2eed8e55e33844d9a4df62d483ce7ef4461f2131fe099d0e6cb73d0c0b903bc8

Sharing

Copy URL Twitter E-mail

General

Target
Arquivos Minecraft MPZyn.rar
Size 751KB
Sample260710-va45wafv4w
SHA256 2eed8e55e33844d9a4df62d483ce7ef4461f2131fe099d0e6cb73d0c0b903bc8
MD5 10db3610e357900ef07d895c92e65c3a
SHA1 a5a752b98a377c638242225727d8bb42d49634c8
SHA512 bde76b667957b68ffe25dcaa6ac4ab8d1165b3d27b5c17534198084682c9d7dfb849626cea01434dd46209765f9684d88c8f1df20e68039ade0f1fdcc23ade42
SSDEEP 12288:aXiL5LRAUMWtCmRHn5o5JI3xELVjWz3ggJ/mDnHefzGUfMuwrZUzGxi+yoASz4:qiL5cm3o5g2g8gJoHefyeSUak1oA64
TLSH
T104F4238FFC3794C1F01F5E07278ADE6257CC9500364163A958AA752CDBBD036F8A5A2B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Arquivos Minecraft MPZyn.rar
- Size 751KB
- SHA256 2eed8e55e33844d9a4df62d483ce7ef4461f2131fe099d0e6cb73d0c0b903bc8
- MD5 10db3610e357900ef07d895c92e65c3a
- SHA1 a5a752b98a377c638242225727d8bb42d49634c8
- SHA512 bde76b667957b68ffe25dcaa6ac4ab8d1165b3d27b5c17534198084682c9d7dfb849626cea01434dd46209765f9684d88c8f1df20e68039ade0f1fdcc23ade42
- SSDEEP 12288:aXiL5LRAUMWtCmRHn5o5JI3xELVjWz3ggJ/mDnHefzGUfMuwrZUzGxi+yoASz4:qiL5cm3o5g2g8gJoHefyeSUak1oA64
- TLSH
  T104F4238FFC3794C1F01F5E07278ADE6257CC9500364163A958AA752CDBBD036F8A5A2B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1
- Target
  Arquivos Minecraft MPZyn/System32/Windows.ApplicationModel.Store.dll
- Size 2.2MB
- SHA256 c1469dea551c95d2c68eb42ceb37f020cb5b75d777e7083f24bf2e54ae2e4f55
- MD5 86f54a87a6260befbd8372fdd150b127
- SHA1 8e92ff0b8ff2d1b0c2fbe59bcbb1705febadcbfd
- SHA512 101756ef73eb4d8cd85d3151fa20dfceed4773039bd1951bf685b913ea7fa0c36df992a98f6d12197befe7bfe2a57cd4115e76251190a33e84da62b9322d3cc1
- SSDEEP 49152:Tl6ZnGC0xHw4Oan2YLqybPLLgv22SckY03ZXB6md1OI6EmT199zGl33Rq:Tl00kjGq
- TLSH
  T118A5395626DC49A5E0B9A23D86770B0CE7B2BC041731E3CF0A28094D9F7BBD5973A365
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral2
- Target
  Arquivos Minecraft MPZyn/UnlockerPortable/App/Unlocker/UnlockerAssistant.exe
- Size 17KB
- SHA256 b0a4c2b6f40d7ad177dbd40c26b579d67cc9a95552970d9f6f0c7de372ce2a2f
- MD5 255e405d801cf01247390f38f92d8042
- SHA1 5c80e7b634c10629b63d43083542a4b1b8603318
- SHA512 a8cb3500c80b29a8f646dccf1b48baeac2c86ce2abca71b845b732dbf47f8603ff6d51b319217c2ad1f1314c5ff27bde5a9ad7d2a56363f74eefd275c9970b41
- SSDEEP 192:nkf2W/OThExEPYqRWJa+De9zf8pRvBpD3FMXKv+abac5WrYm7+TJ8OLQPF8VlmY:npM+Q3Pe9z0pRb3h+ab1HLU8VE
- TLSH
  T1E872294D977A4812F0B20E720C4527C1B9AB74788BE89B128497B58D546F34BCD3EFA7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3
