79504b6f5497420e29af6d926077aa79dcb9f85a01e14b5731913e899ea631f4

Sharing

Copy URL Twitter E-mail

General

Target
SteamML_Online_Patcher.zip
Size 310KB
Sample260707-2k6vsaf14n
SHA256 79504b6f5497420e29af6d926077aa79dcb9f85a01e14b5731913e899ea631f4
MD5 737202ad2dacd7bb1bff0e263b7e35da
SHA1 e5701e057df355fd354b73ef095b5053e5d7ad40
SHA512 1c265c358f636cc0fa46f2a56ef28de7637b0301871b8f79059f9e6d3c8da89f450816e1f8d2be8ed88ff74177a334be676a6d979b1995d6b4ca689955af036e
SSDEEP 6144:K+YSoxdetkjg1MOR/vb9Zc8rKsHiQw5oKmylQY5tfTEpM2EbMrEHi:tgxsKjg1MOpBvUZiLm2EbMb
TLSH
T1F36423913F52174BC11C2AB1929BD3CF9C7A53A70E62020C718EC6D1FFA879271965ED
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  SteamML_Online_Patcher/PatcherFiles/unsteam64.dll
- Size 352KB
- SHA256 07c70d7cb366da4e1769012ae0f5f09fbd03c198c9fcff11e91acd1c1339c3c0
- MD5 71cd1bc714386d416e67a21be61cf85a
- SHA1 99f64d03c15e2133e1993375b9722c6677cf886f
- SHA512 87a5570f3275d836f487041f02f97addbe894452ef43840758c59f81b477b7a3525c7685646f503d74ab8cc8320b49be2aacdb3358859da82556018495e5591a
- SSDEEP 6144:4IQFU1uOfDchMM3Wndm1+M3aFxm70a6nfnAhdnvAG76XDLYhCrepl:bCUQOfQhMLmyFxs0TUlvAO67e
- TLSH
  T1447423F7B02E9163EAB26633CF2E2DC9074D1081F48AFD51DE9C9A0F25196DB170742A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

upx
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2
- Target
  SteamML_Online_Patcher/PatcherFiles/winhttp.dll
- Size 25KB
- SHA256 93406d0a02e7c164b89828cbfe3b289930a112d2eca50bd4a52e72ece169e6a8
- MD5 babed39aca9e01afcd2b4c97b0ce09fd
- SHA1 609323cad91f36181c5df2733a57cb5e9f87a246
- SHA512 452e9a38d8af7c5d3fcdd666fc80d752598b4671534e3d332cfa704100210ed015be7cad613c3331539e92faac42b186d26dafab66d01578177542a13b4d07a6
- SSDEEP 768:lXPV4pHX+qAYXN6n2FtsC1fxgKTb0kcmckVPxIiT7IO:lXtC3InetsC1fxgKTQkcmckVPxIiT0
- TLSH
  T114C280A273955278ED7AD63CC6B1A787C27370681DF1920F03759A84CF237416A29F8B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  SteamML_Online_Patcher/PatcherFiles/winmm.dll
- Size 16KB
- SHA256 bfb385ed30eead316bf65187ab5105392efc4e894b4d6a79adea74db39a73523
- MD5 6ff8529a8d5e1564dee532dc0d43faa4
- SHA1 c7e53d6e67e8b6aa718e76a0d4e5ae68717323ff
- SHA512 530e87fd40948d1a2c0bd8a5dcdbb7c21412d9d65e1633fa4e69c397c5c55951b53980f9e343a69b0808e5b4b9ee40b18e849b88db66a9069c5924200044338e
- SSDEEP 384:lif7k8eShWB2+H1jg5lS0XyACPdpZUN8U7ZSdCbraYP:lif3ekWY+HZIyvFp2SU7ZSdCb
- TLSH
  T113728DA40A94D59FC644E13B0C93842CDBB6A3D7E2626B13E7613F86C741B8A648DD53
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

upx
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral5 behavioral6
- Target
  SteamML_Online_Patcher/SteamML_Online_Patcher.py
- Size 2KB
- SHA256 bd8efdfb08ff1aafeefae28765fd74cc979fbb0b85cb08d420b896056e77c66e
- MD5 ee967c58ef6c737b7e097b1ef7959a92
- SHA1 0996b3659795f2c6062d085582eff9743c056f8f
- SHA512 49a67877fd1e9702087c33d83803ea54ddcbb4d72909acfb2d1b9e157894a6e71dee4b28e52d66a7042179ec1e57f313569c702a959281eae2c25476aee58d8c
- TLSH
  T1D151FD200E629C689273DE6EA4077497E56F82A7447C652278BDA082CF7C48152F9EF4
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral7 behavioral8

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Drops file in System32 directory

UPX packed file

UPX packed file

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8