f48e2e19c810da3d76478a4e3680d2cf955ad49f84f3c924f5720693b2c24e4d

Sharing

Copy URL Twitter E-mail

General

Target
Stumble Guys (v0.73).zip
Size 661.7MB
Sample260722-vf595adk7z
SHA256 f48e2e19c810da3d76478a4e3680d2cf955ad49f84f3c924f5720693b2c24e4d
MD5 efa1ae61ee833fee1b98a41935ed3f41
SHA1 758f5b96d820aa2e15ce0c4f281093f66e2307f6
SHA512 7cebb69f22a697cb20721cc48baa2bfa6edfd6cd4b4e5e155b7d2545c4d568ee4e60fb4708462634c2e08b83ff5a43c681dd566569184c3e670e6385cc8316ce
SSDEEP 12582912:bSwLzkT0KuYDaDwWPnSjz2edleeApekhciuwDMpHddd5StNFx:eWziUp5/Sjz2ed/2ekuNwDMp3sP
TLSH
T1CF7933A69DCA9EBBF125783B86AD278040816937C574D83B0B018BD18FB57CA1277F1D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Stumble Guys (v0.73)/MelonLoader/Dependencies/Il2CppAssemblyGenerator/Cpp2IL/cpp2il_out/Photon.Profilers.dll
- Size 31KB
- SHA256 284c19ad689d30d140798814eeef7cfb1172efc2c1868b0f71acf23705d38ab8
- MD5 901dc64c9907cfc8dd03bb1ec23cefbf
- SHA1 ef5a97b1ee03c82d68981a617b0cd04684cf0e0c
- SHA512 c3698d2caf93181b89195d815051362bc5ecaa6a5aa05f4b992f2c087bb84cbcbc7d786bc2c4472d7c692ef90c3be114e14f1ba11674f5a40d78d4fcab339020
- SSDEEP 384:oAtuMZgAxs9FxQbAwoT/MvsjqZUL8wFs5Ul1l00hLXZ3OG1Whiis/AXFcb:oKuMZgodoQsSgZs5az00hLFpinXFc
- TLSH
  T101E2AE86DA7882DAC26E2F3178D865D0E031776F09EFDB862CF560E52C667A71187C4C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  Stumble Guys (v0.73)/MelonLoader/Dependencies/Il2CppAssemblyGenerator/Cpp2IL/cpp2il_out/Photon3Unity3D.dll
- Size 162KB
- SHA256 045c9b48a959670eb63c9b7514248a018952d973822ad73f3b0b989448a7778a
- MD5 44e1c3abed3a684ad66342fc9fd0753c
- SHA1 3252cfed5c0d0a32b48257908da086c96b794a7d
- SHA512 e57d4163a65ea62b3bb0da49719b78df18e7437e2bfce473f107cad496a6bc242e4d03aad7fa2e56ff5eb70144b100caf1048b82377ad68ed1fc700edc4ce773
- SSDEEP 1536:iP+VnyEJ+jB9wPHEEIxVf6gux6NoW0RYYIyDxJiICNALTjZz7/DpH29vOWZ/tyDr:LJjk9klxT4Gm1LW1zCVvML
- TLSH
  T124F3BB969A7882DAC25E1F307CC8A890F131B72F499FD7C72CB560F92C626976187C4D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3 behavioral4
- Target
  Stumble Guys (v0.73)/MelonLoader/Dependencies/Il2CppAssemblyGenerator/Cpp2IL/cpp2il_out/PhotonDeterministic.dll
- Size 177KB
- SHA256 4f63d2069efddec923bd2d8bf626c73a5690d35aba314c8ba9675cf2398b80f4
- MD5 e23d036e89793c36de8a29fb2a5cff60
- SHA1 5c100135761afc71ea982a2e3be8c5a023626955
- SHA512 f55231a99077b5be6e8ce3f31405f93351dc0cd9e04d7a778553035057a1f7e59e4241c8dcefd3b3d93f51cd1f7a69d1c9c9e55233a24ecbcab94cd9a4b3f04e
