2af313d636f792601b2c1fea7898248d1791db456c1057fb50754cbbcd128ab4

Sharing

Copy URL Twitter E-mail

General

Target
Geometry.Dash.Full.Edition.zip
Size 408.2MB
Sample260706-2ea6xscx9v
SHA256 2af313d636f792601b2c1fea7898248d1791db456c1057fb50754cbbcd128ab4
MD5 8a15c2c54324031d43215f7cc1eff673
SHA1 9ddfa38c3472e678acb0e14c0ffdace7e4dd398e
SHA512 85664f862141982dc4f130c6bb08004aa3ef2e912a409afe2709cc921c84df7693ac7bcf48d291af00e4fd623c36c3eeb6a500498f400ec2d5f090a15d49681d
SSDEEP 6291456:5n3fXPkA+GwzlVyBjl5ktkhum6FY1czZaL6z5/+cc4wYLhE/T340FbY:5nvilMXmeomV1czZ/O3DY
TLSH
T12B1933A491DD60FBC99E3E7151DA31329DA1202FD03AB98DEF5584F816EF8C2725A70C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  .levels
- Size 3KB
- SHA256 3bb523d8f8cee58f6adbe34d316196aaea2aebb123814859c775b3f51d8df407
- MD5 55b87537aa019e08ad59d4a6666d76f5
- SHA1 e26247659e189b973a9453415ffc018cf457a5e7
- SHA512 1cf90fa77842d65cfe68d9e6ffef4b0bf6e33c2f46b5cd7689f093075e4338d0c38ec5402734dda851d097c5f4e70d4da400ad1d885f82220aeda31c8e3bb036
- TLSH
  T10E61848D88792CAE79CFAFF02B2F2BCE5A52421F05C60E8656CEDC5B7009DC8314D616
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral1 behavioral2
- Target
  ALI213.ini
- Size 1KB
- SHA256 053f8ec640a7e50fe0460614049a94f782f09841de34cd12b8c1e3df6918c660
- MD5 8bad962894510c45bbf46fd98f688796
- SHA1 8cc5826557e27fcfab0eb53ed6ec15af6fe6f18f
- SHA512 6368c60f4313793deb4b2211ae3e463edf205c9731c16582471b175a7100689975088e7f01af0d0c2bfa2267c172a49a8d5d010ba4d6d4cbabde4fddbd0b1d49
- TLSH
  T14641120E43CF1172132901A115A7BBB0F6B470562D770555FC7C678C3F46FA9D25186E
- MD5 SHA1 SHA512 TLSH
Score

