f47dd0c8dba0777e1ea13c6de11348739b86374ab1be46c265e0087bf9d77b96

Sharing

Copy URL Twitter E-mail

General

Target
Victoria.II.v3.04.Inclu.ALL.DLC.zip
Size 548.8MB
Sample260715-e5k3gsbw9p
SHA256 f47dd0c8dba0777e1ea13c6de11348739b86374ab1be46c265e0087bf9d77b96
MD5 b7b3d78eec64cf71caa5c7983030746f
SHA1 0ce47cec767c306dbac2f689b36c91902fc20843
SHA512 a0a2009ed22c961ed4d4fdca34d09f33deb3f041bb0d95a39796f06f603188ba509da50fade199b2894025e22753bf4d2d45c4571bb2ba9fdca1830defee1464
SSDEEP 12582912:TBONvtajKaZK0dN+63pyMab2aNi/JPY4aHXTNgGrRNfJasivJeuVLXW7iWW:nKN0a7i9jqJRtveJTVi7a
TLSH
T18159333FDD08552BDC8BA8B6B377C1159BDED10474CADE5E08125324BAA58E07B36E8C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  Victoria.II.v3.04.Inclu.ALL.DLC.zip
- Size 548.8MB
- SHA256 f47dd0c8dba0777e1ea13c6de11348739b86374ab1be46c265e0087bf9d77b96
- MD5 b7b3d78eec64cf71caa5c7983030746f
- SHA1 0ce47cec767c306dbac2f689b36c91902fc20843
- SHA512 a0a2009ed22c961ed4d4fdca34d09f33deb3f041bb0d95a39796f06f603188ba509da50fade199b2894025e22753bf4d2d45c4571bb2ba9fdca1830defee1464
- SSDEEP 12582912:TBONvtajKaZK0dN+63pyMab2aNi/JPY4aHXTNgGrRNfJasivJeuVLXW7iWW:nKN0a7i9jqJRtveJTVi7a
- TLSH
  T18159333FDD08552BDC8BA8B6B377C1159BDED10474CADE5E08125324BAA58E07B36E8C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1
- Target
  Victoria.II.v3.04.Inclu.ALL.DLC/A_House Divided_Manual.pdf
- Size 9.2MB
- SHA256 eaac4dedd7afbc97f3af3dc128a6b7ec0e615abfb76788f8b61dfc46daccc0b4
- MD5 3c0fb43a81d15446027ad507b5d6a428
- SHA1 fba5f73f0024b994ef8259ee80d652dfb418b7c3
- SHA512 d9eeb4c5cfb0864b6c57c9cc3548f6ce4ff2386663f083bf1c18f37ed99e245d7ef5dc24565acc852a159f76c8ab802264596468a5e20dd108919e06688f969f
- SSDEEP 196608:ksImb2BAA5ERLg2D2U13+cSnUBCDmIDgtNQEWXwAXQ7y++r:6lORLggvbSPDTDQ6dXwAXVRr
- TLSH
  T1F5A623718C465F7CC4CD860D676A48DB0E9EF6B3AD8A5E05386C8ED4B342F8BC9426C5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral2
- Target
  Victoria.II.v3.04.Inclu.ALL.DLC/GAMESTORRENT.CO.url
- Size 196B
- SHA256 05658194e8de811116b86d073fbf95d0831f8a05b26e97908a44cad5cd8470af
- MD5 22418db266e93f3d2325a86817a6fc09
- SHA1 56fad950b78092feccde4d2d8eeed9eca7eaafca
- SHA512 9bbe646d3254d769df6e53e884a0a717c8ea68e2b47ff647aa4382f66c597b22f950c1a7d2be9a2a0720506c7964eb4912f22a7c1e02ae6a48bdc13756195a33
- TLSH
  T16AD023084704C1E5E54395433170BC48544D755019D5C414D344CE4B0DD06C0D45CBE2
- MD5 SHA1 SHA512 TLSH
Score

