1e05fcdfcadaac96dc36c166b1bcacd6ea77ea21dca7a01bd191402705b8eef5

Sharing

Copy URL Twitter E-mail

General

Target
catalyst-1.4.3_[unknowncheats.me]_.zip
Size 7.9MB
Sample260708-ds1fzaaz2n
SHA256 1e05fcdfcadaac96dc36c166b1bcacd6ea77ea21dca7a01bd191402705b8eef5
MD5 a2b12a075740e8c131f62d2e29acbb59
SHA1 ca681447812d4d390e64a9e65fe8f403ca6e2a9a
SHA512 b91492a83b8b08984bc749c72a05d9a1bfed5c22d193c6b85b07df5e708a0b4d3a63b860f942c17217daa5bf8e1f1d3d52b77a0dad3eb6e19a9c131d6f0e07d7
SSDEEP 196608:Vq2FgdBUz1utLIzYCVLYLkAgFI+25Zl2JKA4Lo3Vs0lk:VIk1ut0zXVLYLkA4B25Zl6yFgk
TLSH
T1B58633C6423B212AC4270D39CFBEC3542544EB6893B4774E9F3E6FB2246A8547D47AB4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  lineup_data/lineups.json
- Size 193KB
- SHA256 2ba5f6be3c554d69599aaa265341895ea505425c183701e2e867205e145af0e5
- MD5 c55e0547b9ef9a2fd5cc7af1af2f35f8
- SHA1 eb307099ae85d02a308ec65bb4e0d508c49f4e71
- SHA512 39e8a0a26f8631bf191908b664cf050cc2af24ccdd4edf6004a07d25129862e7e7482779a4bd2418eb835e74df40345afdf34eb699fb10c9b156be9bae6c0eb1
- SSDEEP 768:uC+RhiGlVd2/3R+Fb/jwilim2Q2F2ZawLH8/2JyWBITNv6MC0Sj0rU0TVswr4slw:nEIf/9z9HyUrSm/8SdBwRLH
- TLSH
  T1A2145737DA1D8C9B5ABCA37868E8430AF271138FA0862C5F37BC558C0FF7515498E65A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2
- Target
  lua54.dll
- Size 328KB
- SHA256 88bdfabdf268a5f661a696df6e8500469e8d4b220e404c0b07529013f12ae699
- MD5 ba18d56d2e7bfe079415f5bc9e537d07
- SHA1 5d5824b8c4129b0ecaa1856b97e2974f1668b645
- SHA512 960b40d00c6d3ac5345555bda55e906e975088d8814b4625eac54c06d1fa94392a55e0991d5c16868ff25c7a278f646cfe1d025c7bf6c7e8d7fcf076278ab408
- SSDEEP 6144:hmFRmQINwLt+tMeePzUPK6DIQ06LUJ4Nb7pqiysYjOHE2NCqR2Z3ZW:ioQIN+t++eePmQJIpxIL2i3U
- TLSH
  T106647A5A726808B8D9B7803C8E66955BE7F2382403B187DF11E297732F17EE619B7710
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  radar/radar_config.json
- Size 2KB
- SHA256 a53d026a5ce107bde2c92b4238780e61b5394a9c8fbdf10082444c7d018ee329
- MD5 a9a1f06bc8d00b2f1e84ca307eb557e9
- SHA1 9135b0a89055a566849a647422b2b5e1e709bd29
- SHA512 1ca7e87a63dcc08a350529d97d8029c38d1cd8a33e7bd3df45e40a2f70a00a9f26f7ed4b60c34ebf2df6068a3e35e690435dfb8f90a28bb8b916dd6e2bc82058
- TLSH
  T178515228C8719C97B0893069439B064676A454575CBA3C88330D5A4C4F6EC3FBCBBB9F
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral5 behavioral6
- Target
  sounds/Battlefield 1 Headshot.wav
- Size 64KB
- SHA256 570e5d57a4985de64321c9b48b66be7e27477718840bf1a3666ab191c08b2f17
- MD5 d74980877bb0009f9c2b002ea659b30f
- SHA1 f86a45acfd37951a64f55353526bc640dee3c57b
- SHA512 7d0acb9a63bb87decedfbab3dce112008a95c5150ff303c47be883d8e46e3f23be91789b2227420c72582130e3ca86fd7fb0eeb33a840329f0d01a9a61bb10db
- SSDEEP 1536:S2wz1TFDsQhhNxSQ5JltYftkCHjRT5l9seUw:qZdtxZJl1Cl9Ww
- TLSH
  T13953028B1E060D0FC15F12F9827B036B17404C046690B4975B6B2BBD9E78ACE8D7F709
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral7 behavioral8
- Target
  sounds/Drip.wav
- Size 4KB
- SHA256 adc5cfaa5c1a1b60637d2ae23a8e3137836d7e067bce3356f0d07e84738383eb
- MD5 125d6560c6fbfba68d72ed941d3c16a9
- SHA1 f2d7080b0e9ed3f8d204cdcda79014694c511231
- SHA512 faf5c917bb11a0535f7a1fb93e0f15b2132ca9f1193d6b232cf2c7357d97110bd4470c913ab957cb727c36ba6229986c3587c08b2f0b1f28491c94d55d446106
- SSDEEP 96:o0sf2WmmlMbzRBCIPYGaCi5xpjY8UNo2EWui5:oV2WzMbzOIgGaCaxJXpi5
- TLSH
