dbdb3113df2e89eef19f94e952b1ae573f1cbf98bdf5a4fae1a21f7e4561f257

Sharing

Copy URL Twitter E-mail

General

Target
Half-Life.zip
Size 311.3MB
Sample260709-epssdscv7k
SHA256 dbdb3113df2e89eef19f94e952b1ae573f1cbf98bdf5a4fae1a21f7e4561f257
MD5 d51c055fc6b3be90fcb69747a6ea5123
SHA1 3d294c354acb716568fbf58efc3ac6d908f01a28
SHA512 9510d43c36562232874d7bc887291621a9d84f954dfe819e1581c5a5916c8672867c0b03e1e3cc03d5bf9e82d4b097c5b6ff09269a6d3c63d1d68bf95892700c
SSDEEP 6291456:ln/AwGJDCGNKy3JXgyg5cySzq2LnaMCKmeC1Q67uSCt0/nBoJ9FOoSLN:B/AnJDCGnXZgm7aMCjJVBe9FLSp
TLSH
T1A6F833C5E1D24A87E07FBE3BF47CBE5CB018600573864096698A82542A5BFE277CF61D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Targets

- Target
  Half-Life/SierraUp.exe
- Size 456KB
- SHA256 fdacea5607f5da00b9ea0f34cc4c91bab7f3e06a09eb5739670bbda503017d7f
- MD5 b12268711a871a9d64019e9927b2a937
- SHA1 a4e07c1b49e98d16b04ac0e2393d56f9bf9095cc
- SHA512 e496e0d127c00e449f84591c0570ed03e78eb051a611af74c5d4fa0f094c04e95530138aa09154a1d92639490fa8ebc2a007c7e994966f2cbd9f9ac393e8d9d7
- SSDEEP 6144:xQe8bChUMKXET+A/mhWtu+LtK3KZEayaL3x/6q8y/M6zgVQ:ipbChUMzT+zE8+LpEayaL3h/98
- TLSH
  T1A9A47D12B3E09071D79A19300BBE6BB5AA39EC8117354BD7E364FD3D4831B91A93731A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral1
- Target
  Half-Life/UNWISE.EXE
- Size 158KB
- SHA256 4751a3547f3b482bb4a2440d4e91e3dcba9b4b0f5b1bb50416a32fb47ae75c5e
- MD5 3a938ed2427df10e571041069e6980cb
- SHA1 c3c96cc03ec6714cf7c98caadb00fbfaa8e82411
- SHA512 cbb15307bc6219b317380f90b3eb44227f86df295bd33f4a7983021e8706ebd1ac889080b14001592f6852386f43fd675be6e94e28a2c5131e00f12bcd243c85
- SSDEEP 1536:Ff6Q/2mS/jdzjrAU74ZBPq/9Cg7Q3469+Yo/nW2vEXLJADHAUs:oQ/2mSNfr4fPsC7B9+Yo/nWhJwHAU
- TLSH
  T19BF3D852B1D40E42F06EBE3058714EB99A71FC3114349AE7EB20F67E08B25B89D3675B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral2
- Target
  Half-Life/hl.exe
- Size 920KB
- SHA256 6a41070753a1cf5801447e0c45eec52d6ba38e05be72cae8040f7c751ed451e9
- MD5 fbbbebc702d160e1eded09e70952ccf0
- SHA1 90fc4079889ded43ff5ee504a04a90951ad008af
- SHA512 837a5eb387b47be38f4a3074e3ab832b49ea4351505274c0837783810d129b8ce61e3be04087c8158a8d44b2f8bd6e2a7ba351e684ec85ba5d19e29af0ece40e
- SSDEEP 24576:pvciYs+yEInHloneO25G+gL4+IuWIq9VQKL5v:dVe/ne95G1vuH5v
- TLSH
  T163157D31B6C540F7CB66663009BA2736AA74BA994B304BC39354DF3D7932590AD3B31E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3
- Target
  Half-Life/hlds.exe
- Size 76KB
- SHA256 070ee1e43ac7e66494f3feb1410b6ca2776dabefe83f8e5893359dbcb990cfa1
- MD5 f973f36e5c6ff780171db52a60afb4e3
- SHA1 5803ea7841e84ca354ce99d20bd4335d07264a5d