4^/10

discovery
behavioral3
- Target
  Victoria.II.v3.04.Inclu.ALL.DLC/IGG-GAMES.COM.url
- Size 198B
- SHA256 6626bfe6c288b998647273217e711fc913371597756601d88b4352a57215d591
- MD5 e4aeaaca90fce67661f114822a05821c
- SHA1 383566802ada60fa79899fafd8965787165cc9a3
- SHA512 6c53520d70d03ef00526648fd282b83b4faa21d8784aa848682fc023df0173142403723c2e932590d53cb1ff5439b63cc20cc640333c0e646952855436c7282c
- TLSH
  T19DD0220C8708C1E5EB43E84332B0FC44984E794808D6C898E684CE8B4CC06C1985CBA2
- MD5 SHA1 SHA512 TLSH
Score

7^/10

discovery
- Loads dropped DLL
behavioral4
- Target
  Victoria.II.v3.04.Inclu.ALL.DLC/gfx/pictures/events/leopoldiv.tga
- Size 309KB
- SHA256 518b8a7b2c0acdea7eed8bbab160b96d9859ff0ffaed5756660af07fa655e6da
- MD5 4ab2fa37aaaacd2d4d4abcfc2c5d6e8b
- SHA1 3423f441d442316a0a95f6c6c06d5cd689c41e25
- SHA512 90343e702b3fcb6bd95063cffc4010101d0e18dd5fb5e8ddf8b399f21dfb4459b7385282932dbb4fd998d4d858ac09421cd19bd8e95bf9359a65cedd72ff44d0
- SSDEEP 6144:wZ9VoEKdNJqurcwgVRq5RnMigaD69s4sjRpgAOctsoo:w3Q/DrcVRenSVqibb
- TLSH
  T1C86401594C22B1DC497006A8649B3FE49EEC1B342AB98D67DFB2940323627B5A15F07F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral5
- Target
  Victoria.II.v3.04.Inclu.ALL.DLC/gfx/pictures/news/peace_02_news_image.dds
- Size 413KB
- SHA256 1d347f16836561f6c2a0712d3bea2afb86ac18e21e2eadd537a5d55e6e141877
- MD5 f7da80e0c93fd3cb86e9d97de0c7c38c
- SHA1 8ef6ec12bb50362a01fde007fabe18cd621bd676
- SHA512 7535a709ae28e9b8c2bd1f0f0092a30599681d52adc3176bdea89e53712040a630d7e67d2156439f7e54a9082436da5fd71c8d692fdc77429be1ac82b44d2ced
- SSDEEP 6144:VKd8TqcLXrFgNT8ZZm6Cgk4UlIDS55rld9lU3+jUWT7k2XjN98cPXwPDHnqiBoRm:VKQ28m60/53d95U0Aajz8CwPD4RBTI
- TLSH
  T1A5943A14066AC9A7C3510B5DCCA1B7F5C0AA8EA1F41E935397E0BEC9BF75BE91D04382
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral6
- Target
  Victoria.II.v3.04.Inclu.ALL.DLC/gfx/pictures/tech/advanced_metallurgy.tga
- Size 89KB
- SHA256 81d28d4bdc532cc5632e26180eeecb5ce5af3e0307ce02586f25961c0d2f20fe
- MD5 5f2744e41a9b4b850c67a0c4c219c580
- SHA1 d6598a97f0a01e5bf298a4d4503e8d80d3235a2f
- SHA512 c052f51438ce706c0e2b53c5ed66d56d7370d6b7823a6849ba36a5f341521a2f4848555964d80837703931bf3177096acf17fe6a4ef8bb5fbbef0e2a811f855b
- SSDEEP 1536:HbXPbfiMxW4DyZiBrhNpY2596WNzijGBjPgiFyocLHS9QUfG9b4dMjL8jiebXowW:HDjiUNBp596WNzLBEt29q9b4ijL8jrXk
- TLSH
  T18E93BFCBC2962B472070442A2E05C0125856FD5DB6A6CF806FF6DF2D116EE246EE9FC7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral7