  T163814B935D0EEB4482D768A995FC91BBD432AF25B54789479A326C8C347EC4D4C3FD00
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral10 behavioral9
- Target
  sounds/TF2 Bat.wav
- Size 20KB
- SHA256 03da71d02c08c3d6fa0eef7820762da38f6dfafa3e1f7f2ffff2c74346ecc01c
- MD5 9c65c17b92bb2dd0846ce7449a185a9d
- SHA1 11096148bcdfa982437ca4db52d678c86e5b00af
- SHA512 7810c2e4467a841a209e937a298ed434d9a428946af589a216102d56aa0472bc8727248302cc8467e689fe660690ceb52b7bd7f815a8f747b0d96d232ee9a234
- SSDEEP 384:ow4j6Gh65kglPSUA8Vs0SM3qtbSC+8zwZ5II:FiJ05Zs8HScUmChwZ5II
- TLSH
  T19C92C032E92C9416ED9739746C246E8523905F34AEDCC9C450821EFB9E0FBF082BE712
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral11 behavioral12
- Target
  sounds/bubble.wav
- Size 32KB
- SHA256 c6b25c60f50838761839970a66f7bf2766659f953aa7759160ce558eb6cd7b5a
- MD5 fe9495d16787a9be6242f16ee9a17020
- SHA1 afd63e155780376532f9782bd65c044b1815c296
- SHA512 352d149fcba9623269d5ebf12d9bbdc99e36f0e59a656b099efeadadb09abbea003ff83eaa9aad6f79f3e9baf8fab3c795a79169c84e0bc8c0944e0c42f7142f
- SSDEEP 768:GmciqA0EpPViWdtmpTynUaij4GA7I11lsJM:GDiqATpPVi0mTI8j4q11Ke
- TLSH
  T14BE23557A09247ECE0086E7A8DC3F1445483B725BCD3DA7D322ADE1B716368191F3D69
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral13 behavioral14
- Target
  sounds/cod.wav
- Size 11KB
- SHA256 fe8bbb31c7f63ea2ae3de137ef4b190628c63735e6f09662c0856b118ec4bb07
- MD5 36c555c139435f86453b222c0519ea93
- SHA1 ead9f8047e7287c9c25709aa25ac9c25023a29fa
- SHA512 469f47a4f5fc4dc3d0e6ba569ebf2aebb3cd805dcf8797c99a248da41effd8e17d4dfe33575b2ec8dec5a2366892aee4730e95e8ce63ff419964f056f2c96fa2
- SSDEEP 192:H/LvfSO71bKKLnFzvTZSSku2HL7IxJLieZrego6T:HjSG1bXLxvTwSkbHfwceBe3
- TLSH
  T12D328192A8972C26ED00457D6D6BFC711213B6F48C2C9B2B3A94B46353530E1DFA0A76
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral15 behavioral16
- Target
  sounds/cricket bat.wav
- Size 33KB
- SHA256 57669aca78c249cd0533a4f8843edf7913a863cdda3ca3b488b97389a5bbf0c8
- MD5 8b802dd2efd7b3cd58970d8c8a455013
- SHA1 9da634bf3c7ac390eef574fd8f0b2910a300d977
- SHA512 03c5b29fb2b0716e812338d894bea51d7c229b6d8129b58366c2b98a92457c773f5352b116ecfe5813ce1e0695e76199f0f9419251755f6d10574fee8313f8ad
- SSDEEP 768:5yevC6PwHOGd2jnYkmvR8aEQv7e23LQ2WHJX4mvjaCUUB:5HbPhGkDov7e6Q2WpX4mvjaCUUB
- TLSH
  T110F2CF3BF2C35354C4212BF73EA55AD565207E1D4E890A3F620A7E0E2B717C5C2A7A74
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral17 behavioral18
- Target
  sounds/fxxxxity.wav
- Size 77KB
- SHA256 b53c3a8b73de1baafe8ee5a4f0ac2984ef6602408d2a3e105eae961cc4590074
- MD5 a0ea8415877c57b4ba4687b09db68cf2
- SHA1 c6a49bc38a9d8436e3e77685a920c59e45fd25aa
- SHA512 9f13b41cfeb75ece9bc1fb3d8a529f8b030212720b66cb7a58f1d7490c57de63cfc87f7b77d86fb6432c29d1ac827f3e18d1e76d72e2499f39bf55f706426ddb
- SSDEEP 1536:Ea+0XZlcrRdqsVi50z6xZWe4kG/i5xnMNjm8q27u81s0vShBU:/+wLc9dqaq0zCZAr/i5Wjm8fSos0kU
- TLSH
  T1A673BF13EA624251BD590A238FA6A4613B16331EFE9A192F3448DD0AD3D370197DBF39
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery adware persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral19 behavioral20
- Target
  sounds/headshot kill.wav
- Size 164KB
- SHA256 0c8176824ba1b421d1c6b597e31388b2aa72dd5207ac51d6e270c303bd7eb739
- MD5 51b755034b01aef5a456d5881b6a2cf4
- SHA1 8817ffeed19f9eb697aea60bfb9d6f82e49e2454
