0a1f8905298f0dedfd308d72b42a472a16e6567f8caec78044cd4f8cca92128e

Sharing

Copy URL Twitter E-mail

General

Target
Escape The Backrooms @VaultHaven.zip
Size 1.2MB
Sample260628-acww3aet5n
SHA256 0a1f8905298f0dedfd308d72b42a472a16e6567f8caec78044cd4f8cca92128e
MD5 3142f9b39ea236892fc4a835506d53f0
SHA1 3695e9b833101f3236586f968cfcc589651946b5
SHA512 ff8e70bc16dc84a6e43b3f7673b220435181a8ba11c1881d18acf080e702bdbf6ea5983a8b6c6144fd2275494290681398e2049febe54364d2ae86b09bd90ed9
SSDEEP 24576:t5DAHLx45DCoyhoVqWYUcPWmg40L61s597BJE0DPfeTXe:tyrxlNhoVq9Hb1s5BB3DP2TXe
TLSH
T11C4533072F0386E0CADDD8B2AB315C9CA17E567B36E4736061CEBE5A2DC2B120D5945B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Escape The Backrooms @VaultHaven.zip
- Size 1.2MB
- SHA256 0a1f8905298f0dedfd308d72b42a472a16e6567f8caec78044cd4f8cca92128e
- MD5 3142f9b39ea236892fc4a835506d53f0
- SHA1 3695e9b833101f3236586f968cfcc589651946b5
- SHA512 ff8e70bc16dc84a6e43b3f7673b220435181a8ba11c1881d18acf080e702bdbf6ea5983a8b6c6144fd2275494290681398e2049febe54364d2ae86b09bd90ed9
- SSDEEP 24576:t5DAHLx45DCoyhoVqWYUcPWmg40L61s597BJE0DPfeTXe:tyrxlNhoVq9Hb1s5BB3DP2TXe
- TLSH
  T11C4533072F0386E0CADDD8B2AB315C9CA17E567B36E4736061CEBE5A2DC2B120D5945B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral1 behavioral2
- Target
  Escape The Backrooms.ct
- Size 1.5MB
- SHA256 e4074fe412110f0a81423447c121de1fc05370258ff490d441a320edc4a755de
- MD5 6a99f05fcfdc363d1321ccd907a2baa8
- SHA1 1d85bea61dbdf0ab984339f7aaaf76946ed5c090
- SHA512 9f3adfa02321a3a9e00bff5cf09133f2342e613688ef5890d8bb6a58783b28ff81940a937b2787579b8ab652d73d8694809f77200cf86bd8de3aeaeefcb79662
- SSDEEP 6144:iG5m1s6QVO+dVO+Nw/KBZgVO+ZG5m1s6QVO+dVO+NWM/KBZpVO+wG5m1L6QVO+d2:xF4KcIvxS
- TLSH
  T1E46512471A06993BA1FF51159F086805FC34734B12D5E245B8ADA2B31FEAACEDC6F350
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  Last Command Spammer.py
- Size 1KB
- SHA256 c311fbccdf02c16b9e406fb5a256d84c984097cf201847b3f6c52d276992a532
- MD5 62ccf88ec97145587a390258639f1f6b
- SHA1 7568a304ca1f2c1429dee039006e3b6fea8e1b10
- SHA512 cb8bf7fdbf2f0e14d1ca8debf780f6a7366b0abeecfa63923e45d02bd7097cf7932e731ad8085063033421502fe7cd3ccbe6043d7e46db4d19ff7efdeff39314
- TLSH
  T1693102173C2E25799AFA491FE201D175CF00516B8A68148BF89CBD993FB0569026B179
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral5 behavioral6
- Target
  [email protected]
- Size 37KB
- SHA256 9ee9e283b6e1e52ec2a00ac9185699f4ad60aa07c1380829e923ae0d4af213cb
- MD5 e984042cf8ef2429c21d99e0f1142e6b
- SHA1 cf891a4510d3ea7db1691e8f990f1348ae2454a0
- SHA512 829b214e40c702831f96db19cd5a04d3b0872c57723d7fa906ddfe6b57f3d6609b8750734856ca504f01b48a09b95bd84dd4c32d83a96f1f4fa853444d3b06a8
- SSDEEP 384:+zyh93fSj4aunHJSU/9MPHD/fXxrhUlCVVbyogprgBk5WOS3cpg:+z+Z3/C1
- TLSH
  T1B203FEC1A3616FA5E1D40E3A2CC9343385042DDCD8B4160ABBF3E79765EA221577A27F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral7 behavioral8
- Target
  README.txt
- Size 328B
- SHA256 d8382769c7f84553ee7d12f15eb21503c367051e5ec8c11d95d7185968d4df7f
- MD5 bf8eaff152017b320698a46b1c41041f
- SHA1 9e46263759856380693e42005264e6b4745b678a
- SHA512 e2ea41ec733933b41ceb520f0d30f5a6ebe773d7af1c220656c30ea37e8a8e58aa15538152e97d6c48626c7629e2740956f08c796c01638bdaeb8a7b8514158b
- TLSH
  T1AEE0265B97828533322525459EC435E30B29201A3B56A898A04A900452E2A33476FEDD
- MD5 SHA1 SHA512 TLSH
Score

