6a5354f7075c16cbe6743f4ba40ce66410d1d9d1af3df2459201ff03c1d1b4e8

Sharing

Copy URL Twitter E-mail

General

Target
FeminizationDevice-.0.6-steam.7z
Size 168.3MB
Sample260707-rlkc3agx3l
SHA256 6a5354f7075c16cbe6743f4ba40ce66410d1d9d1af3df2459201ff03c1d1b4e8
MD5 52d820eece3b491f9d19a631e25c27ad
SHA1 69be363df595df8cac4d3404cf4498865abafe0a
SHA512 dc06e688e86f7530342261ce24856921b0365e3875e43748525417f2762346e12e9233bb77077d5daa45e7e1334c0a8d20b9c0e86708e1398a1ba573fe2f2650
SSDEEP 3145728:BDgDT2pLj+jg3SdXkIlbTZSMWvQhwuB/zpxmw4e40s11+UDmVPiKRoQrRVqFw/00:RzARkQT3aQ+0/1xmjt11rmVP4oVJWu
TLSH
T12F8833440B4CA1BED7354B3524FB3FFD9B7A16E9E281519950B124B62F222B09E1FDC2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  FeminizationDevice-.0.6-steam/D3D12/D3D12Core.dll
- Size 5.4MB
- SHA256 8710110eccf43a32e5e1a04552cb344832922a0cd23caeecb764e18bd5cdffa8
- MD5 7fc05c9a8366d19302dfd13d09d3ebac
- SHA1 df07482f58cc84c439979548682cc44c48471a06
- SHA512 68385bde06684b0e9ea809372f151cd266cc4f9c3be14be0127a2e7468538f453c7da434ef5ddd9f751dcc054032dc6c7baa2bc5bbebd1c6ea3e5d148a931c1d
- SSDEEP 49152:DDcfp0Vm21RnkVNaAFiEVTmZA+kkIwaaKsb7Xvdq0SpZcxNom7nLMzh3:Tg21Rn7rImnbDNw
- TLSH
  T131465B47B2E95298F1B7D07CCEA34B4EF671702153605BDB12610BA96E13BE04A7B3B4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2
- Target
  FeminizationDevice-.0.6-steam/FeminizationDevice.exe
- Size 652KB
- SHA256 575c775cc26276c511057ab67e26bb73cdcf9063a0137fb0b3b91d22ec0b71ce
- MD5 267efc272f26fb85c84db9c29fe52a9b
- SHA1 58061aa52143f403a4c8b89a03237012dc1a779b
- SHA512 fe7bc16795796145e6676f2960e5ca03a0edd8b46fc37d12478205f846da9815ca484ce9372e6d6b6f341bcef690ed6e5fcb8285e3a9b9738b123d4d712094ab
- SSDEEP 12288:XrtfG+RHL/5Ma8YHaHmiXMkPKahAZYTRJsT0tEvsYNQ:7tOkL/xFbhkPXRi0aj
- TLSH
  T11DE49E43D64114CCC2AECD73C05739778B950EE21D2A996F23A5BEA37A72C865F07E21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Drops file in System32 directory
behavioral3 behavioral4
- Target
  FeminizationDevice-.0.6-steam/FeminizationDevice_Data/Managed/Assembly-CSharp-firstpass.dll
- Size 6KB
- SHA256 164ec174b0a4425473e2f50da7e88e4c843826ff5d1a05615349170b46360625
- MD5 dcb000585f8893f1584af4731580b260
- SHA1 650754cc6ab409a87172095c0c62d633654d0814
- SHA512 692d4d471795575c328afeab50807d633fb216c13ac32491901dfa9d1ecbaa01d69a138cc0d90a8067870bfe8883809e9449826d4f0b61129ba288e7c6cca61d
- SSDEEP 96:jN4/oavodwm1xGCaSVu210at/HlWYkOE1fBZJyD6Lkxk5DXOI4Fn:jN4Do1xlVL1p/HzkOE1f8D6guBO7
- TLSH
  T1F0C1F926A7D80233EDBF47BD9FF243517374B6129942D75D18891A68DC723101E32BB5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  FeminizationDevice-.0.6-steam/FeminizationDevice_Data/Managed/Assembly-CSharp.dll
- Size 354KB
- SHA256 961ffb42940c3d806e75c0ba99fea0b0868ca1ff3ce5a06e583a8a65e2761d4e