- SSDEEP 3072:JN0krR5rEvcM7a9kPt81XTjEvYmMS46h15K2G4:7LrRyUKa9Ut8ZjEvYmMS4S15K2G4
- TLSH
  T12504CD869A7982DAC35D2F34BCCEA990F121B72F499FD7C32CB860E11DA22935547D4C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral5 behavioral6
- Target
  Stumble Guys (v0.73)/MelonLoader/Dependencies/Il2CppAssemblyGenerator/Cpp2IL/cpp2il_out/PhotonRealtime.dll
- Size 113KB
- SHA256 04ae29e46548f553da39de5dfa16b8a027157e2d540a17c5f6d4bbb8fac9c3a0
- MD5 10487ca2462eac40f0a06fd28fc974ac
- SHA1 d4d3cb6a38131d969a34db94f9279a277e7c2be5
- SHA512 48d64c3fd3597b7103edc36da810b7443f2b4298ecfca4acf80c354254e4088adb70224987b25cea14a3677f7b503631f7a675619a509d3811ea250a782e9289
- SSDEEP 1536:IPVMZl1Vt+ab3CBl0w79IgZ7hEvr4KCGur1mXdTXPvmdq6p1ex:KsVVyBJJivr4Kg1mXdTXP+U6p1ex
- TLSH
  T1D2B3DD869A78C2CAC26E2F307CC4A990F131B72F599FEBC72CB460E52C666572047D5C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  Stumble Guys (v0.73)/MelonLoader/Dependencies/Il2CppAssemblyGenerator/Cpp2IL/cpp2il_out/PhotonWebSocket.dll
- Size 2KB
- SHA256 92b823089fb49232155dbee3cae25a059cc0046bfc2de77ebb8651dc761b4979
- MD5 66353faa142a6cde63a220f577467aca
- SHA1 7c7453fa48fb784fb338eea08011e526342c9334
- SHA512 e6037da7281b54d51b2ba21043cc34a10c7ba18e80b142400f88d92f1394202cb8b127d423fd6ca6695d177ab1c370eafba27584720808071bbaa311064697d7
- TLSH
  T1AB41DD3B9BA15A77CC4B03B84DA3578117A1A4051A2B8F671D8491B6FC112A60A17A84
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  Stumble Guys (v0.73)/MelonLoader/Dependencies/Il2CppAssemblyGenerator/Cpp2IL/cpp2il_out/Playgami.Scout.dll
- Size 117KB
- SHA256 03908cb09ce39a7ec699c8c184dd3329ea628019ac09fdb27dbe9b7d774d98cb
- MD5 1b6e4dd76ebae7241a76d9dc131cf3bd
- SHA1 ca111245bd86e8804ec0b93657b93269351d9873
- SHA512 90e3083531f89fae55e7a1e1792c18a925ad91cd2f3f9a09b5616c8de09f1a2ea3ed05e8d57ec698e5c932f7cb95b63b3293184ed108d5366e71944ff06b2c84
- SSDEEP 3072:JfiuSj0n7XRQ/xnOjb3/Te9eMiyI4G3IIagnGV:Jf00n7XRQ/xnOfTecMiyIfn
- TLSH
  T139C3CB869A78C2DEC25E2F707CC4A5A0F431B76F59AFDB876CB460E51D622932087D4C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  Stumble Guys (v0.73)/MelonLoader/Dependencies/Il2CppAssemblyGenerator/Cpp2IL/cpp2il_out/Playgami.Sdk.AdsIronsource.Runtime.dll
- Size 11KB
- SHA256 8112c69ba86fa1fe4a6f2161bd32f5d834ee5af8df863169ecd3ca2088c8cd35
- MD5 66997f939f803742cd98bf3c513c430d
- SHA1 480276f704a23b956f88b40a43aacdf59e4ed647
- SHA512 55674fa15dc2da6d1fb1fc6feca0ad79f2314b08db826529e2318a147c32844fc79384a6c8e42cdcf154d23abe35da9ee9790256544d8488c57aa435756dca9e
