c90c8693e6a9252f4e62713477000a2049b2f200e3dfd8aef482dc8a284cb209

Sharing

Copy URL Twitter E-mail

General

Target
Deltarune-AnkerGames.zip
Size 804.9MB
Sample260628-ppmw9ahs3x
SHA256 c90c8693e6a9252f4e62713477000a2049b2f200e3dfd8aef482dc8a284cb209
MD5 2e3d8d57b3a921b533d7be8b2a1aee57
SHA1 2e41e3d7ed651b998890ca5fb016faa8ce1c352f
SHA512 3978279f8b4ac920cb91545383b8072601d76ca1ec5cd90779a6733dff3d3069c8ce09b352a54058f6e8f73beb132ecfa164ca8ee0a37f81d4cf577787186efa
SSDEEP 12582912:wfCdEk3GTN6AYSBbHBhwOhxTsrtxg35+te1gZBYyDV/n8+Cb3wu9Pt1cOzRO505S:9OKG4A9BbBC0oy5Cb7Y3bL9O5w+B8t69
TLSH
T14D9933E946E02E4EF8BB3DB5559B090027DC8C0DF7C7888797E2759864FB6813E9850B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  AnkerGames - Free Pre-installed PC Games.url
- Size 113B
- SHA256 9f87edbeb25a2d74f4d28dda08c94387b01efc114c79296f271405921fb99d24
- MD5 71f27504bd18ec938b6da025cf88f36a
- SHA1 7195d5f24816e3ee617266f25992516b1ab6cc72
- SHA512 4055e560b17163c5b660c8526f70baf8f516adf34e970926f40be094d2ce007863bd26fe52d963f492186a5f51b1a4a21e1d8a2df2310fc5f4e9ea0c5cb06ab3
- TLSH
  T131B012AF4007838DD141440E4071F8488D0FF9A44ED2E0AC6258DECB4C080D6CCC4F36
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  DELTARUNE/DELTARUNE.exe
- Size 6.8MB
- SHA256 b882cc1879ad8f24c63fa6e4f47a8fef9a01065ee61ad6220beed9932b04e7ed
- MD5 7bf3cccc2e54481ced3a149e1a083684
- SHA1 ddd9992ca1ae2e7eb8f63b4b20c63b430dba4026
- SHA512 9e29c01120c1f145363c1d0e2cdbd764a50dbe875191b98839ea37a7cafaed160a654d88cfbd84b73c5e3e5cc4bea863373d2a3062205f768191fe6ccec843b9
- SSDEEP 196608:nbP4YyBOMDt0q3LM76lz38SmJPcZoOxCeW00q+Ux/agp:HE8S2P5Dhgd
- TLSH
  T108766B8632A4C1DDD167803CC55696FAE2713C41CF5197CB2AA0BF6E3F37AD409BA621
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery
- Drops desktop.ini file(s)
- Network Service Discovery
  Attempt to gather information on host's network.