- MD5 b06d126d36558e51903d2eaf61f886bc
- SHA1 9c3eba4b53f3f76f5e3f99d6517b7b3f4f99b1e7
- SHA512 49d2878cb14e6df5fe4a326cfff41ef2d7ddbd5efa329f42805ec4d88201530009e838fea2bf0955b067363e400ffb3e71e31eae6af9fa779d308041eaf89945
- SSDEEP 6144:dq856sns41zuTDkw17562wvLuPYxExEPW+7WDBE1RTk0WaA11:dqu6S1kB17562wvLuPYS2PW+7WDBE1RZ
- TLSH
  T15A747465A3FA092AF1BF97B8BEF210C24BB675467538C65C1C9222CA0875F724D13B17
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  FeminizationDevice-.0.6-steam/FeminizationDevice_Data/Managed/AstarPathfindingProject.dll
- Size 358KB
- SHA256 4502cb130362fd63b1a39ac69faa67d8f713f7d24415e05114f0d86cb8eaf466
- MD5 358406d35ff155d430a5ccb199a8be1f
- SHA1 ae9b5be439fa901356da1502712d845adb0b832d
- SHA512 32bedbe8ec181fa634f4dc729a1b629573aa91b91f6e87c692fa5a6fc8d5edaa6c5d44c1161d75a00a812f204e8a5e239328f5e70266e5678395a548fdc71e6c
- SSDEEP 6144:QaC0RpfR9Z4e4sm7CLigFjBMFJ5aRYhnhc1e3YYussonPzTCFub:Qi9e20a2j5GHF0
- TLSH
  T178746C1067E84626EAFF6B76E47A0550D3B1F926AA7EE7DE4C4890FC1C627809C11373
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral10 behavioral9
- Target
  FeminizationDevice-.0.6-steam/FeminizationDevice_Data/Managed/Cinemachine.dll
- Size 297KB
- SHA256 5f1908da119349ea7595f4dbc1aa6c8e4d76262339b6ce08eaf05a81009a9288
- MD5 23045aa309818f1f72dd7c15dfbb2955
- SHA1 b515c71a59526e4ec7a3f21ff04cea83d1ab1614
- SHA512 69a1fa857122fdfd522f52869beadd958eb116d1f183f4c5fa1524851ae8c9a9e649dfdb3458817e8d6264e22a2e394e00bc31ddf488fee51955120d8a72c748
- SSDEEP 6144:IKt4WX9Us71czz8ZtNLdT3GKFoj4CMzI42mx1exVF/Ad:eWX9UmCz8r9dT2njJMzI42mx1exVFs
- TLSH
  T1DE54393037908A7BF98F07B9E059099593B4916FB76FEBCD6988E0EC2E4375054825E3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  FeminizationDevice-.0.6-steam/FeminizationDevice_Data/Managed/Mono.Security.dll
- Size 235KB
- SHA256 cb9c3e77c0dce84e0d8b34a0873e042a75b6e31f177257be031e116a879683e2
- MD5 b06133fa6f5568af121620e51b0faf65
- SHA1 1e44c2979ebb428622efec445f4eac5306c111d4
- SHA512 30805b89030170dce9078b43f4f8fff9a67c9807b44ff49f670772b4f47c37828df19175a64a376df3e68ac511e536564d32acf90b0fe8f9b5ffe1a9b49cb3aa
- SSDEEP 6144:mUjTQ70cnf8MoVRxS9iJdBF119RJXG2yY+Q8:nEiH119RJXf3
- TLSH
  T1B0344A1863F9531AF6EE8779D4B15019C3F4F50BB9AAEB4E5C8282AD1C027918C41BF7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral13 behavioral14
- Target
  FeminizationDevice-.0.6-steam/FeminizationDevice_Data/Managed/Newtonsoft.Json.dll
- Size 675KB
- SHA256 a56146202232958f46bd6a28b5a7da166aea123ee0d646735a46e5c341dfbf1f
- MD5 d751086b7423fd5580b5e909b06217b9
- SHA1 c1707b17df636cd6d4a804361fc6ead4ef9db5cf
- SHA512 86655b59ad62664a35a30807cce7dc2c2be8f1ece235f35dc9031873d255dc6f13a22b55d0386becbe927f007a14a6d936ba3861d1103af8f2fe16aa0afebe11