- SHA512 123cd0f4363cce17378adff137156b31e6eae5b6089404748d11ab4550554eed868d5394d1f56f8ef5adb6a71aafa7148f6a147dc8553e5a93dbd8e029b488c4
- SSDEEP 1536:V+2F/NHZnE/s/6vXwgsJ2nO1QHE2OuVz9Hr/Di6WhObD8TALbNDK:w2FZ/6vXLWx1QMYqNh68TALR+
- TLSH
  T156F3BE82F209DE11C8211F7A4D62EAD44673BD58FF0B93073580BBAF6EB71C19D16682
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral21 behavioral22
- Target
  sounds/nxxxxlose.wav
- Size 148KB
- SHA256 6115f903005dc34586981af698043fb67b3b33553daf95cdb502b563413e9f83
- MD5 80ac1c1391243f225779e637cd66b963
- SHA1 ee1ee672c864b66fcf46c06f6faa8ff8a49942e4
- SHA512 cc022e2593cf37af8e2f22da0ce26057e9dafa6db271694509bef88c0ae834c2fceaedb944471d9eee66936ebd0ac66065e85b280bc7f0015cd9f087016f0a90
- SSDEEP 3072:j67zQd2hNc6lxqYtFvTel6eOygEHQsZprreK/2Xeo:j6XQd2h+6WYtFvTebOEwvJX
- TLSH
  T120E3DF47B321D760C6E8D9768D96CAC80760BD4B5E03AA23B075F75FBCA12536E03399
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral23 behavioral24
- Target
  sounds/ping.wav
- Size 23KB
- SHA256 85cedc89bfffc965c76b41327edf1da1964034a416d7d46365fb08bc743b82ab
- MD5 a929fd57d761c9982e3bffbf3373a883
- SHA1 b0dc3adfb15cb4ad504ad45c7229dd3f96f8f75e
- SHA512 976c84135c44cc5ab01278fe5a538485b1b1526e776fbd1aa1676b7755ad735b4f4fca9f172b3357e6e9e39f8bcb701e6cd7f9843e75bf74f28b363bf00ba342
- SSDEEP 384:0Z4fMCEBNh8RDpHIdueIgvP7TpTEiGVwmrQhGHR+azXESvFgZKoEXVvCW2453uDt:0aPEBj8ZpgVvjVsOoQUSSvl3Cdh+Mom
- TLSH
  T103B25B9151BBDBD7C00F2074840549DE57049E3A85BFF21BB9F37E6FE496649324E260
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral25 behavioral26
- Target
  sounds/skxxt.wav
- Size 63KB
- SHA256 1e0bf7a712e184ab6a76da113b2f0d9866d5f6f5ccd56ced01ff3560146dab7f
- MD5 a539f88347c043b6d83a87a449cc302d
- SHA1 12a054c77ff0897f2004f315cc5caf264f062998
- SHA512 0df76780a460adbb695f64ae4e6a4a135f5a25e8c3e81923e3e8c3167f1253dafdde67d70b6532a5f0c4d09abc16e6be862ca9e69b7ba58429e8f1d15fbf4b81
- SSDEEP 1536:bcGhBXOaHRuS1vMiEzvUUJsaVx23DEgZGhg:bXneaxuSNnEzvUUJsfEuU
- TLSH
  T17853F151B291DB8445CDD30BFCA55C5A773DB38E8D01A43A503CE28971A3113EABEB9E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral27 behavioral28
- Target
  steam_appid.txt
- Size 3B
- SHA256 61182f39851829ca78c919a83ecbfa045fc0686bff16d0cfa3e643988d9dfecd
- MD5 d5cfead94f5350c12c322b5b664544c1
- SHA1 16a9efea4885a86a6c0e036b52e0b0bad6da1845
- SHA512 7a9b38db77b85e5a3de5c649ddf2017184b87ca947d0034565307a07c243256d080cdb2a9faf38595f8d153861abe4b64ef61fc695481b4498a5a19ccaaf170f
- MD5 SHA1 SHA512
Score

8^/10

ransomware adware persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral29 behavioral30

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Drops desktop.ini file(s)

Enumerates connected drives

Drops desktop.ini file(s)

Enumerates connected drives

Drops desktop.ini file(s)

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Drops desktop.ini file(s)

Enumerates connected drives

Drops desktop.ini file(s)

Enumerates connected drives

Drops desktop.ini file(s)

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Drops desktop.ini file(s)

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Drops desktop.ini file(s)

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Drops desktop.ini file(s)

Enumerates connected drives

Drops desktop.ini file(s)

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Drops desktop.ini file(s)

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30