  discovery
behavioral3 behavioral4
- Target
  DELTARUNE/chapter5_windows/execute_program_pipe_x64.dll
- Size 122KB
- SHA256 a594a7205f6a4ccff42cb460dfa08bb54442cb3317c7bdc0fa0437d636359402
- MD5 50c347cf03c0885d26b9118538721218
- SHA1 9bea3f10425abc7d65a55d3edd4714eeabf07abf
- SHA512 ee1e8f7ddb0d29cfd27f882ad9cd418f048b2707f869412d43332a11db18d67cb3041fab174943a1aef14a22e3879efa1d0818f552eb8073f01883528d5b2839
- SSDEEP 3072:PCkZBW7aSOC3SFFatkeLmRn87Q8uiBf7Q1je:aaWDByFatk6IeQ8u
- TLSH
  T1AFC37C5773E000BBD4668339C8A35A06D772B8520A34DBAF43A4535A1F273E19E3EF61
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  DELTARUNE/chapter5_windows/shader_replace_simple_x64.dll
- Size 150KB
- SHA256 c10210e3cd619774d63947116bd22fb3f60f2d992b21f3ffb0121393e596b124
- MD5 073bf090aedbb91c4e12fa4dcd2ad82e
- SHA1 6f55489aa34e0ec0688f53c7d849e28d368520c7
- SHA512 6b9528272bca7617948f3a578f98b272c4c876f3c0024d469b80b490e54d82d59dd16a7670bc3b5e64a0ec1fb5643fb984bdf0118532da76327682192dbb8296
- SSDEEP 3072:4Uz8MVVIwkYoAVVoAtqV+Qa2wRs3plNPWSfdx6+2U:4+pkYoqVo5na2wY
- TLSH
  T142E33A07B2A540B7D47682388953DF47B7B2F49A076097AF13648A7E9FA33D08D39B50
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  DELTARUNE/mus/hip_shop.ogg
- Size 942KB
- SHA256 62acd3d2de7e4ad81e99a2b31e40b90b1b121d93fc0c79ec724a7f1a47892a66
- MD5 3d407240e2758034892ba7b6789e55db
- SHA1 e838b6a21e5aae83a5128dabd95cefe645f44f6a
- SHA512 a7236222b68841738580bf793db341b3f0c968ba47b4ca1043f8380036d1e24aebac9b39d77e983fce6568c3e9e44eabbbd116e62f7d7024ab0406919577fffa
- SSDEEP 24576:asuGjE7Os1s564m7ImX0Jm61SPV0yHVLw7EVzDoHC/BtR:axGjE7OsO6x7Icb6IPVTEAtDoHWzR
- TLSH
  T1242533FEABDB4718D823743DF58C2FC6746EEF1D496986D18DC87E12CA7BA051821842
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral10 behavioral9
- Target
  DELTARUNE/mus/kris_piano_shop.ogg
- Size 575KB
- SHA256 289f6bbcd9da8e04f3ce8a4b11302aae96c6dbd9db10881dfc25abc13b1a69e2
- MD5 e85bb1f52b4b5b4192c11a5456d243b3
- SHA1 0d1c25d0d9ab324246df0dd8147e8e2b3f1db91b
- SHA512 a936765ddb3a2ea687323619256db50577c64a31da03c90ff8f2e3dfdabd0f82f88aefb5b96cf2d00bb923f94395c21e09203724188da2bb6ec69e9559c22bcf
- SSDEEP 12288:RBfyYUpNMqgPTCsOLu47VLfalLGvR3bBCi4i/DSZPBBkZl:2YoUOqUIGlbBCitDkBBkZl
- TLSH
  T1BFC4233B9C928D8DD69D13F2EAB72E21BB7B88580FA00346577E4478DD2775D2D18883
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  Redist/DXWebSetup.exe
- Size 65KB
- SHA256 7e963c1bec5df9b42773877bc24291a04095bbfe5f7128b1286f061c4423a071
- MD5 0415e9fe38d55d1eb5ac7998486e70cd
- SHA1 bad17f277209fc592b0e39ac1b6254c6055cff37
- SHA512 2bba4f6e1988e420870cf2d17ad3feb15200d8e250d4759a7298d306909a654f2078853e2816125433780275f49ecf07f96d41ae6253cc0d27faec2b1d82617f