- Target
  Victoria.II.v3.04.Inclu.ALL.DLC/gfx/pictures/tech/assembly_line.tga
- Size 89KB
- SHA256 7f64684103611d242f0c67c3ab39647fa704f34f8982a6b4492c0d37e2e30095
- MD5 bd373774a1641d289ce6669d48209c25
- SHA1 84c5cc2dbb483c7c14165ae408968dcd0ba61e24
- SHA512 69923c43aa63e95e63c164fbad23ed210f267fc4363d1dbf96a198216da654d1f8c6e973bdb203dffda6d3e58c45991509248238753320e568fce5037ba74939
- SSDEEP 1536:1qW5+7ZFOkig2pJmzhdyxWrMGQwpGuuDbcpj/jIlU3vXXCNATv:kWglQkip7MfyxWgjMGuycJ/UlqWIv
- TLSH
  T16993BFCE87169F8A741028BC7904205134CBFFAD35B5CDD0EEA6F80A599DA65A074FCB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral8
- Target
  Victoria.II.v3.04.Inclu.ALL.DLC/gfx/pictures/tech/infiltration.tga
- Size 89KB
- SHA256 dab0288790a69a8f01bd6c65f851688ed429ca5f2daa8ec9629aaaf62e314396
- MD5 7f16e1c1dce0dadf39f0d258c7e935a1
- SHA1 36841766e6a570155ebdf6a2d85ef644254f9cf6
- SHA512 8fca22fe83e23bbb18caf80b07d7f67041423fd44623042dabd1ee6c505be2a6409e34f100dd9ae3cde69e21d68548bb411397239a44bfb8d088aa1717f7dc67
- SSDEEP 1536:iC0myQC7J7uuUJT3aK/Ayz5Fjym7bapVHeYtU3Bzwm5RKbcV/UCPYaJJvS+U8dmX:90myQC7suURqK/AylImabRtU3xw5Q9Uv
- TLSH
  T104937C5576167341D98EED3A7BD8C14E594269B4F2C3EC7B1329FB042CC7106BFA828A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral9
- Target
  Victoria.II.v3.04.Inclu.ALL.DLC/gfx/pictures/tech/late_classical_theory.tga
- Size 89KB
- SHA256 9547fe0c1a7c66d726e05b9d7cbf945a3b66d788ecf11128da10e27920ae386d
- MD5 c226de2fd15759a54fb3ffdb3f490c28
- SHA1 f5d825e2b97b1a6710b4deb8267e05fe40b4a908
- SHA512 7691a6d2bc184f301ef548a5140ab69567642fdf41c909970cbed8918c7edccfd2125ca9fbdc42e4862148d0df5175d229f56d893fc8adbffb45a2bba47c19d6
- SSDEEP 1536:4oR9JveYPNLZK8btzOFaHB+eV16rWNkvH+qOHXnWaIkYn6rA+Z3jYUiWL6/Cg5sM:4u+MZKmdO4fV16rWNiH/O3kkY6J11619
- TLSH
  T1FA93E18F0075678B269199F0AD14D669C1C4BFA63BBBE072B78CD61819FF4388F54B81
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral10
- Target
  Victoria.II.v3.04.Inclu.ALL.DLC/gfx/pictures/tech/naval_decision_making.tga
- Size 89KB
- SHA256 3448c7e02b142aa128077fd40b9d7276e74ab6c8e9513203d386c21dececdb0e
- MD5 938e9359fd8d92f9da8b2806301e4475
- SHA1 5ccd5bfa80ae1bdc46b0d3f477e11046640420f4
- SHA512 cd6181100cec46b6f85d1de2d34706876963eebce8a3e0879b5616a3449dfa5f29312449ab9f4d5e659313f8fddf76cf30cf7b9e2ba5c5f2b0da13232a8c0ad0
- SSDEEP 1536:aZpVBUaLZ1tV12TLciX67+n/mEL1cnB3eDfnvwD62kLm5p0cnIe/KrXaQ4iqe5qM:aZpVCal6QLanONWnvwDCm5p07zXa5iwM
- TLSH
