9173bb3be44836e5f26352d9693460f95535da06cfc2962bc22b4783bb9eda66

Sharing

Copy URL Twitter E-mail

General

Target
Sims4_DLC_GP05_Parenthood.zip
Size 445.8MB
Sample260701-hpatcsaw4x
SHA256 9173bb3be44836e5f26352d9693460f95535da06cfc2962bc22b4783bb9eda66
MD5 03f94e23a2394e591dcaa26bbc5c14b2
SHA1 f106d2d526a1e9eb7d5536855a7dda7945a3093b
SHA512 bddf21e300c14fe7732802018000b2a5e91a48c23e026231d735eb8bbd123d71f26d1a1a8f0ea4de531c983b20a26560e403ff70bb825e33e9ee7a702ca7c7f5
SSDEEP 12582912:dYJyz2Dz5irJXfbRVNYGwFC2N5Lk42LmHWO+bZqX8:mJyYz5GlfsFC2+a2eM
TLSH
T1EB2933F683815D22CD3D66ED989F4C297750945EABF5C9F3BD0723E112FA2A007A2613
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Sims4_DLC_GP05_Parenthood.zip
- Size 445.8MB
- SHA256 9173bb3be44836e5f26352d9693460f95535da06cfc2962bc22b4783bb9eda66
- MD5 03f94e23a2394e591dcaa26bbc5c14b2
- SHA1 f106d2d526a1e9eb7d5536855a7dda7945a3093b
- SHA512 bddf21e300c14fe7732802018000b2a5e91a48c23e026231d735eb8bbd123d71f26d1a1a8f0ea4de531c983b20a26560e403ff70bb825e33e9ee7a702ca7c7f5
- SSDEEP 12582912:dYJyz2Dz5irJXfbRVNYGwFC2N5Lk42LmHWO+bZqX8:mJyYz5GlfsFC2+a2eM
- TLSH
  T1EB2933F683815D22CD3D66ED989F4C297750945EABF5C9F3BD0723E112FA2A007A2613
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1
- Target
  GP05/ClientFullBuild0.package
- Size 417.6MB
- SHA256 7802f20d016cfa0b322a918cba702cd3d8650e1d981d529891eb59b0cc902a82
- MD5 42094d629f4e71a7b591bc0bbeae6017
- SHA1 260c5cfd3d7e4ede7a3bc414372229c3f89ef3a2
- SHA512 1c3fc0597acd9a258aac9a6a79aae73549e36f0b8c5034b821a4217e0638655d5e7dabde33f7b0abc55b7029dafbce16dfc2effdc59d539234e6a2ef1853a1e9
- SSDEEP 12582912:VD/BkrrMhMUF08HRl9LJg16ibNX4YwJ7OlhwBP:VDZ0pUFn9C15X4YRA
- TLSH
  T11F293313CA409CF2CDAD963496CB0C1527153079B3A5C4F2EE9EA0DA37AE7789D72907
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral2
- Target
  GP05/ResourceClient.cfg
- Size 244B
- SHA256 5f6620c66366690b65f60ad1cef8b3ca69c5bf8504218b60e00e46d33680c8d0
- MD5 5ba47357e595eae31341c29fcfe5cc82
- SHA1 73261937604faabe18bff5a24e07c6623d109af8
- SHA512 d9fd429b239812353292d727a39d7393501e95f3ba3f413c38d6c35feaa5ee03dd5081364234abd73727f1c66154c8f6629d93c6ce59b2d469f3be1fc247768e
- TLSH
  T15AD09E965789A38BCABCA929E3308A5622DFB160709142ED615BC29C321174381F78B0
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral3
- Target
  GP05/ResourceSimulation.cfg
- Size 153B
- SHA256 b3ff86edd9140d13a499f0587990a8e01b8e082655a9dac55eb84f141caa0e7a
- MD5 64ba5379678a3c854bc525da27fc72c1
- SHA1 8a8ac9565ded6a932be61a66f4b83d17b6148e8e
- SHA512 c4e91b1965cafe5be3cbc934bd363037e441094b50dee6df8a557442485bfeb2d36758cc032d599a31d62fe5c33bae16bfe99ab9ccdb65634a33fbbaf97ddbea
