ccc2324739bbe5db2cbdbb77762d7d0b49c5c7da55f6b99b013de407e7faae31

Sharing

Copy URL Twitter E-mail

General

Target
MECCHA CHAMELEON.rar
Size 115.0MB
Sample260701-d38kbsdw8q
SHA256 ccc2324739bbe5db2cbdbb77762d7d0b49c5c7da55f6b99b013de407e7faae31
MD5 c09519bdd11c1e3ba1b091f180683247
SHA1 97b2f478ec9c0f32e317ddc246a8e9fdcaa876be
SHA512 ebb28bdd7f54d444dea758635c7323b7d55c892f6b07af491e35f2fbefbf3925c360b9abbd659f1e163f44383c15755dd29568c18cb00c34190252e818bf281e
SSDEEP 1572864:V1xoindsLxjZu+KEounoUAPVBG5xprIOUfYIBRGqESYIHIqwsSCwaqPHMmB7+h60:V1xoxjZR4yYfYIiSIq1may86WkapF2TC
TLSH
T16448331E1D0198BEE848F2D8017D4CC345D45BEBE768A29D946A35C3BD25FCA42F8F1A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  MECCHA CHAMELEON.rar
- Size 115.0MB
- SHA256 ccc2324739bbe5db2cbdbb77762d7d0b49c5c7da55f6b99b013de407e7faae31
- MD5 c09519bdd11c1e3ba1b091f180683247
- SHA1 97b2f478ec9c0f32e317ddc246a8e9fdcaa876be
- SHA512 ebb28bdd7f54d444dea758635c7323b7d55c892f6b07af491e35f2fbefbf3925c360b9abbd659f1e163f44383c15755dd29568c18cb00c34190252e818bf281e
- SSDEEP 1572864:V1xoindsLxjZu+KEounoUAPVBG5xprIOUfYIBRGqESYIHIqwsSCwaqPHMmB7+h60:V1xoxjZR4yYfYIiSIq1may86WkapF2TC
- TLSH
  T16448331E1D0198BEE848F2D8017D4CC345D45BEBE768A29D946A35C3BD25FCA42F8F1A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1
- Target
  D3D12Core.dll
- Size 3.2MB
- SHA256 244c72d69a06fe082aa59844b841f7605fb272e2394bc1fc998bdfc8d7921f6f
- MD5 95d10c7ee53e1381be84895cf89a79b5
- SHA1 eb0f69c151926c30e166b994f29ceddb55c6eec8
- SHA512 5485e8dbd3c0215d3b7234fc302b1052a01f2d157a5359345ec7538b86ea7e57e7a4b00dfa5c11f3131c9a5baa00e923cb10d2d41b46cbcf31e6000ac4d3601c
- SSDEEP 49152:RPb+ZBjjuIx5VrUAxYyZwzplBzG+RuSPbTiIqUSX3Su6MZXs34Xsmj:WxUzji6aj
- TLSH
  T141F57E03F69940F5D5AAD0B8C91B860BD6B178B4877293CB25A0935F2F277E18D7A331
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral2
- Target
  DML/x64/DirectML.dll
- Size 17.7MB
- SHA256 18918565cfefff21fb14362b21d32f52a1108a3a1cda564ce104f496e9a06588
- MD5 150a55f678a0eb8a155aa22133ec0bb6
- SHA1 e66729099ab058c6566142eb3e456bd2605a803f
- SHA512 2047328d6f318b4aeb72604005b1657de6829101b6dcb9437006702929d29f94e28e71bffb32510c9cf922d48bdbe551a38cadf1eebce0c771c6a0ae9f62ae61
- SSDEEP 196608:u6Kj5yxjROGq0Ytzn7OBdzIkRnyrQAH5+sM3TKV:oU2GMtz7oZIkByrQo5QTA
- TLSH
  T1ED17D01A6F6415A6C17BD23D9A530A43E3B6748A43706AE706F80D311F97BE05B3F386
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3
- Target
  EOSSDK-Win64-Shipping.dll
- Size 8.2MB
- SHA256 b73f5e43ebf4579f17411ec26d3824adf4ff09636a4cef3cd0712c83f5eee70c
