8465984b01b42a75f5faea8f2d884bbd6085a695c40c2b90eb0385f0a5081266

Sharing

Copy URL Twitter E-mail

General

Target
Goldberg_Lan_Steam_Emu_master--475342f0.zip
Size 18.5MB
Sample260722-1bty7ace79
SHA256 8465984b01b42a75f5faea8f2d884bbd6085a695c40c2b90eb0385f0a5081266
MD5 27beb58209a060789229eb2b849dded2
SHA1 051dc1f491ff11a56ceb17f556191083cd517789
SHA512 7eb58728689a652189cb2af5c5c4fee2d11fe95bdfc3c0ad96851584bc75820b24f99954425be9f19934f4f3d964093f7eb67b27f89eea199624a64f93d62341
SSDEEP 393216:CBH3JSILRhVLQVBbS7brMH35TUXfxmAN9eHuCKBhcWkvxuiXb3uTKSbx:w/LtLQYrMHpgmuewkpJ3uPd
TLSH
T1721733F0DB438938D9C09ABE851B8DF96B9B85D3CF168E4BD9CD7101721785E2227287
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Goldberg_Lan_Steam_Emu_master--475342f0.zip
- Size 18.5MB
- SHA256 8465984b01b42a75f5faea8f2d884bbd6085a695c40c2b90eb0385f0a5081266
- MD5 27beb58209a060789229eb2b849dded2
- SHA1 051dc1f491ff11a56ceb17f556191083cd517789
- SHA512 7eb58728689a652189cb2af5c5c4fee2d11fe95bdfc3c0ad96851584bc75820b24f99954425be9f19934f4f3d964093f7eb67b27f89eea199624a64f93d62341
- SSDEEP 393216:CBH3JSILRhVLQVBbS7brMH35TUXfxmAN9eHuCKBhcWkvxuiXb3uTKSbx:w/LtLQYrMHpgmuewkpJ3uPd
- TLSH
  T1721733F0DB438938D9C09ABE851B8DF96B9B85D3CF168E4BD9CD7101721785E2227287
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  Readme.txt
- Size 13KB
- SHA256 a49c3ddecd7af392d63f06666272970834b8f767ae0e2b310451269183a1938d
- MD5 cb9ae9be19c2ec8c6cfff3fd69dcefe1
- SHA1 57fabe1ace51a7dc6f2c89d2a4916d4e67aceb5c
- SHA512 3af5795e7cfeadfbf651aa7345ec3b6e03f58ba1a57e3c30e9a825a8c148ee0a2b3ea5d66af28f4516fd2aadd6741d306845a036f460fbbe3bdb5ba5a34c6bd0
- SSDEEP 384:onicZhpchc8hoW5vAJZ0kMdsv8F/nagN6HOyi19:ei83aaKv2ZMykNagN6uyiD
- TLSH
  T13152A35FF65413734220127AE28FB6DBE718C0FE52F1A431B4AD929832519E712B6DCE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10