- TLSH
  T1C9C08C960BAC838A4B7CD76AE3708A1630EF70242082038C308AC24C7310B8141F3460
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral4
- Target
  GP05/SimulationFullBuild0.package
- Size 2.3MB
- SHA256 d4c80999169a14a68fb9cdf6f355d3c07bb78789b51cfe1103d13a246b177427
- MD5 c165a4d665fda0653a5317154582929b
- SHA1 9f47a21c274ceb2533a960afc57b20374ab31390
- SHA512 1935af8e6f2bc6a4bbc1a53ed693535f4a2831113bcc6885357b71de4672db0943d92cb90571be41dd541d60919c85ccb846200d996d18c1b11346b6db9e9115
- SSDEEP 24576:oZmOEjYRcxVAkZA+NvOX/PEBhSxUFPqa3VEQkslHlq93xL6qW41XfgurCTuYrqT+:oZSUkbzq/PWuwl6hL6aIz7ek
- TLSH
  T10DB502516DF24CF0E9D0F6301AEA3D969C687ABA4B26A17D1F481C8F3B2D13ACC58435
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral5
- Target
  GP05/Strings_CHT_CN.package
- Size 67KB
- SHA256 27e416ffad91646f90fadc58917670b446ea6507600e14715bbb93b6b67f0a4c
- MD5 94087de0e5f615c0e7a26a6936f1de82
- SHA1 f45b92cc7c088c12f3310bb1baa69db19f6cc26b
- SHA512 f179a1c9bdb3d6d58f52c43aa4227fafeb6b214b479100d428ea6a3d5e3f2dd93541d07877830965b9dac5162752478355373e07b4a5423b829d0bfc5dc1573f
- SSDEEP 1536:sGIYalzOnKxHDIcS7Q0kF/Vl2hV+b+6w6/fZE4igw:snYUd9S7Q0gQV+nw6/fG4pw
- TLSH
  T1176302218E1DDF1FD6044EFE58E95E6B3280B572D2368B3B6439CFA50F5203A0569F94
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral6
- Target
  GP05/Strings_CZE_CZ.package
- Size 74KB
- SHA256 6b5e72577a29935dafde438368597754e5b3f4a8bb2c51c4a8000b226373354f
- MD5 8b1b024eb63541bb5601880f7a75ff1f
- SHA1 1ba9edb3382cae1d27c462f44767eca16af02d60
- SHA512 3579ab7ae4bf7cfc8cf4aefd572dee42e1c3df47e62ecf410118e5f45a86a5362846ea24c72a6608b1038d40476cdf570162004491396c1999ff885034c7149b
- SSDEEP 1536:W35DvzdnHjaheO3hFK3E1HJKlpY9/a/GPImLQVYFJxBWxSZ/UvwfOoy:EZHj+eAFK05JwY9yjytBWxAbOoy
- TLSH
  T1977302ACFD48DA5595493FF278367F42AF0C0205E0B680C1D36F67BAA898768425D3A7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral7
- Target
  GP05/Strings_DAN_DK.package
- Size 64KB
- SHA256 96602d1d9f4b0a0c16ec181a3eb513f8eec377422a99a054eee17868200d73cc
- MD5 59f2bb82e54884606df6da9aacdf5e43
- SHA1 14d3f23dde7dff447a697dbae8f9473853af8ce6
- SHA512 43a0a7cf04dc47b48105599271e32f026e5061b4fbcd675ca4e3f6fad4515a3e324804d82686143f9d575452b8a1b86474f10195f14a2cb6dd1152033e97314c
- SSDEEP 1536:r0ZGO9avjd3FufcWoz3fepWW+f0QVTtpivvh/0QLQ3evsr8GvEEjCie+i2:r0jud3FrrepWhftVTtpiv90Of+8Gvti2
- TLSH
  T11E5302C6C498DBF9F598853EA983FC09DA2192CD5DAF4015C6415BE33AC01731B6BF64
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral8
- Target
  GP05/Strings_DUT_NL.package
- Size 68KB
- SHA256 0d675d220cb7939e2c38e3569cc9eabe14c9c21da8bf4b1c9c23bdc11f35e553
- MD5 d43a4a2c7549d989a7b3b757ae7b5800
