696ad11dec0a1fb2a612ecef32119f3003fd648423ed4137c0d78c72827b8ea8

Sharing

Copy URL Twitter E-mail

General

Target
Among.Us.zip
Size 675.0MB
Sample260703-176b4acz4k
SHA256 696ad11dec0a1fb2a612ecef32119f3003fd648423ed4137c0d78c72827b8ea8
MD5 0ee7e3f6a1c2fb851a51b71d533aa2b0
SHA1 44a02d05a038c08f19788ead38ed3add3fad67c6
SHA512 c978f6db70868ed0e329c622e4125e248f70dcd399f1607faef074933c2f38c1af76530a6b8ffb089a04ea03570d9763fb722340ee102149db442b6405292dab
SSDEEP 12582912:1J1dofkaobfwyYVTRrpcu/xlXCkfyR4wBLqmTstkjigBbkJky5ydiI5w/0BP/YkF:ro8VwyYFlxlXZyRPsmT8WigBgdkQI5wm
TLSH
T15F79334A0ADC4D7EDD0618798871BE4A5E06107647D4897B61A9DC9CACE3FF102FEBC2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Among.Us/Among Us/Among Us.exe
- Size 651KB
- SHA256 209d0cda85a2f86a46b6f3f97843dfee86d18259c987708376f6e1bf87d208e3
- MD5 b90b3d839872ae022e37a87b9636081c
- SHA1 d3ee59ea8493a4f36a5acffafd42ea85a1928a9c
- SHA512 6af2adb57de70224bbec93d8ea76112edba5f192bfd56af610afe3607a179c6c3d0a468e6959c8a71bf8f27b4a341f6a1ebefe631fb18451c244c5264a1ecb65
- SSDEEP 3072:SQJ/VdFgIW9mYucJ/OD8JlsI9TTItTukyyj0+5snQw:7/7FG9mpcJ/OD8WYkV5sn9
- TLSH
  T166E412EB3E68098FD251147FCC718A63895B6C696B058D4D75B33BAE4C204357EB2A0F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery
- Drops desktop.ini file(s)
- Network Service Discovery
  Attempt to gather information on host's network.
  discovery
behavioral1 behavioral2
- Target
  Among.Us/Among Us/Among Us_Data/Plugins/x86_64/EOSSDK-Win64-Shipping.dll
- Size 17.5MB
- SHA256 b5b023265a160112bdab17bc7e5175d02d8db8eec8d8bc04b749b06a5914e523
- MD5 c3ff158d4230d9600349b64591d4f7b5
- SHA1 60672a9416bf2bbeacbbd259be72024c6ec09e69
- SHA512 645cfccef67eabf56c2242a992194d1969e05a98822ad6fec864185c17e08e38affd2025495cb479fb7e4be2d7c811154f494557cf2922b5b046b0b864684a84
- SSDEEP 196608:allTCTZnnZk4ptZ/J1mk8XmOLqDJRPP+Emk9C5M:Cl2FnRtZ/J1mdmOLqDJRPPfmkEO
- TLSH
  T12E07284272F40094D4BAC2BD8E27D912DB71398A1B31E6CF0660999A1F77FF599BE310
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  Among.Us/Among Us/Among Us_Data/Plugins/x86_64/Microsoft_Xbox_Services_141_GDK_C_Thunks.dll
- Size 2.0MB
- SHA256 58133981f9527abb8f5470d275e5d425ae639b6e333132c113cf95b36e220c0b
- MD5 ca1c0f44f72bd0aaf4d390273452b408
- SHA1 e29c7e11b401e6903f29a2c641046e44471ebf11
- SHA512 1f19334b62ca810f628d632e0129492150c8e2ff942dbffffa90731ab71a68268c922849b5a9fd328a574f92645c92b12923cb67993bd50ab2abb8b7a5da0e7f
- SSDEEP 24576:fk8yWPn+LiXXEfy/qKrRoiZiMUhWJvi20kEKSnnFUOUuh39XbQ7Rl5a:s8yW+cXEfCqiyA0kEKCUOUK39rQ7k
- TLSH
  T12FA55D9B7A6880B4C1EAC2B9CE5B8D4BFBB134454B3097DF40E18A5E1E77BE0957D210
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral5 behavioral6
- Target
  Among.Us/Among Us/Among Us_Data/Plugins/x86_64/Rewired_DirectInput.dll
- Size 104KB
