5f2a03f16b4626916c310ca9ea4429a6dc62d20f5cd0c58cd56b1e274c4ef205

Sharing

Copy URL Twitter E-mail

General

Target
Cyberpunk 2077 Mod Manager - Framework Depend-96-1-1-7674-beta-1609750767.zip
Size 18.2MB
Sample260709-vya7psft4v
SHA256 5f2a03f16b4626916c310ca9ea4429a6dc62d20f5cd0c58cd56b1e274c4ef205
MD5 ba68b9b16a814d71a0bb677d795e5d8c
SHA1 83727e7ba210a54b6f664a73b7d532f24b0d605d
SHA512 7147cf86f9989c867ff7b651b44bc8734413bfc8a6b75f292b8ab2e0abc747779bd275694eb5978a56e4746fe7f5c4c98e4d63c80e83f29c691b5b0b6929787b
SSDEEP 393216:Febsa7DircIrN6PEPsRQWndaK2KVY6G8NL7MoVq7AEatmVkxFKbmNLT9:FebsUWcIrDmQWndfbV6ysGCatmVkxFKu
TLSH
T1EC1733ACB349897C5E32FA67C58BD7E2E3E50940191219E05FF9AEAC4F205275F3602D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  7z.dll
- Size 1.1MB
- SHA256 db2897eeea65401ee1bd8feeebd0dbae8867a27ff4575f12b0b8a613444a5ef7
- MD5 e7ae42ea24cff97bdead0c560ef2add1
- SHA1 866f380a62622ab1b6c7705ddc116635e6e3cc86
- SHA512 a4a27b2be70e9102d95ee319ec365b0dc434d4e8cd25589ce8a75b73bbe4f06b071caa907c7a61387b2ce6a35a70873593564499b88598f77a7c25c47448fb0a
- SSDEEP 24576:ax6t04DSc9S0B07sjsPEtd+F5zrtV53SePrnvgwPWrlahtN:axBOp1B07sjsPEtd2znPrnIwuh0N
- TLSH
  T154357D15F7F1C074CA8E45308A2DABF550F8E71ACA20A8C76780FF6E6F318D5D229959
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery adware persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2
- Target
  7z64.dll
- Size 1.6MB
- SHA256 34ad9bb80fe8bf28171e671228eb5b64a55caa388c31cb8c0df77c0136735891
- MD5 72491c7b87a7c2dd350b727444f13bb4
- SHA1 1e9338d56db7ded386878eab7bb44b8934ab1bc7
- SHA512 583d0859d29145dfc48287c5a1b459e5db4e939624bd549ff02c61eae8a0f31fc96a509f3e146200cdd4c93b154123e5adfbfe01f7d172db33968155189b5511
- SSDEEP 24576:S+clx4tCQJSVAFja8i/RwQQmzgO67V3bYgR+zypEqxr2VSlLP:jclmJSVARa86xzW3xRoyqqxrT
- TLSH
  T148754B6BF6748260D0B7C075C5D2AB96EEB134868B3096C752859B3D2F17BF6C939320
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3 behavioral4
- Target
  Cyberpunk 2077 - Mod Manager.dll
- Size 13.9MB
- SHA256 abb6b07f628372d7515f3d0e61c35b223e414d20edfd2e7a62b64e83363c7a7d
- MD5 55e944f8a1213a0e03f50c88aaf6439d
- SHA1 b63a1448aa32cc53b1f3fe448d126a14b5e71389
- SHA512 3c81f94f82f30a5249c05994baa45ba4b7e86afca35ed7eb278af92a3780e44f28d2160d7ca0ff264c89f2660df9c83cc15def7dd2c0e51d89173ca4a8f833f3
- SSDEEP 196608:921OHUp4VjVen0z4FgpNSngVJVf6qjXzkiu+zJUwEn7ED8UXcwpOxBiWn2:w1ire0Ee2YLf6kXzWKJqi8MOx
- TLSH
  T10BE62317E390CA12D9361B7F84669316A263DD512332CBCF616A7E7D8CB31F14A123E6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  Cyberpunk 2077 - Mod Manager.exe
- Size 247KB
- SHA256 655805ec1ab1f1ec01a4bcd63f795832dbda968ae528c1628d1d71092075d5d9
- MD5 a2ccf5b96242e4718b81835adc9bb9b3
- SHA1 5ff5944de34d44f0e40b6f1d9ad2429efc5ba4c0