ransomware
behavioral3 behavioral4
- Target
  experimental/steam_api.dll
- Size 2.4MB
- SHA256 33585536081b1e6f4bc1e5cc91f16d5513822cb0510546446c2e9be35d08b74f
- MD5 d6e749904e8116946c3734f496602bb1
- SHA1 378e313efbdbbf373454769182c24b3c6303e3bb
- SHA512 5fd53c96b89eadaff44bc0fb6291321bca4afcbe953d2ff020262c290f6adbff3b3e6490cb88cb98d33f2abb92541e96ef0fa5f963019ca0fef8687a2da5b071
- SSDEEP 49152:UHzA27ef7zmnyUVyf0xqTT5/iyjPbMu2AI1NrFzBMipzW3CoukffC0vHVou16eD+:U827XnPYcxqXZiyjPb92AIjRBM1dvVo
- TLSH
  T1C0C58E21BA96C0B1D68F13757439AB2F443C6A514B290DE7E3D4296BBEE90C21B3714F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral5 behavioral6
- Target
  experimental/steam_api64.dll
- Size 3.1MB
- SHA256 286f2ed575fb16bba9c451bdf5c8738b5aa6587ec7831830cfae1739c6347edd
- MD5 77f259bc5affc9d59958d2e35d946830
- SHA1 d501e2b3ca6970dd1ab771a6dc6f2ae67dcff996
- SHA512 7915f3fb4c4aa0728339fac274e104579e67b1af98a665124d5b1695d8d732ee0a114a7c2883ea5f8f15af1a3f3610733b42e1b70ff367b3c72948d99bb79430
- SSDEEP 49152:OpF1DniJZzXjB/mBgxdxqxKjYRy8kG5V8QNfC+cHVheehy:6vEZfB/VmK8f9gVhb
- TLSH
  T19DE58D16766C80B5C1BBD17C96478B4FE2B134461BA257DF22A44B4E2F77BE10A3E321
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  experimental/steamclient.dll
- Size 72KB
- SHA256 3554fa409a7df923465fa2647a26de31bbdcc96a7f2e42e432a2aa7169774400
- MD5 6f204772b6ece27acd5a81470e9f3be3
- SHA1 7fa6f98429cab766336aaaea6a8ecb359b497ccc
- SHA512 89ffeda1024e5da13b8e81d2179cc4b452e7f2f991fcf5e2ec359a85d8e508852369d07abffed2c30b1accb7e9f9fce524a00bc00323b92ba55c66dcb6236eed
- SSDEEP 1536:A/NA00qdebDAmUXt5lHrDdrrlr9TA/rDxsWqdQcd72OWlH:ADebD+t5lHftRSf+/72lV
- TLSH
  T1DC73491076D1C871E5BF29311174C6A16A7EB8624EE09DAB3B86177E4F300D1FA35E2B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  experimental/steamclient64.dll
- Size 87KB
- SHA256 7f9fabf5055db099c90b952739e970cd6aab01171d1a980bf96fe9b77885a6a6
- MD5 502fd49c2abac79889b0642525bb226c
- SHA1 73d78af41c12b1aa4fdf404f5a1a7a17674a8e2f
- SHA512 3e30e1edab640f329c6bd9318878e904e6ea1ecb19f683a3688a9ad519ff3924e0c604b829f25ff3ccca71a41bba225191cbda9efbb1fc4bc4fa73f488d20972
- SSDEEP 1536:zlq4T2wNubeBLcaeYSUEBbaxiIXLYDtTpA7ai3ubCvmTXrvDV/NsWLxd09dlfSvt:Rq4T2qu+LpeYhEFaxiIXLk5poai3ubCG
- TLSH
  T17D93299A63E504BAE177853888635E45E777F9121521CF6F43A4029E2F633A08E3AF31
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  experimental_steamclient/ColdClientLoader.ini
- Size 207B
- SHA256 34a80ad4554f24adb35f5afedcf8b2022bf4ff32683dabeab68bc083ea330846
- MD5 7df77d2991c64f8e23f908af2721d2aa
- SHA1 4a48619e44e00843556efe24552898033fefe935
- SHA512 31b37cdf534489bf975cbde40939f10cca079deb211880c1435756b95ca8d6445073db771396f08a4b74248da060b6baa405c9a00de7053467b4f95c73fdc5de
- TLSH
  T11AD022122B40327B4202CF08CE25C6CAC3A2C003481B2C415817F04F1B220EA8B3C03B
- MD5 SHA1 SHA512 TLSH
Score

