5aa1ccf84205fe4e34cd74c7367e9c255e7a065ef171d54f213d43afdc1c0f06

Sharing

Copy URL Twitter E-mail

General

Target
MalumMenu-3.1.1-Steam-Itch.zip
Size 30.0MB
Sample260707-18tppafy3m
SHA256 5aa1ccf84205fe4e34cd74c7367e9c255e7a065ef171d54f213d43afdc1c0f06
MD5 ee5b5dcaa53afa38b1da9bd7db4bf40e
SHA1 704b3e716d5298a2829a8b2315ddcf55849d2201
SHA512 80bb8e8ae680932755abea757be21aa1d3010a84c67dff1f531267d606deda4f657c4947a4f1d58b3afe15fbd3b2651f57d424a5b1e646a3faabac4ed5815114
SSDEEP 786432:4TBw/TtJ48YNvqv+zNYptyB0rdWpXdKjGWCtRXDR:4TBiz454Xyar4zkGW+9
TLSH
T12767337AE090D8E2D87B38360F0FEAD793A6234259D1982E471C50C0E68FFD3B65D55A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  .doorstop_version
- Size 5B
- SHA256 75a2f501000d4fe28f74bc7ee66dae5581959d28b6c44f0c1b0c05cd5ba261e6
- MD5 7c038681746a729e2fff9520a575e78c
- SHA1 24081282f3a9a62c341308c388d8ed137057665d
- SHA512 2beb8491265f6e4b9736eef7cdfeff5e3a31ca320d00c7b95cdf25afeb04c42343800e8c74c787ef4ccf561020ff3a5d2c76949459ecf69ff5f3d7567460975a
- MD5 SHA1 SHA512
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2
- Target
  BepInEx/plugins/MalumMenu.dll
- Size 132KB
- SHA256 eeb0a76f5ca7532ac3e1cff6d4a223d48f43576b6ba0dd626fb1446ad96ca2f1
- MD5 4c263482a137015cd3cd18fee6113c33
- SHA1 4bbaefefe2f6f151ee163702d3bfb6b13e500161
- SHA512 cd7793e5e364a50cde49414155bd917eb6ec9f5f567991c354c251d54f8a059875811ef6e3546eca74a604444283f597b12e05b77cc18b20a13d987458951907
- SSDEEP 3072:MBYqh5diqFju8FrxxuGPogOOraVXoXNwT:KYqh/pBu8N5AgO2aV4Xm
- TLSH
  T1D0D3076027E98E69E6FF1BBA64B1011546BAF703C9B2D34D3DD170ED081279ADB113A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3 behavioral4
- Target
  dotnet/System.Security.Cryptography.Algorithms.dll
- Size 673KB
- SHA256 980fc7e2b974c68356441637a070b5b901708a153a5fe71cd8f68a28a0f992d8
- MD5 e609db7c1b4b17201bf8b3bd3986e98c
- SHA1 92bf534dba303c13a103354245c16afc9beaa4bc
- SHA512 679b4f8786b65c3f8e6bb5d76dfdb884d2a05c6aecd28168d2f97c0df6483fd8dfd0c7313946c41963516db5d88fbcf3fb183731c410672fa9da54fc07ff9c88
- SSDEEP 12288:RRDfsFv/pflaymMMD64dH571F7fvADizo/fWBHLihslxgqB92MbUmVa:RJ0flaymMMD64dH571F7fvADizo/fWBU
- TLSH
  T153E44A263AC9A501F25D04B58276E925932EEA90573BB3CB1648E7D810F2FC54E727F3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  dotnet/System.Security.Cryptography.Cng.dll
- Size 409KB
- SHA256 53c5c609ba615f688f85d1cface6ab0d653173c2af2a88ddcd958dd5587ec4bd
- MD5 00d2592835fa69e331246c24317173c4
- SHA1 272adc12db9a03a553f9c59713717455c7bb0828
- SHA512 6916aae84bd48ad10984257b9d144e99f538c7e8b38fb6feaed5ffaf4f15d394d91a566a24f556af19b80a5c20592c4e030a2b3fe6c131398373926421a7afa6
- SSDEEP 12288:5o+bntH3Zj7MnAQCz0hUgWWZ+Oaclbx/z9rUPB:eitH3Zj7MnAQCz0hUgWWbx/BI
- TLSH
  T12F946C36F7D49626F69D407D85F2EE51A3BACBD8073B53CB1440F1A920A77C989312A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  dotnet/System.Security.Cryptography.Csp.dll
- Size 168KB
- SHA256 faf32ad33f316fe4d12e0f2daeae50426af74e023106d04e3198dbc3aa11267a
- MD5 3b6361dccf69d2a2edde83ccdcf423b3
- SHA1 24003ba305878ff0cc50705e7789b0d8de900e8b
- SHA512 8386471114215515c3bac7fb5bb7263cb77f23549197a7ff3458f2e877664682995052d7134d84e9b2806002492e270903c3ba42f4ba4396f492a92e1ba238db
