147674a45d1f5b2fff64a4e687a17b4fa70111f43ed1a18f8fe4f78283f0cc7b

Sharing

Copy URL Twitter E-mail

General

Target
HS0.2.7-OP.zip
Size 349.8MB
Sample260628-kkpg3ags2z
SHA256 147674a45d1f5b2fff64a4e687a17b4fa70111f43ed1a18f8fe4f78283f0cc7b
MD5 471d91912c9006dc3dbe549e9d2ccc58
SHA1 8d69a6d1bf3310badd5ba66a8160d700398a7383
SHA512 b2bde08bd619f80db1751dfb36430987b2375c7c1c2fd4b043429fd70e1e180a14b0bc0df888599a73948926582beee280f02fb95797afdd97229298f9e81a93
SSDEEP 6291456:JtlT1QLF+ayxShQvPLwB2Oj+/JhKhihghVdy8kLmxAwTRSpNKtsA/7OAFlvrZH9F:JP6pt1hQvjwB2nxhKhihghVdy8kLmxDL
TLSH
T18E0933DCC3EFAC7AE597ABB5746F1804D7F47263677740219B29E5808A8F371881A702
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  HermioneShop/Game.exe
- Size 2.0MB
- SHA256 b2fe0f8cd0adb1d221d662e5f33b36b8245413178d8986b0d6dd3c42fc6d78de
- MD5 f760c2f862cf7d98b570bae41364e05d
- SHA1 e318735c83ca25fd4e7509eddb6fc0f2df90fc2c
- SHA512 6e759cd0b0f038e1c1158d5b58dcb5cc5c90e3ef85124010b55ec5744bc66b0cc74441ccb552402882af5d5f3ba4684c5e33d70889e0d2a930b3e0438c95a65d
- SSDEEP 49152:uMKeLJ95d90stngnOIoYcGfXZRcu+CsT1mTvj:G+sSuJj
- TLSH
  T14DA56A07A65504EAD199C078CF06D135EB71BC494BF5A5EF3190ABDA2E37AE03B39B10
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral1 behavioral2
- Target
  HermioneShop/credits.html
- Size 4.5MB
- SHA256 d9729b75ddaac7b9b21c62ccfbfbd12edb0619ab04da3d0cfaf1ff31e77dfc41
- MD5 9831b9e75e0208ce0dacb6db23d4acbf
- SHA1 065886a77a6eafac21c5c297bfbd4d2cb50751b5
- SHA512 27d57e91c41fd4cc000622daa7a404f9ff40c95589f5ced7d7beaf5336b4480ef1ffe972928794c76fabdc923b787bd6673191e1c5a1815d74b9438695637e99
- SSDEEP 24576:8wEBqmnLiLIi2hrErjKvMPkUoVAwurQBzun:VcqmLAstCuUcBq
- TLSH
  T17126D56BBB49037306F282626B4AA4CAF31E903F375A1514346CD15C2B7B92583FF69D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral3 behavioral4
- Target
  HermioneShop/d3dcompiler_47.dll
- Size 4.3MB
- SHA256 44422e6936dc72b7ac5ed16bb8bcae164b7554513e52efb66a3e942cec328a47
- MD5 7641e39b7da4077084d2afe7c31032e0
- SHA1 2256644f69435ff2fee76deb04d918083960d1eb
- SHA512 8010e1cb17fa18bbf72d8344e1d63ded7cef7be6e7c13434fa6d8e22ce1d58a4d426959bdcb031502d4b145e29cb111af929fcbc66001111fbc6d7a19e8800a5
- SSDEEP 49152:aYlc/220PPiMLKam+VMrLi21f4i3jn5ZO3XUDmOZQwVd2uQpN3WsGVUWd55i/jrs:a6KD2Mrdaix4NQnLt
- TLSH
  T16F267D5677A840A9C27BC178CA574313EBB1781403349BEF55A0C665EF33BD26E3A728
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5
- Target
  HermioneShop/ffmpeg.dll
- Size 1.7MB
- SHA256 44917512b58d193b4361f2d07b723346feb7bc69f2b0ff51002b3c76f88d0f71
- MD5 f2db31ad12fd16c5359ac583181fbfdf
- SHA1 4721511f6b0294713032d3c3be82e638f1084e06
