188b4a6b995fe1db785e6a4b00a94490d500359c97ccce42c6496793c5a88a95

Sharing

Copy URL Twitter E-mail

General

Target
Balatro-SteamRIP.com - Copia.zip
Size 103.4MB
Sample260629-rd6akafs3w
SHA256 188b4a6b995fe1db785e6a4b00a94490d500359c97ccce42c6496793c5a88a95
MD5 1ce68b87cd70cab3aacbb6ec1b8126a3
SHA1 1a78aec1b513b16f7f682e07e1d3990b1f862f92
SHA512 3c67a40166f7707a797f6af4a68329b8e0ac78aad2aec22f0c140d362ce090a33a5c37cfcfa03bac8c66ae30731d79df2ca80aad73f56a802179fcbbe1161ed3
SSDEEP 3145728:u/f4n4huGqeM9d7cAv4lJohgCHREOT27t38ghR2Zrdp:u/f4ne3Cd3sJovHREOS7t38g32Zrdp
TLSH
T1E6383386A45E0A5F9907A837E764FB0C1999661FA10B8CE6E35DDF031E7339307E8D24
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Balatro-SteamRIP.com - Copia.zip
- Size 103.4MB
- SHA256 188b4a6b995fe1db785e6a4b00a94490d500359c97ccce42c6496793c5a88a95
- MD5 1ce68b87cd70cab3aacbb6ec1b8126a3
- SHA1 1a78aec1b513b16f7f682e07e1d3990b1f862f92
- SHA512 3c67a40166f7707a797f6af4a68329b8e0ac78aad2aec22f0c140d362ce090a33a5c37cfcfa03bac8c66ae30731d79df2ca80aad73f56a802179fcbbe1161ed3
- SSDEEP 3145728:u/f4n4huGqeM9d7cAv4lJohgCHREOT27t38ghR2Zrdp:u/f4ne3Cd3sJovHREOS7t38g32Zrdp
- TLSH
  T1E6383386A45E0A5F9907A837E764FB0C1999661FA10B8CE6E35DDF031E7339307E8D24
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  Balatro-SteamRIP.com - Copia/Balatro/Balatro.exe
- Size 53.8MB
- SHA256 0d75fe164accf3312734d4b37ac98788dd15f0b8e4f9bb8b7f90c4e59de93f47
- MD5 0b970613aa75561c15a3f6596c179275
- SHA1 b37282b28749c6b1d057de10efc8d43a4fade95a
- SHA512 43ed49780c32a6da43b331c76d78b214a054ef4b16985cb2a53bdf651d6de5b663e3dba7a16484fd73331aa8d3bcc6bef6feb0223acf493e0aa9b31430300829
- SSDEEP 1572864:/J0bQ22JtEJSUjKaMCy534n312MuT2C2CyFr3:h0bQ22DxzaMJMuTOCyF7
- TLSH
  T125C72289C4FA9B6EEC342435EB1782B858952E0FD501B8BB81D93F3239BFE851B47514
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  Balatro-SteamRIP.com - Copia/Balatro/OpenAL32.dll
- Size 849KB
- SHA256 6c7aedeabf7dae8f130559b8db470b7c03080ed17d6004984073bb1e9b202e94
- MD5 21e5da3d9e84546b7b803f09fdd082a7
- SHA1 58269ee9c3a9fa2e5ff92d9a71c00213305b2357
- SHA512 991d2df9f635b548f623112a21a6518a6768a2ab37326b9a8f5b9b0c737849614794810766a8186cacccdac7868c081824167d233993586418d8173c2eeeb4df
- SSDEEP 24576:dCbIWvjYAE5KvEdf6ORpuBuArgFpti33J:AIwjYAE5KsdfDCBuAWpti33
- TLSH
  T11E05E056B6A140F9E877843586A3BA0BF2B5304A031099D783A08D297F77FE15EF7712
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral5 behavioral6
- Target
  Balatro-SteamRIP.com - Copia/Balatro/SDL2.dll
- Size 1.6MB