1^/10

ransomware
behavioral10 behavioral9
- Target
  UUU3021/ESCAPE THE BACKROOMS IITEMS ECT ECT.txt
- Size 2KB
- SHA256 71f7f5ab7f5bd96633e3c3e479824bb6817494cc248d5c40d1bdd373e8d51a16
- MD5 8bf2cdafadf463a3b149865f352cb67d
- SHA1 d95f8fe7d8a1cd85bc5bfd44cc052956ac2f57a8
- SHA512 0e1abb0c52012e4901e3bf2b9070512c9aa4a96fd9aa371bb9286dea17cad61848bbc8d79f6c7d0e4f9e6b518ec91466aa5f445ca6357cdb17333698730d56a0
- TLSH
  T13C519A6423FB5782EACF30FD23F389D600D195048B22F462B9F5191BB57A5420EB85CD
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  UUU3021/ModernWpf.Controls.dll
- Size 373KB
- SHA256 3456dad94463e71e1ee300219871172439a49c9cf9ff3f67109aeb755b5c35e1
- MD5 d79d1ee499d420144f9f8a2327d7ec0d
- SHA1 6829f3fd12dceb1f5ed82d5f6f91f9723506451d
- SHA512 04c967408a948cdda989e3914084d15769b1a15b01c185f07282a1e863598d67b3efeabc9ffaefa4f01b8078db07948a00ba4bc5e80e2e70c8f4deebdb422397
- SSDEEP 6144:5pbkqF2YeqPqlaiWlnAMZmN0W+9is5ZoK6Lg+L8gigMUumgSH4b:0qF2YeqilEnAMZ26gigOmgSH
- TLSH
  T17C847CA433BC0535CAAF577990755414DBB5A88323EADB1D26D66FEC0CCBB024B112BB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  UUU3021/ModernWpf.dll
- Size 985KB
- SHA256 9c5f0b80fd4b47c4d6ee4b17558c234fa1bfc3a3dea05260ac9a41a9dbbba9d7
- MD5 85b01ab1a579c52563f7ca8b750658ff
- SHA1 963e7d7c734203828c4e2c5569eea0d895c1c17d
- SHA512 8492378286d23d4fba816ca38e13ff007aadea522555f9dd03d900d4d5cf29243e6ecba50bcc6967cc158c060d92ca91f166e5634267684409e3869538820509
- SSDEEP 12288:QSv4w7pPaAXYqD9J/ohIrksBi7cNfak15I37TLO4aI37:QSBlC7qDL2PsBi7cNfaks37/O4z37
- TLSH
  T12725297073A08A74D3A35A7F6668FC146A35B8656351C60B36CE3F3A88C61510B7BF63
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  UUU3021/Readme.txt
- Size 4KB
- SHA256 c1423fdd68be3740890fd1ade4105d9dd9010ca06d1e9610d0b4663811d362c0
- MD5 c0a3026e53da8f2151bc08d273e6f5f9
- SHA1 9317b876e8761c8a7072104fedb9a628590c06c6
- SHA512 e6d18e3bb38c49499a5f6cedd4eb405371fc73140a987922698763008be371772da0d0d0690c9ccfca823fbef274e75dfda149bbfe0409e33321b5b93f17aa7b
- SSDEEP 96:JaxZlADFeAajYcyVaT/klJFM+MUkn9R0tZmefDSV25AGT5z3Jb7bLTQ:qOeURVaT/Iz8AtZmefDSVtGT5z3JbP3Q
- TLSH
  T19991942F9E05533304E29262824EBBE8EB22856E573695B13078C03D7225B3AD37F4D2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10

