486a7ab81b9d9c58533833089b30d8ec48dbcba5955a4b008cb5e8f4831d2747

Sharing

Copy URL Twitter E-mail

General

Target
Funkin Of Heights [Psych Port].zip
Size 115.9MB
Sample260628-cw2yjaey8v
SHA256 486a7ab81b9d9c58533833089b30d8ec48dbcba5955a4b008cb5e8f4831d2747
MD5 9293b56e6a96689e743dcb6c889f0f1c
SHA1 1845055f157ce39eac9bb26ec095dd6f1c202623
SHA512 18ae3ddcc0526f7353c91b62c1ba19bf6b58d23595392b44ba336a369972ce2b70f1a80e95a2ea5987ed16d566618c15454f72b83695fafbfc05a482fb851818
SSDEEP 3145728:EkYLJtzIXMWmTrB1ZI9zTbLxh9fdZizK268xt:WtEOT7qnxHdZK1
TLSH
T1654833939B425EA7D44FB5F5010B071EBC6C9EAA7792888715D0B53848FF820ABB3D53
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Funkin Of Heights [Psych Port]/data/noob-pico/XF.lua
- Size 901B
- SHA256 9b08bec8c2c146d126074ad0ffb11f9495d6b9e133a7f4f3aec1cf260c389952
- MD5 4e8462ad0e0a17cb24fb201852409795
- SHA1 05cae55d210c8105cf5cb18c30f394e7dcb64d62
- SHA512 1b6e4762e7cfc0c0916fb47130a0317a7fba34ce3d981639117ac463ba802581306e27f95d094738b14630c9a20a6124c836a554096eb256048891058c15ae95
- TLSH
  T1E111A7AFE0C311A440B3853ACC17AC15DE22E49BD5B2D541349D544A5FB0658EFA2A94
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral1 behavioral2
- Target
  Funkin Of Heights [Psych Port]/data/noob-pico/noob-pico.json
- Size 26KB
- SHA256 4dc0378315f41cff81f360f51577b2f00c07f8dfe3f2351036014b8dc5201182
- MD5 bf232194ec6930782fa3e2357a70a900
- SHA1 1c000de71f2fbca1df1109f2f049d70984f78c71
- SHA512 80b37227510b2e12507d921942c4bfefd0758b562af16473de929e7b9fc94eee3a4588c45b10d8034a43c6da9e7323204d64fd4fd2c0e8b79dc7cdb4178b64a7
- SSDEEP 768:/NnWLzmXUc0NOHH8Ht/9sssp+Wz3pwStmFjUHTMbnbKC+VO4/y6tNPKJfrFvpE2z:m
- TLSH
  T1C1C287FB1343677FF1D646A6E3533D480E34E056776C2EC896A966608FBB4DA302580B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral3 behavioral4
- Target
  Funkin Of Heights [Psych Port]/data/noob/noob.json
- Size 28KB
- SHA256 cfd801b0638644702bb852608b2263ae9249ba471549847a6ab2a022d5ccd44a
- MD5 5633e7529c060ee9b1f7af98ccfce4f1
- SHA1 c5f8aacaa1167d8c0b084e337afbc03387816fe7
- SHA512 030bc919954402da2241c82de29e615b40b88bef3971a92dd0990eec96b30522d11f9dd0cd30d09859277aab283b4c38b6d3ec725d9cb3d6a36eddc0db3c77d3
- SSDEEP 768:EMVOViUJNlydnflC4cEqCh2S1W+2uD1WmyvVz3tMDZX2l+VcvpHS5RBSgor5D+E+:Q0
- TLSH
  T158D288FB1383277FF0D646A2E3533D540E34E056776C6ED896A962648FBB4DA302580B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral5 behavioral6
- Target
  Funkin Of Heights [Psych Port]/data/roadblocks/roadblocks.json
- Size 44KB
- SHA256 c33e938009f51eb822c784146e6897295007b0795bfb6090e8de3c7684b711cb
- MD5 067ef0a66785f58c874b30c6acfe5917
- SHA1 bb3ab8b6dbbcf96331331cafd5ce307421326139
- SHA512 ea2db5f1ecaedd40e311b9be96e17a0452f22672c99af2e4005496b538110dfe3f53dcc22089d3e0a9f595185650a6a8cd47a24700ca774a87be37e1fa7917f6
- SSDEEP 768:EtoOqxdM+3ati1OozvGuRllNfmTqL7BV4SnNTKVKBrQlyCoKQExt5dZsEdvKKQwx:tjT/2eLI
- TLSH
  T16B13AB3B235370E7CD4646A3631A0D853D342357B4BB2528EEF6BF398E595DB086580B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral7 behavioral8
- Target
  Funkin Of Heights [Psych Port]/pack.json
- Size 238B
