c4949e748348256c219ec0406d2e16e3f4845fe676d3dc26dbfcb2059afdfa81

Sharing

Copy URL Twitter E-mail

General

Target
Steam.Auto.Cracker.GUI.v2.2.1 (2).zip
Size 16.5MB
Sample260716-dfx53sft3v
SHA256 c4949e748348256c219ec0406d2e16e3f4845fe676d3dc26dbfcb2059afdfa81
MD5 93dd0c79faaa39c57d67aa07aed48c24
SHA1 65490baf70f3cd3375a161556dc908aaa683c085
SHA512 4f1bca38cec5c74f5c3dc0836086387ec57303d9b9231be8312159173e0ed519dd48aa4f5aa061c28c378b39e271790effafb6026ad95476dc8f74769b637ac0
SSDEEP 393216:QGzV+s5SdCAOe9IcnfNPc02zyJLcbMhEo1W5BL906jz7RlyK:QXsk8SMz0LpDU57bHyK
TLSH
T1D007330E0225418EB58AE276FDB599287B259F374F5476402B3ED285080CE7269FCFBD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Steam Auto Cracker GUI (v2.2.1)/Steamless_CLI/Plugins/ExamplePlugin.dll
- Size 5KB
- SHA256 c6dce0ce7d432fbb8cea249e4dcd1394adc8c2adc819012c745b709c68e585a9
- MD5 dbfe069390646f3402b21f28005f3156
- SHA1 062664b8e81e0b06f72970acf8cac2ecc2001d51
- SHA512 904525f99e9c458e4e04db95e4d10bb34f78cfc569b61b5b9a57e557bc50bf768e6d29f43ecc70b381e7a50d74dc7ab93ed5202e14b77a3ec036d031e9db19ca
- SSDEEP 48:6c6A+IvVrnXjGluJoN1DDemM+V4edYGlQlsNlRmlb/lbGyClbVSVgz3HVNUwtwcr:j+WVjgd1V4Wh5yWSVgzVxa5oM
- TLSH
  T185C1631563DC523AF9F74F71FCB353021639FA118DB3DBAD1489064A2D135248A71B32
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral1 behavioral2
- Target
  Steam Auto Cracker GUI (v2.2.1)/Steamless_CLI/Plugins/SharpDisasm.dll
- Size 215KB
- SHA256 6d3ce990cdf58da228697d25416d16d15994135c5f66571fe1e00e9c975bc2cf
- MD5 0f900d9190603d646009ec3523fa43cc
- SHA1 a04598dcef92337ec57c0a357c2e55a1fb9c0f40
- SHA512 24397a81c9ad30f3d5377632d74706345c4a9811076357df3fc8d307a8941167b2b40b85923a4782f22a531e9f3ac4fe234ab892bdc1139a1a60f4ed7798a467
- SSDEEP 3072:y0AUOuR0cuVT+INgDgU0CaG8yVHZ2pFnjuWG/tDTQPd0FvAvxl3vBsyr8fnLN64R:hsuRUVT7U0CaGpVHs/jEEsz6
- TLSH
  T13224A772654223B3D0766BFC47B3E68F01A0DCB729279F59388B39D6D9583305AA2D31
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  Steam Auto Cracker GUI (v2.2.1)/Steamless_CLI/Plugins/Steamless.API.dll
- Size 33KB
- SHA256 d6acc4b0cc768213a46ffad0a6bf6070a6b13f79a22e0588f0ab50c950f9248c
- MD5 c347632a60da1519c48ff043831ca7df
- SHA1 5fa976d84468d69a7cda801651415f666e6e9b69
- SHA512 9ffab32ef1a53f9a08cab77d68b9d5b9676e4e1c2a63acc258f80769d544629a31b03c6f9b3fa17a19f7897e2fb0613379802e67758629a46b6d4978c5137906
- SSDEEP 768:DQS4Cd5dulN1LdZOAQoAksbgaDTO3NnS6KmskO4Nuy8S0N:+Cd5dulN1L7TcTy7NuAG
- TLSH
  T112F23A4117A4C32BCE9E0BB4B87391064375C147BA42FB9749F8B4DA6D533C90A26BB7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  Steam Auto Cracker GUI (v2.2.1)/Steamless_CLI/Plugins/Steamless.Unpacker.Variant10.x86.dll
- Size 11KB
- SHA256 c890dcda2e79970e5a5541ee6340e503e829982f1613c36119be7f754c32065d
- MD5 31f399ccb6bf807bf07ec3ac264d930d
- SHA1 db7757f66e377f737cc06976c03c4d3772a2c85c
- SHA512 af299d52be53d8a1d41a77dde40cd4fd81850960b9842caedd1a7f4f917cf3b5523bc355a13ba95af872d17d704c3ac2ac18dd0c769b2472e57828599b81e100
- SSDEEP 192:q02+M3RP5GJp3WHAnROJqRZSz1rT/xEQayychMWfiKonzV:0B3GJpGHEbTY1fx5ayyhn5
- TLSH
  T12032E90656E44339EDFF5B38A8B2461745B8FE06A970CF0E45C441DF1E22AA18971BAA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral7 behavioral8
