b2f6f91e04588960439d632caedf9fd3d1d6ef634f20034aca67a5b5aabea619

Sharing

Copy URL Twitter E-mail

General

Target
Worldbox.v0.51.2.rar
Size 406.5MB
Sample260722-dsdl7scn8w
SHA256 b2f6f91e04588960439d632caedf9fd3d1d6ef634f20034aca67a5b5aabea619
MD5 986efde5c1df51dde117906d461271f7
SHA1 d2a81f789cbed946620098ec4069b5b1ce58622d
SHA512 1a0ff6bb440f2661ae1072e16d9421e2676900b2041de750dcf93c0cda88f619d845623f5f7dfb8e68e13066b6877f3f64aa1939814a20e0f6af5e96f96af6d1
SSDEEP 12582912:oYRUFz5jpHrB3z1ElbO2GmMcDSWoQTdLRbXU61e45wTU4f9:T2FzhpLBDiNOPcDS9QTdLRbL82wTPl
TLSH
T1F319339C96265FBCC6F84638B170D8B5C25E940C3EC6FBD5C033DAA4A62E139F58191E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Worldbox.v0.51.2/PCGAMESTORRENTS.COM.url
- Size 202B
- SHA256 c4d6ac03d1b51af3f4127bdd12f2317da8ebf4a7f20402f2139c61d5cf10ab23
- MD5 420715a04de8367bb8d37d57ce1d6d41
- SHA1 710369a636391e43be7149416d8e9b390863babb
- SHA512 8737cec4730f412c18e508076d9fb7af2ab10b4b1637c70c2f76c1c6ca7bca27021cbe56dc3305a4ea7704f7ac2c6e005d02c605a4e7f9b0a709bb94cfc7f457
- TLSH
  T1C1D0221D8705C2E5EA43A5473270FC48A84F7D5819D6C4689748CE8E0CD47C0C85CBE2
- MD5 SHA1 SHA512 TLSH
Score

