afeab7169995e825bf2caa0f9b95d9d3fce73ebbad764760612c63c610077847

Sharing

Copy URL Twitter E-mail

General

Target
DELTARUNE-SteamRIP.com (1).rar
Size 601.4MB
Sample260720-2gebcsfz8q
SHA256 afeab7169995e825bf2caa0f9b95d9d3fce73ebbad764760612c63c610077847
MD5 e46ced3bee7d5c93d994cb978d30dd34
SHA1 ee49757310653ee57b92a8b68d879166a179b40b
SHA512 f58419229a5bac516ff3af57b4c97f1dadb69656a886a78c05768bfd10e0eb654e814929b02454412dd06ffc404cfcb5e5631e23bcfffe022f674588f72b4c74
SSDEEP 12582912:uz+3R9lkkhNsSdTwGF5FW2SKdw0FdxPnaGn7WaxSs5rx1/hWyQ56Od:uzC9l5vdTVZw0XxvaGn7us5FW36Od
TLSH
T1F569333D274A741B94F363A21F3D753DCEBAE021152BE3C9ADD71A01EADD248CB42562
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  DELTARUNE/DELTARUNE.exe
- Size 6.8MB
- SHA256 b882cc1879ad8f24c63fa6e4f47a8fef9a01065ee61ad6220beed9932b04e7ed
- MD5 7bf3cccc2e54481ced3a149e1a083684
- SHA1 ddd9992ca1ae2e7eb8f63b4b20c63b430dba4026
- SHA512 9e29c01120c1f145363c1d0e2cdbd764a50dbe875191b98839ea37a7cafaed160a654d88cfbd84b73c5e3e5cc4bea863373d2a3062205f768191fe6ccec843b9
- SSDEEP 196608:nbP4YyBOMDt0q3LM76lz38SmJPcZoOxCeW00q+Ux/agp:HE8S2P5Dhgd
- TLSH
  T108766B8632A4C1DDD167803CC55696FAE2713C41CF5197CB2AA0BF6E3F37AD409BA621
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery
- Drops desktop.ini file(s)
- Network Service Discovery
  Attempt to gather information on host's network.
  discovery
behavioral1 behavioral2
- Target
  DELTARUNE/chapter5_windows/execute_program_pipe_x64.dll
- Size 122KB
- SHA256 a594a7205f6a4ccff42cb460dfa08bb54442cb3317c7bdc0fa0437d636359402
- MD5 50c347cf03c0885d26b9118538721218
- SHA1 9bea3f10425abc7d65a55d3edd4714eeabf07abf
- SHA512 ee1e8f7ddb0d29cfd27f882ad9cd418f048b2707f869412d43332a11db18d67cb3041fab174943a1aef14a22e3879efa1d0818f552eb8073f01883528d5b2839
- SSDEEP 3072:PCkZBW7aSOC3SFFatkeLmRn87Q8uiBf7Q1je:aaWDByFatk6IeQ8u
- TLSH
  T1AFC37C5773E000BBD4668339C8A35A06D772B8520A34DBAF43A4535A1F273E19E3EF61
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  DELTARUNE/chapter5_windows/shader_replace_simple_x64.dll
- Size 150KB
- SHA256 c10210e3cd619774d63947116bd22fb3f60f2d992b21f3ffb0121393e596b124
- MD5 073bf090aedbb91c4e12fa4dcd2ad82e
- SHA1 6f55489aa34e0ec0688f53c7d849e28d368520c7
- SHA512 6b9528272bca7617948f3a578f98b272c4c876f3c0024d469b80b490e54d82d59dd16a7670bc3b5e64a0ec1fb5643fb984bdf0118532da76327682192dbb8296
- SSDEEP 3072:4Uz8MVVIwkYoAVVoAtqV+Qa2wRs3plNPWSfdx6+2U:4+pkYoqVo5na2wY
- TLSH
  T142E33A07B2A540B7D47682388953DF47B7B2F49A076097AF13648A7E9FA33D08D39B50
