81e78d26fd88222537567de3c07e1abd896e4e77710eb53366e142e654c8064c

Sharing

Copy URL Twitter E-mail

General

Target
1777151302357-turtleclub.zip
Size 13.9MB
Sample260705-szev6sds5w
SHA256 81e78d26fd88222537567de3c07e1abd896e4e77710eb53366e142e654c8064c
MD5 c67906cafc8e23c5526e96f86aac3285
SHA1 8fb9f73152323a0384738cf47c535c6bca0bebd8
SHA512 8f303af019f7498d7157eaf2687fdff729ab4e0bd27f6ae1ab7d5f54955c5fbbda89fe7e740a9adbf372fc8cd2390d02b81468cae6ac6114ea2e846109368b5f
SSDEEP 393216:oFQws/rWCOH4GBd+Q9yFHmaqS82y2b2p4g2aBKO5NX:SsqCS8VHm28dNp4JaxNX
TLSH
T193E63359CD7E2D00C3DB83F92E895B8BE9DB20C8911530A4825B861C8DDB7E94768DDF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  build/brotlicommon.dll
- Size 134KB
- SHA256 b3eb3f58a5586036cacc0c85c82ce822a6f7cd05903880355374a4eb64978cad
- MD5 af257e898fc4d8698e29c16c5e7916d7
- SHA1 a719be885574bbcb99561c74a14b2b33628d4d1d
- SHA512 5e7952047cdd54e6a1a5acbc17aaf1382d78dec3c595facea53d03135d416a407e996ae16334acd3d319b7870a062cd60e96b9eac81390c0fff4c7955c614349
- SSDEEP 3072:N4lzbWhNbNL8DXGvVh73pbi0tdpvGJaoZB7PxB4:N4AhdNorGvHdbi09GJS
- TLSH
  T11ED36BA1F3051736C26B227AE45A6BB8F33582B493630551B4A9066D60C3DE4873F7FE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  build/brotlidec.dll
- Size 49KB
- SHA256 b8e3a1da8b255fa51f76f912e2f638c6342f31d612d0522ee23710ceb55d2bb1
- MD5 8cd23c8634723f4fde1cba57275edb3e
- SHA1 e7266f916cfd939aea91d9453255e8cbc3e992e4
- SHA512 70526dc392b650764014d34cf215bc2a0445a059ef117cdf0f18145ae2896b5565892fe1c5196be75ff2952af7f09092c71f25197ba2e425a29adf4f4bc4b28c
- SSDEEP 768:2UwDM0oE4j4vwyu/x6oOWIH880mL/RkeqW/azQxARbYs3JNmG:2UwA1ewyu/xiHfL/vmrmG
- TLSH
  T1A7336D41B5E65A58DD13813883EB976BE7BBB8499301E3E7F2D0F6223E07AD113B5244
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  build/bz2.dll
- Size 74KB
- SHA256 c05cd98210049cebd99dab3706fa91899db34315066d4187ff57137b741f7775
- MD5 73f6b87164c68ed987a005e253e52691
- SHA1 5b88715255336dcdd1b12bf0d7b0a576033d89d9
- SHA512 fbb7d948eae46309bcaabbf987cfe45427c55f2fc6e85766cb6ee9b40d439ae40b9cfc47d90ed551ad3d36d9b7ed6004f4bf9436052a73b5b1ec445d761b84f6
- SSDEEP 1536:maoPj/yb4mgmidK3qFUYGwrxgaE7eJ6yUnz/2l/JYp82:7Ie78BUnyrYm2
- TLSH
  T127733B81A7A6BBEDD61B857982330212FB38BD3C0B5157BF22A4C7362B41FA55C71319
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral5 behavioral6
- Target
  build/freetype.dll
- Size 672KB
- SHA256 6d1f5033f52f098ba5445e2f7b058f83c25d7894119e6f3c721c025156c97ac9
