4059c3923b36eab3a937d4f52da5fbf71b33e4f9a5422223bd603984e7eed392

Sharing

Copy URL Twitter E-mail

General

Target
PulsatingCastle.zip
Size 8.4MB
Sample260720-c74w9scz3p
SHA256 4059c3923b36eab3a937d4f52da5fbf71b33e4f9a5422223bd603984e7eed392
MD5 de70d9d8eaa4f581eb096472d3068e72
SHA1 f7da4f13a9cd522cf6a4aacc6cdd67c3043e7887
SHA512 83407b435304342781c7d7c772f1e7318988b264f0ff0508bff30692ef7ba27410880c1e611fc91cacda3b075453728e390f391f293c93b3c7376787d85f3b6c
SSDEEP 196608:g0TXseq6VwnUeswJhdyrwI4N74UHRJCKM+B+8qfz0K89D/:Melqrs0+scBzH7V2D/
TLSH
T1DF963306069AE4DCC705DCFE05192A76BA6707BFE6434A00BD3D0223B361BAC657FE94
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Targets

- Target
  PulsatingCastle.zip
- Size 8.4MB
- SHA256 4059c3923b36eab3a937d4f52da5fbf71b33e4f9a5422223bd603984e7eed392
- MD5 de70d9d8eaa4f581eb096472d3068e72
- SHA1 f7da4f13a9cd522cf6a4aacc6cdd67c3043e7887
- SHA512 83407b435304342781c7d7c772f1e7318988b264f0ff0508bff30692ef7ba27410880c1e611fc91cacda3b075453728e390f391f293c93b3c7376787d85f3b6c
- SSDEEP 196608:g0TXseq6VwnUeswJhdyrwI4N74UHRJCKM+B+8qfz0K89D/:Melqrs0+scBzH7V2D/
- TLSH
  T1DF963306069AE4DCC705DCFE05192A76BA6707BFE6434A00BD3D0223B361BAC657FE94
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  CatanicCastle.exe
- Size 7.6MB
- SHA256 c9a1970c25211e8da47176b151e9a221a5dd92b4d70f81f6014ef6c486e25b50
- MD5 46c010245807df55cc4e47642758ade1
- SHA1 adaa505b751059d7cefcbf46d344cdfc34bda90c
- SHA512 688efcf18649c5cba205e3e6280e14d634d39bf10da72d189cc01332716d4cae10da1ce779203ceb56f7e21467a641ca105fb93097ac76c1289874425ddcef98
- SSDEEP 98304:seMcXBD3p4LZgHsTD8NoqUA6vtXdEM0Vq:seMcRrd8INoqUAQhaXA
- TLSH
  T137865B4672A0C1DED167C179C65A76F7E2713C04DF6086DB26A03E2D3FB3AD049BAA11
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  GMLive/gcmt-dll.dll
- Size 161KB
- SHA256 009989ddbf336c67453ad7a6fb32b3ae960883425a0e867b167d9d5514ee2450
- MD5 15667020a11c73fe8513bdd412ca713b
- SHA1 801ab3570e57f80bf6a55dabedaf771f32955a95
- SHA512 a3151bb5fee69426231e2a585f022f74a2e1c7ee0c5fb6aac2483205e666ade1a23180f996de5c775826749b26fd7ffd103a3e977071154ff96be483194bae8a
- SSDEEP 1536:SQjeyA5V6ljEIL7d9RFkX6oB/9KVaXrv6zgJzz/QT+3hg1k6wxusO1x34OO:1jdgUB7zA1/UVa7iz4QT+3hA533bO
- TLSH
  T188F3294A33A4217AD6EB827DC9939753E1B63210032067DF45A453F62F23ADA4B3F359
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  GMLive/gmlive-server-alt.exe
- Size 414KB
- SHA256 c24277074ecbbe6e3c8fed685f46782fa3d25de195fa1732491e0f2d1c3f1af1
- MD5 a71c045263c5e38e395e78e1769843b0
- SHA1 b5544e72fea4a27327d567f1d0987efcdad8179f
- SHA512 69c56a6a54fda3558ff33e7101255b0c3b00e9a9fce073b15e9a8f2940db2127e7b5456954e9eeb506fa0cef1704cee640773327e830d14f80bb77370765693c