ransomware
behavioral17 behavioral18
- Target
  UUU3021/System.ValueTuple.dll
- Size 77KB
- SHA256 d6fb0dcfee1490a8168117ed1b55758f11db38475417b3668d19f89dcb55cbdd
- MD5 99cec77dbee0ab10b9fc4d52a1d414be
- SHA1 c83d024e80c36b663458d478dfdb067336e2d616
- SHA512 988b0ff9ede87fe7538b2e0cdd684962965b4fc2a4f0fc92726248f249cacb7c5674f3978d2d7cbed68991c71e0b0339d6edda57384097a4da8efd7d77b43cd9
- SSDEEP 1536:h784YWac+abptsy5VyYc/9n1RcGxzeeUVn9KyQgHo0JuresehaA1VUF:h7N1r9KGI04CCAP
- TLSH
  T1D173E82C23583653C73E843318A699C7AFB8D30BD74657BB7DDAE5E818D2374A302664
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  UUU3021/ToastNotifications.dll
- Size 107KB
- SHA256 ed1297117c8dba2b3880246721af5b74c6ae16d745bea176adbeefc1ee75f2fb
- MD5 ce4c69d4ba73105bf8eff333ff8d265b
- SHA1 28549362058bce91dcad5a13993f4f4b26f17530
- SHA512 adc3c6f4d6a70814eb665039f2ee8387522475ed90017d72a37a0a381bdd3d5dbfd2a5cf26afa01f53d0bc312ca568ebdb7d245cdb21f0808d021a92b450b624
- SSDEEP 768:ar7hqeNzclb+af/wFGfdpOOJWOQE9/TBLW/Uwm:ar7hqeNzclR/CWpKsRBLW/E
- TLSH
  T160B3E78523B65DE1C9663FFEEB4DC2500B299F80D4C99741777838284E7A61FCD122AE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  UUU3021/UniversalUE4Unlocker.dll
- Size 1.1MB
- SHA256 fbe25869c37522651cd1f0dde264a0c3cb035fd70200b55028501b0986f19519
- MD5 0192098d333ee0456668a94ff75dd866
- SHA1 519b9f6af3bb7430c9672ec390ac46ef73a1aafa
- SHA512 9b0b0baa5e6ef5a998d29cd76c0cacf540ca6aaa60902d6d4ea58283a0ad53023069e3692943f297a962047a93594845f0d1b04ccb63b8de5abca3fbd02a1d31
- SSDEEP 12288:5PMZsCVf6cXFRwTEhBzWJtMmi2q9MxQ5RZr4EuFww560Vu7pPJh4vRy+aEFX+ecY:lMZ/NJdYd+ecxq1xD0ps8VuYdeICycs
- TLSH
  T135358D1A729841B8E17BE17CCA974A46E6B2740603259BCF07E447BE1F277F11A7E360
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  UUU3021/UniversalUE4Unlocker.dll.log
- Size 5KB
- SHA256 cefb6f16b73e9c3696f0ed2d21f6c2528c88f74d61549dd5170db81162cd18d8
- MD5 ad4c25121714a3f93c3eb7049273c1ff
- SHA1 95d3b3d82ac6c608d0b435b0eb36fa7c16233324
- SHA512 51c8d3856f6051a80114144a0cb43f383888b2c6e404a56cb9cec10b1f3b1b011f65adfb4892926e13da7c0247af62ff120dbb8d5e6b72249114484ba7000f02
- SSDEEP 48:pRehWIfp32GsTidQQRySU89nk2JCa882LKlWhauxGxqxtGwsMALiW9n:2hWC2ZcJCc2LNh+oMwspn
- TLSH
  T138C18F1566E2718F75E3366B19403FE5C86DB36B0954028FF883F3CA15FA06E8B0A755
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10

ransomware
behavioral25 behavioral26
- Target
  UUU3021/UuuClient.exe
- Size 446KB
- SHA256 22431a11497a177fcb5aa362c7a7a7eb21e1c9a27015233f750a24abcbb730cf
- MD5 f27ece59b091a854a1a1d94eff3f27ae
- SHA1 e5b0260fafccf5c46cd066d70e2f608a39036b88
- SHA512 c06be34e69f9fdc92cb4c98d3c60cd022f779f7fb155fb4f26eb96df50b0433bf8e25d904427f68ce334ef1076053c336753aba5cefac2273673c5187369d646
- SSDEEP 3072:4r7fUiujm4LRk2sdVCx42LNtu2ykNARuyuY4YrMR2nR1kwGZPWMaQiDr:mRIUjCxE9kNAcyRMPRZ+hD
- TLSH
  T13CA4615ABF380612C56B87BE51E02947CFA65FC12F7AE54975053CB887333862602F9B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral27 behavioral28
- Target
  UUU3021/UuuClient.exe.config
- Size 614B
- SHA256 8841b21c5fcfb1a27a40d928dca98c6fcae3528202e4834dd9431fb80397f649
- MD5 8c33c8af4d492ea3816643ee506e6774
- SHA1 d1d78c4b4a45cc8549cb79134fac79bcba1f304e
- SHA512 64245aa007c400ce37c39a2defa9cd174bb588e6a1971fcdd2e14ae3f87ee6024df2ac421b11ae2d07067ebe8535086341538d5c59e5e2b7b17ab196380ec696
- TLSH
  T1FEF0A2082E04EF7759328A2B68625650DFB92C9E743520E8F46F62162F1500D59033C1
- MD5 SHA1 SHA512 TLSH
Score

3^/10

adware discovery spyware
behavioral29 behavioral30
- Target
  UUU3021/UuuClientSettings.ini
- Size 1KB
- SHA256 eeb351d45ae8178a93bf4c9e75f4e323462b9dc5f64f3171baa590d4e99c3908
- MD5 f7959ccc26a8267ff3691017f690b8a0
- SHA1 e4d09ae28b3863a8fec0618fd3ba03118fbd7ad3
- SHA512 212d57d2f5126de27a008699653e9be1e98c5a4c33522395cbe4adf83e9cb0a8ce29be71832cb43c9512d199935c93d9363e306f23983d71f4e65ef871e5c4b0
- TLSH
  T1D82179CAECA012242AB50E5DDC78A14217D82927980F183DF6865A3FBB5C9957CBAC1D
- MD5 SHA1 SHA512 TLSH
Score

1^/10

ransomware
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32