- SSDEEP 96:PmJQMjLpvjPlh3dnhyXActgP/fPqXmlOmlD6B9BM3P/RxeT2:u6Mj1vjvNhyQOwPq2guD6Cf/WT2
- TLSH
  T1D63200958B7CC6D5C67A0F3118CA6591E670B32F0FFB83976DE860E21CA794B2647C44
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  Stumble Guys (v0.73)/MelonLoader/Dependencies/Il2CppAssemblyGenerator/Cpp2IL/cpp2il_out/Playgami.Sdk.CustomerSupport.Runtime.dll
- Size 11KB
- SHA256 0aa3bfd8462fa1aa97a65a9d110ccf790b15bd58bb12fd9a35e5214be9c423a5
- MD5 0dfba1b8a2b4e5233251fdaedbb3f657
- SHA1 90d48143c3659df3d6bef0befcd3a822fbf6a6a1
- SHA512 4003b0291e0219fed2f5a9bfd490d7147aaefdfaeabcce549c5bb29f18a3afc93bc01081d0f1488a32f2d87b5472ecb94edbd26c242ea3248a1fe0d18df98632
- SSDEEP 192:JJoY2N0Kd+DopezpCscgpWXaYBy9DGi8zgAKL9t:JcJMFwenHt9t
- TLSH
  T16632BD569AB4D2DAC65A1F313CCA7590FA71B31F0A9F87873DB474E12CA22572247C4C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  Stumble Guys (v0.73)/MelonLoader/Dependencies/Il2CppAssemblyGenerator/Cpp2IL/cpp2il_out/Playgami.Sdk.Datadog.Runtime.dll
- Size 39KB
- SHA256 fc7cb05bd7ec4eba5939f352f9503aa269b729b1ec43aed32fb66b47d960cfa9
- MD5 00f338ae8d826731165d073048be9dd3
- SHA1 32466336105174c7cbf8bae03e6cd1a7f8f2cfa6
- SHA512 49507dc3c86f80f858986599cd4331d45e3c4aca507afc7a56707b908410990fd795476a0b6f28591280447686b82b013a505e95e1a7c94eaa07d0e3b9844801
- SSDEEP 768:i7oNVMm6I1eaym/OdL6bpC88qvZVMAZAamPhjPAI+56g:5Vr67aO69C88qvZVMAZAamPhjPAI+
- TLSH
  T1CD03BC869AB8C2DAC25E1F307CC8A4A0F831B76F4AEFD7872CB460E51C666576147D4C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  Stumble Guys (v0.73)/MelonLoader/Dependencies/Il2CppAssemblyGenerator/Cpp2IL/cpp2il_out/Playgami.Sdk.ErrorReporter.Runtime.dll
- Size 33KB
- SHA256 e278b0b9176df12b1f547498887349badd9cce556c492a611b5b5f76d31afb3f
- MD5 4bb6cd8c08712c3093cec0acca32a3d9
- SHA1 43d92a374456a7e80fe4aaf5cf1cdcced1b1be04
- SHA512 defc2b26205df7dc2c6998021ea08ce3ae600972f64a9b1eda646f97697414a5a0a0622d510090637d47ca76e8d8d12289a06877e1fc4c1dcdd4167527c9ca46
- SSDEEP 768:MhF1gP5YQfulQ5QF7j6BZhjsfTeJGkwY6nJqEbaU:fXQFsJkTeJGkwY6nJq
- TLSH
  T1F6F2DA968AB8C2DAC26A1F717CC46490E531B72F49DFD7832CB874E11CAA25B7497C4C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral19 behavioral20
- Target
  Stumble Guys (v0.73)/MelonLoader/Dependencies/Il2CppAssemblyGenerator/Cpp2IL/cpp2il_out/Playgami.Sdk.HelpshiftX.Runtime.dll
- Size 41KB
- SHA256 511938249e1470b001686c32606e0e13dd3cb6fca90ca97c31771f459a6c0b19
- MD5 62c5f920f2cea739b5d0e8d90edd94a5
- SHA1 0f65b382fc4b3462f8ce31f277be42fdeb00b46b