- SHA1 795390bb344aff847411edaa36652c03419567ad
- SHA512 61381c32afe4c462e4703a1ef61136cbead814c0769ce0eb4c51a1cd28faa1a2a24237caff779365cddd7bcd401034c55a4dcbc695bc4fd6c5f7c7de04bbce5b
- SSDEEP 1536:fReIFvLWW+oVynVMZib6ilnjFL8p3zhH0ketAJXsIipy1vKDa:fJFvLRRc2tdRqA54I1H
- TLSH
  T14163027C9F5798F6E41D4D6612D7981F8F7B20A770AE62B0E73C2CA80D44B76087D682
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral9
- Target
  GP05/Strings_ENG_US.package
- Size 66KB
- SHA256 3cba45146c894e967feb0fd4817d78c627e37dd15c326274d699da8d3d371b57
- MD5 65ecbc7c8684516a98117db71aee2d2a
- SHA1 9fbbcc7342bc3b58f8584d7bc5ccc065358e1bc0
- SHA512 8ebca92076d56ea863f923a38ea1eb723c629b12d62613be1af6e78b93a3fcbc1d52f52aa3fd683848a55ad8b0b3b61cc76640e191721fd9f3798bc10ce49776
- SSDEEP 1536:r9rXN/mFJdhQmwI0dyu480k6YdVQjsznQ/gnWwB/dwRkQ:n+Jomwb+vk6YTQjKognW6fQ
- TLSH
  T1216301A5F1170ADBAA0ED9A810A514C3DD0F5633F516EE7377E51628BDB202CC322E39
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral10
- Target
  GP05/Strings_FIN_FI.package
- Size 67KB
- SHA256 c7c0b7ddde517ee5a55632175bc17371298e758e8f551249b17937f1d45d8868
- MD5 4d501e4278a0e60a0f50a6a20f45e269
- SHA1 5394bbd9f890bb75612e1b856afd5966a4a403fb
- SHA512 45743121300111edd429ccf6160cd0fb55f7383011f1b9e42f10d7a79e79669f11f5bfac9f616c7ab840bc03b22414249acd66c5c14603339a35a5484ad4067f
- SSDEEP 1536:uUtuNUvDJ6YPmfQucRIHZyJJ1KKDJmQUFK6f4pKSKTHJ1hmpUo3F:lJ824uRIHZyJzKcUQwrf4pDKbBmpZ3F
- TLSH
  T1316302FCC935A8F6D6BCF475B07D041B682DA36E740986D3C62470767A2F2218D6D1A8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral11
- Target
  GP05/Strings_FRE_FR.package
- Size 71KB
- SHA256 653552157863e4dfcf8e5f2fb50193e993d4e2e29af1c1e2903d7da9f61b8d4a
- MD5 4dad6a8daa6e8ba2c242e3773c298bbf
- SHA1 48de0d395bfb1603189e55c3198a96eeb2a71394
- SHA512 1307189b04b0bc202be3331c61ad32668afd025d83f6c2cdc7eefc24cc14d06cf2cd575edd143d9de5024d1f37dd930b1852a51157bc46e8ff0617bd9006d652
- SSDEEP 1536:pBnH9IGgwyUC8WQHFEj84W6DNRZbKCL2aRQgB51aPyC74:pJ6GgwyUbXU5DbZbKXaR9ByB4
- TLSH
  T1D96302583B04AF6FF6700FA13E401913BA37915350FA6720DAAD44B84312FEBD2ADA59
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral12
- Target
  GP05/Strings_GER_DE.package
- Size 72KB
- SHA256 800460b409049cfae45049694725326f46d95266508f1439fcebc642407485dd
- MD5 12fbb2bd85eb5df11ed519e3a38c39ec
- SHA1 37daca07cfb93281c204b01190e6e74d63b6d234
- SHA512 ca487ff648160cbc872cc531ee262a26efabb493379e93771509befbfa770f9955e17f29a53b0180d6c88083ed6eee1d39372a9806cb1333048a0a96f840c6ca
- SSDEEP 1536:jixOU7hC1ErVipOpLX+zSdiCUgPW6utvwjKYxfNjzj/n8:EOK5VipIaMPCtvHmN3jv8
- TLSH