- MD5 8163e2257993d4f3257998efb1b3b522
- SHA1 d70ad0c9bfff7d4558fc2312e080264dec644854
- SHA512 54e29c70b13e0bbf2ca90a1177dbf6cdb71c3564153aba744d77e4194e6abcbe1a482acf1f50b3373487dfbb6f5b353e793e3260367aa17ad887efd767b8dc4a
- SSDEEP 196608:XLzsxxKR8LqmrsdgwLBIlPWbtpjnSXPDqClbq7KtK1o:bW1G5FIIb/jSXPxOKD
- TLSH
  T1368612E524D640BDD053CB30E2493FF8E5997AAA5D7A942F7FC214022A71DD2C9A1F32
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral4
- Target
  EOSSDK-Win64-Shipping.of
- Size 18.5MB
- SHA256 9821beb84ed841d2e9bd412ad55b7982cf1fcb64edbf0fd3ef7ccac38632fff7
- MD5 db899f4d83ebc488d0f87c8c965670b0
- SHA1 2eee08cff7e123f316f3cd4d616f9ea699441f68
- SHA512 5843643a165c4a1e18b89f69d3937ad4b328e636cb55415106d7417bc46973fecffe09a3d88f2b97e722c698ff28c6b98871f79f2a7075191dc9289eca0a590a
- SSDEEP 196608:fkw3xyCMO1bhZR4eTa+d8xCCTCentNUtR:N3aMR4eTa+d8M2CWtiR
- TLSH
  T14917394272F40094D4BAC2BD8E67D912DB71399A1B31E6CF06A0999A1F77FF099BD310
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5
- Target
  Engine/Binaries/ThirdParty/DbgHelp/dbghelp.dll
- Size 2.1MB
- SHA256 c1bed91901a4c3f24ad32f09a160d6c92f23543a7030812b2a2df6618a420669
- MD5 2d88dcd29e36a8b2af19f7d2edea96d8
- SHA1 e5ea1d89efd320cc1116d0e5e798aa09a046e9ab
- SHA512 f613c7a9cef8d7d0f9818ebc41b6ed03d5664a2cc9c1016398316edff53d13c90a62d44eab6629dd10e2ad26b2017852f77acd8daf31df3ede99eeda539f30f3
- SSDEEP 49152:jwocwVH+umtSiRFXIrZ4mTQHuEnmDdE51p:jhcAH0r+OFrmD01p
- TLSH
  T14AA58C4792EC40A8D57EE13CD657421BD7B238450330A7DF52A887AE6F23BE51ABE341
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral6
- Target
  Engine/Binaries/ThirdParty/MsQuic/v220/win64/msquic.dll
- Size 2.4MB
- SHA256 b52ad46f1f06c2bec79e5f2ea8ae1b02be21c6173b011cbffe0fac0ee0117b85
- MD5 42bc39a65a0a4adae8e1939e7fb017c2
- SHA1 9715b45bda5ae8b7e3a2eb97f4b2766c23717683
- SHA512 14c5230b2f692c3856f935ef671012710ac75be31aea201e6a7f15d7210ce3b1849acdaec44b581da2e6da1a2683bb22ec1585964e0b92d5d2f40e34eccac040
- SSDEEP 49152:QVwASO0Gtlq1IU6idfp1s7NJt0fegH1yZWxWT4ttWDGyPj8VVp:S+FC0144b+81
- TLSH
  T19EC59E17A7A811E8D877C238C9638137E7B1B81513B0ABDF16A4C6B90F67BD1673A740
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7
- Target
  Engine/Binaries/ThirdParty/NVIDIA/NVaftermath/Win64/GFSDK_Aftermath_Lib.x64.dll
- Size 5.2MB
- SHA256 1368db77821b4172db00afc410e8a45647193dc8e24fede9db5714a69a58b5c1
- MD5 391520775e20fc413267badac1f8778e
- SHA1 cd4cafe96957f0f9154495728d9f28bac483c251
