88A9A7D2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10
- Target
  The walking zombie Dead city/zk_Data/Managed/Facebook.Unity.dll
- Size 116KB
- SHA256 9b36a7310535cdc2c03f33961b3c15bfbeb70ec0842c3eeef2060f97ed74c5b8
- MD5 8ae0b2725f1d3c018ed87e312861795b
- SHA1 3c8f03ee2b2e5440281976242025f95ca6577a40
- SHA512 114a5f13bfa5bfbd6dd7d53c400d39e1a13ebcb87647f49fc7872bf4618e1a79c80069fd59abbe1caf6b0835937047d68edbf9d3992d885b59d42743d5fd9fb1
- SSDEEP 1536:bquqiXj0rSxVLsKfQvYs19ap11RPjJ0GYWK7Wypax:bJTRLPi9A1ZjJ0G4lpax
- TLSH
  T117C3B65057F98619F2FE1B3CE8B601248E77BD9A6932C71D094C956E1FA3B40C9A2733
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11
- Target
  The walking zombie Dead city/zk_Data/Managed/FacebookNamedPipeClient.dll
- Size 25KB
- SHA256 3bda01ca8a4b23480deca8b2e801230054cbbe684003f2bf42ab738abe0842ad
- MD5 ee8704ee0044d3046363a2824b7fd518
- SHA1 b642233ed74f7051b7ce3b85ffb8f0c06e7e0a23
- SHA512 9c1f3d4053b2b6cea115aa67a079369e1493ff5b104998f0d6f3b7158c1e20a931e72a44f61648fd7c270cbab9aea27c7826b00526ace19e9114638b721f49a3
- SSDEEP 384:0yTj0x8UNI8kbRcDD9QTeS0TygdvKdSnTICToozN8xxczYNftAd:Tj0xdNyR0PSCOsIC0LyuGd
- TLSH
  T168B20BA177ACEA7AD6BD0735E43179550132B6493531FF9E8B64A6CE2E273C0C820B71
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral12
- Target
  The walking zombie Dead city/zk_Data/Managed/FacebookStore.dll
- Size 4KB
- SHA256 8d1489f2cdede4e73bacf9767e4076cd31ef46f927263131132949b73e08261d
- MD5 7b163b3e145241a73dd809c74cc1863e
- SHA1 48b04c6c80b6d6e51d9c90a671cf5c2ff6c42c7f
- SHA512 46a5ab27b6262d285081382ebac86a273683ff083c806f45beed631c498089d37a18393f930d18041bfee58bd64808e61e1fabd6f92cd3aa3df33a9a633a1211
- TLSH
  T12381632293BC0777F4B747B46AF303826B70FC658A1BB39F1988522C2C697504E62F61
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral13
- Target
  The walking zombie Dead city/zk_Data/Managed/Firebase.Analytics.dll
- Size 27KB
- SHA256 9557ce59177e0cf11211cb50a8514326a0177bfcdc7e4f1702c2faeec798e544
- MD5 2bab3a5434d0cdac66956b1a1abc4557
- SHA1 c9b39e9b6bc1a48f40d6b93512d6c574ac72e383
- SHA512 cd6290c7bcad437b7f63ffd0903d7362e0251cf22c429fc5620988c72c7202ccfc553a36d66fa5e48af44b03d4b07618c542d58de1bb1a2c6a97fa4bbbd91acf
- SSDEEP 384:vMS7nJCS9YEu1elMqjWocf1HJcv6SCQZiviaRC:UI9hFWoSJcvCQZinC
- TLSH
  T16BC2F2009B81D785C9DF47B0203A0760D77D77C2722E8B5306E849385A9FDEAF5A72E9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral14
- Target
  The walking zombie Dead city/zk_Data/Managed/Firebase.App.dll
- Size 212KB
- SHA256 f194810745cd6645f8494bb0281078a447d73d074dd7c6dacbf50a94c9b0a612
- MD5 751d98ce187c0546fe9b3f25acd6388c
- SHA1 6567148007193af53eba491b6c11a5d67f8f63f4