- SHA256 5b97128066e2470d16b0cac708a7a9e8c95376522f16333a4455429cb17c5dca
- MD5 b6c717f623facadec79613ee3cfc6244
- SHA1 92a9613125af3280eb4c926eca22d3f876f9a0be
- SHA512 f096c1f220767976b8c69f38ada97a6806fc1e465ee1ccbdcbb8b91521d92e8af3f29d55ace9171ba065f164b2b353ade524dffa4ef82f12435fa102a4c7eeb6
- SSDEEP 3072:cX69UZY2taiItgg6PJ99L14v7QoKwRC4VwhgDlhb7:J9O8tg1PJarDb
- TLSH
  T158A33B1773E540BBE1779274C8A30E059772B8520725AFAF03A4465D2F277D09E3AFA2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  Among.Us/Among Us/Among Us_Data/Plugins/x86_64/Rewired_WindowsGamingInput.dll
- Size 149KB
- SHA256 946478c5e8f61cbe75c6d70e3aabe2766126605cba45ddb579a5ef38fb198e98
- MD5 4098ce29c5ea622b0ca8b420beacc87b
- SHA1 125078bf0ce9e876c9e974f611b864cd6f63737f
- SHA512 5ff37d531a5a2a45061cc43455fc6e6d8e7b87477c047bda8f249063d88cad5327fd83fd277d4b7cf88d9d8ff2a931fe40f3b392dfb624be0b9db12414a6b0a2
- SSDEEP 3072:/wQMc2bFa0gAQfngyVfi+nU7b2iIwOqdtfc2KlMUg6ASIgKsLogtMCkHTdRKY+00:1Mc2bFa0gAqngyVfi+U7b2iIwOqEXWg5
- TLSH
  T1BBE3394772B501BBD1B6D23888930A58F77278614B618BDF0774432A1F277E19E3EB62
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  Among.Us/Among Us/Among Us_Data/Plugins/x86_64/XGamingRuntimeThunks.dll
- Size 74KB
- SHA256 69c55c82218b1e42cf9a9edd14a0395f74b24d8ce54f88973b099a46cf1e35bb
- MD5 e89bbf2efcd8cfc298d471d7c3cfcda8
- SHA1 d8a276983270fce2c88c284dba61138e5f6a31fd
- SHA512 d33d34dec02a7f18fb26ee06d6b6435ee06e8f23567109026d962844183ca432788cde2324798e7a43df8b6a5740e17ad532e9756c0eb01d858bb1552b7ba427
- SSDEEP 768:bypi+Q66qonSYDbJtNpjOof4UJjbTtKzbtYT47o5UHbetu88UiEtPJx72ntlv5c3:byg+Q+ISOXjAPb7EuHFZkJF
- TLSH
  T1E17384EF96EC0162D6AD3A398AA24A5FE6A17212070383CF07551BDF4737EC4A63D351
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  Among.Us/Among Us/Among Us_Data/Plugins/x86_64/discord_game_sdk.dll
- Size 3.7MB
- SHA256 bf857c06f322fa55112680ac6e5bf4f8d8821ccf46cad567d6cf90fac359832d
- MD5 2183ab27a27fc29a07c64955df9ed88d
- SHA1 a061d453884ec2f885c88dceb066c248a701ff4f
- SHA512 8df26ca3c937f89602a2aa1afc07ec478bd0d67da57bea3b51c1e452c4a2352f9d6c55374f8a1bd9a1d5366168ca38d711198b1f13dddbf12e83850f8c93cc0d
- SSDEEP 49152:dRy/i1uCyPEDVu4eJQJwK9MMeic7flSug4DHqvpx1F1MeDSbKjowzIU6iGbSnB:nldW02+GbSB
- TLSH
  T1910627217A5A657CC1ABC47083874A725E3134CB1B36B9FF44C156782F6AAF46F3D228
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  Among.Us/Among Us/Among Us_Data/Plugins/x86_64/sentry.dll
- Size 548KB
- SHA256 4af35032e88cdded994202817d3102b7f2eda381e5e544191a28e8a823e6167d
- MD5 080e681efde8e5e4928a2b7b3852e227
- SHA1 da6a778930c07dc9a3a38617219cb60a36774a9c
- SHA512 fcdf7a5c7e25ed4c11da49a6ff96fdd30fb76e2e3632f387f13e13aa2f284a750a00237281c713ca8a1d82bbbff166290ffc055056a853966e744ea5ee288972
- SSDEEP 6144:8xl1+62sfW5EilRDrhe5vbrxSyE6suriefaDvMM8hNU62BSA9Sn:Uls62sfYpheWyE6DiefaDvHw