- SHA512 56bd341ae32a0219f67d1802b92a7a7bcb8114cc9c727eff8b609726bc9d13d4cf7d9d30d944859b76a7385fdb76b077fc1fec2223c4d1d851772f8e7fddfd3a
- SSDEEP 49152:a51CObepcfBU/Rqt6Dg/Auobysa3amwQdvvT+FUnEui9a46W3BXlC133Zt9FSb4e:egid4tc9pYNIOjgOX
- TLSH
  T106467C7A335841DDC47AE178DA431E0BC335BC454371AAEB03A29A6A5F277E51F3BA10
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral8
- Target
  Engine/Binaries/ThirdParty/Ogg/Win64/VS2015/libogg_64.dll
- Size 58KB
- SHA256 8351b1c052e985e27f3e30fdce5971770b25b58880cd5cdfebde488d93590252
- MD5 d9625395db20ee8cf4b08379a172bbd3
- SHA1 02bd55c5ac372b8eddd9e16f9b402dbc583e00b0
- SHA512 b0f3504d54d92c1fb8e10ef357b212f3ee562b17c63a80449723b0b94d8e85c1b79ea55a62ccd5333a229b8900c251bb5fa94f4e931edd3332379d6fd5703c3e
- SSDEEP 384:GVKN7KRked7VWjLmPnUunFqphqaNQL2PnQftfKNRvrzAcojOYPumOIYirsUPIy81:pkSQyQUuFq19HAhjXumDYira5AL2
- TLSH
  T1EB437C174714686FE83B543D98E5D326E976B850936157CF1248C34E0F23AC93E7A3B9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral9
- Target
  Engine/Binaries/ThirdParty/Steamworks/Steamv157/Win64/steam_api64.dll
- Size 298KB
- SHA256 dc4b5d8595e74192d10e06e8019492f67c51ce260254f0a965c95b0fcfd4ac17
- MD5 87be60de8e29ec503b2b6aff4961e0b3
- SHA1 1ecdc537704fc69d89f1c6dd1fb6172c3b9eccbe
- SHA512 6025d1fd14aa57ae6d9ea6f49293ada1a0a85b83f2aeb6247fcecc1c0f24d05909cf51a364a9edf6b33a4a61bafba67359a011fc6d7f117ae82f332239c07b3a
- SSDEEP 3072:FjTqkh2mB9mkVi635gRaeaZqk4YJDf32uB+rJFC9R+5z65lhTbCz+hnv91vFAyNt:1b9mZOB3Zx4YUuoaRRFAymC2CPzrOw
- TLSH
  T17A545A7AA2710CF4D076C13A88565E0FF670744B27619EFF2A6093368E676C21E3B791
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10
- Target
  Engine/Binaries/ThirdParty/Steamworks/Steamv157/Win64/steam_api64.dll.valve
- Size 298KB
- SHA256 dc4b5d8595e74192d10e06e8019492f67c51ce260254f0a965c95b0fcfd4ac17
- MD5 87be60de8e29ec503b2b6aff4961e0b3
- SHA1 1ecdc537704fc69d89f1c6dd1fb6172c3b9eccbe
- SHA512 6025d1fd14aa57ae6d9ea6f49293ada1a0a85b83f2aeb6247fcecc1c0f24d05909cf51a364a9edf6b33a4a61bafba67359a011fc6d7f117ae82f332239c07b3a
- SSDEEP 3072:FjTqkh2mB9mkVi635gRaeaZqk4YJDf32uB+rJFC9R+5z65lhTbCz+hnv91vFAyNt:1b9mZOB3Zx4YUuoaRRFAymC2CPzrOw
- TLSH
  T17A545A7AA2710CF4D076C13A88565E0FF670744B27619EFF2A6093368E676C21E3B791
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11
- Target
  Engine/Binaries/ThirdParty/Vorbis/Win64/VS2015/libvorbis_64.dll
- Size 1.6MB
- SHA256 f14d789b969797f29ae56bc211da74bc7681cc979d45ac55eae2587839743180
- MD5 c2f1d151806cce1872432cb3ba0f4c01
- SHA1 98ecc3c957d2c5211ad57a53e2d1b1c16da65020