7^/10

discovery
- Loads dropped DLL
behavioral1 behavioral2
- Target
  Worldbox.v0.51.2/game/MonoBleedingEdge/etc/mono/4.0/DefaultWsdlHelpGenerator.aspx
- Size 59KB
- SHA256 751861040b69ea63a3827507b7c8da9c7f549dc181c1c8af4b7ca78cc97d710a
- MD5 f7be9f1841ff92f9d4040aed832e0c79
- SHA1 b3e4b508aab3cf201c06892713b43ddb0c43b7ae
- SHA512 380e97f7c17ee0fdf6177ed65f6e30de662a33a8a727d9f1874e9f26bd573434c3dedd655b47a21b998d32aaa72a0566df37e901fd6c618854039d5e0cbef3f5
- SSDEEP 768:6CEPutHjvpMgMwP9h5Ij7khsp/6JtEZwMXVtkUI3t3CXyEyk3VbNbqDvJ4oT1y:/r6CdsCOZwMX3k5dWyklh+Dvbw
- TLSH
  T18C43C4A0EE5C8D36499B52D9F48140DCB9BCC43191299CF3FCDDA12AF09CC6DA278676
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral3 behavioral4
- Target
  Worldbox.v0.51.2/game/MonoBleedingEdge/etc/mono/4.5/DefaultWsdlHelpGenerator.aspx
- Size 59KB
- SHA256 751861040b69ea63a3827507b7c8da9c7f549dc181c1c8af4b7ca78cc97d710a
- MD5 f7be9f1841ff92f9d4040aed832e0c79
- SHA1 b3e4b508aab3cf201c06892713b43ddb0c43b7ae
- SHA512 380e97f7c17ee0fdf6177ed65f6e30de662a33a8a727d9f1874e9f26bd573434c3dedd655b47a21b998d32aaa72a0566df37e901fd6c618854039d5e0cbef3f5
- SSDEEP 768:6CEPutHjvpMgMwP9h5Ij7khsp/6JtEZwMXVtkUI3t3CXyEyk3VbNbqDvJ4oT1y:/r6CdsCOZwMX3k5dWyklh+Dvbw
- TLSH
  T18C43C4A0EE5C8D36499B52D9F48140DCB9BCC43191299CF3FCDDA12AF09CC6DA278676
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral5 behavioral6
- Target
  Worldbox.v0.51.2/game/UnityCrashHandler64.exe
- Size 1.1MB
- SHA256 4325e591f7f62c421ad9f36ca0e15fe2bb9aae4e5b0d695a044ceafd17f4ded3
- MD5 df802def31d7706e8b3dac3b78bc7f6b
- SHA1 dd2c8f6cfa66caa1aa5225b4cd3755d98395a341
- SHA512 d73b5a4cf6c4545629b87862aa59e4d18d7b17c2f82ece97af84df436ecf9c893c20e262915e975561272356f575c44af0c9c2add9787bb449a78740a78227f6
- SSDEEP 12288:5o4M8g5CFF3vK3YjRJKC1Zj4xl6PwsinRZw2mtxb4TRq7QsoPo4njcKylQfz2fz7:5o4fg5CFWYii0zRZw2mX0M/wnoKz+zAY
- TLSH
  T1B5457D6A66A800E9D5779135C952490FE3F27C1907609BDF23A0B7A72F376E41E7E320
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  Worldbox.v0.51.2/game/UnityPlayer.dll
- Size 29.7MB
- SHA256 c127164c473de7cdf4203e14c5e755cc7430fe2df41ec6f1b1ac45e8a7aa421b
- MD5 5c20a7c79d8ddfd1d98e1c61befb9eb7
- SHA1 19f161875bc59f28ea8328c07002c7f232405196
- SHA512 55fffe706b4ccdd06ade8caee073d6efc0e2b84858a51595ad7f9bf56e07e125ab4a9817f825967a3fa08c42f04b609451b715c3edd86dac79fdfbdd5590c267
- SSDEEP 393216:wAxhBQQ3+Sy8++pKNefyhcYDx+SE8ZBBZW7rDSbqDx:wF+kPUP+b8x
- TLSH
  T189679DA6B2F800D4E47BD074D65FA90BEBB1344A033086EB52E149956F73BF11ABB750
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral10 behavioral9
- Target
  Worldbox.v0.51.2/game/discord_game_sdk.dll
- Size 3.7MB
- SHA256 527768710ddb0953fce5eb1700c2566b6451135d76f1d0610b63907cd5ba94c5
- MD5 d8cc567718550ae35c1566c3315b90df
- SHA1 e5d8120a8a8583fe7e3177ae7d8fe797c002f263
- SHA512 5e1d72bbb466d032596147dd1a90f5ebcaa82d3d56ee7a0b1aa3a37d4bb42e1fcb510b269451a1b9c7f3b8a1c18b1c5f530b200f2fbbe2ec990b4e1c12e6f5e8
- SSDEEP 49152:cxytJCv8RbSimYQSaKCZhYtOVt7CPjitem2vUkcWDnVf6OuBimHdXopJErae4/KC:lD400amm+8m4
- TLSH
  T12B0648213A56647CC1ABC4B483874A725E3234CB1B35BAFF45D156782F69AF46F3C228
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  Worldbox.v0.51.2/game/worldbox.exe
- Size 651KB
- SHA256 44e896cda69c9bf36426e22c56458213c96c81c462970222e6edaf0c0400276b
- MD5 51470f958ba42a2318c72565e968ed2e
- SHA1 a04d4f4f2e74d22dff6ae628c167802537e70935
- SHA512 614e9b6161192db172e92b6faab18881031bd83722d5f8151b4b04efe0c2f6306b2a3ff13f81aa69bbf5179838d9a4b2d374adde758e00cde6fcde28466dec8d
- SSDEEP 6144:W/7FG9mpcJ/OD8YQKLnjKkV0VR+6twciPe7Rf:W/744aOD8y73ywbPE
- TLSH
  T15DE455C52849E402C3D148FCFA2698F46572BEE8E81EB88B7B443D13B27E671455F86D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

persistence
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral13 behavioral14
- Target
  Worldbox.v0.51.2/game/worldbox_Data/Managed/AWSSDK.CognitoIdentity.dll
- Size 102KB
- SHA256 4da6dccae2f4a74c1ca496cc7d49b5c27e1818688b4fdb5bda66f2a2fb213f68
- MD5 28a198fecfa87d7a13ae3a825d015bc8
- SHA1 7962bc3beb85f956f5cfb8010ddf79d893391fea
- SHA512 8acdb747a3cf53e472bafcdbfc6928d5752e03344a373e00bf00e1c53c1667039447528368bd5d70f2f8142f89767524557c5afe453d4bf15f1a7b4d20bc28c3
- SSDEEP 3072:K/jU0pygkjYK7jpTwYug+2FU2JnC4BCZOV3CQA:K/jUMmkYEeC4BCZOV3C
- TLSH
  T108A3E9062EAAC71BD77E6338F8308415C1B4F569B501FBAA8D91E8F71CE77904A425F2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  Worldbox.v0.51.2/game/worldbox_Data/Managed/AWSSDK.Core.dll
- Size 792KB
- SHA256 c9d37b03fe7003655976a9aefa81f5ba3f6d8e38d315465250dfe9b9c09b1cd6
- MD5 8ff7db2562d496e7f06525e5781b520e
- SHA1 70290fd14534770810de31df227f9c83329bb710
- SHA512 fc17656734498bf90a5510764cee688b2fc54513a64958df41a4b3070efe80e7411f957b100a730eec79755c2ffa05dc020aed9c17ae6d1c081de758f774d804
- SSDEEP 6144:NaAWrEdHRozNcQJHeNzL0Pc6qxd1Ox3rrzzXs9xTuJbh59u2focY1cWakuoQklqj:nWrEdHRozNB+N005OlnzGxKdfmvJ+
- TLSH
  T168051A4593F46B16F0BFA738643500014973FE8B6A34EA8D39CC948D5F5BB489EA43B6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral17 behavioral18
- Target
  Worldbox.v0.51.2/game/worldbox_Data/Managed/AWSSDK.S3.dll
- Size 520KB
- SHA256 0cd51c3f49e4d63172471b506fdd6b63a83c0c03d1ea9f240a8e222118c66907
- MD5 da748258f6d960ef6b2a9a9706159897
- SHA1 cfabc08e3e6036ba37194a95a79981914452ed37
- SHA512 1f714309df8894458d90ca2ca078dec0aa26e16a9a01774aa2655f03f52dbbef9346291a9b346c5078f3d4c45e743a0c68c41f583754c0d8c3a5425db26411e5
- SSDEEP 6144:1BQJrRnmMB7r/SH2/BefrlxbRGFkn9Y/pNCItPV8gCzvSj/XRrBF6/SW82Zl5K8E:1OrRnfe7FnO/Ulz8rE
- TLSH
  T142B4280573A1877CE6FF4739E0B1052F86B5FA12B555EBAF0B90A6D92C227029D42733
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  Worldbox.v0.51.2/game/worldbox_Data/Managed/AWSSDK.SecurityToken.dll
- Size 50KB
- SHA256 c996452d5fbb5dd19323aac6a778602681d042eaa59a5a3bde551e2883139046
- MD5 84b64ec9d77dbd413d8d7af30cf4fd39
- SHA1 885201b5296efa6012d42ad0aea34b5d81822112
- SHA512 aeec8a2c261217375724c4bc4781ab43b17d1194e45b656517101d9efc6c1ab2d3ea26662369ae8ac26b522a2a3ef249321b875dd8de0222f4bcbb1174202774
- SSDEEP 768:XGMQZR7b8inouGKRTw6DlwQW3XquzkiDHU9rptsnweiaofoGZGS2vvS:2/ZdVn5GKDWV1lI9Awe5COSp
- TLSH
  T19A33095867EB8739D3FE13BAFA71451806F4B4553CA2E75D4F40B4AA7C933808AD2329
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  Worldbox.v0.51.2/game/worldbox_Data/Managed/AppStoreSettings.dll
- Size 4KB
- SHA256 c94ea6661b3282226445bd1978ea097bb965b6f8ae3b1a495c3ff71ac4f401ad
- MD5 412b46dd4b8d38fce9014db1dc179aea
- SHA1 0ebf8695ecd865f888f5f91f9176a847d89f41a0
- SHA512 cadeab2e7cddd30ad72f7694d72a0838295849531e512b29e0cf6e320a9cbe7a390753d48ec663e475617ba491474d6fb7c34d98859ada7e24cafd3766e73c19
- TLSH
  T19881BC1A6BE8051FF4BA0B39AEBB4B42617EF8144E63E3AE0460162C6C31254CF71B75
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  Worldbox.v0.51.2/game/worldbox_Data/Managed/Assembly-CSharp-firstpass.dll
- Size 223KB
- SHA256 c958110133770000a0ed23e71b95e240ef2638d4d46132bf8bef515e347f721e
- MD5 ae9b20e3941ba84983dd082b3b2023e4
- SHA1 7e6d54f56237497f75b06c6575cb590a4c7ac9ab
- SHA512 b6991f93857dccf479795e60c9cb4a5799b281ac77007f241b5c11d8c76ac94770578dcb56912f5da3d88ddd12e77dc847bd63178be7eccaf5cf7d0e0f9080d9
- SSDEEP 3072:WtsqL6NebRs9OjL4Ar+eFpQ1QbTIniyN/juyv+1SgnAaEHnVglJN/:2yebRs9OjLv+eTqN/juy215nOHVglP
- TLSH
  T15424094663E84E9BD26F537E903807118371F316A05BEBDF5CECE9F41AA27C88541A93
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  Worldbox.v0.51.2/game/worldbox_Data/Managed/Assembly-CSharp.dll
- Size 4.3MB
- SHA256 51d275f0168be2f6ca26341ab292406714e694e0270eafcb25b999d5df6dd69f
- MD5 4d5aab0902b3e2290f7d6e51580697a0
- SHA1 50fba28279079f05202a195a27c09382683ac6d0
- SHA512 dd462c9507f1f973aa4b248a9b10f30cad256e02d1c40ac456c581b1055514b1294fd1303956c277ed394d59426f370f42d0b76b741127d44125bf7500873643
- SSDEEP 49152:1Vgtm6is4ktXvMAr9za5oneLoEDFmYMr6GpcKIxxbtrOcPOO05DTFjI:1VUDza5onqomFmYMrZcVx5Oc7WT
- TLSH
  T1A3263921A3FC892BF2FF4F7B64F1164A57B1BC8A2B12D38C1521A1AC1D76B549C06367
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  Worldbox.v0.51.2/game/worldbox_Data/Managed/Beebyte.Obfuscator.dll
- Size 6KB
- SHA256 65a721fae63290ffd2f64e5bee0334cae5f0e0b2b46efeff472129daa69bab6d
- MD5 6344fef9f434bbb058862975117d0ae6
- SHA1 6495de2bd60bcff66a1f0fcece43b05b52ea0a06
- SHA512 807caf93a0481e1ea9d8358f3f69125e2ae3fe68c4e3986c0c017920c5eeab0ed1d511f5d5a4b999abefd6fa8455b4d3058c1c87e71dba23afee74e2dc5c689d
- SSDEEP 96:mRUxBti6oJdUxkY62TTKE5xk/D49TESTkxk/4Wfjf+9yf1laamTaMk/ei:mqLobUTnKE7k/D49TESIu/4WfC9q1laI
- TLSH
  T1D4C1763B5BD15377DC6B53309DA393B22B26E0119253F73E2A988567BE58240063DEF8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  Worldbox.v0.51.2/game/worldbox_Data/Managed/C5.dll
- Size 290KB
- SHA256 9be1068913d8c9311e04f91ae33a2d7c582b35926c15209a5cabbe0d672ed531
- MD5 a9fe26d48230c9fa851adbab820ebb5c
- SHA1 1014740160de7db173e465d3c51a3c5be78a3b81
- SHA512 2e43ee0f0f66ded606a422bc30554f2c4454e339a4127600c445a0b5f8f1a9ce13a21f3667af009577a7066ecd26afde5218301d15bbcd655b2a58bdfb67238f
- SSDEEP 6144:2mCK3klElkdP68S5JHfaHXplkwRvVuUUWLbXsuN7OS5edVV:2mCK3kqlkt680JHslkwRvVuUlF
- TLSH
  T1A254198866D84622DABF67F3A0B21055A734D412E6C7E35F2AD5B6F32CF3322CC49558
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Loads dropped DLL

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32