- SHA256 5ed623e3c310cf522645cb6588f30404e6ba6cdaf6219095a827a28d576603eb
- MD5 c9d3f1ade7be5eb34921530073f5cbfd
- SHA1 6841ee8ec757d705837cf2831c794cfa19ccd67d
- SHA512 f7bcc9890502b99fea54d9f957184065cc33373738ce20483089f52207ac0842632629daffde9ee5b586aeb6312b275aab44386507f8dc0378d9e3aa205217a2
- SSDEEP 24576:h9hsViTu4z6NooPj3Ng24EOhAo1MAWDCpOnn9whY0m0O+3hzpx9:psViTu4zYooarAoaAUCknnehY0m0n
- TLSH
  T17975AE0FB3F605A8CD2780B9C597B217D675B4482BC497DB36940BE92E33BE5163A360
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral7 behavioral8
- Target
  Balatro-SteamRIP.com - Copia/Balatro/https.dll
- Size 63KB
- SHA256 8a704c903575c2dbbc109869d179e8213d2574885f3f429173869dd75620b39c
- MD5 d86732797537f128799f4753ccd39436
- SHA1 b3b0e5e7eabc0ac9289a305be70ccc1351a39bd8
- SHA512 0d76d319f6fac139185af7c9d843b3376bc7ad217c4aea41c8f8192a34d536cf8aced600bd7fecc764235bda176e51e8d031cb953def1135600e5c78cc281bac
- SSDEEP 768:cWfyHGDlnwyEv91+AS2qQYpadRTXMX7RUPpKWsohqlGjtG9A0jVGUUXHwUo0J:cWfyHEmvA2SpCBMX7RUgpiGSHwUom
- TLSH
  T193531A2B769900BED267E23C998B4F12C376B846036297CF0391876E1F577D46E3AB50
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  Balatro-SteamRIP.com - Copia/Balatro/license.txt
- Size 72KB
- SHA256 4ebd1f337cc55f17f520004d6943f8d5d07f9647d329950b66bbd17cf0d6341c
- MD5 02cb6faf045e43e91ec308b066bee16c
- SHA1 eab9ed94ce78b5b2f7a9e885900e0edd358fc48c
- SHA512 aad525db24fce27333a6f9a3391b2cf543e258cb600db03513598b61de8b0eccc368a6240fe37489ea7fe7d35894929e586f01b37b04fee2840701abd33ceba1
- SSDEEP 1536:zfTbZ/Xp+28CRZwBhxzNvi3yYjV7oKxnraxaAelTPsCVItcxhe:bZ/Xp+288wXxZaCYjV7JrSZedPsJihe
- TLSH
  T11473B52E774A03B22AD202516A3F98DEF32A9078362B1954349CC15D337BD3593BF6D9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  Balatro-SteamRIP.com - Copia/Balatro/love.dll
- Size 4.6MB
- SHA256 f8d5d7e976ecc0ecf1870b5fcf4d25cdf9bd3621445a8b8fea54cb4ad5d79816
- MD5 db1d05295d7ad48180541aa2b962485f
- SHA1 dcfa0ecc58087731b1d445ec676054032d45a5b7
- SHA512 291b9b40cdbcfe4ede2d3899d30830a69c10d52663ab00d5b0a00bf0f2de4acddb0d2597248c37780dd5300caa3c22065c69c7a668cfca013f29c47c55f3a4a4
- SSDEEP 49152:QOo0+OeZdwU+wnY7ZIh16+rdrKyW92YelbtDbEatI4Pd6237GMcKSLgfTuGRSalC:zI39xbDg/YSR3L0w/C
- TLSH
  T139268E06BBB400E5C4B7D03C8A9B960BE6B274650B615BDBA198436D2F33BF05B7E711
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  Balatro-SteamRIP.com - Copia/Balatro/lua51.dll
- Size 503KB
- SHA256 d0039528d0c48acf9e4b93e39f929ecd8def2b08c429971b809d8751aae49fb2