  T1477312A76639A964D18010BF3C6032738BDACBE5E053D0D3F73C6D06D4C49295B7B952
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral13
- Target
  GP05/Strings_ITA_IT.package
- Size 71KB
- SHA256 534393d1393891c3beda7575adcb2dad741c51a194c7774522d555089d162269
- MD5 1e21545416ede35bbcc1369bc5a975aa
- SHA1 06c8cfe9f80ab35081a72c239fdf26d851e21ee3
- SHA512 73e5f5ff18a639419e41590a5523e58eec00b2439d490d864e9294e11c4f6ad9cf3c85d77f041e125934ee8f5a668d34ec91ba920d4932e5d01c457c730a65f2
- SSDEEP 1536:3gpGyH5BISOKHhppJfqMbaaY1ZVpvlL0bRWCgwruSOK5PyzDXNAjh:QpGyHUVKn3uzZJ1CGQdJh
- TLSH
  T17863026761F10E63C52815B34487EFAEF06E50F160BAE0D4073E9E385366B70AA5F728
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral14
- Target
  GP05/Strings_JPN_JP.package
- Size 71KB
- SHA256 b51e8c066988398ef8031ded950a167f0ffaddfe32e9f8825b67ea8f8c216501
- MD5 c380af9925d113f93cd6b5cd893c504b
- SHA1 98227dfcd66f701b8ef4c637c6898ea8982627fd
- SHA512 7292b0deed0279c5cffa74af560bbb2b8e3d9fe6963d5a4003f7e53a7b098a7f18bff575d0f0604311a4fefb58f12abca7587ed8db4aa88b0ce459cef35c1864
- SSDEEP 1536:YGTwLgKLbWtTsr7Oi/Vn6mxrEy6IeOa+xEAwk0mL5qeyybeFkRAY4r93Nou5VNm:YzLhyVsX/VLrEyRzLxlB0BoSFj/RDm
- TLSH
  T1B9730272868AAB71D602C5F53D25A646B3B15006FE2A81FF823C79B31E31778C96D724
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral15
- Target
  GP05/Strings_KOR_KR.package
- Size 72KB
- SHA256 7dc047f53b01a71bb8e0979c7971f34795c1b971eca486f2b22ac9842e03c4f6
- MD5 b47e315cf4d0e4443fc5fd4376710439
- SHA1 6f9a37dfd824f34c727a9a2d38e88fd1a1310879
- SHA512 f5d5fb3ab78c1c049cefb535d7f253e7f780ee1cb8442d7b6c21b8697c0f5713eb359dacffae1db832d58d67a574bbbd5b2022e85aa646b957726eec42a6f716
- SSDEEP 1536:wLQUVziDOw9Yq11t4aaJovk6r8pJv8whE2FTC1EP+jQlM25XqwOuICdu:wLTZqOwf1z4nMB8pJvJhnG8lM25hICw
- TLSH
  T185731209C2612856EF3688F100F2F96833B491B394CE7DEAE6ED9DE005592DE484FD6D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral16
- Target
  GP05/Strings_NOR_NO.package
- Size 65KB
- SHA256 9916a4ebe67e2ffceed474a86bc62e7d1efbb8d2322c4b7e13aa5d07cc7e4e6e
- MD5 4bd545791a5d0df956cf35ca94318e84
- SHA1 b7ced0c5fdbe3e84f2efb007d0edf06b0d88c77a
- SHA512 b2842b26768a7615390f7b543b85daf504b4f6d8d35f6f78ec90f162e2433ee4595d48f59114f7e390c7c2ffa4dcc93c2fe2cf7f7a9fd62b17efd6de1ea27cd1
- SSDEEP 1536:+BDTPoD4WYimfKzhUzuE1sOZqeowMiuRp:+lTgIimiCzuEu/tn
- TLSH
  T17763020D91A99CC0C530427BB0363A6F7E20D335F8F817E4D916FA75789268A0F7D6A9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral17
- Target
  GP05/Strings_POL_PL.package
- Size 78KB
- SHA256 5aaf39b326cdc7f32df17b4bc30f2e8f62ec7ded721b6c20f4427ea7a540be5c
- MD5 b3b1e80a03fa8b87405b083ebd83391d
- SHA1 a283d802addace25023909fc7c77b0ef1678c0f6
