ee3a911e8e21671a5e3796cacaab1a79baef0ebb07142a6a259256f24d01ce70

Sharing

Copy URL Twitter E-mail

General

Target
Cookie-Clicker-SteamRIP.com.rar
Size 143.5MB
Sample260709-kbmxwae13p
SHA256 ee3a911e8e21671a5e3796cacaab1a79baef0ebb07142a6a259256f24d01ce70
MD5 eb627229359f67d30af53d55d763d477
SHA1 441d08bae7354537d7d60bd0e3429cda2ed2a2ef
SHA512 2c4b356357acf90d9e921dc4dcad2e0b3be66dd9efa77d609f8f10bb034d85c26bbaf02b4d1e59dcc48e4b65ecfb229a981adad335942ed90e69e6077517f8d0
SSDEEP 3145728:N+6GiVW7+tcIwOq+FcbmAfMr61yueq0tdoUbuPhv7rSI:+4WCtbG+6bmAfv1yuzbPRnSI
TLSH
T1A17833BAD7B1FC7394E3E6F09102E8587926D04E9604906B5DAD92ADB79CF071EFC408
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Cookie-Clicker-SteamRIP.com.rar
- Size 143.5MB
- SHA256 ee3a911e8e21671a5e3796cacaab1a79baef0ebb07142a6a259256f24d01ce70
- MD5 eb627229359f67d30af53d55d763d477
- SHA1 441d08bae7354537d7d60bd0e3429cda2ed2a2ef
- SHA512 2c4b356357acf90d9e921dc4dcad2e0b3be66dd9efa77d609f8f10bb034d85c26bbaf02b4d1e59dcc48e4b65ecfb229a981adad335942ed90e69e6077517f8d0
- SSDEEP 3145728:N+6GiVW7+tcIwOq+FcbmAfMr61yueq0tdoUbuPhv7rSI:+4WCtbG+6bmAfv1yuzbPRnSI
- TLSH
  T1A17833BAD7B1FC7394E3E6F09102E8587926D04E9604906B5DAD92ADB79CF071EFC408
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  Cookie Clicker/resources/app/greenworks/docs/events.md
- Size 5KB
- SHA256 f65268564f5b4fb6a6ffbd265e260e44bfe2383e051bb0492d3324a6920c003d
- MD5 0bb682d6092597202c9c63c281cbdb30
- SHA1 463dfa51d4bb667ff080dababf2a8c760196d46f
- SHA512 a5512d7f5c05a8c17ceb776e0296f2ccd150c2a0704ff656f843942f42612a12376821c3c7d3ef9b252dc83e6f7b27978532da6380e158a9876fafb5042eae55
- SSDEEP 96:Z+Kl3d4fsyFeySTS0kALTZAoaFF51zc6lGZfBGM4I81GmWbGmGLGI6GgdYlGr1yT:SkyFeDTi1zcFv4XWsedY01ha
- TLSH
  T113C193AEA9072373337300D56A0960639507F087336B92F4775C8B5E1568E91F375A8E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral3 behavioral4
- Target
  Cookie Clicker/resources/app/greenworks/docs/friends.md
- Size 11KB
- SHA256 6100c43616cdaa06b089ec7b22dedb215f94a1d47618536a32a873627cc1b292
- MD5 5da9fa8b6899268511c86d6d38eb15f3
- SHA1 007b7c2733c4c1c58ed08d55307d514a5d160eb4
- SHA512 872783fb79a9a176ce7a36505f2a628241b26da9d2dad492fd3ef2d41c80bc111c37b4658797e2fcb485901a028132d9496cf8ac8f3fbcf2716fe38b5b06456b
- SSDEEP 192:+rCaFb5CW1IN6Foqd3amSY+1uyOcwGHn6HDa5:+rCh8Pd+bOcwlHDa
- TLSH
  T13332952F679721B75A770811E948F11B1734A0E6033D5978FBEC891E1349E86A33BA8C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral5 behavioral6
- Target
  Cookie Clicker/resources/app/greenworks/docs/quick-start-nwjs.md
- Size 2KB
- SHA256 3462a10101a04b8b063adef257c500856c897f49a98e91744ad50a254f7bacd6
- MD5 b420e2424130bd1a11654cdf2fdf93a7
- SHA1 3761294fa41b69c20bea27895213149ccdff6598
- SHA512 bc57add5a925ec4e8b19fb5d49d2f14fc8038c063160d72291bd3f855a565609651f93bd3a5938eb2366d64aeec71373f7d96b04a02f9328ad082ed39ba474ff
- TLSH
  T1934196B1620212A7773129A48FCCA68FF363B45F1A01193C6404D25D787B75722AFB1F
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral7 behavioral8
- Target
  Cookie Clicker/resources/app/greenworks/docs/readme.md
- Size 1017B
- SHA256 c750dbaa4b4db039dc4087c810d4790f608ef4cc8ff4bea1d4104773eda675e6
- MD5 1ff986b347f8b9d8a5aa25e9fffef314
- SHA1 07205a307a57143995ec3474d85e50d4eab068d5
- SHA512 f901586572bc41b0af076213fa3edaf6328903d7955ceaa4f54157506e471f86a9d16b91adbc30a67160c1026a6dee14ee4159a724bd2ea78d194ff63ce17b84
- TLSH
  T14811893560F3919A1FF33432ABBB03B6D135455552BD2835263C942C5629B6E81ABC3F
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware execution persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral10 behavioral9
- Target
  Cookie Clicker/resources/app/greenworks/docs/setting.md
- Size 5KB
- SHA256 acd9d2a8ecaf6fa747a4b341132a3e97592bb3721619c5a861dfffb828d7ebba
- MD5 bceb5c0c7f775cec5e93fab33f48e691
- SHA1 43fab1ecc20d46561539095a42061046c27d283a
- SHA512 815b073b6a085e64ab829ac117384d909dd5f6fff0a82248f2eebe955a9c752fbfa86d446c8b811f2768e2c37cf65782a3eed9f7d24592a83b0f4bbe9b9fc42e
- SSDEEP 96:Z4t8Gxq4O4XyBIJFYc5N3JVMr8TjZFqNyPe964f4XJTk24NcSU24tim3szwO9ByQ:GqGDFtt5CoBFqTwMm5gI0+MiClT
- TLSH
