a1fa46bea81a386d80dd94d4496240444bcf5bca9b84d5c1ad7dd76bc8c45c28

Sharing

Copy URL Twitter E-mail

General

Target
Cs2SkinChanger.zip
Size 69.6MB
Sample260710-wk5ptsd16n
SHA256 a1fa46bea81a386d80dd94d4496240444bcf5bca9b84d5c1ad7dd76bc8c45c28
MD5 8fc025d78bc1c59c8ddb1e16423797cf
SHA1 866e981dd88ae1603dc71b0d33bb43b3064a6333
SHA512 14c7f7699955023f1a736351624eedc3f1ecde3b900e6c7f8b4bb07e2d94a90feec7d16f19dc8d6e87bac0849a5caf36dc688431ed8e83678a51714d359b346a
SSDEEP 1572864:8IsrTII3g7ISx4ctfo7I8Iul4ZMkg8tytOYIXImw2jzEq5SAJyEcn:8TTSucNcI8cMkg8taIXxv5dJXG
TLSH
T1D6F7335D51F237A7D2259FBA4FAC560F81E911C76A690CB3838CF9F8998BC794C009E4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  Cs2SkinChanger/Cs2SkinChanger.exe
- Size 25.7MB
- SHA256 d512a8eeee1fa8bd3b9f5ad470abcd910b2e8914a5e5b822c472c51dbe49843e
- MD5 36c5695e96a7aaab8bec0ce3bd58a47f
- SHA1 a753c859c23f2fb0e667ee55d44edced4a0d4049
- SHA512 9b9502d27c4842df0eb0ce7a0a13ec08cab33099dc09e545bc9b2dbed74ff13378e9518aeed695a3877da35156931b4641f86a16d7d3d072705475f2f8c848a0
- SSDEEP 49152:jQJJMji48N6gxmtLhJDU1jTMMAg8wuysdjFLP1cuF:+wiinTP1x
- TLSH
  T1E547BE34A2D8D1A8D43FD634CAB69233D6B178460735A48F0699C205EF73A917BFB316
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10
- Executes dropped EXE
- Suspicious use of SetThreadContext
behavioral1 behavioral2
- Target
  Cs2SkinChanger/libiconv-2.dll
- Size 1.1MB
- SHA256 2e5883a09cfc4391cb81db3f0da4d9b8cda21fc1b287e73a1624ad518d941b94
- MD5 ba98508c9c8fb1681193aeffdbfa535e
- SHA1 789489f95afe79a531373099336310707f0199ff
- SHA512 992c8dba9e2a76bc8dfb2986d637c9005d8e607631dc7a9b5d16597b741421d3c287a1be27a885dfe360ce46e5f4b4b4282c18aa2f4582264ea285d993cf994e
- SSDEEP 24576:fyRg1BAUZLY3wPKo6VbbTOZGavkg3NyeuQ6l9fH+ftFHo:6Rg1BAUZLYgio6IZGaXBuQQ9etFI
- TLSH
  T10535BE51F3D2CB2BF263C6B0C9AA5B26E427EC216B0645337660B3BC5D33BA415C8566
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  Cs2SkinChanger/libintl-8.dll
- Size 301KB
- SHA256 a62094d6e21670f460cb110389d2cb7b9bc12cfbb075151eeb2c52436cc02755
- MD5 83f4bfec7f089f4a9efd5b36690b6cd7
- SHA1 8f9b913c8c4724c70eddab906fb1465e4fcb0dbf
- SHA512 43a4049e6ca85b90fe9b325b301b6c23d94d2045e0b218b0d0495c539ec22c6f43b2f4fd589b77b3945d0f9f2938e84db9c534aeb79fa5b929102b0c6eeeb20e
- SSDEEP 6144:DqvWcwWaX1Ziu21y+7DE4a0onJMFEdd+TuoJB:6WcOXow+8Wmiwd+TuoJB
- TLSH
  T11C642907B24395D9E153D5308987C7F5B973BC720BA0AAB726A0F33C2E329515B19B27
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  Cs2SkinChanger/libpcre2-8-0.dll
- Size 711KB
- SHA256 413b0fd931d5e98e0fc70bb37d33c7aaca9d4a2b0321ec6060bdd716d80dfd92
- MD5 8a360488bff85ff1da8ab57fe40df98b
- SHA1 0e841e0fbe1f3245eafe0fac26d75862b83f0da4
- SHA512 c6549584035244e0cfa9ce36c02671fbda9482268d02f1c450e65653b9e434323569113c5a403a6bb3242b10aef599d14c4a6ba88865d6b74279e09fa2909b43
- SSDEEP 12288:C/94uwmMo7Q++CDdewFv4/iIhZ9SsChldffAf/fmjFUWu:C/Cy7BDd94/6sEXI3fmjFUWu
- TLSH
  T193F4D547F4E321E8CD36C175E7B732B2F53639E91035BDAE16A0C3312E139216A5AA1D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral7 behavioral8
- Target
  Cs2SkinChanger/libwinpthread-1.dll
- Size 72KB
- SHA256 056bc9acb72f6abe0ea310240830a797d6025c021717e9f2236fff13b505987e
- MD5 0024fc94950db03787e05b75d6df7045
- SHA1 185926c71bbba61dfe1b0d39a2aac616a16c05ad
- SHA512 2784ab1115e04fc332bda1b4ae52f1adcae13e0f8da5663158a882e027b4a97a7f5f5f894ec46b1a22dbc360259c0bd61fbcbf8190434189f7cb3970ba58c8f8