- SHA512 440ea6f4897465cc81e895be83d165998ff96bcd00495657bf891940e21a4ea983cc157fe5078d9041ae3711f950e1125a70ed7422604396f8748da57f78edc1
- SSDEEP 1536:UbvMbf1K4+dEF2BViRWMfgUobxszIIvV++P281u4JSuhm1tMJ+f9aEhX1jXye:UbI446Is099oSL++HuS+f9am1Lye
- TLSH
  T17D730244A5196EBBF0596D61D9B0235DB01B04D2982F0CE3DE212FB6EE9A13C487FE74
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral18
- Target
  GP05/Strings_POR_BR.package
- Size 68KB
- SHA256 2bf41ebcc6fd3e8671d4902908336ccd3c6535c7941f6d9c49d308a46ce99ddb
- MD5 d6dbb4bb362fa7ddcaa00cc4d7fb22c5
- SHA1 04ecec831eb9809a2a82706b4f1754416b61816f
- SHA512 2e75ee1dd536ec54c88affd60c970e8f1a0538937bb6db74e343f86a203b734da512a2493981ce380a03dde5a809217bb0aa02e2d53479380dee8fc0745cecc8
- SSDEEP 1536:VcOjYzPrJvroBon+SmQ9hpo2zLNgtRhZoWAQ5UleKMDFvebzB/0:cJ/n+b2XmqmUlhM5ebzB/0
- TLSH
  T104630214410545D3ED25F9FD4C3E8A5B2EF65B32F0078EA4EA3FED60BA804D44BA8E61
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral19
- Target
  GP05/Strings_RUS_RU.package
- Size 83KB
- SHA256 5035be7cb3fe579814331b26fc22aed25c2041e3790f9cd5cbe59c54e1ab3007
- MD5 b00f3f88bb129e8a7555b043e08f4f56
- SHA1 69ef4fb75253a6657d94bea2661b51bb6e2d5d9b
- SHA512 c2a10b52766c911f9960ad5239f9843e9e148c51171f44328bc79786417ea5dd929b3100041d5035994bd23b88dd9769978687571bcd8f37d7bb3cfd8fe2d39e
- SSDEEP 1536:sVDpkXR4qcT5cOSb2L5qN/JHiTmgCORMo+u2MgKEQYXSG4cQSokWno:gNkXR4qcFcOSSL5qNxHiag7Wo+u2MgKs
- TLSH
  T167830220E7F006E0EF905AB3FC56B587E63E66AC8CCE83106DCF50D66F685A21535B25
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral20
- Target
  GP05/Strings_SPA_ES.package
- Size 71KB
- SHA256 078d88be9b57b0e8671f04e0a5369a6ba9d3c8ba5f7a9a4e2e4245a3f9e4cf64
- MD5 06cfba49dbf0f75afb96d66ec30b09c2
- SHA1 cb3c634cb884a1859266d54d2e8178642d0942f9
- SHA512 8e527bcacb88aab124cab7b99ca59f953fbbb2c83609ea547442ea6a75315f47806f51139c770d848c463e85edbd3faa5356c3c245402e4bb419d82d00194d94
- SSDEEP 1536:WcxaR1v1RaZJCQuNw4J8dpJrIXHHsLyyLFaG:/xaRt1RaZAQ8ybeXn9yhaG
- TLSH
  T1CD63022C1CB88DD3EA48D4F56847314D4455E8A42A6BE7CB233BD6227403A3991FCE2F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral21
- Target
  GP05/Strings_SWE_SE.package
- Size 66KB
- SHA256 7b8f5877d79fc925cff4599b31a46e6801c1399ff81cfefa128604bf222f018a
- MD5 edaf387a4f14f44b2c418a0762f977b4
- SHA1 1f54668ffeb4654a338248d6d8b92fac967711e0
- SHA512 d178aee983162f404b31fafd7a80a6c20c7bc6cb151f1077f933948914750446c8e5cc5cadac102936c30f871da7189acc0987b1e1d0bf671637f93ca8b93ee3
- SSDEEP 1536:sUmc80vwVdoelrko4nfMfxdwLKoMrKdNbnm3gRF9:aIVik50JwKnuIgRF9
- TLSH
  T1916302A6C51689C0DA1D1E3379A2AA47C37C8732E21FD949C42F5E3429DA44D8BB0A5E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral22