8^/10

ransomware adware persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3 behavioral4
- Target
  GeometryDashFull.exe
- Size 5.0MB
- SHA256 abe4d7e3960edfa7434829c5bcabf2e4b40baff4fcc66e393ac7017e672c7fd0
- MD5 c5653b5da7c76791dc06fcb9dba881d4
- SHA1 7f4456cb71d1760b6ab17e5503351aa6ef646dfb
- SHA512 dc07f55467a34201ec40f70110e2ddd2f94d9a7920d57dc2f0784df6dab949323b41cdd86e9daae6a1104eabc75cd787aba66e6e4d36f658cc367e08b69fc13d
- SSDEEP 49152:quO8dPti2TXq8fWTHI7KO7DiibR4VoVNGDw6xfSMnxfSRaTQAYjzDTjE:BtbqyW+KO7WjGVNkVxfSKfSR
- TLSH
  T1FD363961FB154C57D9C50BB0E264FB3B04BC1DC26B2D78C392F87E5BB1A60A3166906E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  Resources/AchievementsDesc.plist
- Size 140KB
- SHA256 b85fe74963425ebc2298ffa35efddb32b42bd77cc4e87f37da15ba83f6bef38d
- MD5 33c8dbbe112cc684d31ac3465a721bf5
- SHA1 2d93d50998ffd511259e44385e616b2d66a96e58
- SHA512 6abdb768405d270318df16608d1d37881284a1915ffd5d5ef49c125c89f45b84e927a5916d052ae99e9f019d2cda2f28a2d755f9d02ef9f3b779cf35f186e051
- SSDEEP 3072:FhrPlBht7mKq7QOCg/SpnJzVX4wdDDmAtqAldLeLBJ1e6AZFxBbeOlk:FhrPlBht7mKq7QOCg/SpnJzVX4wdDDmv
- TLSH
  T1B4E3B3B03E213B694C4501D79AF1C46E08E72DD93DB805EBBCE6847BB708F2B947594A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware discovery spyware persistence
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral7 behavioral8
- Target
  Resources/AchievementsDescMD.plist
- Size 11KB
- SHA256 91e281403655aca4c05f939d348f3c8e78f50dc08771643c26bbe859b180f75f
- MD5 f42d2988be82bee3c464dbaf6cf932ca
- SHA1 fe8cebe3a677573afcd59b8fad39322d72115368
- SHA512 50ffe6b60c2832d5771293cc499baa73d1e17ba65d393413d7657faef09ccc6bde50d5aec898150dd6570c75aa7f1ac6147a2cfb7bf109d05dfb3a558940fb21
- SSDEEP 48:c6ysSjLr67sU6JuTr6bm20B6+eor6VOx6t0k6Myu6khya6IM6joC6J36V6wfL6ET:9ysSiwpm2GkowVoB2FcxGbh2Zi
- TLSH
  T14232C2B03E223B694C5511A79AF1C42E18E72DD92DB805EBFCDA803B7708F3B587554A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral10 behavioral9
- Target
  Resources/AchievementsLiteDesc.plist
- Size 40KB
- SHA256 eccbdf16a35e35427eaf628e3248642bd1600bb2f955fc5a37f8979283bd1201
- MD5 155c8d5a9bdf9f505404c607d5a759fb
- SHA1 5487dc580c47eba6f3127c928422c899addf627c
- SHA512 7d877e0acf0bd09187801e1536b4a939cd9f1b808d1389900fb0acad1ced954b84a87e1d555935c1d97f58adb11c867c0fdba2214e521150e2fe4eaba57a848a
- SSDEEP 192:IsIMyxFXQ6UgaaoBDUs3qu/g2WvAGqW6NZ6WXwb4L7tpJjlMxd+NcxiFj5rvoDnB:FDlk4L7tpJjlMx4NcxiFj5rvoDnYaqRm
- TLSH
  T19D03C4B03E223B594C4511D78AF2C56B18E72DC93DB805EBBCDA807BB708B3B587554A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral11 behavioral12
- Target
  Resources/AirborneRobotsFull.mp3
- Size 4.3MB
- SHA256 3cd18bf3be8b871e1192b092c723b3fd11e0832838e07f688f948ef379d51e07
- MD5 2c5b7056bbfbb7f02c9b75ca60f5402a
- SHA1 45c43ed84da23c3b5d4a5b7d827de91f426eea27
- SHA512 8c8154760469cffeb2ed23630d766ca17b7484f2ac09e4e02e64364e3a298ed71079c92b9025ffe4509b5190bf4cbd0b52e9fc458ebaf7c9f9777e4ca3075223