- SHA512 dbc8552a74bd20ffd9c88c3cd822d4f9e7232598de313f91514c21bfcaa53f3542d56377aea5943b9fe568db554c2e265d6688412ff3881860492787e6937ff0
- SSDEEP 6144:UbbUbUwlPxtVNA0ueMSMMYGUXoz0A1VoqxRCv8H:yulPcDe2XNS2U
- TLSH
  T10C851F0759928B34C1BC50B588DB557853322C4DAE800F9E7BDCE67434D3678BEA2BAD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral12
- Target
  Engine/Binaries/ThirdParty/Vorbis/Win64/VS2015/libvorbisfile_64.dll
- Size 47KB
- SHA256 2d97292f614d1f029063603e65de66ba651c3aa2a30fd418aefc402bec1d788b
- MD5 c0f99758e03916927f5352dc59b4f29b
- SHA1 1d857fa1da3b446c4b359832c1baaf9bbf2e972b
- SHA512 f13ee3007e0818c85500bb762051d63deeeb67ee4177a8c59f41b774babca12a501c0c8e89b65f781fd8e3f176c33279d2e1c0905dc92f8039a50ffc4cf82d00
- SSDEEP 384:/e2rmsvpGwK9QaXYBZ9b/kwmVkSA3/pTNYTdk1aLPHXrgP7gpw5WOOBp8FbIYir2:9nv89iBswdSAQS7kWW/BekYirqk5AL3
- TLSH
  T1D5237CD796F124DECCA7C938969B1B2BFEB27006536066DF535481291F22BC2337A325
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13
- Target
  Engine/Binaries/Win64/tbb12.dll
- Size 323KB
- SHA256 27f5f2aeda7be9d3623c4ae511f171ad8ed98055616286b72210d41809d3f22d
- MD5 b996b4ca595ad26b927423c298c038b0
- SHA1 9e2470bae6acc79f074bea9300116d9207ada996
- SHA512 d7f9e3fa3c5a32d1fff767b37df3c243446db397207fcb61581144d36cf9fb1beb8f2d660366d9a0584aed188e91a1213503fe33bc83cb4cb9600f9fa6326870
- SSDEEP 3072:uIE7Jyz964oXz+D0xgiQLNSlsn+GGO4i5VAJYYPHxF8+uvHnbkSMFCWGnH:utJyzXoGlNR+GGO4BJB5F8fvHnbpJH
- TLSH
  T15F64170ABA980496D91A927CCA734A59E3F27C541391C3CF2260437EEF7BFD6663D214
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral14
- Target
  Engine/Binaries/Win64/tbbmalloc.dll
- Size 114KB
- SHA256 ff777f0e49f108fa75536612e152f8d702b94d02ca2bd354570d54216a9dcf0c
- MD5 caab907a643849080e8420fe5deebf85
- SHA1 cd1afd298214b75d12c33c338d5c085e45feaed0
- SHA512 c55c75918e59b8f34af973376a68678bb33b5c536db7899c5786b00538b6d56f7d79847b544746b63e4d629dc1755c17b589e89fa2bafc1371d361ae820704fa
- SSDEEP 3072:XLLJbu9Q0zdf2rjFxmF2MtVuNodWJlnCF:XLLJbYQ4df2rhxy2DNodWzY
- TLSH
  T183B33A4BB6AC084AD52F4378AA934959C3BAF491175087CF137843E92F67BE62E7D301
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15
- Target
  Engine/Config/StagedBuild_Chameleon.ini
- Size 3B
- SHA256 f1945cd6c19e56b3c1c78943ef5ec18116907a4ca1efc40a57d48ab1db7adfc5
- MD5 ecaa88f7fa0bf610a5a26cf545dcd3aa
- SHA1 57218c316b6921e2cd61027a2387edc31a2d9471
- SHA512 37c783b80b1d458b89e712c2dfe2777050eff0aefc9f6d8beedee77807d9aeb2e27d14815cf4f0229b1d36c186bb5f2b5ef55e632b108cc41e9fb964c39b42a5
- MD5 SHA1 SHA512
Score