- SSDEEP 1536:Y50UI6m/amlAH0KRkkxahxPm3YyUKZpD76KC/:yaaUKqkxa7Pm3YHKZpDq/
- TLSH
  T1E4735E2AB29518FECA97C234A0DA5332B533F8201131EF5F9724D3752F64E119F2D999
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  Cs2SkinChanger/msvcp140.dll
- Size 540KB
- SHA256 def46aa6a8f72f27bafac0c43334419486a4d1dcdb6c479a8ef7034b3e1fa4cb
- MD5 4e3fa9bd90ef020c14359639dc19312b
- SHA1 a51032ec39a292afda65b0e3053d4ff3e3241512
- SHA512 3e3c62fe860199953cc87e0516b77f6a039f2563cb6b5cc48edc51f243e5ea8fd9b2e3239a089966c403f17a8b3766090bc7b827399cceb00a37bac970855e15
- SSDEEP 12288:M0MrE03u1mHWV/I3z+bQEKZm+jWodEEV7X:M0p1F/IiQEKZm+jWodEENX
- TLSH
  T180C42A23F75906E0E195E3B8A1838702D7F17C5A8322E3C742EB955E2F577D0A63B690
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  Cs2SkinChanger/ucrtbase.dll
- Size 1.3MB
- SHA256 c2ed69b4a1bb9432c75134e813c70539e27c8c1fe96a784d9be78c874e93d9d5
- MD5 ef62e9b3d7203f825dbf5dda8d4770c9
- SHA1 7f1f99f61082c63a645cea72d41481928b4d19cb
- SHA512 cb79d334af2c436cd62d0f4be8ef8f4f89c4590c666125fd26a218426079beadb9da8cc99cdc28fcef6c3574a4941592f85019aa642f71f1e7559f599b75233c
- SSDEEP 24576:T9KcgsGAmTfFqSgdDWqNUF3Z7Nkqnjqo3JYj8Jszg8mxvSZX0ypapJDBL:T9KpUmTfFqSgdDPq3DjqI08JXpJD9
- TLSH
  T15C55AE6176AD01E9C1BFD13DC64B4606E9B2781503708ADB03E94E792E3BBE9177B321
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13
- Target
  Cs2SkinChanger/vcruntime140.dll
- Size 120KB
- SHA256 184146852727a9db4eea06178716bec3cdbb1015c911f6b0f915b184ad7775b2
- MD5 0d35c5e99871b4f02c490b9fd9dace34
- SHA1 c2280e6285147cd8010becc0cd3a120fca0088e0
- SHA512 114bc156655e0d3249b6f94af1da80528b6695630f548ab596dfb406f6ffcc65276c9f900b637ba9c244ba5a4331aa15d2de0672f6dcbd38cb49a206c100698b
- SSDEEP 1536:a9pCUgtBAVcxStMXcfG8VwfmpcGLOI5Sv+vecbeQ6N7l9gEeza/yLzt:qyA+3EOfmpcGSdOecbeQ6Nx9Mqsp
- TLSH
  T1B9C37B4272B802FBC16BD274C292AE27FBB6B50687605BDF07AA86650F537D06D3C341
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral14 behavioral15
- Target
  Cs2SkinChanger/vcruntime140_1.dll
- Size 46KB
- SHA256 e6bfb3662ab4b1969a73441dbe35c96d51441b6bff8cf1fe7430bd5b246ca605
- MD5 03b43160d21c08de07a79d0a1c5ee81d
- SHA1 0a449093006af667432b83303614b53b62fc0d05
- SHA512 8b835205bf037b78144f0a4a78618a4e74ba087ac9916c83cb25aff266ddcf5c1b859a6e7c6fec2b57ffeee94fa2f52dd7f6e98c387a4ea7a3143fef6a9570b0
- SSDEEP 768:BezSkbhNfI4fWLZyS/dPWxngU907N9z7RV80X9z+:2YZyuPWxn3Ivz7bDz+
- TLSH
  T1FC237E9293BC4086E89B8970C1DBDE57BD38B7D2576093CB1BA5E54C1E537C0E63832A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral16 behavioral17
- Target
  Cs2SkinChanger/zlib1.dll
- Size 128KB
- SHA256 49dea0fa4f407054ff10b459e8dadb6443cc0ca8aefcd19d9864dd0423b27501
- MD5 189289e121629c125a1d1e8be51f0324
- SHA1 f86ef2fe11269fd45f7c5d8c4b523ed8e445b56b
- SHA512 9693347fd0bf9c6d05c288aa09a892368b32d4c2288ed74dcb62358787f034465c17ac5b409dfeb261a7055bf6b2d9479ba03defbcd39c50caad1dbc7e8e3dee
- SSDEEP 3072:Ljf8ECbYiB317HVhVpaKdAAcsrK2M2nuh2UI6vTH2F3/Fb1:fLCbYiBp1LghAxG9BI6LH2F3/X
- TLSH
  T1F2D38D9BF8A265E9C6B7C17085D78B72F930F81106746EBB4258E7742E22F405B1C2ED
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral18 behavioral19

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Executes dropped EXE

Suspicious use of SetThreadContext

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19