- SSDEEP 6144:l7Fdo+OgoepH58alHrtOgLS/EauVVVVVVV8FRMYAWg4uvnXZdvWp8kRxkb:l7FdegoegMOg2/Ead8wQnJQRx
- TLSH
  T13494F8089BF83E90F7AECB31B06650075674959AD63AF75E2CDDEDF459A27E2C880103
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  GMLive/gmlive-server.exe
- Size 351KB
- SHA256 d46d756d2634f854f0d01d6bdf9b91940a981f6aa8a6ebf8f8a9494df034bbf1
- MD5 528f2eb4ac4b145a000bc7a2becb4732
- SHA1 5846e33ddf6539025ef779438b49c5674fcb69c4
- SHA512 fffdc9827d2a6d56b0898863b43fc6d0aa65b2be4b7fff6b199814a950ad71bdab06df6b6ed705f533b31318538756bb90d567bc36d794e13e425c6e0835d2be
- SSDEEP 6144:YctRxkbNxs5xm8P0MkIi48Gw697wyzSeptZ0Es:5Rx2SxmiFi
- TLSH
  T12574D2B9A5E5FD16DBC2E2B88186800706598897CBF343EB04DCED77657A8D07436B0B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  GMLive/gmlive-server.n
- Size 250KB
- SHA256 fb662d6edaba2e8a9a3bd543528f5fbbc6464936e3137b290df7a2036c75fd50
- MD5 bf3287e05ffcb1c3818b605913b762e6
- SHA1 5ccf0a921c75a115b488c31a9316e490853bc93c
- SHA512 c86af838a0247d816c7b6f76444b5afad61350c2f0b679f3842e90472fd7815b510328d8650a0933da7dc04b38d723210334b9a3b02d71f5a9c485cbaaa6aa93
- SSDEEP 3072:YGaw9oIxqyrUDpAHP0ct2EkIi4ZaGWn697V2by99YkFyoLpt0qXSPenis1c:Yxs5xm8P0MkIi48Gw697wyzSeptZ0ES
- TLSH
  T1B34428BDA5F6D11B2FC2B38DD58780070A5AC4975DC340FB0419E97765BA8E4B83BB0A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  GMLive/gmlive.html
- Size 85KB
- SHA256 f562a940d28867f14d5141d3fd4c8760b420fb305a456b337a952a1a98ba452e
- MD5 de416573efcf41a36c104d29cc6e0d15
- SHA1 04c273536fac5473a0eab1f03fea4f8fc6710657
- SHA512 430ebcdb89b22bf24e3fc6aac1796334b4cbc0fd9aa79a58525e9ce32904f1992fd9709ac76b655655c556aec47677d6fa5e853734baf4b7d2885a808ec52774
- SSDEEP 768:RcHFHKKnvcZNe30o3fUJlI1Ule5wAOLKT48JYebKgd7EZ7ObrkdpDBYgaY0iv50r:FWAKT4DEQ8XpjStR5fnq0Ey9Lo
- TLSH
  T13D836199D2F92677413BA1DBA6FF376175EA4428C2610840B6FC87BF06EDC04B41789B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral13 behavioral14
- Target
  GMLive/neko.dll
- Size 124KB
- SHA256 00037f818e37d3f73b9cbfc10cafb1b476492aa54e051e6b2b479c593077d0c1
- MD5 bbb39367e3c7e8400810f2647b167959
- SHA1 143874968e440e68905a418a2534881a527aa33d
- SHA512 2ebf354062a94a64ab8e346274bea52399f3a91bafbc1f2e9dfb731b0ba8e8f1419134cade6fb71c0267d220e3f99c604b168edce3d38dd319b10ede341f355a
- SSDEEP 1536:pWEI/YzP8bNg8pU7e+fvbdmTkjOsBiuTQFGRXO85u+rh1coaqY1coaqYJ:wEI/YzP8bNg827f7g29BiCiGRXr5hZ
- TLSH
  T1FFC349163260027ED6BFA1388BF26606EAF2B5104771D7CF05A49B750E339C66D3E396
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  GMLive/regexp.ndll
- Size 446KB