- TLSH
  T174C44C9A376803A9D1BBD27CD5C34A07E5B2350543628BCF11D487E61F27ACE9A3BB11
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  Among.Us/Among Us/Among Us_Data/Plugins/x86_64/steam_api64.dll
- Size 259KB
- SHA256 ca1fa9a7609ab10b7926400559cf073e5888423cc156af72c6027d72a89eea73
- MD5 cbc8b390e065c29572494901b151989e
- SHA1 238243867b2f2daf54ac0dd5f3b68f9d99f8abaf
- SHA512 e8deb190d9b00d9931f480754cd46b0fa16c4080bf12c25d024ee2c14e75e27a7ed9f9b357a456037c9123537910d5186b7361f359d44a25b175f55bfb9affa7
- SSDEEP 3072:WZz7iKHWadsCKUB6/KuBHlvdXGFcKLF65lhTbCNTnJvxfyN+ve2UhMBCcJo5gDst:+7i6ddsCKg6/KuBFFXyDyEBCcUb
- TLSH
  T1F944283A72750CF5D1B6C139C9961E0BF671304B23219DEF236053368E676E32A3BA95
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  Among.Us/Among Us/Among Us_Data/Plugins/x86_64/tess2.dll
- Size 35KB
- SHA256 36a12aab5bd62fa285eb7ea7fa9afc8302a4e4c0d6aac2483f4daacfdf10f024
- MD5 c17b096e520464f91c4ae0f6dabac9b4
- SHA1 42bff4540fa82ff39ca63eec1997405dad8633e5
- SHA512 e31640430d471dacb52a0c26f1070aa0d7e30328ee3ad4d1cc46f07261305e84540639bcf082a590ca6228faf5a87770efcf8dc24a10ecc96ce6eee3cbe1d83a
- SSDEEP 768:I8jRO/UNfAO6P71hvC1b7DTXO9ucdqChGc:I8lN4Ol1DTeLl7
- TLSH
  T144F21896606444BCD92A813DEA8BD44FD2F5F42A43589BEF43E252271F03AE205FB715
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  Among.Us/Among Us/GDK_Helper.bat
- Size 1KB
- SHA256 79582bc24d7d70ddb678153b5e0eea2a4cf568e9dcf2e9f8a3e05e0423211180
- MD5 b87ac10e5738ce6e35d94b96182e54c5
- SHA1 c9b78fd6a875372048ef13cf017cb3307d593d9a
- SHA512 18505bad01c8ec4ff42e79e3cacce4410e3692357cbeff729514c465d7a8e5e9e49c4cea111971d90b44d32fe04fbf1f242605b965c7b27620d3f5bc106a3ac6
- TLSH
  T1AC31C2347C11717B24A39F1A4A1331C16331518F752C9BA8736E03EC1B3A6D5918F6BB
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral21 behavioral22
- Target
  Among.Us/Among Us/GameAssembly.dll
- Size 56.0MB
- SHA256 3704b2a71a644db33cb4f93ab59557255bbb0a142fd115d944d2d4b71f84feb0
- MD5 64181bad60802550f8c5542bb7b046c1
- SHA1 c1f261cc1e6d03995a71f5769a901d88b0d9f9d3
- SHA512 b40ea7c91041790e2d5939d776e6738c357aaadc9706b2400a6c9d7017ed2299f7c87a87bb47a35833cc57ae10d01ab86515263420b2c47f4108ec20857fee0c
- SSDEEP 393216:EF+OFuzqI62dmu8h8xtUWydW9QGz9x7hGEvZ9mQOCwVDrcC63rxFFnr8wAZqXFiQ:E5IliWL7Fky0We7/
- TLSH
  T181D7084ABA755448C1AEE2789913149FDBE23C441F206BCB21944B8E1F737D8E87BB71
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  Among.Us/Among Us/OnlineFix.url
- Size 46B
- SHA256 3cb526cccccc54af4c006fff00d1f48f830d08cdd4a2f21213856065666ef38e
- MD5 59bf167dc52a52f6e45f418f8c73ffa1
- SHA1 fa006950a6a971e89d4a1c23070d458a30463999
- SHA512 00005820f0418d4a3b802de4a7055475c88d79c2ee3ebfa580b7ae66a12c6966e5b092a02dc0f40db0fd3b821ea28d4aec14d7d404ead4ea88dc54a1815ffe26
- MD5 SHA1 SHA512
Score