- SHA512 e8ad355332ff52175361e856a4766b588e1bb79a375994fdaf71ef1f99f994d8f038ddbc539b26ee30f7f32a60c1b3efdcb46a3c2820d4c8291c8351bacb400a
- SSDEEP 3072:uUffq4qd9J+AbT9aMqOQl+RgAvIudr+HwjvPJUcz:uQANK4PNCwbP+
- TLSH
  T15E342947B2A9D0F8E0A29B3F85624581E3777C6557319BCF23A0323B1FB66B08D65721
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  EG/D/SDL.dll
- Size 296KB
- SHA256 01105e403dd259c4a2965fc94d290feb2c445f89602f4778c82dfe6d59ce3f58
- MD5 7bff3da476cdcf86242962026bc43e7f
- SHA1 75df814438566ea911cdcf9124d52c3ca094eb26
- SHA512 ff3890ca0e0360d6ae4e1e8491f692cae943f07c7f1dbcb712fc824e20f852c4a20cdfefcbb8c849d88d58db14b5a03b93127e06881f39c1bba950a9033543cc
- SSDEEP 6144:gwTNvO36NpaY+JOtOEO0tgN0s1jnikkhIgMjahKmzdlNQL:HlO36paY+JOtOH06h1zikrZeKL
- TLSH
  T1CE546B62F50341FAEC2706B042CFFFBE2A26521184254CF8FBE9EC5C6D916B3685D616
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware discovery persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral10 behavioral9
- Target
  EG/D/SDL_mixer.dll
- Size 140KB
- SHA256 2947ed3cb8a342970983a90bf782c8fbf9c84c1b9e4832334e194bfa45c2ebf4
- MD5 e09e4794abd018521bb13b636feb16ca
- SHA1 69f82e3785f7aaa6e6c636d8b39b69b25abc1207
- SHA512 d95e512bedd45c9ed0fac4591656a89bc3b5096ab59656aafa91ec7695eb42dfc260d07a84a988829a918dcb439e82af2afc5ea8e38e95eaed249e8749ccea5c
- SSDEEP 3072:5A2ijdHe48W85mVZ8z8nCz4Nz+i9v2RowssFo2Z8m2:5qB0sZ82Czgz/PwssFo2ZS
- TLSH
  T1CEE37C85A50304F3E2934132595EBFBE8B2662B98125C539FBE8FC54DF33EE92904356
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  EG/D/dl.exe
- Size 1.5MB
- SHA256 48c469057f54bc4982743b7750cd66ff1ce9256ab4e4731cd2f452d8030b5217
- MD5 c305fbde9ab289a3525390462806fa32
- SHA1 ad400f04c16e5c5eb63228dcd2582d961d117c2e
- SHA512 77e2a3d7235b952746552d8deaa9b9e1c3729d3e3254854183e9db5e259e8fa4846ce7fd9b4904b59c8a84257edd797b8bc2a9eeaaad81bdcaee49936cbf421d
- SSDEEP 24576:u+jIkHlgO2cAt3MDLJm5KcY9HwYfXIFg5qKBfZCulVYHxdi5t19gcN1Ej8PPKky9:u+jeDc63MnrceBRYncN1vPN9gh
- TLSH
  T157756A84FA8748F6ED635639C9D7E37B66349E414232EFA3EB48792A7C337912941304
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral13 behavioral14
- Target
  SevenZipSharp.dll
- Size 2.0MB
- SHA256 758cc36dd97beb939007cd7efc2713bca21b8ecd3d156480d03ffab623441c39
- MD5 045c7bdf77402d2ec211ef7e0bec9d71
- SHA1 1e51995d9827369b05a94a5277fca191eba119bc
- SHA512 3c5b9ad0fc94c747987eaf50ada92dbd4e9d971821bc208da246ff2d6625a0821db3512042eca03710cdc952576c7911c7e934225c870bc69819d0c85142aeb9
- SSDEEP 49152:+83UVKzVx9M0LR8uB9pYi2iq8h14bWXI0anUpLV4HY:+83UVCVDMq8uB9pYi2iHh6bWY0LV
- TLSH
  T120A59E1677E480BAD1668130CA9267D6D3F1F5950B31878F27908B9E2F377D1ED2A322
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral15 behavioral16

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16