- Target
  Steam Auto Cracker GUI (v2.2.1)/Steamless_CLI/Plugins/Steamless.Unpacker.Variant20.x86.dll
- Size 19KB
- SHA256 3cca1fb90b1aa3e1703565a095b665acfc8073b889ff44ef97d17f4221fe707f
- MD5 a058bf89c78880d7ca66c6513ba37a8f
- SHA1 485f1d5a0d6a0958da1dde342d506f76c0bf91bd
- SHA512 33224ad20c7eb7f7c8d6b962bbf42e066ec20d0eb23ca434010935d3620adc719b6736ad10af6444ee01ec7e9b0504fe51411c3c8ecfe532245058eccd0cdffb
- SSDEEP 384:6b90lYR0m+sjrrWTdRIgk+LY+2ITmXjECoQqt3kkJRNT7I1:aCqTWTfsEYRcNtd7t7S
- TLSH
  T1A192F80152EA423BE6FF1B7554F2924240B4FD67AD75EB8E0DDC60CE2933AE0550176B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  Steam Auto Cracker GUI (v2.2.1)/Steamless_CLI/Plugins/Steamless.Unpacker.Variant21.x86.dll
- Size 24KB
- SHA256 2f92eeaf47accd0f87bbe7fb7cf85fcd3c00830f464dfdbd4f661449bbc92b21
- MD5 2144889fddfdeb1fa2cf4f18b611581c
- SHA1 9232fd21d8f0fa92ff060c7ecb630025a1b0c015
- SHA512 94c019ba7b0cf15ed04378413b20e3a0afe7e59bead89d321d6b2323b7fee392436dfc86e606270ed97f4461bde889c0b3c770475b86c394794f949ff7b91978
- SSDEEP 384:y2K3WqyoKTT1FRSiNYkAdCah+LY+OYwFht/kWHj48yyyyvyyymyffDHMjFjQX:yfKFxd8CYEYbNntLfyyyyvyyymyffWY
- TLSH
  T1FAB20A0766A87336D5FFAF35687646020975B957BEB0DA0B2CCC50CB2F92AC04603796
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  Steam Auto Cracker GUI (v2.2.1)/Steamless_CLI/Plugins/Steamless.Unpacker.Variant30.x64.dll
- Size 17KB
- SHA256 81f1d36540fc8756b155b3e58b34f54da4f9bc1f974988cf91d0b17ffc1d14d8
- MD5 956eebdbafff1a5abb3eb9690f292165
- SHA1 4c4183fe055476b35c517753a4eeb160d084e074
- SHA512 c8d461513431df1a09b7b10f3aac6f8b04ff9845a2c6323d4ad05b5b854be19c02d7066eb48991cd8301e6d01e7817700baef5f6ec84e2e2b9660bda79ceca38
- SSDEEP 192:KLCAkfP7kB3VwWHU5FCRr32vfjuglnSs8FBuqrqJ7q1bQOgNj2HVfu3KWgGti:Kw37kM0U5QF4fjug5+y8gqaGgHA
- TLSH
  T14772D80666E45327E5FF1B39A8B247024579BD56BEB0DB1F9C8C808F2E267D04412766
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral13 behavioral14
- Target
  Steam Auto Cracker GUI (v2.2.1)/Steamless_CLI/Plugins/Steamless.Unpacker.Variant30.x86.dll
- Size 16KB
- SHA256 fe2102b096d44aa956788d067856225254ee4e43c133c939e3cd5c0a6cc37399
- MD5 2a32a106e85dfdf75095d034b30b752a
- SHA1 e62d15fbeaa2936f8d40760b2ec4e03115564947
- SHA512 b6639121884a023f771d4049f781ac821995f9cb38885bdce80811a0c2789fbafed22336b29ed203b01261f45fbad41fcaa1187707dca473c8e79d6fb3961eee
- SSDEEP 384:zPuEBILbHtoZDreqbljug6FFl1rjqSG22b:JBIfH+w4hUBlGr
- TLSH
  T15772CA4A5AE4731AE9FF1B3C68B2470345B6F995FDB0DE1F8844808F1F67AD0481276A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral15 behavioral16
- Target
  Steam Auto Cracker GUI (v2.2.1)/Steamless_CLI/Plugins/Steamless.Unpacker.Variant31.x64.dll
- Size 16KB
- SHA256 790f1974f97258058cb57c20787e8a2fcb5c16cca0911719b698580d74e38918
- MD5 8cef9d57f82ed85f390ccd387e21e5a0
- SHA1 e9c5eac6488c2467cb601ab534fe1560c9785502
- SHA512 8cc15de28e630c69e8d9b1b4b0064bcb7f28588156ec67c9c751da293bff0408f39c20b6dc15b90174748346716967104b25be2e2c57e3965c0a4af42c2f652d
- SSDEEP 384:nAZi4/VB2222222Az2QfAog6tc3nqaGsFR:A44tJKWAyi3q+
- TLSH
  T15272C80666E4532AE9FF1B7968B2470316B9F946FDB1CE1E8C5C808F1F26BD04811B76
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral17 behavioral18