- SHA512 6784330732727ea6210b26b93a7c0dd6d57f28e522af70bf37066396f56cfdb35b6317b7a05b8d3915bdd081a4d3133e5fb85682bc64765503b7e1f527bd8a2a
- SSDEEP 768:b2GOI9U3yoPfNP0xt2d658mZifoyTolA54UXDGYbBP0KmGiB9oFXLhXmPWoNT/t:aGUyoXNP0YiEoyTol4XDL0iXd3ox
- TLSH
  T1E0739F27BC61C473E9A0407504E69F7F9B7EEE03026299C3C754DD9A5D705F1A22A38B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral4
- Target
  Half-Life/hltv.exe
- Size 288KB
- SHA256 5333a2b8e760691fc4a63200067152e0353eda29724b26b8a3a697ec4c6266fe
- MD5 a506fde38c5f62dbba5e35d9e89c47e4
- SHA1 188cc8bedacc94d2e0b4324801842bc98bcc7389
- SHA512 f24a5b522a88b1c3e25c3faf2cad61dc8eae86740637de2a6030f88a0787d4b6ede0e301f1b2cb37fdbb8bd39ee0eb656f479d13671cb38822f2ebcc6aba24b1
- SSDEEP 6144:Oaqt3o4J8Xc9kPG7RXgxGUhBH0usDxTIFaLEOAni:2ua69Ps3UsDhOa
- TLSH
  T13A549F02B58180F1CB7632711ADF6BBAE6F4DA891B1243C347E4FD79AD266D0953B309
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5
- Target
  Half-Life/hlupdate.exe
- Size 15KB
- SHA256 f1f138752752a56295179ed611fdcbfa6a3264828bfc5fb047f5e5f9835d1e50
- MD5 1ae686da02c6d1b5560f6de8f5ea9e96
- SHA1 2125b559b0e8d5857ece40eeef966fc0e20c6b37
- SHA512 9d759b7963251f44a9948baabee8ee8b419741caabe4d9b2193021cd159037391dd9564ad7d3f34b1ce9b95e60cb4b9ba21f4327b88780b1d41a60b78e6c4066
- SSDEEP 192:JwX+KiDy7niJ+RQalJQYD5tr3W5US5zQbudoCbsRlaRA1VvzGvi:JwfzJQnYD5trEzuudElaO1VvzWi
- TLSH
  T10C623B0BE8859873C0DA433800BA6FAB96BB69A537F345D3DA94747E1E311E06C3C356
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral6
- Target
  Half-Life/opforup.exe
- Size 1.9MB
- SHA256 eb9eb0140740b3af7e4fba47710d76592c5066a847e7602b85f1b85c8f8e0198
- MD5 5e192671491562cbc9a95eac6ace7f7e
- SHA1 601bccf5bd670fede2b3bdb47c18ee53dbd3938a
- SHA512 14c491fdd4f61887ef19fddbe02cbf2f173f179d93aa7fdc114081ae09f65977e7aa1f5b8d86c32149c0d6ca7b28fe59b35c7113f19b1de7f22d0e5c60c04b10
- SSDEEP 49152:b8bRjhhYg/0YQtV3scea4yDEyl0EoWisDJBepkYm9z2cF2BM:b8vKg/1QtV3eav7Bc6JQbBM
- TLSH
  T1A29533E85FF0BA11EA802E7454F2B60DBC111F2DEA226F2B4E58B715A8DD7F4141E817
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Loads dropped DLL
- Drops file in System32 directory
behavioral7
- Target
  Half-Life/tfc/qfiles.exe
- Size 56KB
- SHA256 36f7227e6430b13891f16183bea21f5d971146b72c0f4307444b07a382060bb4
- MD5 8bd4f654effe0163f484e897cfa18fe8
- SHA1 88c5aef880634eb1dcc186fc54a5760f00e7014f
- SHA512 e9feb1cb646fd6decc79874fea78ab6c4070b43acea7fa41bb9dfd8bb9ce702fc5d0f3c7f57b6c8a9fe0967b584b6440c1cf4ce66d3d9693c952ee4b937ef879
- SSDEEP 768:X1MozQuYXcWpzep/UhcblLa6+cnYiB9h1YK2VQuyo7i:X1jz5WP+blLH5RYVyo
- TLSH