- SSDEEP 12288:aBNYm5IWx4AhnIqjCfP4bYaRLL0eglBmjV+0kRqQCB0jEIF:aBum5I24A5LYa5g1ByNyq5B0jzF
- TLSH
  T119E4282063A89B26D1BF6735B4304D1547FAF807F2B5EB8FA604D5E92C977A08D107A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral15 behavioral16
- Target
  FeminizationDevice-.0.6-steam/FeminizationDevice_Data/Managed/Pathfinding.Ionic.Zip.Reduced.dll
- Size 235KB
- SHA256 481cc0f9a53a9ba94f8ea3fc0fb2a520b41812c2fdc6ab10581751eada743d34
- MD5 1bebc6f68d83ae67251378ac7bfd0e56
- SHA1 7650b24feee9be0d5227b59c7f2735df6e05f15a
- SHA512 7ca948290df3d9f4f58d3bba2f5c2f111d74f6859b0ae145b94b08e288da8d24e863887decd5507e30b3da764f21912862b8536c828e13d5ed191ec8ae070b7c
- SSDEEP 3072:cWWdICvUvLYPPC1hLBy6YmkLqY6+xbrzEw/GAJkGnpA4Pel9GS5axw7Bx6W6EKXv:m2Oa1ohEwCspMl9kx8V6y/Q
- TLSH
  T185344A5427E8DE5BF1BD27B4D4E28061C3B6B061F57EEB8F9D4424EA1913340AA053AF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  FeminizationDevice-.0.6-steam/FeminizationDevice_Data/Managed/Purchasing.Common.dll
- Size 13KB
- SHA256 0b919dab305e2e24da0b522e67ae0db2e9b55d786019e4f098f7add2acf892ef
- MD5 c901af090bdc8bbcf3fb85d99857f456
- SHA1 f19cf0f3277229a815c6e9b55c07c68ee2f5bf79
- SHA512 e22db0de1f821839c71699c88ac68fba53b2dbe20d279c5923ddccc2863244aa20d92035e8626e0913f340e4a177845731f5342f9003187e63913e0e6fbae25e
- SSDEEP 384:RV+EYlFHJQ6NqKaaOJ4BoPZZC9KGV6nnVXEgLxzfm1ncs3rR4:apJQ6NqKaaOJcoPG1V6nnJEgopBrR4
- TLSH
  T1C2521A686BA88337DDAD13F2047313A16375D141BA13CB1A2D8872F9AA273860D51F6A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  FeminizationDevice-.0.6-steam/FeminizationDevice_Data/Managed/System.ComponentModel.Composition.dll
- Size 251KB
- SHA256 cd8ed1cf2e993bb7cc7f3ef552f10818c39492632086c5c4c627eb9413b48f87
- MD5 bcce35f4cdac0ad8a9279a32326d9e5d
- SHA1 0e6208d431d2b4c7fe8dcb27a94ab73b79e1558e
- SHA512 98e2d00cf1f3a2bab9b2a3aea01e69db85f95b31d780fc5e461cff5cbbaa978676056bb9e4de2e8e28938dc079d81c7662853f719b617e4939a6c3b2fd303c6c
- SSDEEP 6144:YkwkYfxuS0ZNORl1X1XYZGFU+22kUgUlAwU5e81hXJXee4jsURlXXMAX8O33iEP3:YkwkYfx8ZNCxL
- TLSH
  T1DE44281533FD0366EAEF0F78B5B480148BBAFA06B95AE71C2C8951FE091379499117B3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  FeminizationDevice-.0.6-steam/FeminizationDevice_Data/Managed/System.Configuration.dll
- Size 122KB
- SHA256 6c6a1d36c38fa92c47db93e25527622a29fe89ca6e70a2117c93bb19aa742510
- MD5 fe68044064cb5e12cab9a9531a9d5f27
- SHA1 1b872ab5026defb23a26f3ebdca376c420bf720d
- SHA512 11158cb8ba54847cfc8dabbcfc4dd166d3aad688ce6032943ffdc764626d8466da7b81b2836490a073690d89b6099aec5f90062a96bf0b9e8dae70a30211431d
- SSDEEP 3072:eGHTFkizuGCOE/htnREcacWown5WJGL0MIeWgNe:eGHT5+H/33vJ0
- TLSH
  T1D6C3F92563EC872BE2EE177EF8B515110FF1FA0AA436D74C5D89B0ED1827B804662367