- SHA512 f89839b8661542d9f92d8cfc899a5f74297820f501d14c0c20b74bf93297c170f1aeeb91cfa18e9c35de8ec22151602b5eb6590b73b72047ac97dcf955ac045b
- SSDEEP 3072:Y4G4auhqndNqHudL0fjZDsINQVCi2vkHiUILYHfMxV7K8iMCo7fQqYF6v4xVghod:Yqh80tfiINsCujMT77Bfeo44o51
- TLSH
  T18B249D810F9D8E02E9DF76F4D47302029B38B1E794BBF7D809992438950770166A97EF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15
- Target
  The walking zombie Dead city/zk_Data/Managed/Firebase.Messaging.dll
- Size 21KB
- SHA256 fddf056f5ae1c9f76db0615f1546cf3d9d87b28a61cf872c21517a5b65b515d1
- MD5 a3bca52ebe9ebdb87512c8f4fbdaf5a3
- SHA1 e19e6345d42ec66c569caffff04162c37e427a64
- SHA512 2f82ab634d883f340dbf372eca0f6d11716074301f488e18a2ed3d1c37c94819af6e7c200af2dff7335335fb9de40410d96f48c31508a6bda383339b4fe32f3b
- SSDEEP 384:DszHNzRJL3qLuk8S8b8k8WneJhcZwt1NW9sGw2gRyJAmfbWC2faeqT6tS2w609Mz:AzHNzL3kukTqVvnAH5oC
- TLSH
  T129A2A481CBD3D893CDCE92F074B336401279D646B907BB8956B950B12AD3BC7A1233DA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral16
- Target
  The walking zombie Dead city/zk_Data/Managed/Google.MiniJson.dll
- Size 9KB
- SHA256 412a0d2dd004317536041085e785570e8afc3a23e33bb13ddb43211abc9e1d3a
- MD5 459c0710468e3ea588f9e78af423ea7f
- SHA1 4c36672ec50a6aed449999d9381bd055c0658066
- SHA512 0306cd6b1e85ceac5286fe56f6ac708dc68d5037651e5bb272b2d7a8129093142bfe01791d754b88cbbe3c4152e96c08ba6b32389b8eefa791ed8a7067f53c41
- SSDEEP 192:grADyCUeb+YmOTTV6/Tltolmh16Ubw7uOIB:hVtdJTp6bLNXT
- TLSH
  T1E212C616E3A5EF27C94CA77944E307504335B641A9F2DE0A0EDC81EA38133E56F25ADB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17
- Target
  The walking zombie Dead city/zk_Data/Managed/Mono.Security.dll
- Size 286KB
- SHA256 0d0b64e00104caf2e80a7573fb3f5e08b4d09b524e3b3bd7f0fe3bb73bec08b7
- MD5 db581051169b2bd63b10543fc6429e74
- SHA1 1263d9b5dfa57f028eaa5cc353740f25c7ab400f
- SHA512 77809a43b4c605c7043dae698916607111bfc56c080d12d01a2ab308efba1b476789f7aaeefb4fd5d0b106efaa0d9f2eb736d395289351733df62439493b4a49
- SSDEEP 6144:rytgJ7SzJWhaeQTVJRj02ooGzsbFNG5ms7h:pB5ceQ502oVzB
- TLSH
  T1B15439086BE8DB67F1BE53B8D0F05015CBF8A15AA19FFF5E1C9610E818437909A41B6F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral18
- Target
  The walking zombie Dead city/zk_Data/Managed/Photon3Unity3D.dll
- Size 147KB
- SHA256 3d05bc49ed687f60ae1fbc28d40beec1cd40330c9f14c7445ff4cd0ef425727e
- MD5 d8e901cba7c675fb8005ba2351379fea
- SHA1 de62fd805416f8715cc6d3bdc696cf79a5e98cd7
- SHA512 0dae7579fabbfefeee1d5421fcf8ad63c0d5db5404be8ed5ec1d36df022d00618ddc1e7112b70591eb9ff5d3ecab6dcb4bac5a3d50609f27426c0e2437ffd075
- SSDEEP 3072:Ca+WN/bgKJtffSia1wR2lcJHgnQGQuOQ2jeeTHU4PWs/O4NickvYnGShTt2YYY:r+WN/bgKJqCvh
- TLSH
  T1C1E32A2C57FC4A26E2BF6BBD907201104770B9136573E76E1DD474EB2C22B81AD11B6B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19