- SHA256 b34660866b5e458d7e1e2d38e761a88f6d177aa2c67b5407e0112a3cf952c95b
- MD5 35e08cd640ac58266f0c8fc85e7c08f5
- SHA1 a3b8c31704ba84792a4e417fcb1adcc9f681d58a
- SHA512 96f30dbbfd72b8d7ac91f8e2eb34adba20d874cc5817ae05185dbf446df1e00010b3cac2bb76850711106d300d16aae1ee699d9f10f6824f056bfe4f51d0d745
- SSDEEP 3072:oRroQ39QNkns8B1zFdYhhpy2sB8uPCE3mLZGx75L5u69aAtWP+9BzPtSw:oONknHrYhib8uPCEgIxtVu69dcWt7
- TLSH
  T160A40745637104D9FFFAD0378756D653E6BA316863B34EEF1620AA70BA322F0453E609
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  GMLive/std.ndll
- Size 203KB
- SHA256 5672a2aee801e2b6bc8c358dd0448e698c4e0ea2b207ed3e7e148271d6c9ae58
- MD5 226a016ab73c621746134f90df44d851
- SHA1 b6a3897b4f2d5af408cacc2a9da66d28d7532941
- SHA512 de2fcf444e2d8915ab4215e8ff91a65fc390421c8b5b8ac43bf30a1a5b35696e8c7b7b5a719b929df5eafd41d2c0be8ed3415522802ac042e685aa1fbdb6214c
- SSDEEP 3072:kcndrLhiRkvqhZsksuhynW/VOamdRwQw:k4drLghZs5qy4ejdw
- TLSH
  T18214C517FEA95871ED22AD3888BB425592B36D3007D097CB02308758EE1F7ED3E75299
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  GMLive/zlib.ndll
- Size 101KB
- SHA256 cc7705671076ea0becf6e8cdd50d2a1c9818bbc3263dba691a53f17f2f892161
- MD5 a7c8c06b67cf73ad4f1061a5479cd3be
- SHA1 cef78f0a37482d149675e0194860d49955071beb
- SHA512 75737e1c04b4f4293e6279d055c46fbaf3b8dbfde8a94a3c2d90c369f7bcb14b7c504dd626443bd199c2d74b07febbaf22888705ad478d7b70a84fb22c08f9be
- SSDEEP 768:RNaoVRXNC8+9Fhg2Nvy1Ei1JL6M7srniS9ISAI5/0J3MMiIO1nToIf1OuLPOQtOg:nalhgeKl1JuM7wa1GIO1nToIfAsSZi
- TLSH
  T1D0A36B921AA161B3E6F6417888D30F6DD775702003A08BDF9284A7A51F03AD92F793FD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  data.win
- Size 6.3MB
- SHA256 69663399c2083f4c742d64f0463ec92f2a83e8f9172c1a8bf09172e2cf8efa44
- MD5 aa5e6bd40ebaf1aa43885bec6ab2d034
- SHA1 aeacd849bdf374194a37ab872a58ba539f9ddfe2
- SHA512 3d51a3015ce1b6c56d323365a548b8cada4f04e775e93cc29f7f429e40ab657a09e2686c96037e32a04fc7f199064d09ae907f05224eecf25b14cffae5a2e1bc
- SSDEEP 98304:KegEO0dZtqUbdaNNWZDoSmv8Ikv8aznU+BXo9:qEz7qUZ1KSo818atX
- TLSH
  T11C668D5B7794CBEACD60A27ECDD57B52321179C1BD42022739C8AB6CD862722CC4A74F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral23 behavioral24
- Target
  options.ini
- Size 46B
- SHA256 de8f135bd461349a59c7282cb18878f5a1a6d33e339dffd5f229c4d9cfe6389a
- MD5 3153447a178dc71517d0d159bf01d1df
- SHA1 b899395ada86370d232adb7a9fc4e3a92f4af005
- SHA512 264dc17dd9099cdbcb5d15f3a644bdbd3528171e725f38fe9d8f949e86a5e331124c5d46ab5d11897206201b2474960c12b9196c92b6586beff7607c3920d381
- MD5 SHA1 SHA512
Score

1^/10

ransomware
behavioral25 behavioral26

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26