0d43824e36a982a5e50b11db9274b71a8b9427c448a26bd31105f10e3a30b0c6

Sharing

Copy URL Twitter E-mail

General

Target
Celeste v1.4.0.0 -Skidrow by {cFinder}.rar
Size 844.3MB
Sample260711-3flvgsds7t
SHA256 0d43824e36a982a5e50b11db9274b71a8b9427c448a26bd31105f10e3a30b0c6
MD5 a1aa494f930d08a09b12f50c6d47c25f
SHA1 a821f293b10ca66d3d2eb55f1f22b469d2a33fc4
SHA512 be616c745fed3091a4df321e0ec0c20cfb26a439783a0425d8c884a42360aaf162662928efeb9f2e5e569a203dbb5c1cfd2d4199a792cbf71804052535d1d80b
SSDEEP 25165824:BhGBwIbp0MP+IyiSV/ToL9gNcaiOXhTVP0sRCtRj4iSI:zGBwkpY7Qol0Swye
TLSH
T17F993394F5EF7058D3DCA8F7BF71AA5344D00D4AA4E26006A246923E7FE337449267CA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  Celeste v1.4.0.0 -Skidrow by {cFinder}.rar
- Size 844.3MB
- SHA256 0d43824e36a982a5e50b11db9274b71a8b9427c448a26bd31105f10e3a30b0c6
- MD5 a1aa494f930d08a09b12f50c6d47c25f
- SHA1 a821f293b10ca66d3d2eb55f1f22b469d2a33fc4
- SHA512 be616c745fed3091a4df321e0ec0c20cfb26a439783a0425d8c884a42360aaf162662928efeb9f2e5e569a203dbb5c1cfd2d4199a792cbf71804052535d1d80b
- SSDEEP 25165824:BhGBwIbp0MP+IyiSV/ToL9gNcaiOXhTVP0sRCtRj4iSI:zGBwkpY7Qol0Swye
- TLSH
  T17F993394F5EF7058D3DCA8F7BF71AA5344D00D4AA4E26006A246923E7FE337449267CA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  CSteamworks.dll
- Size 134KB
- SHA256 7f08cfc5b685c8f44b34a6fd4500fb136b9c5ab3faba975565dbf8ca308a4551
- MD5 407e6aff9631e0eabcb1c2a95f915a2c
- SHA1 b982bf736e8aa09e451bc50b103fffb7a560729f
- SHA512 102fddeb1564da91578819f44f006056800c380da0d2f5694d9467681cf0a7064dd3361fe21666ea59dbc98fedb2efb9cbaff92b2da6b26ff9b73f9bea56b2bb
- SSDEEP 1536:z+JRbyEQ2/QqREDnyYVPZeDcajGE1RLziNa0Zl1XXV7UbrUW9IIIazhlIv:z+JRbyEboqSNLeAEGcLz/0ZlmrUWHDI
- TLSH
  T1AFD33209300807B8E9F901FDD5FDDB02E1EE0053E368AAD77694A4EE54B5AE572709E3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

discovery upx
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral3 behavioral4
- Target
  Steamworks.NET.dll
- Size 259KB
- SHA256 6c6b307e907294003014da3ed4610e362a9b6ee4093a20e514b0e23454da3085
- MD5 99d438dbfe339a3709d0e4184832411b
- SHA1 f928080b7322cfcf3050c2c5a44599e4534809a1
- SHA512 f833ea075706ec56e42d77b19e7bdb12e1130b4bc3d0e3667fc1a04af362c8c48f170fd03ca5fb7f59055a328b7555fd111ddef3b499962be320425f7ff26755
- SSDEEP 6144:IBhD4Btft0b5nhspFmFmMiYiXZq9+b0obQncGH0rLgMpsSiMYZkvh:UKtqAKiYiE9dH0rL1idZa
- TLSH
  T1CF44F815AB295567C45C037574A74E2E9BB2F0E3132B2B2B3BA1E96F5CD37841F821C2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  _CommonRedist/DotNet/4.6/Microsoft .NET Framework 4.6.2.cmd
- Size 142B
- SHA256 348295a905e1029156c6a14e8521384af779e68d416f07017fa031f6a5ed4b08
- MD5 7d7ca496434a4590a8f210b7002fef69
- SHA1 0e016f9a85c4b137dc35d35d73c3cb9cab479d03
- SHA512 1dc1f6a0eed8c6cfc1a2e9f5be534c55077ab18757971d7c76305572ad1a48e659e5bbd9411c706d5b0e94b4b554936fd90adffe16e22c1614cc2ee509ec2f98
- TLSH
  T104C02B6C84000D3D447357FCC810D94280FF8246B0032802548D1E4C200EDCC2E4CCC0
- MD5 SHA1 SHA512 TLSH
Score