  T14A438E233CE0817BD49550F415794F36BF7BA67011729583CB24ECA96C22AF4AF3A257
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral8
- Target
  Half-Life/tfc/tfstats/tfstats.exe
- Size 172KB
- SHA256 56ea7a69dfe9b3e15ed1da648cd2398fea54cc2c14bb12b0cf18b586c7a2b37b
- MD5 884011b8613c6d676970593646163a2c
- SHA1 138a9f6f9fd8021b0e5f9fd825c75f2d872f5b34
- SHA512 272156216b7a9bd1b3412cc129b723ca1a82f6d30f96cef485f82c055a5cea0ad1be8bf76614366687ed105172615ce6035c3281387e09c8211059fb90c60bd4
- SSDEEP 3072:A1htfmPwW4rPVGiGb/Pmy5ZmN6MbycwpbyWhod5eKq+e0kH:aflGb/PcwI0vKq
- TLSH
  T172046B1235E084F3E3A7653048F2A73AA2B5FD708B318B676395DF3E6D325909536362
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral9
- Target
  Half-Life/tfc/tfstats/tfstatsRT.exe
- Size 256KB
- SHA256 476cc639ee0cb2829d3a19da35a9c03c81181ad88b293ffb034c3686bfb25dc1
- MD5 710d88c358165c54be917131e05c7be1
- SHA1 64fca95006d005ceaca7a6b9d0e3ef2525b03e5c
- SHA512 85397214940e47eddf54f9a97781c7955fc8d6a38d970f7cd5a5e31fd9115a5d6b985c7440a82bcd88a7191a2210668982f721a584864731eeb0f19de6df196d
- SSDEEP 3072:qNx5sQzrLBFBIEwnWyHv45CyuES3mUrm6P1IGOwGqN6LY53k1ZoEpv5AsIZnDUha:q9zrLbBIAUMGOgN6M5iR1IJUha
- TLSH
  T15F44AE107AD8C433C18150B4E9E90BF6FEF4D6195E128943A7ED276C6E78E92D17233A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10
- Target
  Half-Life/upd.exe
- Size 158KB
- SHA256 ed8935f1cf86b23cb378bfd776c3b12aa8bed1f0240edd73f4c3614e31f023c3
- MD5 28e5950c09cc8ecc0e09b97d66aaeed3
- SHA1 a01a0f0316d7d2c8a2fcb0089365efd833cdf01f
- SHA512 46fa30c824d677cfb0e75394bdb2a21bbdbf8a7c7062d9746c034e313dae8717d85fa90d645d99600b45bd2801ad9c8426d4997ce5e937b9e46f1156b8e22b28
- SSDEEP 3072:f1RZY8hY7tcd8aDE4gg59GXjCj8I20d9+qrnFbAs+x:dRZgZcRDDGTCcs+Fs+x
- TLSH
  T11DF36B12B5D1C4F2C5B75A7408B66BA9B1B6FD200FB288C7A3981E7E1D361D00B79367
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11
- Target
  Half-Life/voice_tweak.exe
- Size 172KB
- SHA256 df7df61bba39e395976e18bac6578eba7a69061d8734dee0512819f8f59adadd
- MD5 dfed9043d7a33df440d1ceb2618b4da6
- SHA1 c461d127a3e7a411dc17a4293f460573db65f842
- SHA512 c9450dffa9c465541034cc52a4108a0a97e039be46f6236defdde610c7f263fe8b31237ee6d3646857d273d3e87ab8bf1229239d69803e1c339ff947587032c0
- SSDEEP 3072:fuE5COzDVjEPR6KEZ86nFAmi7gCoPiDqXl/c2V:2E51JjEP4ZnFAmi7Pq9
- TLSH
  T109040712B2F585B1F2F62A310DB55A7A6A76FC75DE31C68F9380961E4C31E808D36363
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral12

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Enumerates connected drives

Loads dropped DLL

Drops file in System32 directory

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12