- SSDEEP 768:7+LUuxgoVGrMeIROhCJx7n6f/X52vVL8:75uxbhcUeXJ2l8
- TLSH
  T14D630F82F7B5999CEF1C753326224415D1FAAEF0370A712A3B8E355EBAF19C0444C99E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral13 behavioral14
- Target
  infinst.exe
- Size 68KB
- SHA256 34ab99536ea59ad60ba6efda3ea6d18291ef096a0bab3664248d6045805da0ec
- MD5 45d4dac07aa361bcd77aa815d1724a16
- SHA1 3bbdf7da5d51211ae269572961b5ebf508ada28d
- SHA512 d940002a8e0112a3b56a909008403b447e9cbb80e38b9bbd508f40aa68224f7e5d9681e1039e747ae939e0829a25be2319b9f9d0862cebb042e4c525ccbc20be
- SSDEEP 1536:dSKL6bzRYK/ixmu3XyhJRxjWhKfLXJ/y/Fae:dSKL62K/u3XmxCAfLXJ/y/E
- TLSH
  T1E8637DC3A648407AE0BFA53486F15B23F7F5F854033953DF1A1489290A67BDC2A3D74A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10
behavioral15 behavioral16
- Target
  x3daudio1_1.dll
- Size 17KB
- SHA256 fac23787e7c199c1969806850b5a9652f66f6dcac86f48f6f834abc253848a55
- MD5 489e5b8bb1bd1028ff1c798eaaec65e4
- SHA1 da9c385c48a6f590347581c5c3dea67502b99837
- SHA512 33e3c28d60c7063d76c6959ef18dbb0227466766c4be9ce920911e192b75c18d11943a2eb0bef2caa920a6efa29162acf9f6c9c07ed5ddf5858420b240e0c0cc
- SSDEEP 384:9aEDn7U4mXTtLgfbZMpZvHEyWfoWtLCcM4aeW1:ln7U4mjtsf2/ijL3baei
- TLSH
  T17B825B41CA7C44C5FD566EF1B1A5E883BC35B3C08B199AE312B7D1490C9B3E4AEB056D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  xactengine2_7.dll
- Size 393KB
- SHA256 bcf3012a44b448402166bbab661a9fbca7f9e3c11ad17b3f96a54bbbb82bb235
- MD5 8c970509e0ae10061e3ed6d51e34feb9
- SHA1 29e2b6c6457b04c736b874b91a492d1db3a26124
- SHA512 765ab00113d1d16775be9edeecb69b9a050b7e43eac8b7738e82f2d47d8346f5ffbb9f38c9bb308eef79c1167717fd8a297b5285cf696bbdec4dcb089c596b76
- SSDEEP 12288:8yZUR8I5vcDgCa3R8Lq5ucIMeLGdqrjA:mc28Lq5uS+A
- TLSH
  T121846C93F1E45DE2E2BFE07DC6A68643D7B57094071097C72390522A1757EECAABE320
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

persistence privilege_escalation adware ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral19 behavioral20
- Target
  x3daudio1_1.dll
- Size 14KB
- SHA256 ff15f14174a5543f028fa49cca745582fe4cacf3bbe490749cf43444690ab359
- MD5 121b131eaa369d8f58dacc5c39a77d80
- SHA1 d8fe20cb6f28bc5334ae64a8df3563d1985beb9b
- SHA512 ffe19ffea137603e5401f133d461b30af6fc25b3affb8a8ce20b98e3270de398b9ecc83a6cd904ff42c5885d3806c7e175957bf4a5827dc2f067756a51bc40db
- SSDEEP 384:rRzhlxrni/jKXEg4iptXWfoWqDLCcM4aeW6l:rRfkLo34ipqoDL3bae/l
- TLSH
  T117624C828F380205FCA52EB4617DFAA3793CF7C21F919D2350A981C60D92BD59EA851F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral21 behavioral22
- Target
  xactengine2_7.dll
- Size 255KB
- SHA256 a43c92af3fbe91dfe2a1d415342631fe64e18c7dd3e16e93b6c78947b68e7bd6