- SSDEEP 98304:/yCKA59f2VI7D4Emt87qNQeIp+0MV7bYP2ggC4uevtUv9h:JKA6VI7sES872tKXMVIgCjeYh
- TLSH
  T18826232D7B11C4FEF50369F8B35F6264E9993E9B6075A0C9FA22F2C035730A1A79508D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral13 behavioral14
- Target
  Resources/BackOnTrackFull.mp3
- Size 6.9MB
- SHA256 8dc1ec9b7c791ef86cf5d6380a65591f8e00ed51e07526ed97ec529e8235a016
- MD5 bbe036be081819c36f0798a82877bb77
- SHA1 879642a6230e11bd0486c2211f3754541699a1c5
- SHA512 d894ae281e60019ba477a7b33aa917563790176c2193a9601ba48b67ef43fb8a1ea7f03fec6aa36d7cd77421ed7edb8cc92169608f6e9a849ef6091bc71bda87
- SSDEEP 196608:xd2ZquWQG8uz/qTo0lraYPqd6tv6bWo4gIny:xIINzAGd6l6r4gwy
- TLSH
  T1EB7622061B01667CB14BB9BD77472786D7993E10F311C5D2E4BAF339A0B71B69393288
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral15 behavioral16
- Target
  Resources/BaseAfterBaseFull.mp3
- Size 5.9MB
- SHA256 315e956fd7a5e2eb0ee64cc823f10649692487efd4b5523b9577e024f4a14386
- MD5 82849bf9fe3c3bde9a173ded3a84d139
- SHA1 30204fd368368539ccc204608a84d66ba0bfff44
- SHA512 c97600c0fcb37ac60f106a3be5e5d508cc14c8d0da8e9c27a9e0045b1f31b0b9125f9e29edebc05f66c65e734ff727f12ea358d569befac1dcb6e0850882ed0b
- SSDEEP 98304:+68wvzcDv057wMGCaOcSUhT+fc2NfeX2GkQEOTvZslRh02XCMZESyohj6JGE6+AZ:nvzcDv057zhhcnhqfc2gGGkQrud5fioV
- TLSH
  T16B563392C5149229F887B4BC659BD5A1D80EEF3A2C87D5D1BC11BA51B3B3CB123F418E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral17 behavioral18
- Target
  Resources/BeastModeFull.mp3
- Size 8.8MB
- SHA256 26325434b7e3343666c471eca452aaaa37aac9d49c325eb0c4cfbf2548434632
- MD5 82243faf322c1b8c85622bf2caa15dc0
- SHA1 7c12f38c1b113e36617d3896c816bc8e7c7d90a7
- SHA512 9b3850534c574c50766de31c08b49774528c6c8e51bb1fe000417b97daff7eb544f96a097e2a7040aeef6afee4be2b0d98b9a04a420cdf24c1ee91851b9c5f09
- SSDEEP 98304:YKvtkTIkgkDn3eM8Wd8LowuJPEF/73cGH0/Wq9zx5vVfUbNB9J7N/b8HE/7:YKFgIk1L98+Y/7sGU/lxtULl7
- TLSH
  T1CD9622466318A27DF11BAABEB3035790DB4A7E54F204C5CAF5B2F738A1775752B03288
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral19 behavioral20
- Target
  Resources/BlackSludge_AnimDesc.plist
- Size 19KB
- SHA256 b02f906684022f76bbada1d4e698dd336f6e9956fdfe6c3a579040bd948b3ad2
- MD5 2683710937545066c073e3c3bba6d539
- SHA1 685b2752d4434a152350b0dce5bca063d414065a
- SHA512 431e3da1ee4581480084a07d39fced6bec23cd4828de728166f2b9393e63ad2eb1ed6c775a32ebf8362d0732c51872d12425ba6ea7bf8348d6d418d71991a8ee
- SSDEEP 48:p6ysZ6TxvCJXlDkbsd5KCJXltxbs6FCJXl5Jbsh2YCJXlaMHbsuIqCJXlJUbslN4:Uys+4GWvZah7VnHgMroYk6GEhdMJlG8q
- TLSH
  T1C59251A402E5C6290C7559A293D1952ECCA932CF8D7704FAFDDF85470F7AC274AB3922
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral21 behavioral22
- Target
  Resources/BlastProcessingFull.mp3
- Size 10.7MB
- SHA256 cf81c8f7f06b9847752d8cc99a7431aaddc6fd773b10a1f84948fc7700af3d56
- MD5 1a88a2384d4b6f93f1e0ae91d4015557
- SHA1 7dd3e4e3275573df15dcd59e4c5f720277728b67
- SHA512 e680dba8fdcfe140b5c34eb722b5cff3d778412877a44485cd50a2d506a064397663fc545f2957233eaba73a3d8a50837a1d5f4e58b7fafc75ae1ac90e8c9bbe