- SHA512 17ea72069aa2a601e4e5e2ae433d529796f153dbf1cd2d2443cd2b514ee7bdc73af36ba1fce2f54b74f2e4a4148a2e51dc2bae7b8b9fa4013fd3a9392497437a
- SSDEEP 49152:4pvlwTaS4rzi865zldVJQSJt9eJACdcVEhM:rTaSczQ/VJ9enf
- TLSH
  T1D585AE07F2A505EDC06AC134879B962AFB3178494B246AFF17D0B2293E77BD05B3A714
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral6 behavioral7
- Target
  HermioneShop/js/plugins.js
- Size 34KB
- SHA256 1d8905dacad326311f288da30b26a025e8b4882b8e200061d1577225afec2933
- MD5 14867025f472eac46d44144a336716a5
- SHA1 10648061e362bd8d12cf316a2335934414c295e1
- SHA512 0ef45c9c993e1ea3fdde49bf93426b2f06ba1f07ec05fe7abb850aa8537aa2edb5b370dd856594cc64fce7c00b57116f33570c9985d1114a4dcbb51c2ad36d44
- SSDEEP 384:OsvX3M8OP0PinBnAYuGtufw7UW6TGNGZTwZ2DMB95oQ7x1/YuOsn6IKQ63tPd3V9:SZyiRAKsTGNGZcZ2S1/Ypsn6IKQCdRV9
- TLSH
  T144F275520741DCBD918A8719B83CEF197CBE07FA398E0A926CDD5C2C24973B9D71721A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral8 behavioral9
- Target
  HermioneShop/js/plugins/===================.js
- Size 76B
- SHA256 d19d035af4530fe7053f70e6be9ba80abfcd608f78d2336880d355684440eb4a
- MD5 0f99ac3d333727d5058480dbf501bd6d
- SHA1 a1e671fbbb0102dcda895f2b5dac0533ed1e9ef9
- SHA512 59b1361f6ec51b77c4aa79555e50816200239452b8ee56b69fa325cb8cb0457e1fc66f97f44111626c634f5b77ae76d079c1a726dcf3c8fe4e9f27d9a5df32eb
- TLSH
  T1D3A004500F5D10D113301C1431F11544D01517C14353505D741031101C0774101CDDD0
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral10 behavioral11
- Target
  HermioneShop/js/plugins/ANTY_PIRACY.js
- Size 4KB
- SHA256 a254a40dbd96c8ad13583695dd1cfb52f2ba3c0f050fcc635c91feda3c02e6e1
- MD5 b9b5cbd6856ee10d97a187ca54b029bd
- SHA1 4c2361fccae221135fe5d9d51635ecff6204c7a1
- SHA512 6a92bcff4b72df68bd0944fb03197052294b05420c63cf326563ad741f13882bf0c8b3bab8d1d30369d9c4ef586130dcb5b24f5feaf5c65ca2c5e81e7eabe500
- SSDEEP 96:oxVroxfaSQt8ndv45FU/Fw5R6owGz7VaLSN6aK4VE54:Zxf3dA5+/C5tTpaudm54
- TLSH
  T14691E96B36A8533B0066006AD61EC9DEF7B7943C424520A4797CE16C27F97A1433E6F9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral12 behavioral13
- Target
  HermioneShop/js/plugins/ArrayAnimationGif.js
- Size 66KB
- SHA256 dff586f2882bd5dd6f85dc51b2b2eb1a150bbe381796e1f30eed34fd03a17530
- MD5 26aacffba337fd978a7a6a7ee962b8fb
- SHA1 625d73e69fc13134e9a2201e553230b7f50c3d6d
- SHA512 d2114bbc6a2f388d46c35e6cb9288c846eb4fe679a58065b952d4b7cc9fc5d87c8779e9e10d416426e40c97f93c4a1a697d894db6b72403e46e56956593c5b33
- SSDEEP 768:+w0FvBz62tFQMeXYJti2lvBsBkV4f/Ys89Y+PH2+AzVYYJDC077mBdBjCe9GGaqp:GnIISatAf5EB6CGCbtslrlB+LhlUl2
- TLSH
  T1C86385107FD0B850239F4FABB22371E1EE79099EFA4426DBD1147D39A903216FAC6532
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral14 behavioral15
- Target