- Target
  Steam Auto Cracker GUI (v2.2.1)/Steamless_CLI/Plugins/Steamless.Unpacker.Variant31.x86.dll
- Size 16KB
- SHA256 fc7e1ac80a7d2c0121e083d218b7369c4d217eccaf395cd1c0292d000f19446b
- MD5 2c7a10fb35202e73632b2637426d9d1b
- SHA1 ef2a8cca203e05f6728a6d0bc61aefa5c22b650c
- SHA512 f502215a110d11bf6e52139e59553375c3d65f093859935fe5611b5ddcfdd1c5c2aa86696ace1a99720ec6bdd2e778c354f7cf7c393dc69a5ebf7894a3d0f7ac
- SSDEEP 384:bCSyGvzGvVFjnv3logr87Q1AK8QG2neA:QkzGvVJnPlDVG74
- TLSH
  T17A72A60656E0A31AE5FF2B3568B247135BB5F955FEB0CA1F884481CF1F26BC4481276B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral19 behavioral20
- Target
  Steam Auto Cracker GUI (v2.2.1)/Steamless_CLI/Steamless.CLI.exe
- Size 110KB
- SHA256 70cd54354865ede605ec0fbfadf15f5302aa85a777394f28b0de6acfd243e795
- MD5 2a2f85ca57b8ffc8daf586c1773a1e56
- SHA1 d340cadd1eb578c25ad393541f16ecd6b0eac2be
- SHA512 4126a07df763fea7eaa142a29b5c13512f350153396a4d0ec6738c12a84f44765c8e3f80bf0b042adce810ee968d3d2a31ed243ab0f4fcc48c1600acdd3fd403
- SSDEEP 384:h89XmZM6WmqIRP68hcFpOGoA9aLu44B3qiVE341ByXvonJcbqPySHYqzQzw4rs:G9XmDWsR4PY2N1YGx1ByoJKqhHEDs
- TLSH
  T132B37151B4C8A564F93E75F2AC66C4C102763DAAAD215A1F34BDB34E09B3253CE2772C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral21 behavioral22
- Target
  Steam Auto Cracker GUI (v2.2.1)/sac_emu/dlc_creamapi/files/steam_api.dll
- Size 631KB
- SHA256 ec17086182abcce73df94bd9a07c4eb6316fc5abc403befa79e7a713e71bb122
- MD5 24c712826d939f5cec9049d4b94fcbdb
- SHA1 de43e868668528a169cf474c962bbacb148583d0
- SHA512 b341ab590e1083673c3b626f906782a472415411448f8722b7829517041d1c5efaf3b19470c4a172376a61d54b97803137b8dcc7579ddeaa76e3f9117cfa5af3
- SSDEEP 12288:JzoMoqWWSdQy8tmy6zfu/fRNL7gcD/+DfYwX6dN62ny8fC7wSNa:68r62fvL0e+Df/X6dN6Iy8fCESNa
- TLSH
  T140D408B5B04541F4D9AA853255285E9B3AAD043B3726ACFF33D05E7A84F21C22F36787
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral23 behavioral24
- Target
  Steam Auto Cracker GUI (v2.2.1)/sac_emu/dlc_creamapi/files/steam_api64.dll
- Size 677KB
- SHA256 532802e678b51f5279b50a21702c9f58929dafa61af9c45d1f0eb4dbb807c889
- MD5 1b14c913c0df41cc0667993d9b37404d
- SHA1 87532d36ad3a7c5f15c89d2da2f5c2f69187cc07
- SHA512 4e0068f4a5b0b33094b96149fa3fbbe36f659aa75f18f37ebfc2af3099aa504c5c57a52d3ff3d79c37629dc0ebbfaa3512c136d674cdc6c8f24fa23525767bbc
- SSDEEP 12288:q7c2EXh/QMrJSpR44HjA0xFuNq96HpIfZcVKt9qBmbVBly8fC/Fa:q7mXuMdc4SbYg9oSaVKt9q0ly8fC/Fa
- TLSH
  T19BE4073A111801B4C9B7C1359A4B4D1BF660741B77A26DFF22D0012A8E93BE6AF7F785
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  Steam Auto Cracker GUI (v2.2.1)/sac_emu/game_ali213/files/steam_api.dll
- Size 899KB
- SHA256 2a20ac96fac5c46b7dbd7bea0d073dbee40ca99c4fd0e36d1a2fa01ef66cd53a
- MD5 7e890387f073f1d7af5d28d6b6a26dbb
- SHA1 0edc825b58742fc6f2ba9a0510715ba1db8530d2
- SHA512 f6e303ec9f7efa7b5ec63771fcf7330635881a1aeeb6effde36bdd81e6ad2f3e90aca63163be6543cadc08c04ba52dac88aa528a4342514c37bd1b8d279c113d
- SSDEEP 24576:aoAuDJokDzYF43mKj6Idixs7Qdkjw/JYy4fCGirpEH9:HbJIF43mKj6oi/uU/J+fCGi
- TLSH
  T15A150136111256F4C6F6C13AAD539E0F76B4128F71A91CFD7A448933988AA433E376CE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