- Target
  The walking zombie Dead city/zk_Data/Managed/Purchasing.Common.dll
- Size 13KB
- SHA256 816b6f54d632303ac891c0d2026eae18a81247b5dca1f22d08d3a5fb4f25fa4c
- MD5 204cf0e859caf508a150b2693bc20906
- SHA1 9de9cc2b7933f9227f83ee91d48c7dc0568d89e7
- SHA512 f52774b697302bd405dde614a8b2c87391ec1138641bc3e365baba48ca5610e1112c244616418a22764d5a02bf68d1f47f0585e735fda0d4fb8ad70689a9979b
- SSDEEP 384:Qb/0HKyL/ooL43lqs41h8TT2IlxjN75O6zPI/V+1c4:TL//0P416H5lX7sU2Ei4
- TLSH
  T16552E90CD7E55B27C89A1B78847303505334F1559703FFAF1EA991FA28633E98D91E2A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral20
- Target
  The walking zombie Dead city/zk_Data/Managed/ScriptFactory.dll
- Size 6KB
- SHA256 dd6c9bd4f361f713c5c971cef8214249e9e2154984e102c239ab1c4b6f022a85
- MD5 98ee620859c391d47139ebec5a2a6964
- SHA1 c5ee451e2abfa83fa59c00bb0087194f804492a8
- SHA512 e8b880b2ba0712a058ef9479ac842edaf45ed547d98886f61be66cecbadb1f7a2b53f254838f2f178d21ddf4c817360b78fd33f650b15ac539b496eaf28258d1
- SSDEEP 96:TTvGI8buwGhLEX+F72uTAI2cagKU2AFPp+dEiDa:TWxGy+FyuTAI2ceqPgEW
- TLSH
  T1DBD1C512ABE4CB3BECF74B3B99B3C205A638B6049D13CB1F05D4925A5CA12684F62775
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21
- Target
  The walking zombie Dead city/zk_Data/Managed/Security.dll
- Size 51KB
- SHA256 bce273ec4894fd9ebac01d2c7c9b6e92b26a724f9b7474a8b40858d0abb025b9
- MD5 29d1695727c230c58b9af5550a80686c
- SHA1 8eb2d5cd07433d1671180085fa60282a398e03e1
- SHA512 b9d2091fd5d6dad7f237f45b30864956e9393f01a202577aa155cffe9c0ac749530fc0e02296c410e6c86909cc6209eb5d8c3dea113e375cf58ffb35495b09e3
- SSDEEP 768:NBzqktTyT/x5QN9MfdBFskvrCNRCrIlnF87+X24wBTj7iBI72pAdv:TqkKQN9MfykvrCnCEL24wBTPiBIJdv
- TLSH
  T112334C253BA8C729C86D5BBC60B2D126C7FAE1475913E75E6E9364923F233854900FB3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral22
- Target
  The walking zombie Dead city/zk_Data/Managed/UnityEngine.VideoModule.dll
- Size 18KB
- SHA256 167de9e05b9805eacebeb0d104abe3f1d2e1bf41ce4dd3e349ee72825cb200bf
- MD5 bdf0ccb0ad97e497c65e1012d2156329
- SHA1 45a02cdf28b5b0ffc2df67b75af873585b12e5e0
- SHA512 d982e57b3a09f8650c238ede8e940e4c368079307ec88798a89bf7c166ade0959f115c0eefa08d6d1ffb2cdee1b9daa57ac3014bfcab886fead31ecbf27d382b
- SSDEEP 384:S1egOBmDgQnOQrydbcdtHmLoV9DmAy0Kij:Bhcka3Zhrke
- TLSH
  T17B82C95663D8889ECDFA07B8F87502010334E512A71FEB9526BF45AC193B3A14573FAA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23
- Target
  The walking zombie Dead city/zk_Data/Managed/UnityEngine.WebModule.dll
- Size 27KB
- SHA256 58986f93a9369f304999df0c3b0125fe2da4432b1a121122f94d40b0d99110fe
- MD5 865088489384bf206983b3d4fc146cd7
- SHA1 41acd2eca31339a845864a9ae18c4214748b1b8c