7^/10

discovery
- Executes dropped EXE
- Loads dropped DLL
behavioral7 behavioral8
- Target
  _CommonRedist/DotNet/4.6/NDP462-KB3151800-x86-x64-AllOS-ENU.exe
- Size 59.1MB
- SHA256 28886593e3b32f018241a4c0b745e564526dbb3295cb2635944e3a393f4278d4
- MD5 9a5d647ee710af2b1aede329c40bbe1a
- SHA1 a70f856bda33d45ad0a8ad035f73092441715431
- SHA512 e183b33f93fd5f9aa93a1ec02103d2548ca22e3447ef2ceede89a5debefc4f2c20990567eb17afa412e0698d577adda373e433847ec8b79ec04be3c86edd9f0e
- SSDEEP 1572864:7g7Xhx6o3bLRPlESTjTXKOz7QbB8Tn1EduqkJy/YPVUwk8/:sv6o3/zEyjTaj18Tn1JPoQ1x/
- TLSH
  T188D733A3231713E6C4872BB00F6197A1FE3E3E897179C04AD4D4772F3D35A949278A96
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral10 behavioral9
- Target
  _CommonRedist/DotNet/4.6/noop.cmd
- Size 22B
- SHA256 6dbb73adec91cf3fcfb3e882aa9ac90fc27837259cbb266da1436b99f5ac1f73
- MD5 d7fcb065910d37a1fa5d0e8d0409af9f
- SHA1 767a831a8fb1edcf0f80b9043cf687d388ace13c
- SHA512 967ea2173e70e5b1857b2c55b129c71cf61b7359477581cf390e6db3274f45c99bc28f96604b7397f69a3ccc33f12c4e4af8281a366b178861b1dcd62a730607
- MD5 SHA1 SHA512
Score

1^/10
behavioral11 behavioral12
- Target
  _CommonRedist/XNA/4.0/xnafx40_redist.msi
- Size 6.7MB
- SHA256 e02a21a2abcd32fe64411704fca9b199844f13f22f9d5b60d4b7c912c7c88e15
- MD5 f949909f4cfe27a17e6ca047fb8d4a46
- SHA1 7a7b99a71d4aca7bf91b8824d34c9e35096caa97
- SHA512 75fd31f535d9a8a8cf1df35ba1c4a1fa071f9289463a98f549ce1450505efd7934d6bd79ee6ead9650be22614ce653cb371cb0a16fca65f54a01df6f44129310
- SSDEEP 196608:LYD3C1XXfzHuL//JpjkvVSKhzELKFQrF:LYEPzHuj/JVKVSKhMKI
- TLSH
  T1EA6622A2756AFF41EDB406BCD931CA590926CF77812B0C156C2935667BF7E0202E9E0F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery persistence privilege_escalation ransomware
- Executes dropped EXE
- Loads dropped DLL
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral13 behavioral14
- Target
  fmod.dll
- Size 1.5MB
- SHA256 a8db3942bb5043e5bf425ee71c73ddd43ff1798faa2313960d59ab1148d95aba
- MD5 021c0f4991ec7e4f7d6a18872d9edebb
- SHA1 15bff6765f43b891f3f0b3242f57fee138af91c2
- SHA512 2de064947c99b4ca2ddddf6673192c31b12ac8e86266dc15615fea9d88d6e2fa979638eacc9696d28938253d438637bd3a06a4b2e271f3dce9cf70d64c807430
- SSDEEP 24576:cYURLh9Q3GIk44Znhn0HkwT0afBeWc2nmtnry2zVGseLVVUKd:cYsGGM4ZnhLC0MoKio
- TLSH
  T1B4659E10BAA0C1B1E4961173A6FD3B6B69397EF5032811C3A3A40999CDF01E36BF57D6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral15 behavioral16
- Target
  fmodstudio.dll
- Size 1.1MB
- SHA256 c2dfc4305b175053552301bc3820732c0eb7369859d1959d17d10a1c8b010b19
- MD5 a0a016fb7e711006cdb59ffa449dd549
- SHA1 d2a45d3044c5bd8c88a1283fbb081707bbb6a20e
- SHA512 c4ef6152c1362a3b9359193ebcf05397c5e0ed248bddb1427602ca7478ec29224e6a46d498d06766a221c1052a25109f4a502b996567b1f278029d85aa721f19
- SSDEEP 12288:7da09ZkUpMV7W6htVX/CfePJGQ20lDfr5B5IDjT5lV7Fen:BN9uUpMV7WMceBGQ26r5jIDen
- TLSH
  T1D2354A31AC40C671E8E15173DBBC3A2E52ACC611032C16D793AC4DA29DB56E37B3A6D7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral17 behavioral18
- Target
  steam_api.dll
- Size 861KB
- SHA256 69add3559c70cc7c783e9c11943ed5751a5635b965a43a71938e401941079eed
- MD5 7cf6c4a4695a045e46f47f81331ecaa0
- SHA1 342017577a08cdad72d5ade4ef1e8ed6909a0b9e
- SHA512 b9714299cf04c62eb9ff2476490d1ed01f5a8614132935788e97178b458f23c197e651516a6cfd342ec0ecc8c488ce90fa84cb7e15f3eba854bccddcccb6fc72
- SSDEEP 24576:x0mDIm7UIxt7yaujDwBeaz/46mwN5Qyy9xCc:tfUIxkaujk8azscQtxCc
- TLSH
  T185150177621601F5C5B4C634AA528D0FBBA4128F30A4EDFC3A088636CC87A577E7B5D9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

discovery upx
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral19 behavioral20

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

UPX packed file

Executes dropped EXE

Loads dropped DLL

Executes dropped EXE

Loads dropped DLL

Badlisted process makes network request

Enumerates connected drives

Drops file in System32 directory

UPX packed file

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20