75cf32f90ea4a792df978cb6040aea24c046cd10e545a72179ccb2d4d096a77f

Sharing

Copy URL Twitter E-mail

General

Target
Hash.zip
Size 16.7MB
Sample260706-pdagsaax4k
SHA256 75cf32f90ea4a792df978cb6040aea24c046cd10e545a72179ccb2d4d096a77f
MD5 3dbb549dca47207334fdabb15f3bafe9
SHA1 a45e10052162eb7f7881970bbfad9da44332397a
SHA512 d33d1c99efad4338bbbc8268cbf52fb37b3da0fd591ba17233341749abbf3235e946994db549ef367f0b6c0f879d8d1ba0682e61b8d190fae7fbc417bf0323b2
SSDEEP 393216:mLqcFrRDXl6PP+au3KXxRzu5Gf4OtdQWRZXhLcEJQ0db:fkrRDXl6e3KXLi529IWRji0F
TLSH
T1120733B6E15AE1ACC401E7B76D84E100DB9C1936F05A46126CC5EBB0A61FB6F7E1F90C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  FilesUpdate/Data/Lua/Windows/quests.lua
- Size 7KB
- SHA256 6bac232010c6e67ec7c200cb1f8320c6b4ee8826bf198d4da2ece852855b15ee
- MD5 b9b0af207ed97cf405fb2d3e79a1f5a3
- SHA1 29165588f92c0ff8f5fbb46aa3f7231a2e4cdce4
- SHA512 7fad2e7fc44fbe5bf369663ab136c7444d45aaa174f36d903cc11b670d88f18fa298c49b46ee2ca1e82cafc392f57625b29a96b94964f3deb29ef28ae3b82c21
- SSDEEP 192:yhwezioM+q8bKCQdCNNyZXu1EECmo+bqK1CF1p2f+MaZmMMsVmEkl6OLSecS6S+D:yh9iffIKC/byZeMmo+G7C+MjJSZeT592
- TLSH
  T138F1321BD8192050D4B2E5D6DC13CA45F311223B320A157B79BE85980F7966AE1ECFBD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  FilesUpdate/Data/Lua/Windows/season_pass.lua
- Size 15KB
- SHA256 cf005782ed27c862303c61c59eb80bad89916fa69129e236db86148cdf3a2929
- MD5 63ed8f4ecde89ac1c72875326202176d
- SHA1 076d5c72c4509cc415e658806bff6397c81e0939
- SHA512 eca09f548be5f9dcefc7b7bf770ae61bd91fda898c5afc167454a191a1c850f0a529f2c0489fca05af49f86756fa96622c36a23afc637a40634035d3b34e9081
- SSDEEP 384:R4eOK3lx7JiJbl9RY+WnuZ5UkWbsf6xYocD9sfiD5JTK9FSTRY0YkK4VvKvb3Lhf:RmK3lx7JiZl9RY3nYUkWbxxYoODPQl
- TLSH
  T1C8722423E95124E385FBA5CA6D9B8C84F7111337101E42CF7A7DE1681F3E608E3E596A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral3 behavioral4
- Target
  FilesUpdate/Main.exe
- Size 11.1MB
- SHA256 3b60192f209ce61b02577254d30949914d2cead36fce81c5b5298f83e60d0238
- MD5 70671f5d567414b25c70e1dfe605dd62
- SHA1 6ded3f7a493e149f772276fed4bf1fa2bf026922
- SHA512 c7c55435bbe57d476b95b0afda52d8935cf3c42da2e088f3a6fd3483a6877ffe7cf8a33d6153d875bf3530040508d844bd68b98ff5e961d7663ebb29b97c9caa
- SSDEEP 196608:6/sDrIMQvv9eWF7DSj/y6UvgIjWMazRyf:6UDrIMQv027Db60jqMat
- TLSH
  T18DC6AE11B607D031C59521B1B47EAFFF857E69381F7928D3A3E0293D5A702D22B73A1A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  FilesUpdate/dmoprotect.dll
- Size 4.6MB
- SHA256 2d0b5c16cf546ab1b2f4b285e542beaf390208eb0897d31283393f447babc333
- MD5 3a81360c7783a2bfd458244c3b814651
- SHA1 45f0d6539bccf0b212349233183bafa14b4cccbd
- SHA512 b703bf766e904dbc0c3d7cb0ee82a4187e89634b8bc7e2de6e3f347f26bc7bc88a766a72dbeb5605aa60f87e1d6cfddb59d8359049e08314913a0fce12bea928
- SSDEEP 98304:nXPh6DfY3L3e2cEMmQCKGKtpiPgRSt/dAlWlOqieQKpr38StkDpYZpZLB:n2sL3cbmQClJPgRShoWjieQErRtkN0pv
- TLSH
  T1122633210261ABC1C6EA6B73F9479E017C52BB8F6E594572DC4FA8D8133E6BCD324C94
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion discovery themida trojan
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  defense_evasion
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral7 behavioral8
- Target
  FilesUpdate/dmosys/dmoprotect.exe
- Size 4.0MB
- SHA256 2a00632e9b56be5754b07ed3db8d461683f6a08664fad0805212f1f7c810631e
- MD5 5110308132c050aa557517aec254ac13
- SHA1 3efb8e0a8d2fd579b5d3a09101ace11f48f829f2
- SHA512 e710f7dafefd8c010cbee523591fb0cbed9475a53dbb67fb940e609fb3960e1483c2c5670c565a30e84c9267b0eb84f2a2ee9214d7a7482907397dfa69480987
- SSDEEP 98304:dMSRu/D2FhZBS5QMUZdHGfBEfzEl6/A1Lpm:deD+hZWQM+midupm
- TLSH
  T1961623859BB0CE99E556097024E01B1C7DBAF3D5CAF803D93C81ED76A87873E853A634
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

adware defense_evasion persistence ransomware spyware themida trojan
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  defense_evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral10 behavioral9
- Target
  FilesUpdate/dmosys/dmoprotect32.exe
- Size 3.3MB
- SHA256 21fb28336efd2053ea8ea9888751657c39858a8360c7a4b6711af96f285d0872
- MD5 1ed9c149af9fa240bfa9138002c21ffb
- SHA1 c9f0248c285ee922e74b143e8ad7a7f22b196f3c
- SHA512 dca5eec690598297e7c85f0876e48114ca90caffdbe80f259a4e48deaf98fa167288d2de1c2d411bef350e6d4aeaca4df75a2aa6bea1039aec9196406b6c0ef7
- SSDEEP 98304:dSwZVAV94OpFP+pBcf/2GFP0vGxUWfvNLtgjI:4wm9tFPWBOeGFP0veNvNejI
- TLSH
  T1BEF523C2A670DAD9E667043428A50A1C3CBEF3DC47F443D53CC69E35A8A871E863DA75
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion discovery themida trojan adware persistence ransomware spyware
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  defense_evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral11 behavioral12

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Badlisted process makes network request

Checks BIOS information in registry

Themida packer

Suspicious use of NtSetInformationThreadHideFromDebugger

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Checks BIOS information in registry

Themida packer

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Suspicious use of NtSetInformationThreadHideFromDebugger

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Checks BIOS information in registry

Themida packer

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12