- SHA512 ce12cffa70f8ccd2aac9f2f7231ebe5e127dde0818dd90b8157f8520f8f30dc71c7045033437751a64262692b1d89da2d07724c62a83c2011de7d63bea8d0d12
- SSDEEP 384:aY7d4LcVRfkKX09UosSCHG39JtUXzHw3AxtCOTo1WXDewmV0vq0M5eVXs6CgXjJX:/8Ifk+osSCm39ws3HOc1M/gI9smXJ
- TLSH
  T1E8C2F71C7BEAD62AC75CA73148F212105334E48AE423EB121EE455B95E773F50F862BE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral24
- Target
  The walking zombie Dead city/zk_Data/Managed/UnityEngine.WindModule.dll
- Size 5KB
- SHA256 6051cf6b28bf50a721c3d34224aa4854120917139086f47068e965d7f3108671
- MD5 20c4fa5ef07ba0b288e2eedcc6dd2d91
- SHA1 084572d8dfa75b0c93fcf24aa077e3a338ebd78f
- SHA512 8028bbaa1509f413041ed885816377e7bd4eb2af33e1414d501ed0b7db84261743d60f5cf4c1bede2805e22f77de2db8a39647e6eaee7d8c6d83ede53da60a52
- SSDEEP 48:6X4v3K/NrC0FypGDfxkqBJMsJlTByEVLnqn1AEOOPulCA0LxxI:b3KRHQck6fPt0Lx
- TLSH
  T164B141B173D4846BDC258B367473835035F0F822CE37C36B8A951258BC310998F12B71
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25
- Target
  The walking zombie Dead city/zk_Data/Managed/UnityEngine.dll
- Size 52KB
- SHA256 d0308db6e309be9060c19c429dded4f266e8f32a97849b34d5bdae2a79b89fbd
- MD5 d9adffdce3ed816554b54c57c606595d
- SHA1 22a5eed751ab8b2517e88de555f5e9985910b47f
- SHA512 35720df1ed6073335d15c0fa6d267e096bebec182dd37b4abae84c7e371aa92673015906a3ab5a54fc111ca3889031a8d793f414c29f8632cb4984a790db1193
- SSDEEP 1536:mgLhAqGE7IGpjem494XGgNmE+yC3ccq0vU28tdk:zGgNE8dk
- TLSH
  T17133F9713B745A32CCBF0F32DCAF95801AF0C466393BD86B20594209B5BA69B375635B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral26
- Target
  The walking zombie Dead city/zk_Data/Managed/UnityStore.dll
- Size 9KB
- SHA256 89d43e20f5dbef37dd1e145bdfec8632ade844a0318c9c83902189ce7f798afc
- MD5 3c3f8df3218078b990c484c0828d595a
- SHA1 77ac399608c32e01bb6ae0726bc9bfdbe9ce063d
- SHA512 e882f03e81e856f13b41a9e0371208011c7c7162ee067b4e0f10ea18d79c4a23bc1a3d46f0a10160c377bb2ffb17e7b8ab486d580271d0548dc4f5be8464f847
- SSDEEP 96:BA9PLISJNCkCDePuYF6osFDDz4Mo9oGMoJoEYE8EcKaH5SBKue1bWH9lf0Wk0sPO:BGLIEVCDpYyHz4nJoEYE8EmHa+Wd7J
- TLSH
  T1E612E812C7D8877ADFFC0B786073430007B2B924AE55D78A5E5861ED5D2BF809BCA61B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27
- Target
  The walking zombie Dead city/zk_Data/Managed/mscorlib.dll
- Size 2.4MB
- SHA256 546e8980c42f013338fad7c6604e56f11b4e044e670f67b4c3318bd3629562c3
- MD5 04a55c70d26bc4b62f0678b4a9fd4cbf
- SHA1 1521927a001e9534b0a7b974d6059c977ced5880
- SHA512 04ddd8954aa1efb65f814f40c8609f583813d983554ea65588393761729f133880d5e3295483f266c84fa9ff76362496f241bb3e3a7506c2d1626910655c216c
- SSDEEP 24576:Bpa2qN+0B0/QbghMjgF0UbdRuMQJW26XlaOwkXqURpZM/YO6QSMJ:BUxPB04bgZ0AlaOwkXqURpZMgO65
- TLSH
  T1DFC55B50ABF5CA2BE67A6775E8F101140BF4F852B763E34F364912B80CA33049D56B6B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral28