  HermioneShop/js/plugins/CGMZ_ConditionalChoices.js
- Size 33KB
- SHA256 9f4ec350df3ef21b1127bcb2e7a3d1d7ff569b58b4badbcd24493a736e74025b
- MD5 648f0069fde305eab5af4a81e47e1f2d
- SHA1 b37f02c62215c13ff0142d2a4a55a247a2df908b
- SHA512 4139ab4d2b1b3f04d8cfca7c0415a22993f9e3cc7890bc40d53bf8458708f0ca105eac8673f8b4b44e29aca60afab2a9d6001abeb22edf8646b46663dc4df3bc
- SSDEEP 384:LUWZny4txJhguLs/jejOj7cUQ9uKBJWvYoYOWovMEhrN3TWQzdfxRuNz+hjzlzD2:LUWEWmuQuUDCEDcVt
- TLSH
  T149F2EC3B3D0CA22301AFD12091EA98D0E3398224BF5A159CB99755742F77B51BE2FF61
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral16 behavioral17
- Target
  HermioneShop/js/plugins/CGMZ_Core.js
- Size 187KB
- SHA256 eb9a09e92312f58879026cf3baf47129281ad0730663cfdafa7cd04511e94a35
- MD5 a2e2e3fc3955475b3ccf1108bf64fb48
- SHA1 fe1c686ec5418b3f93eedf8c8587ea2122a6577c
- SHA512 8e8156b30e9c9916354deb0c02c51392f9221ff051b89c66f66a8560800ab1741c20c52a30ab4763b6530a9c4dc34865207ac602f5c75e8f9a3860a598a9063c
- SSDEEP 3072:EFVxUblxBifa2M+w1YOD2zx+JkkjL2ntpG:E23DakjinbG
- TLSH
  T10C1463163E68A135C2D1F2A8923F4A09EB3B8178B755406CF48DC5D82CB532A4A7FF75
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral18 behavioral19
- Target
  HermioneShop/js/plugins/CGMZ_Debug.js
- Size 137KB
- SHA256 c820f115d2967ad588c154bef1ea6dfb3d43a342c1cbf446c829d183fbf1a384
- MD5 477b32db49e12e5747eb67c4e2ef1762
- SHA1 b05df095ec7ee5c65341d67bde8fe9f1e7173b60
- SHA512 87a3fab6710be65c8938b6e64500e9132b8b100038fc3d7f3e85b89b32bec97678e2575ac4ff64c35de74e42fdd01cef9cce80139af827cdf88732da6e396c30
- SSDEEP 1536:PBXq4Uq8zVoqXWZsdSIZ4ttVOQ3UPM2ZCp:PU94tsY
- TLSH
  T1AAD353217FF56231C0A4E67582BF1B15E77B12787602568EB49DA088BC737834A2DEF1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral20 behavioral21
- Target
  HermioneShop/js/plugins/CGMZ_QuestSystem.js
- Size 216KB
- SHA256 39c318b7662a12453209a4b89cd4822377c7dbd7842511f3fa3e44db9ca15f5b
- MD5 a0918151c0555080283fc98473bdfb20
- SHA1 b3b30b2be8eee1f272ad081ac65e895f7625865b
- SHA512 cb5a1ac0135da89d2b9aaba8fb8a59e89035a250186eb3991eb8831a00e474db5b89e4c3646b2b1c63b2b62b122c1410f0c844e75ce9365800d57860bed4890c
- SSDEEP 6144:IBGTMPWR9UtN52kOLDL5ACnsNQZ3BSaSQr6BOqrB:oQR9Ut/2kOLDL5ACns+Z3BSaSQr6BOq1
- TLSH
  T1BC2443333F78B23451A1D265167B9B27D7261274330265FDB4ECF4C49D2B3829A2DEA2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral22 behavioral23
- Target
  HermioneShop/js/plugins/Cyclone-AdvancedMaps.js
- Size 52KB
- SHA256 cb15aa6d20729762e51ab99a9620e4d3c90e4d6bdeeb0e3735685445d93a0d91
- MD5 026cc265662dd78ad0d1d7cc594e781f
- SHA1 dfff26f0813f95ad2a5598d77b0431f27b8264ab
- SHA512 369d6dc519a2ea7056643dd28ead48a97032bf3dc790ba18091c8f5c463168f969547dbf43cb06ff8f4897cc51c15208348ec942bcd1fadb2d49ef63492d7747
