cf935b149915dc4ed4edf89e3f5e41e9b4d9c183f97557b268460ffaf81bd9be

Sharing

Copy URL Twitter E-mail

General

Target
ToNScenePlayer-1.0.0.zip
Size 90.5MB
Sample260716-xe4e9afv9y
SHA256 cf935b149915dc4ed4edf89e3f5e41e9b4d9c183f97557b268460ffaf81bd9be
MD5 c09df9f5d237171238c3ac6c5b16baa9
SHA1 670293e15a61e8a9b30e1010bbc46c726da29bdb
SHA512 36e2886a16b6fdd75c459b159ed23b606a41221e2f0eaad7c7e6e049e07ca229cde0ec0d9a31baf2601b0c9fbfbc378ab33ea5147b4dc74703dd714ce1328b4f
SSDEEP 1572864:ST7mrsrYV4vMGuvo8qFdUeKJYJHA6B2F9UU7mmuuliCA0MFUSvqwYbN4PUASd:W7OeYVfGuaFd3KJuP+9Uummx4hi7bNsq
TLSH
T19328332FEB1C4DF7F75AF1412E501C663CC9B21B84D68F8D0AB958A8B9A51F4E025BD0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  ToNScenePlayer-1.0.0.zip
- Size 90.5MB
- SHA256 cf935b149915dc4ed4edf89e3f5e41e9b4d9c183f97557b268460ffaf81bd9be
- MD5 c09df9f5d237171238c3ac6c5b16baa9
- SHA1 670293e15a61e8a9b30e1010bbc46c726da29bdb
- SHA512 36e2886a16b6fdd75c459b159ed23b606a41221e2f0eaad7c7e6e049e07ca229cde0ec0d9a31baf2601b0c9fbfbc378ab33ea5147b4dc74703dd714ce1328b4f
- SSDEEP 1572864:ST7mrsrYV4vMGuvo8qFdUeKJYJHA6B2F9UU7mmuuliCA0MFUSvqwYbN4PUASd:W7OeYVfGuaFd3KJuP+9Uummx4hi7bNsq
- TLSH
  T19328332FEB1C4DF7F75AF1412E501C663CC9B21B84D68F8D0AB958A8B9A51F4E025BD0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  ToNScenePlayer-1.0.0.exe
- Size 90.5MB
- SHA256 4758bc05254e25ab5c5ecec9b263089de0ad52359f62ee6b4f397ed07e573240
- MD5 c04662138108021850f88b379c7b6a5a
- SHA1 fad14da30c5ea8c8b6c8dca64be3ce7867312fe9
- SHA512 43387405bc9ff3a7dac1b7a07827f52d6f6a4fb205d537da35461deef4f93b7dd7aa500401549ae1104cb3febe342c4c63965bde5a6438ec677ab23c362aee07
- SSDEEP 1572864:+zbY69SQSdL9W+Gj+2k9hEy6XmV9kEnEtxUcNuqIGLECGEIZYw3AIUrpe34uKR7:Mbt1Sdg+Gq9hX6XsnCxUyuq7wFu3rpCc
- TLSH
  T11D28332EFB184DF7F796E6703E501CA63CC5B21A84D24F8D0A7945ECF9B11A4E025BA1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery defense_evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
behavioral3 behavioral4
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH
  T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $PLUGINSDIR/app-64.7z
- Size 90.1MB
- SHA256 4f0d6848c44565e3f0726c48c7372a950a80a50a6a531293f1094e9be19a3ffb
- MD5 2ac16b540e6a4ccf4346bf892b7544b2
- SHA1 3d65a954adeb37bb2849f278d2a0027e08fed20f
- SHA512 ac7b6726720b3835e4dc4177b70f9505fc89aa4e52248bc76f372847290ab8642a2021d93aba774f2db2eb7121eda69e69dd20f111618c1ce2053f66d3ea95e4
- SSDEEP 1572864:MzbY69SQSdL9W+Gj+2k9hEy6XmV9kEnEtxUcNuqIGLECGEIZYw3AIUrpe34uKf:abt1Sdg+Gq9hX6XsnCxUyuq7wFu3rpCO
- TLSH
  T1AA28332EF71C4DF7F756E2603E5028A63CC5B21B84D64F8D0A7A45ECE9612B4E025BE1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  locales/ta.pak
- Size 216KB
- SHA256 83bd8b194f8917503abec85a8c5caf247b0ff7a0e71976cb6d0ecd5fc8602f0d
- MD5 4be68e04be286100ac901d77503d2b9e
- SHA1 aaa714baa581899b1dcbb37f58793c2e37be6ff5
- SHA512 c3794ed039ca867aafa24a28d4734023a4133f3a826ec223f14ec40097a151361ffcf9beeb4db81ae5d42cdd9cdf6f242ed6c338dec34aa3e76f9aacdde526ba