3^/10
behavioral16
- Target
  Engine/Content/Renderer/TessellationTable.bin
- Size 253KB
- SHA256 edc4f3b628a139c5e185bbaeca661c95c1f427368d3b92892c5cff36c56dd941
- MD5 bc5d66a78840bfaff5bfc362de64afb8
- SHA1 3a3402ca2d3531ab8352c818ea1181288bd78c72
- SHA512 91cbf450ebb7e8e85a137ac018994ff0605625073e6cfd3e2a82cdb869159b2c843b301d455d250ff0f0a75ed1309456a4b2ca831aa0ab1d67f1c48298921014
- SSDEEP 3072:UzHWaDcj4kSIWdMfZDRAxjL4wPUjT8QiMtp+S2gWsMmuq:UF3kSIdfhRAxjLr8jT8QNqjgWsxuq
- TLSH
  T1D4448D1B434C6BE0D218123044DB5FB39DAF69A71B731997E7B56A2C0E31B90B8B53C6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral17
- Target
  Engine/Content/SlateDebug/Fonts/LastResort.tps
- Size 930B
- SHA256 0f775fa99d05e21d43d2d06d55982b23dcdccdb512a9a5a07aff674f212c41b8
- MD5 e15c3c2ad82c41935c7ab27b76e58964
- SHA1 57161fd8fcfc3e071179f48a9df67971c2dcc94b
- SHA512 37a08007fb0dfaf06347df72e5bb823ff1dd00997e0d62f785b717d394661feda132f1af7227bc3c350659cbe2ff1649ecf92d3d1c5e79e674484efd838d2803
- TLSH
  T1DE111068F4DA61296B93C232B4678900FA21F2DA95DC1F70F890E4FA116D7C53177A15
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral18
- Target
  Engine/Content/SlateDebug/Fonts/LastResort.ttf
- Size 5.1MB
- SHA256 fff0f8de0b868b964950fe97c9b60f893e9bc85a4f90b3629c5693db058b97b9
- MD5 89454f173319872a5fa975b26d028f9d
- SHA1 e4cd182c152c7d50c0ca230c86033d63b3fbd057
- SHA512 3ec278de92e326600e4a0e238311dbe9168416eed0716118c00ed146ddd1f9b0dfcfb27dfd0b6dda89fa49376ce208961d6b6d672b7bd922af8e262a3ff7b69e
- SSDEEP 49152:BB4Wu7JPVO/zNwHLLY2cxqPKHUBNRnNn3nm191d3l8WcY2:0WcF7HQ2cxHj1d17c1
- TLSH
  T14A469E9AB281DB37E21DB3F9AB626BE14786244E86E00CF2FC55B70971194C5DE3D0D2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral19
- Target
  Engine/Plugins/NNE/NNERuntimeORT/Binaries/ThirdParty/Onnxruntime/Win64/onnxruntime.dll
- Size 14.0MB
- SHA256 c8dda75c930538a27283437b7890f5349bf86cdc8d6ffdafd1eb7a8ef4c8ae17
- MD5 e16e95667a57ab12613720762e1fe62b
- SHA1 c94f961a9299422f856daa36d54f4074c267f77c
- SHA512 918c5f8fb0409ad42de993ec8de1635533b78b71a35923195beb712de9493af5cd71a1656cab742eeff3edab76fdba00c662091024a90b73648c6f512e7e969d
- SSDEEP 98304:VFoSlq0Rw2sadqTyYijSpYkrji69ROrjHpI:VFocRwvDGjMVrjX90pI
- TLSH
  T19FE66C1666A902ECD1BFD17C9A4B5A03F771744943715BEB02F041AA2F6B7E09E3EB10
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral20
- Target
  Manifest_DebugFiles_Win64.txt
- Size 229B
- SHA256 2a473c339efdeb4aa57a9ee7e76d8df006e9f3df30a19b0fdc1b4368291001c5
- MD5 0d939cb2a77427d2a15f042bff2a4db2
- SHA1 81e916f1d2fcd8c1e9c9ee2f616bd417080bc0ed
- SHA512 60a2b5d008b08192cda3e49e63b22425205b84a83b55d0ef3e04f777c43492757bc9a078921f60376872f7a7efc3d488fd3feacc0b7d8cd27cb66d3d940b2f9e
- TLSH
  T107D0A759777B264377184457CC2AB416EB1571C6B2C086211B30159AD7C834537376E1
- MD5 SHA1 SHA512 TLSH
Score