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  FeminizationDevice-.0.6-steam/FeminizationDevice_Data/Managed/System.Core.dll
- Size 1.1MB
- SHA256 437fc98ff6fe1881087da0691f7aa6a94acc3a290a6c2ebd1f923f75ca6a109b
- MD5 92d5d9ab1aea9849a9a16a1a2edb67e6
- SHA1 24efd9d36efc966a937e7c01f4b7c16b69250099
- SHA512 56655bfc9884812c9c1f2a063e04223d81bc6768f77fa4458f1923842e2b2e87e8cbd87450f62cd24b5e809f960555d1f68acf94187d2158bf6f5e337deca600
- SSDEEP 12288:LWK8Xi19FV57751umv0RX15PgLdfJ18VjjvM44hvetIX6e+ixHzR:5l/umv0Z15PyC9vMNV1+iF
- TLSH
  T195354C01B3EC9B27D5FF7776A4B442A007B6FC46AB3BD78F104891A95D56B008D887A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral25 behavioral26
- Target
  FeminizationDevice-.0.6-steam/FeminizationDevice_Data/Managed/System.Data.DataSetExtensions.dll
- Size 29KB
- SHA256 14006372766148b96f8391e7fa5d3afaeed75ec49ca30e0a1758107006a86c6c
- MD5 af6be932f45fa52f539af7164044e799
- SHA1 ffee747097707f75baf5ae90a979855c1cbc3f68
- SHA512 b451cd789ff89c1c9ac02b50f0be04c97d128f0f5aac9663bace58068486c4755959b9a733795b487acc0e5bf4d5b18a321e7411ad12372d4145cdcd40783ee9
- SSDEEP 384:yEAjm7aELetOdc8l4LodMqokNv2Y2rsFKOlIcMYOxLsnRbli3ESmMadMkrVr5UhH:ycZC8Ll4LiMXkv2Y2Mcdlsj5Q
- TLSH
  T187D2C815D3EC4311E3B727B5BCF9518A8AB2B913AD35D79D288E23CE18127804D62B77
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  FeminizationDevice-.0.6-steam/FeminizationDevice_Data/Managed/System.Data.dll
- Size 2.0MB
- SHA256 436bce8104d76cd3e5a1396c8a0e0439f8452d04e4505e9d206211039bc644ef
- MD5 e55f6e413fb0191c93ecb0c9438f0f8c
- SHA1 1bac352ccdd30405fdfa85eeb72a3a248859d768
- SHA512 ca61ca2ab8b5c33ab67123e417078b7233c150aceb4b7c029471f217a808f5cbdb9b58cc17b0ac1b4d675002df0479c5edf24522bfc18f9f22fc37e82e283775
- SSDEEP 24576:wTy8NQuznGO4TiWB1V0Nt8OZUuhHwjpj5zuctRoOB4M+Q4cggyT:uykz74VHV0MOZUsgoOB4M+i
- TLSH
  T109A5185077FC5A16E5FF2B31A871101567FAFC16EB72D38E6508A17E1C62B508CA23A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  FeminizationDevice-.0.6-steam/FeminizationDevice_Data/Managed/System.Drawing.dll
- Size 478KB
- SHA256 ca96eccd8102347c74b9d8383cdc36fca865d7dd21cb9b67b8277553f7b30a16
- MD5 ab6e09171a0af4a08d4e25517d9ac0f0
- SHA1 852093cc85760bd07656c302c385c7f8a47deaf1
- SHA512 a8386a4f9b0816c88ddbfcbc4b9b6f0f607d277e79904f760495ef7b43ade4bd892c8ceab60936f0908a54604d8395e5c44200c72ec86d7e550c375da30f6d6b
- SSDEEP 6144:yHutOmSUsXjt/z5B4CqvhOgEGKPx+Jg/NY7c/nENZ4k7cheeEp:yOtOmVsXjt/PicgEN/MGq4k
- TLSH
  T135A44A1077B4592BD5EF2B38E0B24968A631FC076B26E75F4681B62D1CF2B809D417E3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Contacts third-party web service commonly abused for C2

Drops file in System32 directory

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32