- SSDEEP 1536:YAxeroxBIdy7/tj2QCA+GeE2k4ca6QVW0QmJfR1o/tRxL+Eo5arAuZKVn2n/QahA:YTMzIgj2QTtRxA
- TLSH
  T1D6241DCE913EEE890E93288F0318536912986155C47BE3A67CB65F1198ECC5DDF342BE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral11 behavioral12
- Target
  locales/te.pak
- Size 200KB
- SHA256 992ae39f2d4e12446d63641163c2a2e50cff039a22eeb7e1d10e4f3fb990ed86
- MD5 646fcd54839f059f45f5021e65a1bf8d
- SHA1 d62948e65bc5894db48d5941a2e5396e6d4f848f
- SHA512 004c58867eccc90a1a99354211c06e9cbcde55bb4bf1d5126d3ad8fa7fc3a9b091cf357d7aa935b4e139b8adecd0d32cc8f22169c9b20321fb7bbc76613714db
- SSDEEP 6144:MN4sJAcB6Vgev5VvQSanBgpSXBmHdUVQtGwLwroXf/:tsJAcB6Vgev5VvQSanBgpSXBmHdUVQtb
- TLSH
  T1C114D0023A7AD211DAE702B3352CF5AC49781B4261D6732C1EAF9357FB87D6E0843676
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral13 behavioral14
- Target
  locales/th.pak
- Size 173KB
- SHA256 01da858d02f039d9aebadf2c8d3c2726fbeb2715b5a38c46dcee91d186d4014f
- MD5 14b118e1ec52caca0e8f5503a18fb697
- SHA1 cb8ef4b772bfc4ca1e1287399c04b6f94a9c95b8
- SHA512 5e9b3b71ae91fee69946841c71a08449d0073b7501852cc157f2b628478e31dd991877c692e97c079e93989b00e575671807adf04ae0f069705306b1369b905e
- SSDEEP 3072:y6FsseLCJFkSCkIOBrOmMrDOUXFIY3CGAw1p/x7GBH7FbAdSCtTDMC5a/C0:y6dcCJFkSCkIOBrOqUXFIY3CGAw1p/xa
- TLSH
  T1D9046B733247D9D479441B5B262A7789A63DAE693F72F8E04085215AB3F071AC432EF3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral15 behavioral16
- Target
  locales/tr.pak
- Size 89KB
- SHA256 7fb57ca2ef966d68dcb887a5c4a69cd2ec084a86909b39b5c020d503b1f1d926
- MD5 b5ade2bf06460f13f80a213126dad442
- SHA1 a4747244957f18be1e4e8e3a19f5a2bf4e348614
- SHA512 bc7e381f608f110966c4c894cdcd0a839883311fd93d98d658d2ed44552763b95e29e90a39a6faccbcb8fdb026cc10cef00f6893c4a8bed2229749d3cca52511
- SSDEEP 1536:6TW4tR+niljz2hYaNH2vjiAP48hhnkesXaxWd57CIviNEiOSJ81tZjhhpsFpBa5m:6HvVjKqaNH2vmAHfnkesCIviNEiOw81M
- TLSH
  T1EB93098174EB381C8F79238FD6E5065AF98F1796F232A44BD625E726334578602FB60C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral17 behavioral18
- Target
  locales/uk.pak
- Size 149KB
- SHA256 5aee02b568a167fff78e33ebe72342142c94abb68022867f33f0b4c549633a2e
- MD5 790b68ae686c649e6cf87b0beacf025c
- SHA1 dadc03e4cecadba6e7653299007b8456ff2a9cd5
- SHA512 922cd908591e72b328ca36ae511283eea30407b981584c0e04acd21698651b49ab919b8ee8e70b06cb0fe6169818257220678cbd8a00919a00aab00e2fc0fe4e
- SSDEEP 3072:ijTB3Ij4FkSTLwRRKXRw5aLNiXMnQUCqE8Eb4U69wp:4TB3Ij4THLNiXMFCqEgE
- TLSH
  T1C2E3BBA19B9D58DF0201F05BE8487A0D7DAB45FE7FA7431625A53DBE39F2024863C31A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral19 behavioral20
- Target
  locales/vi.pak
- Size 105KB
- SHA256 3d94581673e34d169692107e41065765d44fe53a76fbc0f3bb39e3ac566d24d8
- MD5 d5fb1a9c8c7adfc77fa9d70d4cec8246
- SHA1 6da77430658d3d4fe8501717cb77a1ef647781c0
- SHA512 961ed9267e1ad0952eaf7047e230abed5eaf0313d11d7fe299c158a2959a6e514be8c4127c10504cebcac8b94171b0e9fde324f3d7e0c58376e295a254472152
- SSDEEP 3072:8CKMPn0gPiz+sE+m9PMv2nRkWbNkoq7RpW83Wtd1pFeSShVwBPR:886aVbNQV/X+
- TLSH