- SHA256 38ae3de06eea853c7df84250ee43e6150e78188963a58e6ce76c4e714e0b3d87
- MD5 a061500226c7eca5c594bbbb8fb9d388
- SHA1 3b72e900782460e4fe685b68d220e4cb98b63f78
- SHA512 36d0b9b20e54531b8af3933092cd3cb603ff75fb57eccb309d535d207d240bac5d1da831151dc5adbb246b3d406db0a283e56ccfa13788b139075692466b12d0
- TLSH
  T1EFD0A7B349D0741BE7A8495C0D3B957B2B00024DB029288474853D9EF1BD9537512E45
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral10 behavioral9
- Target
  Funkin Of Heights [Psych Port]/scripts/Preparados.lua
- Size 3KB
- SHA256 08430a6c453edf164fc98d501b88f6b937440b23ea8608546e70be6279c7ea04
- MD5 ab921aaeb1076b3842997a866d1fb3df
- SHA1 bb7c1addfbdca3b85ac6652c56c0b4d0f705a56d
- SHA512 31d7c386026ea9a453d72c385e4abe4f52698df91bbf34c6f611ccd86b6cd3c8d421bee2ea23d77a55b22500321b0bb28b776c34c93a8f74354b49abe8acb368
- TLSH
  T1DA7186768233366CB836803D7821A1264D2B2431CA39B5ADF796D9981AD013F4DF1BD2
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral11 behavioral12
- Target
  Funkin Of Heights [Psych Port]/scripts/UI.lua
- Size 6KB
- SHA256 118d6689fed30a268d6947c1ed1114dfe0f24c98689229398b43290d308bc0bf
- MD5 5a5cab727f33d6ff74c5e168e0e5c40a
- SHA1 fab8a99e0095d8cd96aea353d6c394a18749ac51
- SHA512 b229c6a9a7e44a92c5f3760683f820532fb3f52dea38206e564b9b0118121b87b60ec9c37cc9991bcf87e5b612ba638aeaa23250c1fa5e3fc865c9c0d4a9e3b4
- SSDEEP 96:Q/56OBCIZWF74z4mQk+FfFr4FOFuOoxxqZ5PAJ:Q/LM74UtrIqPoxxqZ5PAJ
- TLSH
  T19DD1CE12254266EC14FBE5656953BC05D70B0063EAB1C66AFB1CC2C05F7834CA8FA6BB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  Funkin Of Heights [Psych Port]/scripts/characterChangeShaderFix.lua
- Size 2KB
- SHA256 db5e447b7e00f744be937b55e6b7f8d4f00f94c1de62bc9244d940418868e9a5
- MD5 e116677aa695fdf73f4fc97c482a7d05
- SHA1 641082530d7db7062281c596514e7c8814434a3a
- SHA512 a125092a5c1a53ea52937c957e7913a227dede4e74de56e983c144041e42035c46b173fc12722165f52ea453bd8665eb97a3f9f773f3bca5626ccd7259939c7f
- TLSH
  T10551CC2939C220150A73931D8637EC05DB765393002691D1B8AC6BC93FBA1ACD67AEFC
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral15 behavioral16
- Target
  Funkin Of Heights [Psych Port]/scripts/movecam.lua
- Size 2KB
- SHA256 2d2e11deb82d2aba1aec44c3fbe6fe299e7487b3b408c01e6035b4ae281fdeb3
- MD5 e3e8fa4167181313762314ef721c27ce
- SHA1 51aaf17e7e4ff129a3f26bf470c0d168ce74b7ae
- SHA512 099328c6afc2b18f163bbd276a7499eab3704fd8ca54f6ec7a1d5c546e0ff69080a53ca6c5cf98b43e66c17b080a6dff912e42a575ef0e18a794e6ebdba91876
- TLSH
  T1064166EA361E5116A8D04030AE735CA4D11B85303CBD51E8F7E48FE23478A7C8CE6E76
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral17 behavioral18
- Target
  Funkin Of Heights [Psych Port]/scripts/🎋🎋🎋.lua
- Size 2KB
- SHA256 8e1c05abd76633d4ad57e19bd561d5a3011c942700062da6a0c42ba6ee54ebf0
- MD5 707972b821d9c47c6b8694ab1b7a81a5
- SHA1 ed30e488bbec88d41df43acdd8728167d24891fa
- SHA512 d088a12c7854238ffb6417155ae70233415581ab473e5ec0433ed76a08af90d1078066800175fbd857c8bc0ce3a4ab3e282cf225a05a7bb4e6e34262030a0d15
- TLSH
  T1F351646625472CA5ECF6072665A65C08C7164111A3B1C715BF6C83E99FFCA1C823AA7C
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
behavioral19 behavioral20
- Target