- MD5 a4c6917e7ce10c3cc81c2ead434ca20d
- SHA1 7fd822c56e9e3fc066f1d3ed1d2081ea6193bb27
- SHA512 6f7a3d668caed8c436a47ffe58f6659a80d3eff64a89b77c5d8e731b193a26b1995b2bcea6e52ea0235dbd91ba1b12e2424c1a2bb63e248d6234699e5f705166
- SSDEEP 12288:5UfzJWl+OzQHDaZsTfJepcW6amB+ImlA1afEWmNRK:5UVWTzJZs9ep/6amBNmlUZ
- TLSH
  T119E48D82F3A016ACC667C27C8617872BE776740513109BDB56A05B6BBF13FE16B3A314
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  tc/ext/curl/system.h
- Size 19KB
- SHA256 ad2ef36f23bc65584b801780d1571e9691403bb3f7fb40da54b23c5f42887747
- MD5 9fedd97463af4247ffc8ff57e627e6f0
- SHA1 5cb2feb6e84914499723c6f8832104c70430118d
- SHA512 0fd83c55bb108ffadd68dc087ff9d270a8199188e1de12b6fba40bfd1af76a3823090d983485c21934953555e1423f4df1d237222333e724c1ceb8201b4dea88
- SSDEEP 384:4we77vPGwuAvQnu6LGrewBaNMW3WVCfVMpIV4epQSZYW7w8M8U9A95Tkbi4ePtjA:4xFM8
- TLSH
  T1C792C1811E8B945480F29621344D59EBD3C4CA73B1213AE071BE598C5F6D722F1E7EFA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral10 behavioral9
- Target
  tc/ext/zstd/common/xxhash.h
- Size 256KB
- SHA256 661e02c172a10b643a2fb73f6e67a8c7ec4486081a695ac1f194f8b4b6c1eb70
- MD5 b250c9292146d5ac93d01c7772bb9d03
- SHA1 e5d841230a7870437bdbfaa6208c39f1eaba8d4d
- SHA512 e2fde95b5851c95451c80c5aabba607bcc5173104bd9e091f9ac7a59e62c6841e283afe1ee1efdd0f997526271a6e5e1efe8bac1edcf6adda17555958ba84b7d
- SSDEEP 3072:l41hHpGiGGvOihG8nuHVvdvt2EbfRDnWWQPwx5zfTtL1WM/TeRIoCHE3:IEinMdvt7tp7/TEI1HE3
- TLSH
  T1B744C84E39A24D220D8300F7329D13C3A315985BB35195E6744EB6293F0FEA5D3BAEE5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  tc/keyauth/Haze.h
- Size 1KB
- SHA256 a3542126eb4c3bdeda3f896843aa87793677bca364f13dd8ae0604811e6b2068
- MD5 49d2246024f8b4d6ed88859b38e8469c
- SHA1 9fc972a2022c559ec8af4c3303379b5418d6ca51
- SHA512 d79b23650584f22066d69e249edb089cea9b1a30bea26eb2fc6f2c6df6c95e3d9d039d1f05432d4425b2cf2380721bc632219a2157603df734d25c2d4ffc9ce1
- TLSH
  T1EC31000386A4B651B9F3904B8E5B9715BAC9A5447FC17EAC98BBD3380C034809532E3D
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral13 behavioral14
- Target
  tc/src/cache/custom_entities/custom_entities.cpp
- Size 8KB
- SHA256 1c2f92e4106a95eab16888617880e8b2574fe75674aa8fe00eb10bd59b37e6f2
- MD5 c954750975c364bbcc60bd9024199a45
- SHA1 fd74e16b5f227ece933bc58f9dcde8f455ef7441
- SHA512 af45c3daa6aed02277337773033f6048cb7bdeefe24308f8a42eb07d4995d8ebc110c07d8b57a18a36b297cdada2f53a33d9f54989ea1c832aa4d0886ccc9694