  T1B1B1A92F5E9321F370B22A1C730E74562A62D051132BAA78746DC42CB7F1D49E13FA8E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  Cookie Clicker/resources/app/greenworks/docs/troubleshooting.md
- Size 3KB
- SHA256 20e10167e786eb8fda3accfd69f3e27e84316cddc07b4b8d82c1e62c113f9a32
- MD5 d0950b957f991fa30d13c75bf7150f60
- SHA1 091dc0c736b70f6406925868af7cf2576819cd2c
- SHA512 4d95df88ce600e530e282ca9a2ed3e84b159f990d1ae696b260aa1251a401f0fbbad3300ea919e05539d3b440129f2582a06207e155011f95afe27addeacae35
- TLSH
  T19371B79EF643027F55F20666A64EB093EB25C06A234AAC24741D439D2B38357A33F5ED
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral13 behavioral14
- Target
  Cookie Clicker/resources/app/greenworks/greenworks.js
- Size 7KB
- SHA256 e308321bcd8eccfa0e13a9c5b71d7f9189d92a0381dedc648220a12d3e59117d
- MD5 b172797d51e7a2520bd7195675b31e35
- SHA1 b553c8a917110cc15f8558be303159a0d584fee7
- SHA512 b43b06a4061ceea12121aec8b0a2468b7070ef534c77cbd142e7d27405c15ab24eb2a1db0649b0a28231bf3f5cd81adf2dce8fd7a9b42f994be294273fb008ab
- SSDEEP 192:7QGyBdSJ5M1zgQvz7SIl6tH8t4aL+rAuJztft2JeYoM:75yBdSJ5M1zgQvz7SKKHi/L+s2txfM
- TLSH
  T11BF1DD324A56A0D288F1BB77C6471705FABBC1A3071E016A748DD38D5F70420A7EBE9E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral15 behavioral16
- Target
  Cookie Clicker/resources/app/greenworks/lib/greenworks-win64.node
- Size 670KB
- SHA256 ace11d518cb14af12e704ba0e76cea1a67527dcb8131295539bb76601e09f44f
- MD5 97a76c6a0d49459521069d11bd96d59e
- SHA1 51ff98cdd0a109646a7abaf2fbc99f4c1f1ef72f
- SHA512 7e37f1a53be2b84d2d89cc7a9af74dca304db8e4abba011c28024e6f806c6a13e22cf889403b302a0b2ba9d8a45d03d2d836bf944db43ecd5d46e3dfd2ce8b3a
- SSDEEP 12288:Q3Uss7UswPZsjeCNOcXpPL1k3Fnsel6SmDNmOogTscTP2phvRyeTcl:Q3B0SZKeCgYl6Fnsel6SKNmObTZwJ
- TLSH
  T193E46C47E39802A9E47BE0B8C65B5913E370B0493334A6EF0399C6595F6BBF25D3A740
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral17 behavioral18
- Target
  Cookie Clicker/resources/app/greenworks/lib/sdkencryptedappticket64.dll
- Size 778KB
- SHA256 bb4c89dfdb4c082dfcbc02b72d343b7aa343bcb8dc53719428aa60b207544590
- MD5 fa223d443c073b89f0dafe15e27ae710
- SHA1 364bc30be7acd6e05de1d828ae743c26477239cc
- SHA512 80f4bcd9694272dc81816bee0c04b40b937faced5f8d3c79c48fb4179807e8eb596c07fe193b409d97d8a04ef368d4bc377449d1f924fa37f4f628acdc091a15
- SSDEEP 24576:FcbnnHLRDKPsf2k5Q+exLKUxPCrhFJfJ3:ebrROSjPmWUxPCrhF1J3
- TLSH
  T142055B19BEA481B5C077C17E965B8287FBF274051B359ADF52A1432F6F37BE01A3A210
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  Cookie Clicker/resources/app/greenworks/lib/steam_api64.dll
- Size 1.9MB
- SHA256 0cfe547ea82071953cf99daffa3bd11bb468eec0e400961e7e33e4dc36674ea8
- MD5 c7ce820020b0900eb44d2a72f2ab9294
- SHA1 f057a14bf15864c83bc99809ee248034d55993f6
- SHA512 61a99f16e162f7590e10d18577aadfdf8aad203d7539627318ffa0c6c06a0370ca56709dd6f07ea3406978cdea7afd7253a80aeba3c199a23ccb41af439c5933
- SSDEEP 24576:XeaHJvXu6zYPY6+UYHAjnQGuJbySAN6onVZEpYKXtR6IyefCg+alA:XFpmwYVTXm+SANj6YKXtRxfCJa
- TLSH
  T134954A296A6C40BAD17BD17DD9478B8FE7B1709A0B306ADF0264035E5F277E50A3E321
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  Cookie Clicker/resources/app/greenworks/lib/steam_api64.dll.orig
- Size 259KB
- SHA256 ca1fa9a7609ab10b7926400559cf073e5888423cc156af72c6027d72a89eea73
- MD5 cbc8b390e065c29572494901b151989e
- SHA1 238243867b2f2daf54ac0dd5f3b68f9d99f8abaf
- SHA512 e8deb190d9b00d9931f480754cd46b0fa16c4080bf12c25d024ee2c14e75e27a7ed9f9b357a456037c9123537910d5186b7361f359d44a25b175f55bfb9affa7
- SSDEEP 3072:WZz7iKHWadsCKUB6/KuBHlvdXGFcKLF65lhTbCNTnJvxfyN+ve2UhMBCcJo5gDst:+7i6ddsCKg6/KuBFFXyDyEBCcUb
- TLSH
  T1F944283A72750CF5D1B6C139C9961E0BF671304B23219DEF236053368E676E32A3BA95
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  Cookie Clicker/resources/app/greenworks/samples/electron/index.html
- Size 762B
- SHA256 8e42609d2cce901fdaa842add128d4b8233446a8a9566f1eb2711251c2dd928f
- MD5 5328635db55caae196395f13215bea8f
- SHA1 032432320dff572f6c95a9b200ddaabf9cde2551
- SHA512 363122e8a74698713219a43d3e0c0cacaeb42af2a8a2b006d640acad75982ddec01759ca799426e42737b5ff4d5e3359e39306e94fdaf4b26f1103449e579187
- TLSH
  T1FD0128B41C84E97603F5215A3DA1E70EFA79A443A713461934CE52572FF36998C8F44B
- MD5 SHA1 SHA512 TLSH
Score