- MD5 64333a8fd053eeb8f59ea03812b59a1e
- SHA1 6a5eb12118790d13d39d97b93836a8a16709839f
- SHA512 f1fd5d6115b2f94cca1c815d0288a6c7068857ca83199df4c7561190510159257ea09ffcf19b1615565d9b39ac7feeb150e9e1c341dd1e3de9d838d715055f27
- SSDEEP 12288:gpfXORux/pn2GNUGMuh6G9Y+j2VnqXWER:gpfqux/pn5UGMI/Y+S1qXWER
- TLSH
  T182B46B8AF5750769C5AB817889534A0FDAF5B84007509FDF01E0BAAA2F37FD51A3B324
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral15 behavioral16
- Target
  Balatro-SteamRIP.com - Copia/Balatro/luasteam.dll
- Size 189KB
- SHA256 737d63541c206e5f88298022c48c7205b0fc72a07cf051a354a6fae2bcd88f49
- MD5 3a9684714ccd9f25a9a6d94de9972f8b
- SHA1 694380cc1b4fe03d6d7def8384b9ec6c62ae2949
- SHA512 d227eec2d8bfca1afef5bc89a5b6a1ee81edc731793fa4bf91edfd824f3b3bc969bf663b18de97aa0ee2d3b999ae40e2a81a1d9a828f0324c5a0880fc5a037a2
- SSDEEP 3072:WXEgpcnvT+hGh9D9z3rQ4Glx4XHz/Y0kyDp1VhfYfPkuZMgRs:8OsGh9DhEHlqD+E1wkCJi
- TLSH
  T1C814194BB76000F6DC7A8038D593250AF6B2746507349BEF8790076A9F2BBE4793EB54
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  Balatro-SteamRIP.com - Copia/Balatro/mpg123.dll
- Size 193KB
- SHA256 e13adb64607c3cf29669ef03cbddcc922096874890043047de1d19886babbdfd
- MD5 8117d0efb10f06c61320701d6f1ffcc3
- SHA1 de424f4f2af03fed2fea306b6d32384fb21eb1ed
- SHA512 b8f76ef0693b74a005a6bed4393c2cb4cfd6b8cd5df97428e42cd8a21c33dcd040909223ec7eb444293c94308afecc0005e72573bf605ff0d6df838ed1c41d26
- SSDEEP 6144:mZp1yn8vwQDw2MxWsIv2wIu+xxM1BwuHql:oEwJcppyzQR
- TLSH
  T18B144B46B2B1C867E57A503D9616D94FF2353CA08B105FDB02B82A7C9B731D52DBA383
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  Balatro-SteamRIP.com - Copia/Balatro/msvcp120.dll
- Size 644KB
- SHA256 2abf0aab5a3c5ae9424b64e9d19d9d6d4aebc67814d7e92e4927b9798fef2848
- MD5 46060c35f697281bc5e7337aee3722b1
- SHA1 d0164c041707f297a73abb9ea854111953e99cf1
- SHA512 2cf2ed4d45c79a6e6cebfa3d332710a97f5cf0251dc194eec8c54ea0cb85762fd19822610021ccd6a6904e80afae1590a83af1fa45152f28ca56d862a3473f0a
- SSDEEP 12288:N2fus43uu43Ry4GHlT4xH2K+M+/i+WSpY+7YOzCaK9A3gS2EKZm+GWodEEwnyh:muJzCaK9AB2EKZm+GWodEEwnyh
- TLSH
  T11EE44C13FB150AB0E192D3B891D74741D7F1BC898822E70752ABE27D5F67391AA2F360
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  Balatro-SteamRIP.com - Copia/Balatro/msvcr120.dll
- Size 940KB
- SHA256 ad32240bb1de55c3f5fcac8789f583a17057f9d14914c538c2a7a5ad346b341c
- MD5 9c861c079dd81762b6c54e37597b7712
- SHA1 62cb65a1d79e2c5ada0c7bfc04c18693567c90d0
- SHA512 3aa770d6fba8590fdcf5d263cb2b3d2fae859e29d31ad482fbfbd700bcd602a013ac2568475999ef9fb06ae666d203d97f42181ec7344cba023a8534fb13acb7