- Target
  GP05/Version.ini
- Size 1KB
- SHA256 314eec7f3ae85778fdfe4c26ad76c7097c12cbfc402b5ed719527d71094a660a
- MD5 9418668179d679216713cab5501d8db1
- SHA1 f60867bcc4271a9f07e36687de43e296677c2a07
- SHA512 ceaa1bbf70cd720b5483bc83f9533b23aa17040a2afc2741491101f79728ca351d80a083b0df146a96adbb39288233dcd08f62ef20a7a37beba594805fc5311c
- TLSH
  T1F231E6E80A52432B9E813DDF82AA13D0AF75F6C59E41484997E786443212E1F7D2FCF5
- MD5 SHA1 SHA512 TLSH
Score

1^/10

ransomware
behavioral23
- Target
  GP05/magalog.package
- Size 4.0MB
- SHA256 abf423289e71ad3e280439f35096a74c796bf584c03cdc757a72b0e73c77b89e
- MD5 93c1c56f57f5ff0a985367eaeffe5e2b
- SHA1 1c4d64149ba57e97d549679019f73cdf339b4773
- SHA512 69d7129d2ee89ea14b353d67f68de2345669c68ac6dfcfb9b639db1677ba0abf7e394e3d416a483b1e273b1de3ffcc7988569eeee7b489102d0840b6228ed5b6
- SSDEEP 98304:FzoD4Qew/Md627G7Fg3ebvy2VzzyVcA9NgEZ5VJZktSiwR1:FzoDr3/Md7S7bbq2lCxNtIU3
- TLSH
  T14B16334498C4F2CD4FDEAD5CEB2CF462C89021A425FEAB6DEE1F134A9F6B5481971C18
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral24
- Target
  GP05/thumbnails.package
- Size 27.6MB
- SHA256 97077fd3dba5bf1980492aafbf5fa49aba7a8fbe945930d97cd97520702bc5a5
- MD5 4c0389324ee714cf6bc3729b58202d91
- SHA1 fd8e7fab2713681cb50c9cf11cc95e7ccf7edf48
- SHA512 d49c5bfe0d233cfd2756218e2c291c88b84805a703e190959cd4e804b8c732b8331683de3cc490176fbfb97470d46f79449294ad4ce6ac93a77ed9137f393e5a
- SSDEEP 393216:ZdkkwYyTftZZmd6YuTar7OkeD/LAdc9z++14T5Rk2y9feUZw6Cr6DZT:ZDD2Zizu27OkI/LAdw+Fjk54Sw6woT
- TLSH
  T1DF57E1AB9B5247E0FC3786F799151EA2E2EECA9139D0374F2DE045E1C650FC8984CA4D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral25
- Target
  __Installer/DLC/GP05/Support/mnfst.txt
- Size 1002B
- SHA256 811d5ae292067b61fc13fd1dc2294655665a312b64e2d1c8a613d6dc42d0646a
- MD5 7eab6b0ac796edad6be26ed50c9fa284
- SHA1 b2ab4d0cda2fc5271a729bbc9f9202314f1bc642
- SHA512 05440b3f71d6a141a1588979c70b43ed8ebe42903a628edfa337b90274c09745a5a48fbe4c2b56f562cbdbd727084624c343557ba72d00f68f9ae0fc3935c146
- TLSH
  T15C11005126B0C3F12240FE4A39DA1E2E0B1EB5E0B82162FCEEC3D06173C8218C657232
- MD5 SHA1 SHA512 TLSH
Score

1^/10

ransomware
behavioral26
- Target
  __Installer/DLC/GP05/__Installer/Cleanup.dat
- Size 78KB
- SHA256 a2ac759af7322a4b457f449d21ca197b71ac2c68f6c8a4e2330a575b59125c24
- MD5 c8b0cba6d3187ceb5c57767072bf445d
- SHA1 44c316f2438fcc5937a5d14ed8e81b42536d9c55
- SHA512 c6b5236ef6c572c88bc82a19fe50147a1583b996bf086c694e33d1862973fd10ba58e514eddf2475b2d68413791943754b3d660cb3defe3045f8181d907b160c
- SSDEEP 768:nFRz3DMNvBmDxEvXjWAoEqZT8MfW+hVPGfRExmUZeT1uAgR81UOkX3TKtUdxR0PH:nMjHqZ7PhUpEBe5uTtArxR/
