Overview

overview

6

Static

static

3

TheForest_...ic.rar

windows10-2004-x64

1

TheForest_...ic.rar

windows11-ltsc_2024-x64

1

OnlineFix.ini

windows10-2004-x64

1

OnlineFix.ini

windows11-ltsc_2024-x64

1

OnlineFix.url

windows10-2004-x64

6

OnlineFix.url

windows11-ltsc_2024-x64

6

SteamOverlay64.dll

windows10-2004-x64

1

SteamOverlay64.dll

windows11-ltsc_2024-x64

1

TheForest3...ix.ini

windows10-2004-x64

1

TheForest3...ix.ini

windows11-ltsc_2024-x64

1

TheForest3...ix.url

windows10-2004-x64

6

TheForest3...ix.url

windows11-ltsc_2024-x64

6

TheForest3...pi.dll

windows10-2004-x64

5

TheForest3...pi.dll

windows11-ltsc_2024-x64

5

TheForest3...of.dll

windows10-2004-x64

3

TheForest3...of.dll

windows11-ltsc_2024-x64

3

TheForestV...ix.ini

windows10-2004-x64

1

TheForestV...ix.ini

windows11-ltsc_2024-x64

1

TheForestV...ix.url

windows10-2004-x64

6

TheForestV...ix.url

windows11-ltsc_2024-x64

6

TheForestV...64.dll

windows10-2004-x64

5

TheForestV...64.dll

windows11-ltsc_2024-x64

5

TheForestV...of.dll

windows10-2004-x64

1

TheForestV...of.dll

windows11-ltsc_2024-x64

1

TheForest_...ix.ini

windows10-2004-x64

1

TheForest_...ix.ini

windows11-ltsc_2024-x64

1

TheForest_...ix.url

windows10-2004-x64

6

TheForest_...ix.url

windows11-ltsc_2024-x64

4

TheForest_...64.dll

windows10-2004-x64

5

TheForest_...64.dll

windows11-ltsc_2024-x64

5

TheForest_...of.dll

windows10-2004-x64

1

TheForest_...of.dll

windows11-ltsc_2024-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target
    TheForest_Fix_Repair_Steam_Generic.rar
  • Size 27.2MB
  • Sample260722-qq36asstev
  • SHA256 c6e326ec50231bff443178fe996b8b809be039d7eb1333a6dcc7addf77d36af2
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
discoveryransomware

Malware Config

Targets

    • Target
      TheForest_Fix_Repair_Steam_Generic.rar
    • Size 27.2MB
    • SHA256 c6e326ec50231bff443178fe996b8b809be039d7eb1333a6dcc7addf77d36af2
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral1behavioral2
    • Target
      OnlineFix.ini
    • Size 707B
    • SHA256 2682a8c8961101e738a1d9d48168aca5c3655a81507cfdf8dc1dd1c10c1bb209
    • MD5 SHA1 SHA512 TLSH
    Score
    1/10
    ransomware
    behavioral3behavioral4
    • Target
      OnlineFix.url
    • Size 46B
    • SHA256 3cb526cccccc54af4c006fff00d1f48f830d08cdd4a2f21213856065666ef38e
    • MD5 SHA1 SHA512
    Score
    6/10
    discovery

    • Contacts third-party web service commonly abused for C2

      Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

    behavioral5behavioral6
    • Target
      SteamOverlay64.dll
    • Size 96KB
    • SHA256 9edeba9df599d65fb378d4bcbe16e9ac2ea3b7850491e662e8ddaf6f1d74849e
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral7behavioral8
    • Target
      TheForest32_Data/Plugins/OnlineFix.ini
    • Size 707B
    • SHA256 2682a8c8961101e738a1d9d48168aca5c3655a81507cfdf8dc1dd1c10c1bb209
    • MD5 SHA1 SHA512 TLSH
    Score
    1/10
    ransomware
    behavioral10behavioral9
    • Target
      TheForest32_Data/Plugins/OnlineFix.url
    • Size 46B
    • SHA256 3cb526cccccc54af4c006fff00d1f48f830d08cdd4a2f21213856065666ef38e
    • MD5 SHA1 SHA512
    Score
    6/10
    discovery

    • Contacts third-party web service commonly abused for C2

      Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

    behavioral11behavioral12
    • Target
      TheForest32_Data/Plugins/steam_api.dll
    • Size 5.2MB
    • SHA256 f9cb4b0944b4bff92212774d2f3a8b43b8578d02591bf16b155323a867b83d70
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    5/10
    discovery

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral13behavioral14
    • Target
      TheForest32_Data/Plugins/steam_api_of.dll
    • Size 183KB
    • SHA256 586eaa7a024ec2de2ac1d8732e7d5824f3a6ec1467ea0165023f805c06b49925
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral15behavioral16
    • Target
      TheForestVR_Data/Plugins/OnlineFix.ini
    • Size 707B
    • SHA256 2682a8c8961101e738a1d9d48168aca5c3655a81507cfdf8dc1dd1c10c1bb209
    • MD5 SHA1 SHA512 TLSH
    Score
    1/10
    ransomware
    behavioral17behavioral18
    • Target
      TheForestVR_Data/Plugins/OnlineFix.url
    • Size 46B
    • SHA256 3cb526cccccc54af4c006fff00d1f48f830d08cdd4a2f21213856065666ef38e
    • MD5 SHA1 SHA512
    Score
    6/10
    discovery

    • Contacts third-party web service commonly abused for C2

      Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

    behavioral19behavioral20
    • Target
      TheForestVR_Data/Plugins/steam_api64.dll
    • Size 6.2MB
    • SHA256 848ae5c29bc9723486bb667173f4ccbe3ea2c9d11e13188342539aae68341a6b
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    5/10

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral21behavioral22
    • Target
      TheForestVR_Data/Plugins/steam_api64_of.dll
    • Size 206KB
    • SHA256 c0a90aa701795c5e6d9515f86a2c86fb31441275f1fce244a0518e71ddbad05f
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral23behavioral24
    • Target
      TheForest_Data/Plugins/OnlineFix.ini
    • Size 707B
    • SHA256 2682a8c8961101e738a1d9d48168aca5c3655a81507cfdf8dc1dd1c10c1bb209
    • MD5 SHA1 SHA512 TLSH
    Score
    1/10
    ransomware
    behavioral25behavioral26
    • Target
      TheForest_Data/Plugins/OnlineFix.url
    • Size 46B
    • SHA256 3cb526cccccc54af4c006fff00d1f48f830d08cdd4a2f21213856065666ef38e
    • MD5 SHA1 SHA512
    Score
    6/10
    discovery

    • Contacts third-party web service commonly abused for C2

      Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

    behavioral27behavioral28
    • Target
      TheForest_Data/Plugins/steam_api64.dll
    • Size 6.2MB
    • SHA256 848ae5c29bc9723486bb667173f4ccbe3ea2c9d11e13188342539aae68341a6b
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    5/10

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral29behavioral30
    • Target
      TheForest_Data/Plugins/steam_api64_of.dll
    • Size 206KB
    • SHA256 c0a90aa701795c5e6d9515f86a2c86fb31441275f1fce244a0518e71ddbad05f
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral31behavioral32

MITRE ATT&CK Enterprise v16

Tasks

static1

Score
3/10

behavioral1

Score
1/10

behavioral2

Score
1/10

behavioral3

ransomware
Score
1/10

behavioral4

ransomware
Score
1/10

behavioral5

discovery
Score
6/10

behavioral6

discovery
Score
6/10

behavioral7

Score
1/10

behavioral8

Score
1/10

behavioral9

ransomware
Score
1/10

behavioral10

ransomware
Score
1/10

behavioral11

discovery
Score
6/10

behavioral12

discovery
Score
6/10

behavioral13

discovery
Score
5/10

behavioral14

discovery
Score
5/10

behavioral15

discovery
Score
3/10

behavioral16

discovery
Score
3/10

behavioral17

ransomware
Score
1/10

behavioral18

ransomware
Score
1/10

behavioral19

discovery
Score
6/10

behavioral20

discovery
Score
6/10

behavioral21

Score
5/10

behavioral22

Score
5/10

behavioral23

Score
1/10

behavioral24

Score
1/10

behavioral25

ransomware
Score
1/10

behavioral26

ransomware
Score
1/10

behavioral27

discovery
Score
6/10

behavioral28

discovery
Score
4/10

behavioral29

Score
5/10

behavioral30

Score
5/10

behavioral31

Score
1/10

behavioral32

Score
1/10