- SSDEEP 196608:CGIxp838inHnkWmvd+R+WksIl1hq+rtpIem3CkWYGs:CfpIRnZm2tkLq8pxmyFYGs
- TLSH
  T1D3B623A34AA80266B54F6EF992AB12F1D1046E71BF8758C6AE457D33F077D2273B40C4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral23 behavioral24
- Target
  Resources/Bloodbath.mp3
- Size 9.6MB
- SHA256 7f0c4ff207220ff5a5de80680176a7b034fc57aaf10194569b839a8af0c76a49
- MD5 c4a1b8d431f238bc5b0d69b11e9a6f30
- SHA1 52a79139782c47f78cc9f73db13fa2ede7954e5c
- SHA512 1445caeb79f9de8aeb5a05c8b40cff055c154db66cf4dc553e8bf7f131415a78d29c288cff296f6bdee09c6f2bae63806bea2537e316cd5c572ec1f836b2aecd
- SSDEEP 196608:uM/ysZR8E9sjeWIkEIP4Jz8VZBzp1SpcfdJpXo6DY+:VR8Eije5kEJ98VvzpAcfdR
- TLSH
  T179A622420305663CF11BA9BE779B0B90D7497E12EA25C0C2F5BAE33EA1376B513536C9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral25 behavioral26
- Target
  Resources/CCControlColourPickerSpriteSheet-hd.plist
- Size 6KB
- SHA256 8c42e6abdb385e9ea2ccdd3969e58c3c7202780b50f593fbc25dfd2111a3bde8
- MD5 33d6eeae51a761ada4517f53966c1d66
- SHA1 ce667e1aa8d0ed460e0d37d1a83a1279ebdd008c
- SHA512 440b8fe889f7be342049e5c88687c0a0db0e601d74a1958d101fe8c78424d6bec0e6f1254df9ba4ebb95a1658d24729df5e780a560e5441bd025f3b444be32fc
- SSDEEP 96:mysHvlbW23eP23eWCm23eZBva6E+a9NRiTCR:zstqoePoegoe/O+ejR
- TLSH
  T1B5D103A602C0D219597059A693D0852BCDA835CB9DB311F6FCCF91434F7BC2B89F3922
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral27 behavioral28
- Target
  Resources/CCControlColourPickerSpriteSheet-hd.png
- Size 104KB
- SHA256 5e692cbac2875a9a2361ef5e68b67476d1944a3499989f27cddfb0fe185f765c
- MD5 5ab698c6594cdc52fb82ef76ff1bd58c
- SHA1 c19e99810de0450d429b6d1401b1e2ab70928e52
- SHA512 81f4857c109f25eec4a77066fb0ac6654847d8370ca4d7f0df6f1327689925fe8f10047d80f566f7a3c01a9cc11389bfc7222396dd2128f4678d09f90af55e74
- SSDEEP 3072:62R7wLY9K4NKq7NdRY/3hGl9MUjv9BMRApRI:62FwcEad25iD/MSW
- TLSH
  T1C3A312688DA273299B98E78D4E1CCA311ED46033CB7CBA11727B8F9419053E54DBD36B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral29 behavioral30
- Target
  Resources/CCControlColourPickerSpriteSheet-uhd.plist
- Size 7KB
- SHA256 f9cf67e7723d29c9ebb68b6d2fc01251d9b06a23b06ab74b66ed963452aa4ab1
- MD5 0ab9a750e850ff3395020e3da59589d2
- SHA1 491ce66061ba856e60f8d4dd6fc06b942511eafe
- SHA512 4e8a3515f0fbbceb835767a561321afd282dd1625468a82322646d3fe5a66d2227a8f458cd6b9c9b7e3ac48c519f989a0f43519c6b55fecfc9a57818d8a5b831
- SSDEEP 48:cnys5dPVgdPidP9vdPDKdPI9dPedPDdPAd7VlQndPNdP6xxZWGgRSxGo:mysTPgP8PvPgPkPwPhPWEdPvPW3Rpco
- TLSH
  T192E112A556D5D6280E3509A293D1811BDD9831CB8DB250F2FDDFE1430F7BC6B8AE3522
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Drops desktop.ini file(s)

Enumerates connected drives

Drops desktop.ini file(s)

Enumerates connected drives

Drops desktop.ini file(s)

Enumerates connected drives

Drops desktop.ini file(s)

Enumerates connected drives

Drops desktop.ini file(s)

Enumerates connected drives

Drops desktop.ini file(s)

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32