30c023dd4e26b6695816083676bc5904f94e49cebfe1ce221709f7d7651f68a1

Sharing

Copy URL Twitter E-mail

General

Target
SpyParty.rar
Size 303.9MB
Sample260709-vtcvqsfs4y
SHA256 30c023dd4e26b6695816083676bc5904f94e49cebfe1ce221709f7d7651f68a1
MD5 960930cf303eef96ada1af8929dcf673
SHA1 a47ddf42373963de4275c8a9fa6dc5263508281c
SHA512 bfb3ecad990c00622e38b260c2f45f7854849c078727d20e245960e2b611d5953d0d01af386fac0b2b19a1762698dfd3df63ae42ef30e525aca4835c3994e963
SSDEEP 6291456:tWy6radZwYCDXvoNLIIe0oS5wJaYeMYEicpuif:tWyaarsoWsoS5AaYe194
TLSH
T124E8331345301FD010F7F6E086ACD574A5DB54974E322EF0A09EA8FA8DEDD384A7639A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  SpyParty/SpyPartyProgramFiles/SpyParty-Manual.pdf
- Size 2.1MB
- SHA256 5962ff9b30abf7a38f30b597f5edaf206ddd567bf294a83b23bb50d38b680f4b
- MD5 0b242b7531932827786860a9e2289c46
- SHA1 f3de11182dd603d32f2d0b023c922978a8c8e891
- SHA512 df740b6f71a66eba292a878b046cbc185ce3c1ae4fafe697e8e6c9772e830f646128be10cd3db68700e8e645819f0d906aeaa28ec6c736793ec4e7b9569744a4
- SSDEEP 49152:gzs+3s0FNeeMJSrdzZsc/5qLD8i3rrJyCp:gzVs8eedl2Uq31P
- TLSH
  T1A1A512DF8BCC5076ACDD4270BC04079A8EA929FB96D0768711374D7F1A40C8FA7A8979
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral1 behavioral2
- Target
  SpyParty/SpyPartyProgramFiles/spyparty.exe
- Size 9.8MB
- SHA256 62762d5706bb4837bee5f65a27609b13f204bc79227320daae6dac31a821b198
- MD5 a5413e03c7a0674265b2922fc53b3409
- SHA1 48e0e502239df1d845ba71be5af88ce08128b368
- SHA512 d0460ffa990ef7f519cd866b93f116cbe933a8a908533022c13b5861418b2afbce9d2ff185045c80824082d0af0b4c668a929878887837942fd624fdafff0286
- SSDEEP 98304:8aZK6S5WVdz4M3Nuv/kNFrkJdLC9gx7621Hk2XHuG3nE6RKrhNuW:LKj5yRNuvcNhk7e9gx7rkMu9XrhNh
- TLSH
  T117A66B01B3D15224FBF715B6C9FE626E4A39BA450B35C6CBA18418CE49B2EF17E30752
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral3 behavioral4
- Target
  SpyParty/SpyPartyProgramFiles/spypartyhelper.exe
- Size 1.3MB
- SHA256 6a6b45ba866e1dd9f7bbc65e57cfccf4d91aa91cba5afcd4e8208e0c1f41cfa2
- MD5 69cbd18a057bef16b92ffd4fd1250eac
- SHA1 fcb050b43f9e869e3a54dfc8c27d057697d59a7e
- SHA512 17432d90b8918cbdce995f05ef4c725b5541ee2cdf20a57c5fe83de17c512833b74f92c0648e2340587e2b2652a1117c621f95f7da4b5393b07540104cbf7dab
- SSDEEP 12288:q9nWf2/7A/JBEqLILO5kMGTdDnkUEpNJus/8WIcUO1+O7rV0gsGz+IdZ1YF3bQT/:q9nWEqyuB+cBEGjr1W3bQTd6nkFw9T
- TLSH
  T12E556B20B781D165FDD301738AECA6EE4159B4308BD850C772890BFA997E7E15B326CB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  SpyParty/SpyPartyProgramFiles/steam_api.dll
- Size 219KB
- SHA256 af17df745250d1814eaa274fff7b0faeb43381e6762e026267e5859778477abd
- MD5 fe8e00c889a156836d57919ca23cde50
- SHA1 7aba06d474175bd0d7f672e101b0a05104580bb1
- SHA512 bdd89b54381da6faf50c9e18d9941f68b8d300d952bea84bd785ca00d617eef6dbdf7d9589adfb14e1dcbe6d836bb2d7785ccc9529e781a64f3125bfc4ce091c
- SSDEEP 3072:Mc8htAhfVOxDSMVmNp3yv5GPNSv7WAbYiAs+6pyiy6oICJwRWbaqH2RD4f:MptAhNOhVmN+wPNSljyCCJcWaef
- TLSH
  T17B24193035B051B1E9E38135D6A4DE1B2FF9756B67384CEB7A88033948662C32B7719B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8