- Target
  Arquivos Minecraft MPZyn/UnlockerPortable/App/Unlocker/UnlockerCOM.dll
- Size 10KB
- SHA256 86e8e34cfb71100cda06fe96573d832049cd18b1b251823139e935a1faefcbe8
- MD5 49b6af547ed4ba1fb07bf6f384fda841
- SHA1 d865b17ead0c92339eeaa651c03a629ae5a5e031
- SHA512 6ea392a740bef18a770f3b86f691125dad7dcebf7972fcbacf06fdf04e09cd0717fb0705a303a6b245f66d399b4f4f31013b82cd6f0b0b52f90b88a9c5c18889
- SSDEEP 192:2BNzky6fIAt/KNn8JZ1QfnMP1aFQ4179BUjAPeJjIKT2Z:2HzzAt/0n8JrQfnMP1aFQ4NBw
- TLSH
  T13722197392D611D1D19A07703DB58EBD1764AE3413802153ADA3BBDF217A722F13B34A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral4
- Target
  Arquivos Minecraft MPZyn/UnlockerPortable/App/Unlocker/UnlockerDriver5.sys
- Size 4KB
- SHA256 2a24e6cd5d6e0cea3082c0699a2371084cc1268b31bc714098ea0d0c11b3afac
- MD5 bb879dcfd22926efbeb3298129898cbb
- SHA1 cee6b0a5cc1651448b827e55b87d73030b15c287
- SHA512 49978bb3450330319827ff9c0f373bceaacf7a7f24bbbab6eaa3615604fbb6079c70d873e161bd3a42b16f75d0f5231696774c3a354ddc4c703b00952a8d447e
- TLSH
  T1C981A2A7B3A00973F3590B70014F506B703B69A01B69ABD7DC95A8899211FE0EB3C7D6
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral5
- Target
  Arquivos Minecraft MPZyn/UnlockerPortable/App/Unlocker/UnlockerHook.dll
- Size 4KB
- SHA256 af36ab81c5befe41140a5da5f605361be18b55d6410da1cbf1bf7e0dcf52bc92
- MD5 abbee3e367f6e6ed415d33c78121ffa9
- SHA1 72ed524e769a9f8e72804c019a1cbf58f0d305a7
- SHA512 a01c955f3f60325c4aba28ea6c4c8c0d9f0b1a46928fccb37d38ad676eeaee8814fb15ca15ccb79739d63802bd850940e365cf542d2de1381276d22796f62c63
- SSDEEP 48:C5H6MDvlw43mN6MJmxolFuTUyJaeGA9TKziUFvQ4wZK0E8ee1kAosky4+q+O:AH1ln4J9FwzKBkEtjJ+DO
- TLSH
  T11691840B3218DFEFD692033134AD8B5327FE66301E32840D6C374ABABBA52115972B13
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral6
- Target
  Arquivos Minecraft MPZyn/UnlockerPortable/App/Unlocker64/Unlocker.exe
- Size 122KB
- SHA256 a0b651038c4301f70e4aea506eb90edc584a5c4ca46880c7dc2ae5eafa6dc506
- MD5 0a77f732624155a215f5ca54df9b2930
- SHA1 172bdf71343dd6544cfbe04abbc3dec4535f7d84
- SHA512 6482c9fc3b5ff9d5798deb9965b4dfab9ba62b889e921011696f29dd96b813194a59f76a52a88fa4962317c6a43a21122c857e4ca80c6c4360c2cee544117352
- SSDEEP 1536:QjL8UYqusRZHN+R6iJBf232Qxl1D5ljFerDUF7TGMvB+xpgGfGlbPMcpEkAEAG+L://sRZt+R6+232QLADzMvYonfgQ/Y39
- TLSH
  T109C30781EA52A5C8E0F6CA72D5F01323FEF4B540C1349216CA96CBA75D0EB54DE3E64E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