1^/10
behavioral25 behavioral26
- Target
  Among.Us/Among Us/OnlineFix64.dll
- Size 9.0MB
- SHA256 b62151144eb4fea88e744d34073dc49b5dcd1b73d0267f96a7be08cb1f15b80b
- MD5 6b5495a04f191706e9ba83df5ed885f6
- SHA1 1aba8b6477603e7ed80955c5a6cd9ae46f53a352
- SHA512 e7549000d7c6a88a92f5edbd86952007d0b5f242e5ccc32f387a8c0334f2ffee24f1655eac2807c9429868ed940d00814f08d2db3408f2240cff7232f76e6324
- SSDEEP 196608:HTLd/HHnwhX2bSKFvzW0O6KG6n1y4U/ewaMKMu7ZLBx:H1PHK2tFvzrOPJ1y4ZwJKM
- TLSH
  T1D3A6124526C4E7BCD4C24538354612D970D0AD9D84FDCA49BBCB6823B6A0EEF116ABF3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  Among.Us/Among Us/UnityCrashHandler64.exe
- Size 1.1MB
- SHA256 1f6a218f18a646e0dd2da9f1c93b90f141d8143d34b8c30618b6d199196a48b6
- MD5 4e135c7e47f87283ddfbac3e768f8481
- SHA1 fad74110ca161b13cbb3a4346323e48d30d5d1b0
- SHA512 d47f59815480608c3474d1d285cb495ea3e61b36e80ec031fdbb816e79cfe8aaff044f2f95b6c5b7f13a2096004b8527cbd23a9e776fa1aa252813b422514730
- SSDEEP 12288:UZ/jkEjk1MOJntzRqGccIl6PwsRHojVBQ4wBJCe8xUoXo4hm/vQfz2fzAA:URjkEfOHRqEpHopBiJpPghm/Iz+zAA
- TLSH
  T119457D6A665800E8D5779135CA52490FE7F27C1907609BDF23A0B7AB2F376D81E3E720
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  Among.Us/Among Us/UnityPlayer.dll
- Size 29.3MB
- SHA256 889d912da7a6897c469253a810eaa7682d12d0e3f2432f61f879f4152714af95
- MD5 e6556b475f949c2e94d35425ed5bc00b
- SHA1 7f543918458a795842c7a38a457a44c1cd0fc7ae
- SHA512 5694d5c98f2bb326c54081e8e082073f7b9777c8c8c0f3d0e9de2810580e5f18f2f507c965d1f7a54dabc477ad29179954a9a85c91b543f35781b7a729e23037
- SSDEEP 393216:Evy2ILJHr6HkCI7l3YxHJNzLxTc/tZ2TUtu7We02YF9:E6J7lyta1x/F9
- TLSH
  T164679DA6B2B800D4D47BD078D65BA90BFBB1344A033086EB52E149956F73BF11ABF750
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Network Service Discovery

T1046

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Drops desktop.ini file(s)

Network Service Discovery

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32