- SSDEEP 96:e0Xdt3z9OpZvF4k/mL4tl4cVISQto02BbROFJ2fIszB6Snmu1bJ:7dt3z9OppF4MWz6O4I6B6SnbhJ
- TLSH
  T12E02CC0A89F42137E672AB7DCFAB1109FF238573EB146A39795DC0401FF529982A1D8D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral15 behavioral16
- Target
  tc/src/features/aimbot/aimbot.cpp
- Size 32KB
- SHA256 a980174ae47e69276bde834407be2b5434eef41026bdc0f1bba41c418acd514b
- MD5 9b01c92bbcf0b2c08def2a2805d06e61
- SHA1 05c5b8b0a60d7819d0ab635258f7a4a4721ec0f4
- SHA512 2ba19180f3099a1371854412eb076262c9c7f4427dd19817db98cd2dfaa594b63738e4927d4811340f7f5635df97726c98b08a5596353fd854296f3b9afbed5d
- SSDEEP 768:l1lz4sQSq68Dc4sQ+FEVAHClPl3UUKNUnOelXNbFz/KlpnYrDyUGHGvWiMFWEj4P:BT7FLHiVKNUnOeLtenYrvvW9WEUvgfwd
- TLSH
  T15FE285A5CFBC506B42A2565AC94B118BB93D80F3AF0C4C76FC1C911439E959F43AACDE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  tc/src/features/auth/auth.cpp
- Size 5KB
- SHA256 6253ffbba40097e3bb8a5769ba0c38ebe14f58fb09cd07451d9959d9a55849d3
- MD5 e5c24eaa6d8aedf282b6617745a13f18
- SHA1 bd23777366aded4bfbf99e044f7bdf1776aa677e
- SHA512 04c5cef19424a56d345904ccc31c8134bdcdd388513471542994ada956f8116e2e3b85daaf5eb06b1087da07fd842870c65a090606c63fa77a7b55f084f5c078
- SSDEEP 96:BnB77/7DIh+eFibRueWbUIy5i/BJN69oiJgWvZe5bWhmoiJgWvt2+CbyByQSwvFG:BB/vIQeFi82Iy5iZT69oiJBvZe5bqmoF
- TLSH
  T154C1CB8A4BF72C27C647717A9F2B90037617814397488F60F99D1328BF462B998F2797
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral19 behavioral20
- Target
  tc/src/features/avatarmanager/avatarmanager.cpp
- Size 18KB
- SHA256 14380ab78926a8f8a0a071263adf9b68d5a24fea27ea0efe336f53ee5e1f98ea
- MD5 d30ec8669b9a7aec96386da1654298a3
- SHA1 42a5028ae8e65c04507e3b91bfbd1cbbcf6096c5
- SHA512 883a34b9d868a936ceae8e85b370ac760f64a32dfa7f9bb49dc653625aef750e27688b0f03c1d42e5acfaf41fae7ab682cc969ad8c85d0bd80873dbcdd431108
- SSDEEP 384:LfKFYWBtEsl6ulzBF7uViqk/tKlhul3h4buY7ut7uri7oknctswxwE:rKFYfigi7ogclwE
- TLSH
  T1AE8235A64863A9118E33B36ACF164219EF9716336760C7D0FC9E41945FF5060A178FB7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral21 behavioral22
- Target
  tc/src/features/config/config.cpp
- Size 49KB
- SHA256 26607fa2c89ee30ec53b2b2514a858907758f36d0753e3377cbbf0d2829e5038
- MD5 201c3e857bb29a8d32d390584ce5e33e
- SHA1 9c9573f20215ae321bd9c759211e70815b354d7f
- SHA512 bf6f3a507a4890571b9f5067c8a95ae95d655ee872227e7d67b5c1fb189a574dd7f09570d9641c0eb671eec26a3f8c35fbc994e8799b11ac13760eea5597fc42