- Target
  The walking zombie Dead city/zk_Data/Mono/etc/mono/1.0/DefaultWsdlHelpGenerator.aspx
- Size 56KB
- SHA256 d87d5196b2ae2abf4e673315e1fd22c3a44df80192f23e89b78108579c287524
- MD5 66fed2411c14a0fc8ce4c593ef601bfb
- SHA1 4680a34aae1193f1e4a6aac1a5dd3c307de257fb
- SHA512 331874a9956c87db0646e4d21937a88009804a59fdf5f5882ea5b1dfb7dd7ef17724e09877d98f52e7327bbf38a46dde0c54d5c85f1e860b88322bdfad64679d
- SSDEEP 768:M28utHkOFpMgMwP9h5Ij7khsp/6JtEZwMxVtkUI353cXyEyk3VbNb1gNuoT1y:ZDF6CdsCOZwMx3k5JYyklhxgRw
- TLSH
  T17743C4A0EF5C8D36499A52D9F88140CCB9BDC43291199CF3FCCDA12AF09CD6DA274766
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware execution persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral29
- Target
  The walking zombie Dead city/zk_Data/Plugins/steam_api.dll
- Size 854KB
- SHA256 1cb212268170094dbb12147fa55a9c9688dd123046812e7f0182e072762ea400
- MD5 226d0e9d0383c34ae5021e70b3b029c9
- SHA1 e45defcc669479c365c9c2b1e888860cf57286a6
- SHA512 fbbb54f34670a6924fe07b28086067d487fcfd4d912c9afb27a19247121e04848d727b5f7b7eaaedaa31cf1788f48b9acb7cbd2cb656836b8e17b9b2e7a46e38
- SSDEEP 24576:xWz6Mh4mCone+iIqSDgU0o7LoiqJYCuyUCP0:66MhCdIqSqOSJ7gCP
- TLSH
  T1D51512F6525706F0C1F1C176A8864E6FBBB4249F712C0DBC3D9446379887A0E6AB72C6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

discovery upx
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral30
- Target
  The walking zombie Dead city/zk_Data/level14
- Size 3.0MB
- SHA256 ce90b15b1e153c69cf2c2ea0469400e7bfb4bf4d2570db4a1aa230abbfe5a8a4
- MD5 5c71fcdb25f5cb4c55b7b73ff4a8cf8c
- SHA1 3d67a575d0262011928027b10ea6fdf50824b2ca
- SHA512 a7c5b437881a8a5f3ed0fa81937de883ae43a6111dac94a9a093a20e5d18f23098190fbbd776051e2631b96972465052ea3e4b3606c83f79a7313b075bb8c359
- SSDEEP 49152:YKx3e5eb8r1qMpiqsO7YpJu6acGaaMgg78qjPrL0YoxuPgA4V9r1MFFup8zvTOeX:3x3eq8r1qMpiqsO7YpJu6yMj8qjPrL02
- TLSH
  T1ACE5389B77A0390FDC22933850BB6FD5A9E481C54BBB1A374E20C23D2EF63357695066
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral31
- Target
  The walking zombie Dead city/zk_Data/level4
- Size 2.1MB
- SHA256 781cad63ba9c8556e413f57da0ebdefcb50474260813e1136ac6eb4e8638da3f
- MD5 dea15206cdff1e4ed328af1725368232
- SHA1 ab14ff1792366a7da58824c45e0968636c7fb4d4
- SHA512 1debd824a870e46439c5c90ce5eee82e6e457c2e8fe156cc88fade6af5c9dc48b1101d2c2b5e92f708f0f979de53e0e107199d57c38cbac4ddfb1d578382894c
- SSDEEP 49152:LUDcqL4jlLScjmVLNsebHZkG++HoIc2Oydr4blLSd/Iac5831ytip:CcqL4jlLScjmVLNHkG++HoIc2Oyx4bI7
- TLSH
  T1C4A5495B77A1698FC832C73950BB2FC1ADE1C4894E7706736E20E11D6EFD32935824A9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

UPX packed file

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32