3^/10

ransomware
behavioral21
- Target
  Manifest_NonUFSFiles_Win64.txt
- Size 1KB
- SHA256 b37931c3daf643814bec262c1a107c29e769852e5cf7e87bf272571863aa0441
- MD5 301abb98511c78f8c309ba3fecfeec3a
- SHA1 4adcaff3aac08dac02f33a0b798f7db6e19fae74
- SHA512 e615163ee3697632d5b784bafdb64e1d3f56c1f3be0d26f63d17aa146e899b93b808953a06bd51ef220bbfc3daa25f4483c93578ad6199e143ca0dbe858556da
- TLSH
  T12A41006113A644A2B52C1B81C733FA4B185FF3D73E8690062B93551EE3C62FD37569D0
- MD5 SHA1 SHA512 TLSH
Score

3^/10

ransomware
behavioral22
- Target
  Manifest_UFSFiles_Win64.txt
- Size 1.7MB
- SHA256 4d66acb9394b7f4869e4dae5992512a09cfb2d2617205e6faaee718735038911
- MD5 6eb72cf8b60fbff343da987a880f0fbb
- SHA1 c9fb0d2048e51c89e9e0a9b10c86076f1b177c06
- SHA512 042e79d824a9d58328d070c729f492760efb1912c91f1e4992bf88cbd88e073565d6219f4c284bc2cd42ce9147c11657e172c71d5e57a3e1e2209cab828cc27a
- SSDEEP 49152:TN6mFcd9kMc00Mj905x8EMFAQ4WmSZVlGqPMc6fZVGVQnZwVC3G1ld8E7p6mTnvw:5DDZ
- TLSH
  T1CE85ABB67B7F6E153B0EC52BA118B6C9BC4675C6008795047B9112CC28C725C3FBAAF9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

ransomware
behavioral23
- Target
  OnlineFix64.dll
- Size 13.2MB
- SHA256 27a1c596c4b1de1e6672cb7e7fba2ba3d3124999493ff82a504beb6f6145e88f
- MD5 00813d08c8a0cdf3420bd38fd72c80e8
- SHA1 992119b11b5067959776b18f609c594c6c888bb9
- SHA512 a842617f0fc320fa90661a7b7a7809252a5b935ce4249a79f3fe520565a02db6c55ec80b9eb581aac1b4b29ad5954adf6f29bcf1d3624ddd86a5b8b03ad929bc
- SSDEEP 196608:OrATka029FenZW3Q8YrVNnZv9/F91mWsz0kg4kAHh3Zkghk0XV4YPNOLOOKj:KeLIJ5d9/FjxsGTiJ1hk+HPNTj
- TLSH
  T1D3D6129925D4937CC4408138F5451AF9F0D97C888CFD8826FFC749127AB1DA9C8BABB6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral24
- Target
  PenguinHotel-Win64-Shipping.exe
- Size 167.1MB
- SHA256 8f6e26cfe9763dc8a467b642bf13d926373332e434e23fdca4d7f4a93f5cd6b7
- MD5 fae9ef64d9b9c08d64cf04183769fb14
- SHA1 c420540cb8fa7e2a1940a64a1c269f4b592d3c84
- SHA512 f088172b00ed58c6a6a3ace6bf8f9232f08895286d1705c025c9aac8978ca47b945dde87dcb2bd4119e3a7f190ec4ee2f99d72418278b1d871d2d57f5938ed58
- SSDEEP 786432:7kQqVdue6BZYMcQ0sRzTli2eIvsHEqXI90OJl333v/Ax1e9Q9Y8fl:7kQqVdue89cXqTs2eWqfI90UnvC7Tfl
- TLSH
  T1E8887C47B7E504D8F07AC1758A3A5606EBB1387A0720A7DF15B045891F3BFE499BEB20
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware discovery persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Loads dropped DLL
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral25
- Target
  PenguinHotel.exe
- Size 217KB
- SHA256 4584159e0ed79b5303e698e53948de6b804bfdf693c1805620b3e6d67aafdc09
- MD5 6c36642d0c6623abfe08a31beeb95152
- SHA1 9e797051d7330f84975204ddc82a2cf89f821ed7
- SHA512 fb253373ba0c8277a4781b017964c7611edb67e391db81278a63a8df2c46f8342addd23c57d3a58c977355192e8c53ab475a47544460ed35fb1f712415e66a27
- SSDEEP 6144:mvudZJp30u31EwZGIMs2Qpra2WjvsCr5bJ8:mvudzp3hlVZGIM9r5bJ8
- TLSH
  T14B24AF07B2A030F9E577873888615656E773B8314B24DBAF0794867A1F232D1DE3EB61
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral26
- Target
  RedpointEOS/x64/xaudio2_9redist.dll
- Size 827KB
- SHA256 0e01f400baa09694cacfd2cfbff0d721c17b56785d2d6e29b6fdd117f70ccc1e
- MD5 835591acabfb69a6f9dace12711f2243
- SHA1 f0103c77e4e3fb5640a6d01a79644a8cfc5e4eed
- SHA512 6a77646846a06b8f25772a24fb8414c8aa8db07ad2b1bfeae72b016a68c64326fcd0e1214aa463bae2faaaf0a019327eac911eda4de3930c541f5142e55c5289
- SSDEEP 24576:N+6PHmQBNmTqtEcl+4n0wcktNvSRbESez5:NhBI9InQMNvMo
- TLSH
  T18E058C53F6E549F5D16B51359167BB1BF672B40027254EFB02A086283FF3BC01ABA3A1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27
- Target
  d3d12SDKLayers.dll
- Size 5.5MB
- SHA256 27436b5288f557fb5bcbb1cc4b5b84a14dc17af2edb0ed2550ddb098f6f65485
- MD5 63c1c8b1cc5d4e016fac39ec5372f949
- SHA1 30300aa3d84b6fcfe02c7a45c375283ce6a87834
- SHA512 e227b811901ca8f043be1ebcdb12ff5f40f4cb578a13f1326b6ef39369e8e5bec2bfd3500daa3b5d09705b8cfc2d7279b52270d7d54711e8ecac6aea1a3e3855
- SSDEEP 49152:KOz1yBwltxWnvjtlJcPbb1n2CBINS8RAMHeh0LYkIydNOUpWAu8nEwrU+6ha85Z2:KINxnbsUnMbYkNO0juZUsnNinljXN
- TLSH
  T107467C1763E802B5D4BAD278CA97860BE3F2B824537193CF06A147991F67BF05A3E711
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral28
- Target
  dlllist.txt
- Size 15B
- SHA256 fc0befb4aae4b7f0eeb1c398fccea03cc795590e09db6628974520091fcfc516
- MD5 d7fd711e5e5f73da110115ce98beca0b
- SHA1 a04719d38bec9a97b8f098cf29bc863006c43a33
- SHA512 e96b14c280a83d4a0d5eca3ce6af8ea5ef679feaa6b70c2775ace90c4ab54682c74d620a681ae3bc09baa534ae643dc7551b8b650f7d84658f38a8934448af87
- MD5 SHA1 SHA512
Score