  T1C893C0CFD313DB8334A018BD3F8412415489FF59AAA2ECA1F7B9ED06155D938C664E63
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral11
- Target
  Victoria.II.v3.04.Inclu.ALL.DLC/ggcoins.dll
- Size 403KB
- SHA256 3e29a9501e1dec6fc728eefd4a4390261471b14cac9f7f95277ab46ab47a0305
- MD5 ae028bfc5bda78d212789acca95cfc65
- SHA1 463b123c59496d26fc9c22a64ed80e8e8f96e593
- SHA512 c3214789cdd8cae02676dc83739c7524195bc86fce3b1e2fc7635e56dbe44f9457db4737e0e3b3f6422c5a7612d9254683e1e89012cfabb7e2263586bc9ccd5b
- SSDEEP 6144:0n2XsW12J0J/LmzraJuZQwaxvk45YPR3m6gcslsvaqAIIa8uwVeNMFCTrx+X3oMc:0nebHwaqR3m6osIa8+sQD
- TLSH
  T12994D6B10FCC5FBEE32528F851A7380827BD68166B14BB8187A7DC4D1987531F06AFA5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral12
- Target
  Victoria.II.v3.04.Inclu.ALL.DLC/launcher.html
- Size 337B
- SHA256 4653f99aef98c7361b5d8215fc7d34a2670a1d9dc240b017966f412d938c393b
- MD5 80650745d20fc9bdd1648e082b022316
- SHA1 924c98cad137d60bdfb0cc52df16e21b9fa8d1ea
- SHA512 d9235a928e8149078959f70575a20cf04df75835020453aa2a8cb8f9bbcc391078bd1cc39842792208987269ceb64df221a0a3e6cb5464310bf02c3a4db9df7b
- TLSH
  T1BAE07D7E55C63C0FC1304570CAE2B6949BD25603A30A494893B1257BE68E24ADCF32DC
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral13
- Target
  Victoria.II.v3.04.Inclu.ALL.DLC/launcher/launcher.cfg.bak
- Size 1KB
- SHA256 f055510a82de3d679ac8c71e8a97bc2ef829281b628c4900f7949586fd856417
- MD5 6c51f71b45eb9130e997bc53b1ebee82
- SHA1 394761c14560584471d4c54b2c5113267ca62f28
- SHA512 6e00c24e2488b75ee6615383a3848ab3f08fef461c2b12541899734467946ad4abcad3787f2bae8fbe6ef5bb6c916dcf7e3a5686397083573f781009269078fc
- TLSH
  T16621E10F33CCA17767E8CB02413692FAB83CC540800B25FD9D623850915E43A8E7F711
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral14
- Target
  Victoria.II.v3.04.Inclu.ALL.DLC/launcher/launcher.html
- Size 337B
- SHA256 4653f99aef98c7361b5d8215fc7d34a2670a1d9dc240b017966f412d938c393b
- MD5 80650745d20fc9bdd1648e082b022316
- SHA1 924c98cad137d60bdfb0cc52df16e21b9fa8d1ea
- SHA512 d9235a928e8149078959f70575a20cf04df75835020453aa2a8cb8f9bbcc391078bd1cc39842792208987269ceb64df221a0a3e6cb5464310bf02c3a4db9df7b
- TLSH
  T1BAE07D7E55C63C0FC1304570CAE2B6949BD25603A30A494893B1257BE68E24ADCF32DC
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral15
- Target
  Victoria.II.v3.04.Inclu.ALL.DLC/lua5.1.dll
- Size 164KB
- SHA256 26384c6ee7d50863e3fb65fdc1bad452d9311f34d782390401de9bb130eecc4a