- SSDEEP 1536:TJR+PJvtsgj+T+Z1nw7Io33xXEg7P9sg7sOR6rJ3SJC6d/:TJUtwGPI6d4
- TLSH
  T18633621D26FA40168053A17D1EEBD050B234896B394BEC98FEDC766CAF4D63991F0F68
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral24 behavioral25
- Target
  HermioneShop/js/plugins/Cyclone-Magic.js
- Size 32KB
- SHA256 4d93347b8c53a29713d08e722a48c33042ae1287595b6aaa56eabe852235b85e
- MD5 31f9a7dc3b0b2d9f8a0c01a05ad1caf3
- SHA1 c0f4596f2a79df1da3110fa071120835da3d7564
- SHA512 d261ae1f25cd8ef01aa64b195ba061154b6cd9ea3f729e891c280b45be97612ea47ce0ae28ef68966da9fbee9e2db5ad3ccb1a4a89636572ca827b007700f4ff
- SSDEEP 768:ONEL0i0CeYo0SjwiwpyaY5GEUdrCViRKn/Jq:ONM0i08owiwpm/UxCkRKn/Jq
- TLSH
  T163E2B7455A22354184B1F37D9F27C085EF2290A76616859EBEEC81A81FB1354C2FEFEC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral26 behavioral27
- Target
  HermioneShop/js/plugins/Cyclone-Movement.js
- Size 115KB
- SHA256 da6c1fa37b22e848965a18167bfbd0cdff94eb66f6ae8b311947e104fec5325b
- MD5 4a338dbef738d229cd652596a9a93f86
- SHA1 c66231e4c20947f0d4737d7a87020d0154cf1c19
- SHA512 0d1b17a3f597225ae2592e64ba74debdb289c5a3dddccf385534f68e4b74cb8c69ce38d482c10a12761fe20a85f564b8d5a1db09a91e830e09ccd38b053d748d
- SSDEEP 1536:fNVXgpT6so1/R/LtKBMblR9P8l0hogkBswnWUWTKBjzwib2:fNaItDbn9PpXJUxb2
- TLSH
  T16DC3308976D6A0264273B3799F57800AFB369527290A516DBDFC82D43F7142082F2FBD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral28 behavioral29
- Target
  HermioneShop/js/plugins/FilterControllerMZ.js
- Size 183KB
- SHA256 7bdae7e574712cc78ad9e3a0035acf85609150c6f39ab9bc480bcb2b851719ea
- MD5 38669f2e94c5c36a8498ade06762b364
- SHA1 2ebbc549973f7461e2d9d0a62d000050182191d7
- SHA512 248fbc3668dbfd00ece8d918372ff1440a41936060512f96a60661342c2212fe7825a6dec9146c6840d3a51776d713ba1655a46bd085423000ce61eca4cfb8d1
- SSDEEP 3072:nvGpuLxuvOX1X+GO/M2AoyhSlS9yoAS5XMRQ9ujjqfiAaOYngVM1Fep0RoLErldY:nvbuIX+GO/M2AoyhaS9yoAS5XMRQ9uj2
- TLSH
  T1F404830D66FA11315A03B179EFDB91186531318F2842EA293D4C93842F9E52CD7BAFED
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral30 behavioral31
- Target
  HermioneShop/js/plugins/GALV_CamControlMZ.js
- Size 16KB
- SHA256 dd4949d8287f8c5e1045891c6c97b199956a386ccc2eef284c9c1e65ae470173
- MD5 d2626561f965e08d57d0acd8a27fc33c
- SHA1 61f7025b8f09757a1495ff77b5523c25aa0a5da4
- SHA512 2f8abbf824518f195b6a84257be047e5571dca35c856d1d9ffc1bcc0f30e39c63a44efc2ef57449866d542f98ef893e048a99c5285c4ca40cff01980783a130e
- SSDEEP 384:TS6371363DvbCas9npf5skVO3rLLuKiK8:TwDuVpBskcLe
- TLSH
  T19472A55C7E5A80288079E1375236E604E63C526AAC02762E745CF1BC2FA657C463EF7F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32