- SSDEEP 24576:FkZ+EUPoH5KTcAxt/qvRQdxQxO61kCS9mmWymzVPD:FkMAlM8ixQI5C6wl
- TLSH
  T10525BE4676A106FAD463D2B4C9A79607E2B2B85B1530D7AF02E0866D3F23B30975F317
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  Balatro-SteamRIP.com - Copia/Balatro/readme.txt
- Size 4KB
- SHA256 9cf6172876b85771d0dd6463bd92786b77bd40510d817eceaf5ff459611ce225
- MD5 05cb183078280382adf73bfc14ad9c02
- SHA1 a3b8f8c84bc7a12514f5521958bc5e43b9abf4cd
- SHA512 332ce80a0c78bb2123af189be75c1d6b984a5ee7ce5c5f0c9503ccd17e2d61c9b8870d3ca34277460c6a1f3502dd564cf832a9d0b95ac8d384bdb89a6c838add
- SSDEEP 96:Ltg9ZT4kpgOq7veiE9aHoemrjDtAG1GpGT2QGTHG85/GTHG8QJOuf1:LSZUzvMaIekjDtAwgy2QyHT/yH6JD1
- TLSH
  T1CCA143BB5F02D7351F11E1C0B1CD65EAE66E4118B99B406CA8A5008D337EC5362BD7BE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral25 behavioral26
- Target
  Balatro-SteamRIP.com - Copia/Balatro/steam_api64.dll
- Size 406KB
- SHA256 c9c693a637d319543ed85cc348cc151e393bd1fa6459134ecff80c55bc36c85c
- MD5 45632f4d278cf575f39334123e9dcefd
- SHA1 55a11e2ed5728227b8fad381c0bcb469bdc5fd0c
- SHA512 4e4fdcc28ca6d962b0ea8a7f695b21e0c68fa50f345642a3412d6f92167c7ca783ef4bfd02ec1b02bcfa0930905b55585677b7695de47e295949db7f57bac067
- SSDEEP 12288:RvcvhFIGtiSC+0ZYKlSWSo9E23R8kyJfCl:RUvh5oSoYipSqB3R5yJfCl
- TLSH
  T19494E03A345211F5C5BAD635BDA42E0F3AA0108F72116DFE79508972C5CBA432F771EA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  Balatro-SteamRIP.com - Copia/Balatro/steam_api64.rne
- Size 291KB
- SHA256 a3ccbe0f56e4af7a06a1279bc5b45bf4893caa67e5467cb5df3b3f681fb850c0
- MD5 cc7470b39ac697d9a9d2d43f5c30093c
- SHA1 542d7574b76c16b35912fa8f6a4435b44525aacf
- SHA512 ed84c34b4c3c7ba95418b2d582bc2dea1ca771e38f5abbd400f0d06ee897ccd47fd8901f7ab3a709340d4706c1fe2791473e6d98a1ffaac6235927b1f758e13b
- SSDEEP 3072:D8Y+BDOgGIWcXSEJeRhqTMdU55UuT7+7JtN3RUOw65lhTbCMTiGu2ZvA45T+yq+q:DYPNrQheMW5vTKxRJ8TyKyqO2CMNOvi
- TLSH
  T141545976A2750CF4E076C23989565E0FF671744B23219EFF226053368E57AC21E3BBA1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  Balatro-SteamRIP.com - Copia/Balatro/steam_appid.txt
- Size 7B
- SHA256 843f16eaaec7c898763c4c4b3954313d825de1b259cb983e1abc1112119d5ea5
- MD5 9aba295450a6e6cb58ec0e73f6d5328c
- SHA1 e7afcf757e41dceba7b916669fe9e9d23587cfbc
- SHA512 2b4ff86d11d8e8659fc53e57cc6f4c2bb5ec7ae54dfa083e44192331917fa471fb6069f88ad3448f2b3fded428451d278bd4bfcf13e23b8715dbf2a7f63cf01e
- MD5 SHA1 SHA512
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32