persistence
- Sets service image path in registry
  This determines the executable launched when a service starts. It can be used to establish persistence.
  persistence
behavioral7
- Target
  Arquivos Minecraft MPZyn/UnlockerPortable/App/Unlocker64/UnlockerCOM.dll
- Size 19KB
- SHA256 0a66b19bb38385a8879633dce1272b8acf1b4b264c88e254345ec249335b41b1
- MD5 5fe324d6c1dc481136742ab5fb8f6672
- SHA1 02f2d4476006cecd771de3cbe247e432950ae916
- SHA512 faa76477503923d1c14a12f00d7d416e5fbb485560ea02ed1e6ef6337f9ad88bc612af241ea61c8f9003253ccf5f66b2c7ce4a508bb2adc761c4f36ac345195d
- SSDEEP 384:b0cviyVcgoH1a3FveCAmbtQ/o8DhQLMwdYJLygbPbCQW1M6jjDAa:b03nTHsFv+/oih5FLfbCPMmjl
- TLSH
  T199923B8747101092DC588F30D9DADAEBAEF5FE467DC6100B9675F99A2EB33F0025891D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

persistence privilege_escalation
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral8
- Target
  Arquivos Minecraft MPZyn/UnlockerPortable/App/Unlocker64/UnlockerDriver5.sys
- Size 12KB
- SHA256 ca7176fc219515d58dcfa66ec61880ece5617275c9b83701bb74d8b60e733d34
- MD5 9dc07e73a4abb9acf692113b36a5009f
- SHA1 0c45b0fa0718e5aba0f21f14178597a1ed3fc208
- SHA512 7bb2f07df990689933b344d2e3061a5e1324aba011e703130379ed24b253bdd464c9d26b8efe2d86523f241236ff1b7edb02919801850bb749849215b1fabf57
- SSDEEP 192:dqD9l0Hvj1+z7PcFVyowJL/W6Mgb5+ebCfYEQpkqs1I5Zgjl50Xe:60HvozjeVYJLygbPbCQW1M6jYXe
- TLSH
  T104421A8747102CA3ED854F32D1EBEAA6AE75F2C92FC5668F4070C5962E42BF5175C00E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral9
- Target
  Arquivos Minecraft MPZyn/UnlockerPortable/App/Unlocker64/UnlockerInject32.exe
- Size 11KB
- SHA256 3b1afea2711e5d731a60b41e87f4711fe1db3345fa316be20347376068479dd5
- MD5 5b964dbcc99edee45a6f235417713a93
- SHA1 e65bb79a470a509a50b4c275c10bc10892ab11ca
- SHA512 60dd41e0434fcc7d6d57a02d69cd47c2b74c9c18316f59aee88da087c22c3e8408aa94ab9738edc1b229db8f83e620354394ae3847e216c2bce33dc0d3e62743
- SSDEEP 192:kpjAiTRs0TjebH947yowJL/W6Mgb5+ebCfYEQpkqs1I5Zgjl5w:kWIsUgHqYJLygbPbCQW1M6jk
- TLSH
  T1503219CB0E122823DCC80F30E1DAD5969FBAE2873DC6D45B456444972DCA7BA17AC19E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10
- Target
  $PLUGINSDIR/FindProcDLL.dll
- Size 3KB
- SHA256 0fa04f06a6de18d316832086891e9c23ae606d7784d5d5676385839b21ca2758
- MD5 8614c450637267afacad1645e23ba24a
- SHA1 e7b7b09b5bbc13e910aa36316d9cc5fc5d4dcdc2
- SHA512 af46cd679097584ff9a1d894a729b6397f4b3af17dff3e6f07bef257bc7e48ffa341d82daf298616cd5df1450fc5ab7435cacb70f27302b6db193f01a9f8391b
- TLSH
  T1AE717387378506B7D08006303089BCAA3B9E9A350F5B59BFD6DBA99F7C641F4E134706
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral11
- Target
  $PLUGINSDIR/KillProcDLL.dll
- Size 4KB
- SHA256 c2689ba1f66066afce85ca6457ecd36370be0fe351c58422e45efd0948655c93
- MD5 99f345cf51b6c3c317d20a81acb11012
- SHA1 b3d0355f527c536ea14a8ff51741c8739d66f727
- SHA512 937aa75be84a74f2be3b54dc80fac02c17dad1915d924ef82ab354d2a49bc773ee6d801203c52686113783a7c7ea0e8ed8e673ba696d6d3212f7006e291ed2ef
- TLSH
  T10881C5436B102FBBC0880630358E7D1E64FA49A8536E00BFD786A98E3DD62D4F170367
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral12
- Target
  $PLUGINSDIR/Registry.dll
- Size 24KB
- SHA256 0b25b20f26de5d5bd795f934c70447112b4981343fcb2dfab3374a4018d28c2d
- MD5 2b7007ed0262ca02ef69d8990815cbeb
- SHA1 2eabe4f755213666dbbbde024a5235ddde02b47f
- SHA512 aa75ee59ca0b8530eb7298b74e5f334ae9d14129f603b285a3170b82103cfdcc175af8185317e6207142517769e69a24b34fcdf0f58ed50a4960cbe8c22a0aca
- SSDEEP 384:W2mvyNjH3rPnAZ4wu2QbnC7qB7PnrvScaeYA4CIDEge/QqL2AQ:/75w/OfrzB4CUxuQfA
- TLSH
  T1FCB26B82B1D1E973D09F0479AB993F15E3EFAD507670EC5300667AC732A0AA2C769713
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral13
- Target
  $PLUGINSDIR/System.dll
- Size 11KB
- SHA256 93d1e681daebfd24ff9fab3952e8ae94eddbdfb3650937988c1fd8085991610e
- MD5 a78507ea1078cadaa8b2ec1a2e1d874f
- SHA1 77fe20488444ebbaafc5b2c0743251a94edc3b8e
- SHA512 0399452c7305f23576d4175ec198ad8da8a530215e9304632b20bcb41a38fa0ba2c1c0b0b734b9f887851c92c7f2cf4cdfad403ace84e63318c0694402e1f270
- SSDEEP 192:8trS5c+oKreH53n2fUC1lfeTf9OJCzD4/IVqh88GrgU6H:/jrd09O3/IcG8U6H
- TLSH
  T11E324B6157A0C5F2D855813C0CAA363327BEBA1151B24E93DFB38980DE1FB917E39351
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral14
- Target
  $PLUGINSDIR/newadvsplash.dll
- Size 8KB
- SHA256 53377d0710f551182edbab4150935425948535d11b92bf08a1c2dcf989723bd7
- MD5 7ee14dff57fb6e6c644b318d16768f4c
- SHA1 9a5d5b31ab56ab01e9b0bd76c51b8b4605a8ccce
- SHA512 0565ff2bdbdf044c5f90bd45475d478b48cdbd5e19569976291b1bdd703e61355410c65f29f2c9213faf56251beb16d342c8625288dad6afc670717b9636d51f
- SSDEEP 96:qD5UDaGxZH52QhtZafDP9BTS9nPg83UniV/zRzGEl1DMl1zN6LmeYt4dO:W5UDaGxZH5T0j+9nl3BzG0IZ6LqN
- TLSH
  T1A002E839618096F3D26F15F45882AB1D4BFAE074239290324F73A1EA6DC0297FDB6347
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral15