68582e0cd340f3a9a47778d6ae579eebb6b3db9ba00b3924714f5beed18358d7

Sharing

Copy URL Twitter E-mail

General

Target
hytale-f2p-launcher_2.4.8.exe
Size 93.2MB
Sample260722-2bhrlach75
SHA256 68582e0cd340f3a9a47778d6ae579eebb6b3db9ba00b3924714f5beed18358d7
MD5 4a9af0897c8cef862dde3510fac666ac
SHA1 b77eba2aac6ae7aa2cde1195d536af2b4c96a949
SHA512 6fccb784485e8157cca1254c55dc2cad8948f4eca1f4031b754e3d99e670d5701e4fda83119f29d295e10e2647bd59bf09e68009a97a96581ed69e9c417a2b57
SSDEEP 1572864:FaqNJTZ6pshYgFFWxyA4CYfgTbc6cDbOPEVhBL7CXVK6PdlH426OcdhlVDYcD+Mg:FRX9HYOFWMbgTQ12ETBXkNdlFah7bE
TLSH
T11328335D96202A06CB1BC3B56E609EE5EC777DAFDD306C176188FA383E418A0974C973
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  hytale-f2p-launcher_2.4.8.exe
- Size 93.2MB
- SHA256 68582e0cd340f3a9a47778d6ae579eebb6b3db9ba00b3924714f5beed18358d7
- MD5 4a9af0897c8cef862dde3510fac666ac
- SHA1 b77eba2aac6ae7aa2cde1195d536af2b4c96a949
- SHA512 6fccb784485e8157cca1254c55dc2cad8948f4eca1f4031b754e3d99e670d5701e4fda83119f29d295e10e2647bd59bf09e68009a97a96581ed69e9c417a2b57
- SSDEEP 1572864:FaqNJTZ6pshYgFFWxyA4CYfgTbc6cDbOPEVhBL7CXVK6PdlH426OcdhlVDYcD+Mg:FRX9HYOFWMbgTQ12ETBXkNdlFah7bE
- TLSH
  T11328335D96202A06CB1BC3B56E609EE5EC777DAFDD306C176188FA383E418A0974C973
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery execution spyware stealer
- Executes dropped EXE
- Loads dropped DLL
- Reads ssh keys stored on the system
  Tries to access SSH used by SSH programs.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
behavioral1
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH
  T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral2
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3
- Target
  $PLUGINSDIR/UAC.dll
- Size 14KB
- SHA256 2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
- MD5 adb29e6b186daa765dc750128649b63d
- SHA1 160cbdc4cb0ac2c142d361df138c537aa7e708c9
- SHA512 b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada
- SSDEEP 192:DiF6v2imI36Op/tGZGfWxdyWHD0I53vLl7WVl8e04IpDlPjs:DGVY6ClGoWxXH75T1WVl83lLs
- TLSH
  T10F623AAA62E847BEE2221636B96723130BFDB5203DA1D01F4D531E596C30BE3953D61A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral4
- Target
  $PLUGINSDIR/WinShell.dll
- Size 3KB
- SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
- MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
- SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
- SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
- TLSH
  T16A51365F13BED7A4C3071738A6FBDC85749B440012C659558BB2172ABF141E0BB3CD08
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral5
- Target
  $PLUGINSDIR/app-64.7z
- Size 92.5MB
- SHA256 a5e025018712cfb0432e1af5998ef2f60c3ebfee35dcc547c769a7b98a2dcdb4
- MD5 cca47e22fab320ec8f41793e47a52ce2
- SHA1 05d72199641cd855140129a6e778f47f89b0f5f2
- SHA512 49aa154da3473d349b358cbd3b1e3a02f602cc61327977f3da6a9f03ae49652c686d44031fa1b5a8367639e629f9c58f11a4d0965b7cf2aa94866fdcc35fbef4
- SSDEEP 1572864:BqNJTZ6pshYgFFWxyA4CYfgTbc6cDbOPEVhBL7CXVK6PdlH426OcdhlVDYcD+MsE:UX9HYOFWMbgTQ12ETBXkNdlFah7b9
- TLSH
  T11128336D96202B06CB1BC2A56D205EE5FC737DAFDD316C07A199FE383E419A0924C973
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral6
- Target
  Hytale F2P Launcher.exe
- Size 203.5MB
- SHA256 e5e36af15bfbe4d10f440828b342140872966c0ea51920e76c3897e19a4a0c58
- MD5 de908a4fc4a0902b93e2ac66e1e21d1f
- SHA1 d217d0eff721e72b61e0ed0b38c3f7b2f1a556ac
- SHA512 d1ce1a45c286d3f7d74819a4f18fe7c2104c6cfdfb26ff31b985f7fd3339f3119d8b70ed53bebe29f94996f2b82d72319430b68fd792949e2ba7b3e65c3b28c8
- SSDEEP 1572864:E1wB6Q3W9Ba+WjRjE/9JexatSIeXmMax9GilPHtPlZwPcLIQu1iw8SDC0gllyJ2:EwjRea6Ht69
- TLSH
  T190A88C03F29A01D9C01DD179575A9633FEB1B8054B24B6DF2BA44B522F76EE82B3DB10
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

execution spyware stealer
- Reads ssh keys stored on the system
  Tries to access SSH used by SSH programs.
  spyware stealer
behavioral7
- Target
  LICENSE.electron.txt
- Size 1KB
- SHA256 5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d
- MD5 4d42118d35941e0f664dddbd83f633c5
- SHA1 2b21ec5f20fe961d15f2b58efb1368e66d202e5c
- SHA512 3ffbba2e4cd689f362378f6b0f6060571f57e228d3755bdd308283be6cbbef8c2e84beb5fcf73e0c3c81cd944d01ee3fcf141733c4d8b3b0162e543e0b9f3e63
- TLSH
  T1B511861E726453721C56136055766C84F12F725FBAAF2784246EF384233746CE5FF844
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution ransomware
behavioral8
- Target
  d3dcompiler_47.dll
- Size 4.5MB
- SHA256 c8e25abd3d45dfb55966a74613258c39b4a83ea2ac77f2f80903499f4d5c03f0
- MD5 6ac6cc720fb6bbe5c0ed4e84ad2b3337
- SHA1 8556531bd06691ce0f8b7d83814c867a420526a4
- SHA512 216084dc2a84ca818d68d603968acc978c0b60bdbe0a3152cbfc400ec11a2b96e81d1698a15dbb7738974f4365a8feb109f2bca5b641b42acedeaeff1e2a342c
- SSDEEP 49152:JSHvWaWTktEzfRriMsCL98dhdVhpHGC6GNCxJYrv9y5Eze+V7ZpdKMZzaWoUyxqJ:suktcrfNlTyj5byqSC
- TLSH
  T1FE268D5767E840E9C5BBD138D687831BEBB1B80413345BDF01508669AF73BE26A3E724
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral9
- Target
  dxcompiler.dll
- Size 24.4MB
- SHA256 1565adbd62a0e8ba2a8b25b3da5d2e2a45032c13aeffdd061228abc3ee5c1585
- MD5 a41223961c47f5e60f2a83597ccc125e
- SHA1 d3050c6e99fa83919ab02e3c7b5d8c40eb566200
- SHA512 7a25b88a9d044cfd471a6c131d85a82ab395168e069204117fb0176e3b393c549b0be23794e48b3ea09f6cdbda83bc20c90795e750e579c9989bde6a19dcefef
- SSDEEP 196608:ysq7jjh1u1/1i9iJj24AD14c9TR8Z6GmfozCEJdXqaq:ysq7jjh1u1/Dxc14e8Z6GmfyFqa
- TLSH
  T1D04729122646D49DC059C879C7678B268A6C30E73FA7B8EBC0F451252B79EFC5B39234
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10
- Target
  dxil.dll
- Size 1.4MB
- SHA256 436f128f22050ae27323da61321a469de0678def7a4e6d86f9ccad4858724f0a
- MD5 f8f3501026df30556c34a9af9cb7af9c
- SHA1 961d9012b6d79e2e3c28b310a80ba3ab36e2c559
- SHA512 3631f8a3d48e8eea25091b93147d88f0e8a7539f2f242fe287d37f82fc4344528901e4cc48c93ebcf8691d2e11227a9b50f2b5ad45f2475c0119ad8b2d3661fd
- SSDEEP 24576:zY+wATtbKYxy0y3ny6eBjNSGlVZyi27+V0IJNSD11J7R+j+v1acLUkJvS5Kao:8iTMYxy0Sy66Zh7Sh/cyvS5W
- TLSH
  T154657E1B229801B6D4BBD17CDA47CE0BE6B2B41503B09BCF12B406692F5BBF55A3E351
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11
- Target
  ffmpeg.dll
- Size 2.9MB
- SHA256 26eed00c4da27de095ba76030b47bc0436ba659a7443e05f11ee162dc225e828
- MD5 38c4d1074280e903212f6b4bf7e650b9
- SHA1 fdece1b93bbec86f949eca244c780b6809ffb2b4
- SHA512 0904363e03102b8ee72b172ab02b78456472a5c726fb1c6b990713c640f48ac16cebb2ac2374dc82a62aeab589b46b9c851493b5768ed28c1e8358d81bdd8e48
- SSDEEP 49152:ncHnAGZ5/wriV8Ay6AC6L6BEH199a1LKIbQ7k6xQv8VNoJHfmX/6s6l8b+:cHnh8F6lC6i9rNoJM4g
- TLSH
  T11AE59D03F6D651EDD019C03497AB9313F631780A4F209AEB16905A223F67FE86D7E768
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral12
- Target
  icudtl.dat
- Size 10.3MB
- SHA256 1cf67874b5a87a8363a86fb3f81e3cbbed54d389062dab8fb52308d5cf8c8612
- MD5 5bfd3eefca4b5ef2d1a869396390a7de
- SHA1 c58567f7fe308ccd43f406b70aa8bf6fdbea4f3a
- SHA512 4489a55fa0b47c8d1e9679032e036c7998f82efb4191b98900ae40cfc30a26b65290867527161c594c42fe7999b2314f8928a5d717d65d4eeedd4fdb0ed0f427
- SSDEEP 196608:A6akBhOR8LE/dUHiXUxa/iJ53IWhls2E91Z0G:AqwKLBHiXUxa/iJ53IWhls2E6G
- TLSH
  T118B63903A2EB4EC6F9FB5F7498F562779527BD49AE32804A51043F3B1C333908664B66
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral13
- Target
  libEGL.dll
- Size 503KB
- SHA256 61ebcd780d17d37ec09a5eb7ff7399ad67726a5a1ff73be1c37734551c3ef1fe
- MD5 e2125f8574719b50c955f8b3e9444d68
- SHA1 75ef9ab467080e726eb8f1a906deefee5c1980b8
- SHA512 8ca2cda69c61aa78ceb2a869cf757a68365bcf801892ad7250807ce77ba8312fc54e6347a381cb399c92337fd43aa82518973aa92345cbfae000306a117414ab
- SSDEEP 6144:dQ4VIVcVQMLMVwCtKpDaLnjSFeN+a+BAiLm4LiE0z0WhcEuvBLPdvtYPqQa:dn0iCZjF+CymG0z0WhcEuvRltY
- TLSH
  T147B48D15F3E84BA8D07AC0348A538646EB7574960B65F9DF02E052792F3BBF45A3E324
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral14
- Target
  libGLESv2.dll
- Size 7.6MB
- SHA256 b35d3337ef4cad5423f4e11a06e280763deae634f7e39c7844e4f0fcb455b3e9
- MD5 c9b6de9b18d0f5dda94589cf038e1bfc
- SHA1 6fbb1ec482e6c0988a5b5fe84b4ca9695d960039
- SHA512 4a59fa62445ace0b27d51ca246b02d5e9ceaf6a4edee2d02051aad52de63b70376406347fb2ab97e42a9d70f3844dfcb0c2eba301bc54a3902b8c11a316f7957
- SSDEEP 49152:4upJ61ZvUdnnnzCwAOqBmONJAbLfkcO0VsWkgp9rnnG45/ifbKnNdCusheIYklbo:LeCXaoJl9aWNd5JIBhhpJK1Ixe2l4
- TLSH
  T1A3867B03F69681D9C05DE278875BA623FA34B8450724B7CF2A9453162F66FE0EB3E714
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15
- Target
  resources/app.asar.unpacked/node_modules/register-scheme/build/Release/register-protocol-handler.node
- Size 48KB
- SHA256 b69ebbdd33eda4766be6a58c7a8268c28f018c934249e3c22ebeaa1d9e45cfd8
- MD5 b7dac826e52eb12f2fb649883cbf0fcc
- SHA1 a847a2228dd2b15b6b6be84fee2e88d91865aa4b
- SHA512 f265c531399b0ff47ce3d758cffa1fbc8f87a442e116cd955f17fd7a656a42780e2baf91fd1cd66c40e84a060e90093b2201ffa697d893d22159dbfce767474e
- SSDEEP 384:onOd/kHfaqxThHSOKj/cL9gp3p+Y3rxS+WFeLHPLMk9m6KrtyKDFPWvrCfLFwUof:oPLBRyCUXrx+r4KRBLiUo4N+
- TLSH
  T12723A62BE2A1D635D02B5434BEDBD20215F178F1DE31022F0698AF7D6ED2AA5422D7D3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral16
- Target
  resources/app.asar.unpacked/node_modules/register-scheme/index.js
- Size 91B
- SHA256 9740d6b8f1290751808b9474175259aabd1cce2064ea6496b900b8bd9e1a6cb3
- MD5 72c672f572f5bc3185b3dc87a245123d
- SHA1 dcd3be3fcfcdb2bfb4e4ed04ec8b04d430ea5833
- SHA512 bb2569d1a9a8d41350058863ee8cb8c066a2046092d93e7268b48574dfc4b9bc54513b3ca9dce10a75a71400ab9c2149334f243e44b62700b0f11e1bef9f1cc4
- TLSH
  T130B0124DD046E2DB27C420C8AC625403894EC111803045C1A304D7C40CA64C05102960
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral17
- Target
  resources/elevate.exe
- Size 105KB
- SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
- MD5 792b92c8ad13c46f27c7ced0810694df
- SHA1 d8d449b92de20a57df722df46435ba4553ecc802
- SHA512 6c247254dc18ed81213a978cce2e321d6692848c64307097d2c43432a42f4f4f6d3cf22fb92610dfa8b7b16a5f1d94e9017cf64f88f2d08e79c0fe71a9121e40
- SSDEEP 3072:1bLnrwQoRDtdMMgSXiFJWcIgUVCfRjV/GrWl:1PrwRhte1XsE1l
- TLSH
  T1EBB37C1274C0C471E5732A361974CAB14AADFD700E759FAF6398127A4FA01D09A3AFB7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral18
- Target
  vk_swiftshader.dll
- Size 5.4MB
- SHA256 a638bd2235309493f50adfcae707675bb6c3615a2ac44ccefeca7c7085389d49
- MD5 91869ba2775cbd0135b8ac20854cdb77
- SHA1 07ff72e2afa2fc876565c8d7a9bae1f67105e5c0
- SHA512 d970633cba93639fe46a569b45f5b4547125f0505cd6878879a7d729a0a89bf723d604e53563fe17120e4825b92c2124b5a82a17f185e46f52d7025893f3076c
- SSDEEP 49152:+hqQRjgbS5A0V4NmoIb193Km3QIH6hvweSNerodqG5iBgP6zPPvT48unNHRVq45u:+1gbID4lz8ZlwZswtwmdXn
- TLSH
  T1F0463803F28681E9C06DE579875FA633B631F8850B2276DF56A00F192E66FE06B3D714
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19
- Target
  vulkan-1.dll
- Size 937KB
- SHA256 ca127ddf17b76a70f35b103c691dc865c6790ac0cc0796a0e2e7f43ee0ecc6c2
- MD5 7b289a8c97f2d7c629329652117d5c77
- SHA1 8baa2a6ccd29e663266de1c2ed40e1a14c63021b
- SHA512 8650456eae455b0fae01bc9ce4afb7157d279036d5c920957f41b9bcaabac93eb1aacfa6a48fb9430941273f954a43d36d65eaccfa4bff31004a7a82ffa27445
- SSDEEP 24576:70+m5ZL5PgxUoW4T0uo4A56Y6Z5WGcXDYsHQDJ6g3P0zAk79oOHTQa:RmPLJgxp/434A56Y6Z5WGcXDYsHQDJ6I
- TLSH
  T1B9156D23DA544669D976D034C9D28B0789B075822326B9CF02A817087F6FFF47B7D72A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral20
- Target
  $PLUGINSDIR/modern-wizard.bmp
- Size 150KB
- SHA256 2079f7a3eba60e0d9ee827a7208aa052a71b384873b641de5e299aeb8e733109
- MD5 52ff52eee3b944b862c11c268a02c196
- SHA1 8d041966e6fba10aa5e10ce5dc1dc5175f11b2fe
- SHA512 2861ae5a06f8413810947c08994f4c0da54a1acee8c4df72cd8b03a9503b26e5512809f8d70fd584239b04a651e7329a701bf7ddcee2dec2c2e14d05ae74f220
- SSDEEP 48:EWQsvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvW:ER4N4S/992/zDmrkVIe1ULo2K
- TLSH
  T105E3BFF256769258E29113445BB4394CEABF7F8A1A209893DE72FE56DAFF134448C00F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 1e40211af65923c2f4fd02ce021458a7745d28e2f383835e3015e96575632172
- MD5 466179e1c8ee8a1ff5e4427dbb6c4a01
- SHA1 eb607467009074278e4bd50c7eab400e95ae48f7
- SHA512 7508a29c722d45297bfb090c8eb49bd1560ef7d4b35413f16a8aed62d3b1030a93d001a09de98c2b9fea9acf062dc99a7278786f4ece222e7436b261d14ca817
- SSDEEP 192:olsHeylO012En8pqHtcE0PuAgkOyvIFc:oATI0d8pUP0WAgkBvIFc
- TLSH
  T1D0120892E6E450B3C5D6133F35AE2B2DCBBD5329B0922C0087738E4979795B66E38347
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral22
- Target
  $PLUGINSDIR/nsExec.dll
- Size 6KB
- SHA256 5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
- MD5 ec0504e6b8a11d5aad43b296beeb84b2
- SHA1 91b5ce085130c8c7194d66b2439ec9e1c206497c
- SHA512 3f918f1b47e8a919cbe51eb17dc30acc8cfc18e743a1bae5b787d0db7d26038dc1210be98bf5ba3be8d6ed896dbbd7ac3d13e66454a98b2a38c7e69dad30bb57
- SSDEEP 96:YjHFiKaoggCtJzTlKXb0tbo68qD853Ns7GgmkNq3m+s:JbogRtJzTlNR8qD85uGgmkNr
- TLSH
  T173D109B836C20CF3D54E46743E22381713FEE4761B7502A18B976ED61D92AE2FE20781
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral23
- Target
  $PLUGINSDIR/nsis7z.dll
- Size 424KB
- SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
- MD5 80e44ce4895304c6a3a831310fbf8cd0
- SHA1 36bd49ae21c460be5753a904b4501f1abca53508
- SHA512 c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df
- SSDEEP 6144:aUWQQ5O3fz0NG3ucDaEUTWfk+ZA0NrCL/k+uyoyBOX1okfW7w+Pfzqibckl:an5QEG39fPAkrE4yrBOXDfaNbck
- TLSH
  T1E9949E22B6D2C036C56E02309918F77921AEB3B1592DDB1B73985B6F7FB44C19E24B07
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral24
- Target
  $R0/Uninstall Hytale F2P Launcher.exe
- Size 222KB
- SHA256 c092b6cad8e74e4b96a4706ac2070771139cb6a47cb00ed6aa5b5d55869f4da1
- MD5 5d055c04b4277959ce5c9c379230d167
- SHA1 ca7bce93d3cec824ddafd50d7224f57d6a2411e9
- SHA512 479db12bdf05445c633276c69e79c4f0bb0149313ea67c8784c8a9eca478665d90409f6c7bdae11a17fc2547b8740a51a4901293f2e9e9d8a5787014faa541c2
- SSDEEP 6144:W740ItoZPZH5opUFGc0K2Ua8T2t0EyL+yag:8TZHxFACLRKJg
- TLSH
  T1B324021077A0C437E8FB4B3197BB53DB4EB9F51116288F6777816A6E3841AE0EE2D601
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery execution
- Executes dropped EXE
- Loads dropped DLL
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
behavioral25
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH
  T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral26
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral27
- Target
  $PLUGINSDIR/UAC.dll
- Size 14KB
- SHA256 2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
- MD5 adb29e6b186daa765dc750128649b63d
- SHA1 160cbdc4cb0ac2c142d361df138c537aa7e708c9
- SHA512 b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada
- SSDEEP 192:DiF6v2imI36Op/tGZGfWxdyWHD0I53vLl7WVl8e04IpDlPjs:DGVY6ClGoWxXH75T1WVl83lLs
- TLSH
  T10F623AAA62E847BEE2221636B96723130BFDB5203DA1D01F4D531E596C30BE3953D61A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral28
- Target
  $PLUGINSDIR/WinShell.dll
- Size 3KB
- SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
- MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
- SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
- SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
- TLSH
  T16A51365F13BED7A4C3071738A6FBDC85749B440012C659558BB2172ABF141E0BB3CD08
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral29
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 1e40211af65923c2f4fd02ce021458a7745d28e2f383835e3015e96575632172
- MD5 466179e1c8ee8a1ff5e4427dbb6c4a01
- SHA1 eb607467009074278e4bd50c7eab400e95ae48f7
- SHA512 7508a29c722d45297bfb090c8eb49bd1560ef7d4b35413f16a8aed62d3b1030a93d001a09de98c2b9fea9acf062dc99a7278786f4ece222e7436b261d14ca817
- SSDEEP 192:olsHeylO012En8pqHtcE0PuAgkOyvIFc:oATI0d8pUP0WAgkBvIFc
- TLSH
  T1D0120892E6E450B3C5D6133F35AE2B2DCBBD5329B0922C0087738E4979795B66E38347
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral30
- Target
  $PLUGINSDIR/nsExec.dll
- Size 6KB
- SHA256 5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
- MD5 ec0504e6b8a11d5aad43b296beeb84b2
- SHA1 91b5ce085130c8c7194d66b2439ec9e1c206497c
- SHA512 3f918f1b47e8a919cbe51eb17dc30acc8cfc18e743a1bae5b787d0db7d26038dc1210be98bf5ba3be8d6ed896dbbd7ac3d13e66454a98b2a38c7e69dad30bb57
- SSDEEP 96:YjHFiKaoggCtJzTlKXb0tbo68qD853Ns7GgmkNq3m+s:JbogRtJzTlNR8qD85uGgmkNr
- TLSH
  T173D109B836C20CF3D54E46743E22381713FEE4761B7502A18B976ED61D92AE2FE20781
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral31

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Executes dropped EXE

Loads dropped DLL

Reads ssh keys stored on the system

Checks installed software on the system

Command and Scripting Interpreter: PowerShell

Reads ssh keys stored on the system

Executes dropped EXE

Loads dropped DLL

Command and Scripting Interpreter: PowerShell

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31