3^/10

ransomware
behavioral29
- Target
  tbb12.dll
- Size 323KB
- SHA256 5fdf9e1d91ce4b03cb6742d551538010ce995b430f4c28b2a1d664fabb46ad89
- MD5 869ba26e6388b4cb66da1473828c5096
- SHA1 19c31e5dd2f147867a2676fa473e63f24c8d2066
- SHA512 a3d698101b70c4fd94cf354ad98927ba0f8c8538f99385cc8193431a525a1bbf59eecb57f328b4a0d6ba5c28f8bba73220b239c38678ad12f230f088e5c5a50f
- SSDEEP 3072:aIE7Jyz964oXz+D0xgiQLNSlsn+GGO4i5VAJYYPHxF8+uvHnbkSMFCWW0nOm:atJyzXoGlNR+GGO4BJB5F8fvHnbpKz
- TLSH
  T18664170ABA980496D91A927CCA734A59E3F27C541391C3CF2260437EEF7BFD6663D214
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral30
- Target
  tbbmalloc.dll
- Size 114KB
- SHA256 0bd90f4831d625613ca5f5279cce892413e6542590f8a8d95b7c46ac04e10a2a
- MD5 d40e730cf11c383d4eb452c11bb1f273
- SHA1 50b0e3cec7bd22f89a16c8f60fc478ac728b789c
- SHA512 c5a4c49b2e6ef87e5e70c4b7e2cfab4bedcf3579c9f18f1d50221bc1b0ad78709b688b0a80faabe9e1e1a545cfdf5dd223a304847e7a4ecba6d396782998e563
- SSDEEP 3072:cLLJbu9Q0zdf2rjFxmF2MtVuNodWJrcnq:cLLJbYQ4df2rhxy2DNodWkq
- TLSH
  T171B34A4BB6AC084AD52F4378AA934959C3BAF491175087CF137843E82F67BE62E7D701
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31
- Target
  winmm.dll
- Size 490KB
- SHA256 61d071e40fb1136da66bf12213062a47eccadd7556171b97381fbc937e978b0d
- MD5 5587d78c2c051ef9076ad19f42624064
- SHA1 ed11f49303128e9453566d83bee62f1779bd7a28
- SHA512 42fc22d08ee963eed7b42db48e5a396db98fabd72df120ba94e863f122fabda230a79b11d952157c73b8506be647ab7a71993deabf477ec5d72442abbc3042a1
- SSDEEP 6144:eo0EcwoNZhIE/adO00WkCUxgtF9Eaa+slRp0YHLFhNpgcHxbEvyW:j/cwoNNat0JuarlR/HLFh8W1S
- TLSH
  T1A3B48F19A2A842B9E567E07CC9434A07E7B1BC464761D7CF03E09ABB2F277E0563E351
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Loads dropped DLL

Contacts third-party web service commonly abused for C2

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32