- TLSH
  T195731A850AB38DA03FFACE61ADA377F586C9320FA1A8CC0BB6CD9751E42455D213159B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral27
- Target
  __Installer/DLC/GP05/__Installer/Cleanup.exe
- Size 913KB
- SHA256 7b04503e581e1a132704f1dcc42f5ca6ad0c72f69e9a00897a77cd7ebffc4ae0
- MD5 11c9cec90cfb70f2440ff9586b09b347
- SHA1 aa74d3fd1d456bece4ddfda2bf6d2528cc1c6072
- SHA512 dbcfb029d436e452063834594633dbe6e4a14395c6d369a86febd54b24accfa956cce6f1e28e9fdc38837348c9153f07b88b5e5eeec2a1617f53a57f9fa2149f
- SSDEEP 12288:K7+Sc8SA2qNBcuMMuERQMrmGuvIpG+gO521dsgyUl3hsFosn+D3yngAgd:++Svmq2+tuTOs1xZOrcyngAI
- TLSH
  T17C154B55BAA1C868F6B209B5DFBD6561087E3EA44F3F54EB97C03B4C8534AC06D31B22
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral28
- Target
  __Installer/DLC/GP05/__Installer/Touchup.dat
- Size 77KB
- SHA256 ba89a4e9d5e62260625e16a5009bcd327e1344813f4509d6ff8dc5f8e5135f8f
- MD5 0200c9186880c61cbcf7bcc2833baddf
- SHA1 180eca1d67298bccc2d65d44a76ad4e01e53530b
- SHA512 d91197ed34690d7f121c6e8e20d77ab30ed9c173275a485a6085e5083d052af996278e6c45cab7a6eda89d1b1bbc5521f024bae450c91678b3451e573c91dceb
- SSDEEP 768:nFRz3DMNvBmDxEvXjWAoEqZT8MfW+hVPGfRExmUZeT1uAgR81UOkX3TKtUdxR0K3:nMjHqZ7PhUpEBe5uTtJrx88
- TLSH
  T115731B850AB38DA03FFACE619DA377F586C9325FA1E8CC0BB6CD9752E02455D203159B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral29
- Target
  __Installer/DLC/GP05/__Installer/Touchup.exe
- Size 915KB
- SHA256 f23ebd9abd77bcc3db667949228689206fb85887c50dae949514fb2d01550062
- MD5 b641c00f775453d079144184b2aa1fce
- SHA1 fa29d191cafebddbd33da397f1ce192eff08c1c6
- SHA512 b67735b71e8e5f88f71f4124220580396467486cfc527bd4b69e26d5ae01f6eda451808488f559801b083a11a50bfb6c2a29c8b8873a33136408790183083bab
- SSDEEP 12288:aPQNJUT9nG4luSDz+Z8nPhUlMmg7zPre0ik/yNaKY6OfuaBsH0sIS:aPEUhGfSJDjzgkDVg4S
- TLSH
  T12F155B45BAA1D878F7B205B5DFBD6515047E3EA84F3E98EB97C03B488534AC06D31B22
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral30
- Target
  __Installer/DLC/GP05/__Installer/installerdata.xml
- Size 4KB
- SHA256 0d181a984b3f162b8b2af9355c8844d7f7d69fe2913781bbe5975d215d33b8bc
- MD5 ea9a0f7fe4781384b6c54a946f47f7f9
- SHA1 9dab75aa49e1ecf84f87901b7fa2ebc41e756e50
- SHA512 7a9c155b072d88f264d2fdb7d900f10a9068bb0a5f25e2704903cc76edcdc69a5112d4b772c2fed6736ffa6644234562346454d465bcc9fcc5e6f33c9e5017b1
- SSDEEP 96:frKW28UGPgCMizK8fMuLf62wCTp8r9q8ri98rUe8r2MW8rQ/8ruW8rGbeT8rFNSD:X28Uwghie8EuLy2wCTm9DiiUP2YQQuXF
- TLSH
  T156913722E0FEAA4321D153B81D0D9A001D4C70737309599ABE9F51EBFB593ED92DB391
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral31

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31