  T130B3960117D1302680BD453EC5CD940E6FCAA46FF3808FE56FE425787A635E56F32AAA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral21 behavioral22
- Target
  locales/zh-CN.pak
- Size 78KB
- SHA256 5379065edbc64b510da18c813bbae85b571da268cc6e4fcf0037160b496bb340
- MD5 d228304afac4b33fde47f5edf246d289
- SHA1 07f0743d8cd94030904928ca155cd5ce12ca5d29
- SHA512 1d2b93fee66053b997580f96fb28db2a5ca2d5b763438b5a91150dca01e746524e64a016f5e0ba898268cc2cce4ab5123047fd4eac039b1ff0608c5c30be5cb4
- SSDEEP 1536:Ep0QyUH6s36Y/ggaiTEqWJ0ZkShh9o1lycW4u:Ep0/sKY/ggaiTE37ofmllu
- TLSH
  T12F835C9811D8BCEC048244942737A27DB581330BF653EAFBAD91899D3B63FD6462790F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral23 behavioral24
- Target
  locales/zh-TW.pak
- Size 79KB
- SHA256 61d8670992226d20eddf980a0e042863d9535556962515d1f91dee54bdce5750
- MD5 500f2452a7f9c783423cd9e4a25be0da
- SHA1 aa7e6661cb36c5d204a91a29b75f719a88721bfb
- SHA512 b49ab5e330b10bb31b55a63f3c2a6997222f17cb63692e1c36a4f184c36de048d9de132d234c0674b3a2dda106b6c0490779a5e8ae994185b1a2caf238182779
- SSDEEP 1536:oPjJeEDwY9AuuRtxdHG/2CY3mPup+bfNtP6RhjfUxzVnQC54HV3XiPjDhS5mx49M:8jJLbAuuRtxdHu9nbf2c954H9XiPJS5C
- TLSH
  T18E835B5808F6EFED0511EA4073DA523F2C49365DFE33B7BBBC4859982E66ED0466280D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral25 behavioral26
- Target
  resources.pak
- Size 4.6MB
- SHA256 ddc85d749b19cbabae11a0b8f7114daf75900179a2147280dd0f9f8faee7d65c
- MD5 d9022282a7fbf3aa354559ab6a9c7926
- SHA1 ff1f2b77d80848bc1a51e48c21a033eb57d8776c
- SHA512 6b9ab157cf8e10d8a79ea2ad4e247210fe2a7fd75dab086eb55951d4e028af3060e1f42175be936c6b093abc2c3071c0fd1c45afee3c567a79e1b722fe5f5d97
- SSDEEP 98304:aAVqybB1h8fawgGMLdWiz1Z/de8xJtHDgAQcchH:aA4ybnhjwYdWm1iovjgAQcchH
- TLSH
  T10C2602193AEA2231C423B179AF8F6150B7398007321AE9B4B9CC97941FD653452F6FF9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral27 behavioral28
- Target
  resources/app.asar
- Size 2.8MB
- SHA256 9d25a08637d522897398559ff8881c61ac281772a98016de15c516710d08b543
- MD5 643f6b08c99c9f3b0c0a6568f53de04c
- SHA1 9df1193106f35036892435671b05be156742ae04
- SHA512 1dfbe6f037829bf07020cf14bebefa47d3ed0381771b4f4d642db560cdd3c102790e83bbcd515c06c572f99b55ee5074d8dbd22a5894cd1aea3922f2e24ac6af
- SSDEEP 49152:DbLmF/05jjRm4A4s4QNhAejRmf4iGaroQNIyQw/ll20FhAgsJsZJsWOPp99ogkl:LG8TA4s4QE4XU
- TLSH
  T113D55B4A7DA3A03506539BFA46DF40A5FA3DA407A120C630F94C52995FC4F64E1FAFB8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral29 behavioral30
- Target
  resources/app.asar.unpacked/node_modules/ffmpeg-static-electron/LICENSE
- Size 1KB
- SHA256 f3930fec4158e7dd7ec1f2f901beb762d3922486bf95fbaf5051295b1c7881e8
- MD5 6d12a1511fa1ca7ab75d8455390ac5c4
- SHA1 95f67e7f9b8134898a0e94e634c785fe0d051ad6
- SHA512 a849ac43cc54c0349957306207f6bfa9583b12f88c37a7e474bf436cff281c761c8ab09d3abfca761b592d972d2627787d48185e114615d075eb1105d81a6ab3
- TLSH
  T13B319967124057A349E2928579B7AAC0B49DC03C3F234D051CBFF1489B2B12FF5BB155
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32