4^/10

discovery
behavioral25 behavioral26
- Target
  Cookie Clicker/resources/app/greenworks/samples/electron/main.js
- Size 2KB
- SHA256 ef6d574138531bc481090cba7bc086385b938865821c1c2b7b241405eb67f0ef
- MD5 b5aaaf32ee7c5010e59f4b30b558bb89
- SHA1 8a773888c629a26b6290c4234cecc84f0a5ea413
- SHA512 fe242677d0d6436e5fbc382f4ee73d5909fe3cdd1adaac9e1f43f0ccac2b73c0defd07d1af1a4ffa1afc22862e06d9ef773545b8836f6f543ae2834fe2234aad
- TLSH
  T184512262596A749F91737A26EB1A220AE93654C30302533A365CD3496FB9C4420FFDFD
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral27 behavioral28
- Target
  Cookie Clicker/resources/app/greenworks/samples/electron/start.js
- Size 619B
- SHA256 6ee65d5f938946d7bc79cbcf2d6ef393121af93aa2ac944809994b4c607e8ac0
- MD5 a3d205e06a5f98fb62492f6532d1c13b
- SHA1 8545f4184efd6582003c2c33644f65edf79fc149
- SHA512 f6384887ff6230f032056ef121e7852c0c3aa67c1c26008e59be026126144a8ef014c9b8444d2230763fa24f42f8b92d2de0cbc1e0783128bc850372e0e33a0e
- TLSH
  T1CFF0AC80A03C72300D7A375D57131B4AF47340396206438175BA40DBBEB14E7280BCDE
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral29 behavioral30
- Target
  Cookie Clicker/resources/app/package.json
- Size 314B
- SHA256 d07d0a73db772a274d036d8194f335d916ff93ba452bac42235dd535f646b870
- MD5 35e01ade165999eae86754d420dd5d99
- SHA1 6d004dd0f9632cbc175b5d86eaf4a2ad98ffcabd
- SHA512 f49c0fe86e5a51f9898f054dab6a7ef8f4b54f0aa6a9800eefd2e5909101cae4d35c2878241492c154889e079a6d0a3ccdf83506ee79a9c070b51007f2863ded
- TLSH
  T19FE07D30F6009C3B0ED802E41420424775558C1B0A89B40D2703566C536DE7729B4A0E
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32