- MD5 ee3043c17751c763e26d03f6eebb1b8b
- SHA1 91d52c619c561db7f678b43456a2bd500064bfb1
- SHA512 1ee1aefef0ace1d5fe4a5fac06d1e46e55c9a2180b98cbda540cdf4a15e5e6f17c99c473276524b10485be574032a66c34ce08a9c973e9a46c59249307dead41
- SSDEEP 3072:PUvMMlibAYKY4rg4ODk2nCZdNcbjNXMga9j6n9aWBn:MvflibAYK/rFdwNcFI9aW
- TLSH
  T172F39D11FB93D178F88722FA4AFC607B0C35B199A7A6D0C76BD56C9248805F17A7930B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral16
- Target
  Victoria.II.v3.04.Inclu.ALL.DLC/lua51.dll
- Size 11KB
- SHA256 b2ba19343691f22d1af1417f9a7cbaeae74ba820a2a412f5a6cdea271cc1a7b0
- MD5 5860f15ae01bf2a35f48d6d954a9c048
- SHA1 9c625c14d0f6d8912b2b930ff0e0fc4881c65e7c
- SHA512 a51a6fc4b0fd2049a8868968d2a6a42bc010f8811ab34801edad1b31804c9747ba06a53d33191400e22ed8596f3bdb4c7de6111c32467aefe262c5eee71a85d9
- SSDEEP 192:Yn9bwibw7JYkjcyFZNcvqr0Py3v7u8meG1+mlXzI+eN1qyOd8cw/RsT9QwhzBDkf:Yn9ZPvqr0uzu8meYyOd8cqsT9QwhFYf
- TLSH
  T122323D1E9266B0CADF6A59F129A5410A091076126322F6F8F7EC8D63CF1237FF42E711
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral17
- Target
  Victoria.II.v3.04.Inclu.ALL.DLC/mod/MEM/gfx/pictures/events/leopoldiv.tga
- Size 309KB
- SHA256 518b8a7b2c0acdea7eed8bbab160b96d9859ff0ffaed5756660af07fa655e6da
- MD5 4ab2fa37aaaacd2d4d4abcfc2c5d6e8b
- SHA1 3423f441d442316a0a95f6c6c06d5cd689c41e25
- SHA512 90343e702b3fcb6bd95063cffc4010101d0e18dd5fb5e8ddf8b399f21dfb4459b7385282932dbb4fd998d4d858ac09421cd19bd8e95bf9359a65cedd72ff44d0
- SSDEEP 6144:wZ9VoEKdNJqurcwgVRq5RnMigaD69s4sjRpgAOctsoo:w3Q/DrcVRenSVqibb
- TLSH
  T1C86401594C22B1DC497006A8649B3FE49EEC1B342AB98D67DFB2940323627B5A15F07F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral18
- Target
  Victoria.II.v3.04.Inclu.ALL.DLC/mod/MEM/gfx/pictures/news/peace_02_news_image.dds
- Size 413KB
- SHA256 1d347f16836561f6c2a0712d3bea2afb86ac18e21e2eadd537a5d55e6e141877
- MD5 f7da80e0c93fd3cb86e9d97de0c7c38c
- SHA1 8ef6ec12bb50362a01fde007fabe18cd621bd676
- SHA512 7535a709ae28e9b8c2bd1f0f0092a30599681d52adc3176bdea89e53712040a630d7e67d2156439f7e54a9082436da5fd71c8d692fdc77429be1ac82b44d2ced
- SSDEEP 6144:VKd8TqcLXrFgNT8ZZm6Cgk4UlIDS55rld9lU3+jUWT7k2XjN98cPXwPDHnqiBoRm:VKQ28m60/53d95U0Aajz8CwPD4RBTI
- TLSH
  T1A5943A14066AC9A7C3510B5DCCA1B7F5C0AA8EA1F41E935397E0BEC9BF75BE91D04382
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral19

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Loads dropped DLL

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19