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  DELTARUNE/mus/hip_shop.ogg
- Size 942KB
- SHA256 62acd3d2de7e4ad81e99a2b31e40b90b1b121d93fc0c79ec724a7f1a47892a66
- MD5 3d407240e2758034892ba7b6789e55db
- SHA1 e838b6a21e5aae83a5128dabd95cefe645f44f6a
- SHA512 a7236222b68841738580bf793db341b3f0c968ba47b4ca1043f8380036d1e24aebac9b39d77e983fce6568c3e9e44eabbbd116e62f7d7024ab0406919577fffa
- SSDEEP 24576:asuGjE7Os1s564m7ImX0Jm61SPV0yHVLw7EVzDoHC/BtR:axGjE7OsO6x7Icb6IPVTEAtDoHWzR
- TLSH
  T1242533FEABDB4718D823743DF58C2FC6746EEF1D496986D18DC87E12CA7BA051821842
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral7 behavioral8
- Target
  DELTARUNE/mus/kris_piano_shop.ogg
- Size 575KB
- SHA256 289f6bbcd9da8e04f3ce8a4b11302aae96c6dbd9db10881dfc25abc13b1a69e2
- MD5 e85bb1f52b4b5b4192c11a5456d243b3
- SHA1 0d1c25d0d9ab324246df0dd8147e8e2b3f1db91b
- SHA512 a936765ddb3a2ea687323619256db50577c64a31da03c90ff8f2e3dfdabd0f82f88aefb5b96cf2d00bb923f94395c21e09203724188da2bb6ec69e9559c22bcf
- SSDEEP 12288:RBfyYUpNMqgPTCsOLu47VLfalLGvR3bBCi4i/DSZPBBkZl:2YoUOqUIGlbBCitDkBBkZl
- TLSH
  T1BFC4233B9C928D8DD69D13F2EAB72E21BB7B88580FA00346577E4478DD2775D2D18883
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral10 behavioral9
- Target
  STEAMRIP » Free Pre-installed Steam Games.url
- Size 219B
- SHA256 4572f3812daf7bcd347d1a36834c5a9fec1f530093adf688a6ecd9e6092cbf76
- MD5 bb3af69a2e7704bc210886920ff7681f
- SHA1 42fa4a09d62cce1c0d70a63e0816135fd6b410e3
- SHA512 4f86d06f06859ed87d5f5353de9971c118477c956a8e0e0019b275f6eb035b2841c7cb959c9f4823a599ca7e73f6a0ed320207d917e8f4ab2a9b20e732551839
- TLSH
  T119D0A9BA0B58900AD321C81AE030BC08E44E75568CDED0B932C4CA8A4D96481C8A6BA8
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  _CommonRedist/VisualCppRedist_AIO_x86_x64.exe
- Size 30.1MB
- SHA256 3c188e4651bcc07df2bdb06d69585158797b1bafb91557b09217621628cd5b23
- MD5 1a7523d92b573859df4cbe8e75509b9e
- SHA1 65b0ccf1fe1f23c4a0557b8a30251cc7e70a1f73
- SHA512 f7c684c00265402876a4159869774096090c7482358fa1882a50468c89483c9a30066667418d510dcc5b9780fbdfd1bcc6672f92ec53cb933c0b36292c6ec40b
- SSDEEP 786432:4JVdGL3z5NXeyQIwJtNYUJwif0nOJa9WEWRIOG5B7DVGLhYNBFv3cnZCa:gjOLXelIMjJwi0wMVW6n7ShYWCa
- TLSH
  T10E6733B51858C4B8E7E0B1F00807F5E1769AF9BCE9C5CC46B1F4BC99A19E4618FE612C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery execution persistence ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral13 behavioral14
- Target
  _CommonRedist/dotNetFx40_Full_setup.exe
- Size 868KB
- SHA256 fa1afff978325f8818ce3a559d67a58297d9154674de7fd8eb03656d93104425