1^/10

ransomware
behavioral13 behavioral14
- Target
  experimental_steamclient/steamclient.dll
- Size 2.3MB
- SHA256 23b86547d3733d7909f4a3cf680441c166a8dccc651f30f7f44b58e5bf5ab8c1
- MD5 e87b69d973206ce2226e0c30711393db
- SHA1 a567b8584f0db304f7ffdfbbbffaf6fa4939c1b9
- SHA512 f64aff55ce1da38c702fa7922c214df55c9809373f8fd01459af0ee40d769e7c07aa5e3296cf7f3de4511396bc8a97619fd13ca833cef024de01dc502a7aee35
- SSDEEP 49152:TYVE8qed9IlFzM5V9nWewuK8/4aEAIeCZ7Y0MPXCoLy3MK+EI/h5HVXFVMiBo:EV/qesTzMHJRwuK8APAIfZ7Y0g0ahxVX
- TLSH
  T199B5BE22B682C0BAE29F11B17A78E76F403C65440B2406E7F3D92D6DBD610D35B7B25B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral15 behavioral16
- Target
  experimental_steamclient/steamclient64.dll
- Size 2.9MB
- SHA256 4c2813290f2547d92d40d7dc0a54d9ffbdce9a3d44c055b45a496366d829be5d
- MD5 905d79cd9aee381759ea7b04b5a4662c
- SHA1 99900f79a03ebfb92c655172d1dd1e61976c3c76
- SHA512 606a2f648f75dff22e552d417902a67f75019deb183386d8ad9b38502bcb06c042764b292dc366702138d7b7a69996cfd2f01a0bb9eb6b4f82b66280c50b2fb8
- SSDEEP 49152:xRnTK0rCnUH1uGd/hg1gfkKscX1RXvOdqLqSHV:xpTwGd9nj0OV
- TLSH
  T12BE58D1A666C80A6C67BE0788A478B8FE37134591F6167CF22604B4E2F777F1097E721
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral17 behavioral18
- Target
  experimental_steamclient/steamclient_loader.exe
- Size 98KB
- SHA256 6d76785ff9806540c469c3b466eeacacb5d129d38723d53936a90b419f22a5a0
- MD5 2a64f1e0fbb0e0687bd41dedf3ab19e8
- SHA1 5601fd7b42835ba56fb13e0fe1915964ab0a42e4
- SHA512 999b836c5bf03851bbbafb08baa32aa6f27db736b38093eff2895cabd5af7e8462eb97a06d0560dc28df9011bfb089884ab1d3eaf496d9963e58ada5fa04de8a
- SSDEEP 3072:ku1hlvOR3R2gFL4pTGt4/NBOtJwgOeYg4fFcIqeBsmSxsyLZ:Ch2Uly/Tg7cSxHLZ
- TLSH
  T127A35A4175C1C472D4B22A351874DAB14A3EFE301E609FAF2398067E9F746C19A36E7B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral19 behavioral20
- Target
  job_id
- Size 11B
- SHA256 47d42a5d8a39a3e4a9432854c564cbc8f0e424e0a45062b5a81bacab7a67e8b0
- MD5 d389b339cbf05f00cc0c9899d16e47bf
- SHA1 8d8fabf0547af97b63b955b326e21c0188eef5fa
- SHA512 8b0de926c942dbae9ec3450024779834ebf4371dab32b0a657a197fde25c8f11e0ce6607f83fe8afdab9808d4e18fb6adc4c1f1e8b66f64ab7fc98332f2def0c
- MD5 SHA1 SHA512
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral21 behavioral22
- Target
  linux/lobby_connect/lobby_connect_x64
- Size 2.7MB
- SHA256 42e5d679aac9d91387e66b1edfae0a77711c9314a6a861002adf3ef8538a7b59
- MD5 a53e96451941ffa57afe4250a8c0be3f
- SHA1 563b337783e362933faae2bfbf34b3982226d3ed
- SHA512 c4eaffda7dba033679a6a2213e32bb761aff4dfdf925b4b52c2186e0ab69a939d7f3531356104ee9e78a3afe2dc4932f9e80846dbb095f325b44494a1a59f1be
- SSDEEP 24576:1Wtb6gmbf/RfOVLWE6xXlddxqwLFHky0kDxrsMDrayy3v5cfqmpX0:gQf/RfOdP6xXllqwJz0kDOMDripmpX0
- TLSH
  T114D5733772A013DCF09AB178ACCFD0E7D988B4F00629716B2BAF99156D14DE50F8D2A5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23
- Target
  linux/lobby_connect/lobby_connect_x86
- Size 2.4MB
- SHA256 433a598deb5da5f3defd8b6848f4d06ec2fda176f030104285143f2fdd6bccc1
- MD5 474b8336d3a59a202c7e066436bd5c48
- SHA1 2e047eb19d786ca408b956db97fe727e605e3422
- SHA512 561b5ee7a9b5a08b31b44d551e022db315bd04c03b692ce00b929eb18ca4632e57f9f5d85682a22e7bc64c356c0c7ea342ea3f0f833d8cbc5dd3fe543b08622c
- SSDEEP 49152:+6uzWxWU8F6biOFZrfaCrDj7gsVBWtFa:+6jxWJF6bpFMCrDQs3A
- TLSH
  T160C5B505F5818E74E132A2F0418ECD77C251B87E929764ABEE0B5974B71A3029D3B73E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral24
- Target
  linux/tools/find_interfaces.sh
- Size 1KB
- SHA256 cc36b7eaf076d667ea6c216e94e3477276e4c6212b81cf9f7b091a8415dc1678
- MD5 02221d773828fa16e925d1976f1a7e74
- SHA1 8b7addb06de08f161b6a1694e6548aab1359728c
- SHA512 9215c84b638568b5e391ba7bbb5e837b320e55ca869585ebb0c35f1a9aa59ab17a0937debb579f094ec186d020a88e99c8805143efa2e116a55313ee449302cb
- TLSH
  T1AD210E36A1273D6C8B1724D315E72C367CC429725A83A4BC85A265E64082EC0B3BDBD8
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral25 behavioral26 behavioral27 behavioral28
- Target
  linux/tools/steamclient_loader.sh
- Size 1KB
- SHA256 caf2258f97a543df27d25118898f8b6a038eed5a1191be5be7df6fb5ccb66826
- MD5 56e4669fc11da6c722e14832c833ee34
- SHA1 82992963c3fc41706a8c66885f6c88777eddc1a3
- SHA512 ebf21ca112e0abe773857d280c879d244462b503c5eff6dd5896d12e0aa638dbe22ef4b2c2096299fb7fa3cfcb10666306a93452cb53dfc9a9165ddda46b1ce8
- TLSH
  T12521D4AE8E929938A31C8740EB4081BFFFF14A374513F51DA0E8938E471AB545729E2D
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral29 behavioral30 behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32