  Funkin Of Heights [Psych Port]/scripts/🎋🎋🎋🎋.lua
- Size 458B
- SHA256 5cce004673fa22df76933a2af3ddf7f6a694569424be95d322760e4bcd71f9b9
- MD5 2fea50924cc9488f6f4266dcfb7ce79f
- SHA1 e9259e06c7529e9ef972384249b75f0d4245a233
- SHA512 0b04f8d0e66c5abb5c7dc6158ab1e0bdd3cd43ebc0ad0e90e21f7549c2f215ea613adc128fbead88f4ced76aae04f6f2c20820695eaa8a9a2d3ca2047f1799f4
- TLSH
  T113F01C1926CC29A496C1D25C3D12AA05C96E50B81FB9DAC9FF21E244BACE21C105F673
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral21 behavioral22
- Target
  Funkin Of Heights [Psych Port]/stages/New Folder/gay(1).lua
- Size 1KB
- SHA256 1aa3d0d82f346696fab186168643c60694a5873d681696761da4fec7f715f5cb
- MD5 f35d1456eaf7fe12ad5646fe508c6e69
- SHA1 f1f200497c4a15e68a27a635e07b1c35060622fe
- SHA512 3e63aaba16e0f705699cf4d4a299cdc22ca94133fd6cd0c7813ce98c6c4f2c13b26d8ea071b05a8d16c4eebf85ec2a798cb142847490c632f331669c4813d35a
- TLSH
  T135317E1AEA4F488812F7918118767D81FB0A107B59339B7B7F259ADD8F78C1CC9B1272
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral23 behavioral24
- Target
  Funkin Of Heights [Psych Port]/stages/attic-pico.json
- Size 369B
- SHA256 2a5139f50e682c13d6260dbf0411b6a7b5ae8189bb9931e10976914d7a22c5e3
- MD5 d2692216203dfda7941ebf95f7de8fcc
- SHA1 d2ec87114b8064839f2565198ec5cf694f11a658
- SHA512 20207bb22d6539198c2ae7c4c19ad45ef8fc4e2771061eaafecf27a1878bbf5d5a5769457e891591ef58f33dbdbcb5172be19feea07bb9673c5ff4c4d07dfb9a
- TLSH
  T15DE0200513CDC02BE785CA119F3E5CB0146044D719C54C84BF9C7D38D62502311DBBC9
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral25 behavioral26
- Target
  Funkin Of Heights [Psych Port]/stages/attic-pico.lua
- Size 803B
- SHA256 63b017e047bed8ff292180a9676d664d199e497931abfbdc24564feb2030f5c7
- MD5 fe2186dd33766c215d1d0ffc737d6f8e
- SHA1 4319d44ae7aeed9a45dffe7bc0aad15dd7e650f8
- SHA512 dcc0ebef1610321deb1515fd38af1b9940defba60997ae814546b194c92dd34b484cb25975f314c0069f8ac5c4cc720e676d1900d23df25a4f8853e536e17dd6
- TLSH
  T1D8014C6A008345C455BFF7E5A563D005C949004BF333C4D9B68EE5D66F700F58DA0DA5
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral27 behavioral28
- Target
  Funkin Of Heights [Psych Port]/stages/attic.json
- Size 292B
- SHA256 a18673cd2acaf069ba94b6d4e40825c4d9926644f1437f05b6c0a2d57f91989f
- MD5 626953a4c68e9b922dfcb04e6cb30140
- SHA1 fb28133a5643bfcf43920cef0b62c13eb1b0bec6
- SHA512 a419f7d11dc262469f5d5ef527c7636644929e7df2dbd049611df919259c33c9ecb1deb076063a9e22f79ca08067adb9dc655851c8e149dc3f4d799d8d443ec1
- TLSH
  T179E017041258D0270681AB1D9FBF79E121F58CE70ACA9C14BB2D4C3CE618033148AAD3
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral29 behavioral30
- Target
  Funkin Of Heights [Psych Port]/stages/attic.lua
- Size 1KB
- SHA256 52375a95e8a8e414bc44983006f7e4c067dbbc165df981f77d5f4f7a28297227
- MD5 5c8c83a974afee8e508aedb82e1ea61e
- SHA1 34787f6d5ea092bacd9407a4fa5dba208af9266d
- SHA512 314491db820b7dd6aa70402d05d7f07b17023de7ec7b3df571be8f0fa43045e53afaf76a98a7426ec43fbdd3cb2ef41572c5f63c10e68f4841edaa9d4b676baa
- TLSH
  T18E31377F208B29DF66AAE9A9ED01DC17C56D201AF739F4B8D752D340E8000AD4C6DDA7
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32