- SSDEEP 768:9RM4n3f0wu0w3OtsiYQCe3Onkp4EZtqrLGbmQYDZe7XL5f2NnxWnk9rOXvUpOBHT:9RME3cw9wYrY+UOBHdpJF
- TLSH
  T143337983EB2C743D4127473AC85F827A67718026323689F2ED34DE28159D5EE594E8BF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral23 behavioral24
- Target
  tc/src/features/esp/esp.cpp
- Size 66KB
- SHA256 929e2a17d323ffdf7ee3daf1dda65fd66488f5384363328246f9020e61fd41b1
- MD5 00abda914aa339bd562a56c8cdbf6650
- SHA1 223ec2a55fc2dff5caa55454563ed38e763c2191
- SHA512 e11a6fe4a917a2791c741028ac79c99867f5236bc88b48c7634f71c67e4194ec65e063f8fb0796351b06acbb75144e58214172743ce5b2baaeaffd92b8525b77
- SSDEEP 1536:J/35nkABcNwtFNwtQ6YDEURhbUgLakwU9BQiEvHl/SAubSNl2:J/35nkABcNwtFNwt/WEURhbUgLakwU9n
- TLSH
  T15C63B4898F2C802E14A65396C80F99AF626E45F15A3D48F2FE6CC43422D955F0E2CDDB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral25 behavioral26
- Target
  tc/src/features/esp/parser/meshparser.cpp
- Size 41KB
- SHA256 39abce6724d835afd978fdbe73685563b2478a06b5cd38c2e2aadc57362af433
- MD5 417e2b7c90f21320f77cd9eefc2ba868
- SHA1 b794b7065709cbd4dd07854c87dee74b4da2f226
- SHA512 057f51612b7cc5ad12326ff3421896d97bd6928af4e4d3067aaf351f39f430c5a990a2ab7ae2f58a1346c21ca695b3331fc26a17877e7bc8f616cfe8619b1a68
- SSDEEP 768:oIeqRxu7A//RkNqH8/RlN/8MbaNZO/hmnaNPO/hDXmfTtxvkBpAV4NjAmmzNxVEU:oIeqRxu7A/KNqH8rN/8MeTO/hmaRO/hY
- TLSH
  T14D1375CAF8EFDD0E1650659844745162D55CF482677FC3E1E4EE8224B2B98DAF3B08E8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral27 behavioral28
- Target
  tc/src/features/exploits/headless.cpp
- Size 1KB
- SHA256 5089177b4ab8fc2033da841719394d46a07c1cd1bfbb71364811cd4f2bb969fa
- MD5 7a240a1e463211c363a7051885f878a1
- SHA1 3a79e48cf76d21a40f8aebe36f8276c3fc8ff1c4
- SHA512 2db42f5fa0790f1861c0ddc949673df5bde770ccc3b4d54610952dd81c482fd43a827e54002b0e19dedf5d9a97824f831b167296fdad03bc018a1e17a9b54ced
- TLSH
  T10031A015B7BE700D02D30E96A6317046880FE4905758A378A06BE19AF2795CAD3CE697
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral29 behavioral30
- Target
  tc/src/features/exploits/korblox.cpp
- Size 2KB
- SHA256 34d751e7541b0e21d3619dd2cdcda03deb1e6c568fca4d716ce0cc8ba11f9ad3
- MD5 bcc5f7c6342a120a7e8c55b8ceb22546
- SHA1 60e5e7ae382e1f42147a82960ef9a3dd569f31f9
- SHA512 81216e38138013f5a99d5c80d0c5faf007863513f7417c1b8ff58fad7a656b0310fe2803a09a259a2b048a5295a06cd7f57bf8c47b618f35fb637944ab0986c7
- TLSH
  T10D41B215B7FF700E01660D4B6532B0459C0DD490875F7771B06EB0DAF27D1EAD28E596
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32