- MD5 53406e9988306cbd4537677c5336aba4
- SHA1 06becadb92a5fcca2529c0b93687c2a0c6d0d610
- SHA512 4f89da81b5a3800aa16ff33cc4a42dbb17d4c698a5e2983b88c32738decb57e3088a1da444ad0ec0d745c3c6b6b8b9b86d3f19909142f9e51f513748c0274a99
- SSDEEP 24576:+tW4x8xAxCdUcyezFSjaBHFaNlsqK5/oh6iZf1LUXw/vxNI:d4x8xqCGexm8FCspg0iZf1LUXD
- TLSH
  T1F2151232ABA0C133D4DB28B48ADDB6B2657DE6610374C4C7B7440BEEAC307D1697964B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Executes dropped EXE
- Loads dropped DLL
behavioral15 behavioral16
- Target
  _CommonRedist/dxwebsetup.exe
- Size 288KB
- SHA256 2cf71d098c608c56e07f4655855a886c3102553f648df88458df616b26fd612f
- MD5 2cbd6ad183914a0c554f0739069e77d7
- SHA1 7bf35f2afca666078db35ca95130beb2e3782212
- SHA512 ff1af2d2a883865f2412dddcd68006d1907a719fe833319c833f897c93ee750bac494c0991170dc1cf726b3f0406707daa361d06568cd610eeb4ed1d9c0fbb10
- SSDEEP 6144:kWK8fc2liXmrLxcdRDLiH1vVRGVOhMp421/7YQV:VcvgLARDI1KIOzO0
- TLSH
  T19654F15197E4817BE4FA1B311DF2025327797DE86CB9E32E838658881D71780BE35B27
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery persistence
- Adds Run key to start application
  persistence
- Drops file in System32 directory
behavioral17 behavioral18
- Target
  _CommonRedist/oalinst.exe
- Size 790KB
- SHA256 b8f39714d41e009f75efb183c37100f2cbabb71784bbd243be881ac5b42d86fd
- MD5 694f54bd227916b89fc3eb1db53f0685
- SHA1 21fdc367291bbef14dac27925cae698d3928eead
- SHA512 55bc0de75a7f27f11eb8f4ee8c9934dfe1acd044d8b7b2151c506bdcbead3ab179df7023f699c9139c77541bbc4b1c0657e93c34a6bc4309b665c6cb7636a7e5
- SSDEEP 12288:0s1yfEcpPzdv+t4cRIy3ze3SUN0PXGTjiqRy2p3kwzjGHTkV:NwfLrvi4cRIyDe3SUNaXy+WypoGHgV
- TLSH
  T1E005F10020D5CC73E4EB32B3843586746EBA7E912F0A285B7FC476AEE673176DA71215
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops file in System32 directory
behavioral19 behavioral20
- Target
  _CommonRedist/xnafx40_redist.msi
- Size 6.7MB
- SHA256 47260420773a20443fb1e38a89b7f39c5237a80a842de598e6c8f7f90a3bbd6d
- MD5 ff1c0202ab7147c9dfd34b582f1da13f
- SHA1 5fc95a9ad87a38e71a953af116fd1f1cbe46a3e7
- SHA512 9a233fd33fa535d0783ac4a97108166b860d7647998ce184e6e5103200a6c8522a5e4d035b85e02280f5176c092e0d3e61a60f228d7ca17f09fcf2fc5cdf5253
- SSDEEP 98304:synfL329J1XswfXO6wiBB+4RZg6aENaCZAU5PMO0MntfERyJGH2YPq/:sYD3C1XXfzH+4cLHU5PM/Mnt+YGlq
- TLSH
  T1D06622A2751AFF41DDB406FCD970CA490925CF3B82274C686929356A7BF7E0202E9D4F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery persistence privilege_escalation ransomware
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral21 behavioral22