- MD5 7febb8ce2233cbae738b16d42ed29674
- SHA1 fdc5682d6aa0ec57b8f3c742fe736d74b3c649cb
- SHA512 73a3c07b13b31d2df1cece720a0268cfdb7ae2a066b9e613f7c4ff0fc37b94bd4f32207149d56e1bcaa5656fd4501b1d136d94e18e97c07a8e793906dbc7927e
- SSDEEP 6144:WAllo3zbGzgRwXrexo1P8tZ5gv0SuR13mr1yF:WAljUwXreu1PgkuHmRyF
- TLSH
  T10C447C21A8509275DCE232F886ADB17592ADC3C21336ABD706582BF6ED603C19F751CF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral23 behavioral24
- Target
  d3dcompiler_33.dll
- Size 1.3MB
- SHA256 90dc7e301a3dfb1c015cb73811b77a5ea21f8ee46944011bca3a270584473013
- MD5 3ebf620536a13ca343e52eca4f0de7f8
- SHA1 b46cd27a56c832b04246e22d4d05e0af3ab3d0ba
- SHA512 456aa59fa6b1e3523544f3d644f946ccbe814f8f6ba175b18b2be0600fd72972904f65899d4a2768a261cd8d1f9b7618a2e867ef3aeded8167e0e45a0d4134be
- SSDEEP 24576:qdy1UKdAAi4mygBH2zDINpwFeuiXounteD53aERvR:qI1peiDITwFweD53DZ
- TLSH
  T108554A52F2A244F5C4A78275CA5393A3FA71FC44432457C79290BB1A5F3BBA0AD3B718
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  d3dx10_33.dll
- Size 494KB
- SHA256 3f0248c3bb9bda2a901b343b3b58172e175a86450d421f0fc4aebbd5a7d11477
- MD5 839c3921005bb41d441e3752c74f2292
- SHA1 bb419fd4cd2e9fc9133c88cd6011524411a63fea
- SHA512 f814096af7e17ab01879d2976dbe0f52b0421f355087289f92b10719338852d6fcae88db06afcc4b9a6f95709458f90c4a14a1e26ba40918bc631137ac1309d2
- SSDEEP 6144:anSrK2fBPwZWD0vpK4Oy4ma1HzsjZqaLJuh1yofzEQh7D6GX:bf9wZfOygzq3K7OGX
- TLSH
  T164B45B41B2B5C1EAF03E653DB0D5F11FFA3134100B2046CB97A4856AEBA3AD44EBB756
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  infinst.exe
- Size 68KB
- SHA256 34ab99536ea59ad60ba6efda3ea6d18291ef096a0bab3664248d6045805da0ec
- MD5 45d4dac07aa361bcd77aa815d1724a16
- SHA1 3bbdf7da5d51211ae269572961b5ebf508ada28d
- SHA512 d940002a8e0112a3b56a909008403b447e9cbb80e38b9bbd508f40aa68224f7e5d9681e1039e747ae939e0829a25be2319b9f9d0862cebb042e4c525ccbc20be
- SSDEEP 1536:dSKL6bzRYK/ixmu3XyhJRxjWhKfLXJ/y/Fae:dSKL62K/u3XmxCAfLXJ/y/E
- TLSH
  T1E8637DC3A648407AE0BFA53486F15B23F7F5F854033953DF1A1489290A67BDC2A3D74A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10
behavioral29 behavioral30
- Target
  d3dcompiler_33.dll
- Size 1.1MB
- SHA256 12e238af4b4edc1f774213709a87a91b77b2c9d2d18fe475b027872923b6fa17
- MD5 fae7e1d578c42a7c3d9d61a99d178bd5
- SHA1 8ac88ff2bc5f616ed284a04ddcbaeb72fb1f304a
- SHA512 75107c64acfb6d84e1b05ba78377dc4699ba83b694b7ace474665c85f3e5843db6d06348fefed539c6c2b233775c7ef81d7bfd81937207e04e637043633cd0b9
- SSDEEP 24576:xZ7WQ9poSeEOgXgGZWFO59DF4G5aJQ6N7Q7Trlxux:H7W694FOHxhy
- TLSH
  T1BF358E63A5539132C45212F21A9FA3B576BADF7013215AC796903EE8ED392D34F3A307
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral31 behavioral32