discovery upx
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral27 behavioral28
- Target
  Steam Auto Cracker GUI (v2.2.1)/sac_emu/game_ali213/files/steam_api64.dll
- Size 3.4MB
- SHA256 9d8165a2b06a26b566a6002f020030dba993d4bc36238001f40eaeb1810c711c
- MD5 99a2cf782112b5ea29cb18674ca3182d
- SHA1 76293671a4d3cad76cfb0d1cef6af1e06c113b5b
- SHA512 6b07c4da646047bc6169a51f39aa659f2266fe0c6a751e5d69e4e8d7a8a10a3d485085482f0adbd79a9ddd1b227290a2d3d450b332ef6b4b116b98b62c09a594
- SSDEEP 49152:tDJhx92BUsVCNaJYgKGEa0nfQzM34VizfCHZm0sDS/ief4YahdzvgsApddXUt7m:pJhx92tcNyXKGEZn11JYjk
- TLSH
  T1C8F501BE61443378C02AC8355423BD4F72B5412F56E89D6E75DB37C07FAB801AA26F86
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

upx adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral29 behavioral30
- Target
  Steam Auto Cracker GUI (v2.2.1)/sac_emu/game_goldberg/files/steam_api.dll
- Size 2.4MB
- SHA256 33585536081b1e6f4bc1e5cc91f16d5513822cb0510546446c2e9be35d08b74f
- MD5 d6e749904e8116946c3734f496602bb1
- SHA1 378e313efbdbbf373454769182c24b3c6303e3bb
- SHA512 5fd53c96b89eadaff44bc0fb6291321bca4afcbe953d2ff020262c290f6adbff3b3e6490cb88cb98d33f2abb92541e96ef0fa5f963019ca0fef8687a2da5b071
- SSDEEP 49152:UHzA27ef7zmnyUVyf0xqTT5/iyjPbMu2AI1NrFzBMipzW3CoukffC0vHVou16eD+:U827XnPYcxqXZiyjPb92AIjRBM1dvVo
- TLSH
  T1C0C58E21BA96C0B1D68F13757439AB2F443C6A514B290DE7E3D4296BBEE90C21B3714F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

UPX packed file

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

UPX packed file

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32