- SSDEEP 3072:PpG8H04pXhzXYGzZumz6BLImz6ZLx9JN/3n9AUQ335Bot72LvbScvbBdY:xG837kGz7jUBot6TScvbM
- TLSH
  T18EF36B53BAC847B6E79B00B540B6EA95B77AB5CE0367E7CF4980F1910863BC156302E7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  dotnet/System.Security.Cryptography.Encoding.dll
- Size 86KB
- SHA256 e9121e278e75a4e8fadec656ce37ee3959e18e3c89d4212da4f47ec4ba840ebc
- MD5 fc5a77d856ce624c6c8140098b1ec000
- SHA1 352333183fefab39999143109427f3a13632f11c
- SHA512 5cd1ba9e746c53365b82e491d16ba36778f919ce973b7f6ff81ef81cbc4bd6e93da7d00f24c9730493aa88d8c510c4219a4dd2ed87641caa9b350858c58cc32d
- SSDEEP 1536:ncbT10y8Ec+BZVeSRzxI6vtI1sWRmWZzn:ncvSjEnBveSRzxlvGTD
- TLSH
  T135837C0D32C4C31BF25A8634A3E7D515027DA7B2D793ABCF1999D18592223C29A72D3F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral11 behavioral12
- Target
  dotnet/System.Security.Cryptography.OpenSsl.dll
- Size 30KB
- SHA256 81dc8f76ffeb06bca9d383d5b5af7bfcda2dd344ce37bfbb696fc7ee54e58179
- MD5 8459b092722b57f53b13da40ae43279c
- SHA1 db67006ec9909e7a92b8a81699848a63542367ac
- SHA512 d0dddd30d791024a47506fdeb462ca045d7b3cf7e8e9152417f1881a7f015be90c5ae2a514319bf86af33872ee366ad09c397c8fe717ae1b775301e56810a6b9
- SSDEEP 384:k49WAfijRWPn/+bwPV0D/F/pQ+1+HCeqtwljWvWivK4OcVVaFN9S6sBlHRN7x17P:2peqyla+iR1VIpujxyOQ69zh
- TLSH
  T10DE22A12BF98426AFCF3453122B5C6115E3DF6C07A12EA5F158AB6882977BC0973137B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral13 behavioral14
- Target
  dotnet/System.Security.Cryptography.Primitives.dll
- Size 119KB
- SHA256 981e31230862f895f7a8786348b704857f579024c3abba2722a9dd69c33e004b
- MD5 6979c68f77b78a98617dc85614a1a1e7
- SHA1 ffcdc8781087937326a765c1cbef69afba86a664
- SHA512 66874b2bae770575fe269f19e1536ee82c48088b59d08ce837cb8bd07d4b5b3936df0e9fc1960640083ed75dcc12daa07b1fddb253235d2c68c182a27309c812
- SSDEEP 1536:p9w0JnkgRJD6OLa6UAJ2NL7wJ+JbVUoEy5vtOJA5bP/7a4PpqFzv:ptnNJxa6UAUhwJ+JbVUoEy9M0/uECL
- TLSH
  T158C35C15B7D8D263F28A56B542F2D2D1073FAAB12F22D7CF1648ED4914B2BC849712E3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral15 behavioral16
- Target
  dotnet/System.Security.Cryptography.X509Certificates.dll
- Size 424KB
- SHA256 a11c410cce149da2137b0e4b5f3d695aaa3e6da0221b47a229affdf49ebcda43
- MD5 d7bd6614a7b42be57dbf1eceb6fd4662
- SHA1 056d678b9ed68cb4ec314fec48d1a7a05121e084
- SHA512 b5d973a8de274b75e92b8f7831833379a09c56b8f87bc4a21fb92a8193b29b7128b00e13efa385ba455572b48ca4f20ed5fcd8051a7e285b875fc6b745f1f2e2
- SSDEEP 6144:GfcCHyAaGk5ds5gM1yZGqCCMV7IKHkd6UNHCKsO3DtPYufvh7OzxqTTp8gAeh:GUClaZ5dXJZGqCCy7IECChaOFoTp8FC
- TLSH
  T1A5947D11B3D6A925F79F0AF4C1E2E12592BEAAC4533AD7D7094CE6EC3061BC199702D3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral17 behavioral18
- Target
  steam_appid.txt
- Size 6B
- SHA256 52d19b26fb6f59cf5c387cdc31209de1d6f440531107d207966584e8226847d4
- MD5 4e877dfa27554f5e584f550096819ea0
- SHA1 6e28864a0922d8a3dc5e41eb081930468140aa3f
- SHA512 131736a4fb1c4191404d8150151d4d4a4134da1984cdbc350e8cea432b2052c6260e412ffba2ec36c98ee88d449be502d4f0ccc9814af3ef5f136af553a3ac4f
- MD5 SHA1 SHA512
Score

8^/10

ransomware adware persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral19 behavioral20

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20