- SHA512 eb56cd61e37c4deeaff5e6704fab8cef239d21c3b810914b212e4af490d2b3ddf731a4323aa1527a66214e1522ca3ceed0ee3d7716f07aa3cc5dab7c6d545bbf
- SSDEEP 768:YKlgEu6D87Xav61mqpaAirLlzwK5Fp+DNlhAEuuTSRlhy7w8Lvhr:bgEuOTXyK5Fp+DNcu+F8jhr
- TLSH
  T1B513A7866AB882CAD61D2F307CC46490F831B36F4DDFD7872CB860E91C666576667D0C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral21 behavioral22
- Target
  Stumble Guys (v0.73)/MelonLoader/Dependencies/Il2CppAssemblyGenerator/Cpp2IL/cpp2il_out/Playgami.Sdk.Identity.Runtime.dll
- Size 417KB
- SHA256 4855d0cf6bacb06ef5f2b83a4326bbaac6d32052a4fc9035eb0fa039ca9a4c1e
- MD5 365d9ead72c7cce2e83993b516e46af6
- SHA1 f31679882a70f77ac6b8833fa151c54693de6d12
- SHA512 1f3e62350ea29a23c54ca07c603275ef6bb09ae230831a55faa04700905099d3504e6837e371db72581a71f1e9ed7d486b6dc701d24a1b6c1fcbbfbb7fc2fb04
- SSDEEP 12288:Kc1o/H/u7X4oh6M1Se8rpRqoc3cPYNRsEo:KJfua2d0RDnPL
- TLSH
  T102940C242DFA501DF273AF695FD47496D92EF7732B0BA49A106103860B23E42DD92A3D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral23 behavioral24
- Target
  Stumble Guys (v0.73)/MelonLoader/Dependencies/Il2CppAssemblyGenerator/Cpp2IL/cpp2il_out/Playgami.Sdk.Swizzler.Runtime.dll
- Size 3KB
- SHA256 744fafbf6a8adb42821ace831130b4db610ff0320d3f94276041b29949b09cae
- MD5 59ebdaf287bfce0529b54d8720cee948
- SHA1 cf44cae4d5c52f8d89fefea8f6d516e096da1ca6
- SHA512 65a7fa097e2b35198a895470eb99a95c5927bfd0df3772f364919ece7525046475c91a00a59f571239b8dc089913c0c24e4d105ed596f538833a981536dcb0a1
- TLSH
  T1FD7151228FA94BE7CA0E0F751C8775C06376B21F199B83932A8451B33C6239729136A4
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  Stumble Guys (v0.73)/MelonLoader/Dependencies/Il2CppAssemblyGenerator/Cpp2IL/cpp2il_out/Purchasing.Common.dll
- Size 9KB
- SHA256 9897327cacb75c3e8ca5ba049dd78247982a9716259617861b7927ab344ce831
- MD5 a6603a2882c366c1077885d884a802bf
- SHA1 0cde6de3b0f00d125c0c8e1256fde256ab2585f9
- SHA512 743f9e237235a49c7b6bbaac99b7df01540bf87457ba6376e58cd9a2f4d371b6b49a9516758dfa274133f0f0bd76288e72d297b379dd37197d98b1c70e225f27
- SSDEEP 192:Yvz7rx1keDV/HcvXQ0E2IyhHxb1uBbofW29IgVne:YL7rxbhPcvX7E2XVHhQ
- TLSH
  T126120DD6EA7487E7C60D2F7028D96690E131B32F4AAFD7872DB070A52CA2B875547D0C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  Stumble Guys (v0.73)/MelonLoader/Dependencies/Il2CppAssemblyGenerator/Cpp2IL/cpp2il_out/PusherClient.dll
- Size 101KB
- SHA256 4029df77f2147e782030b025af25fb3550ea1862b73082bb586c50b73608ea99
- MD5 bca578cba03ebe76fcc471f2a395f712
- SHA1 277ae82de41ed8bfcf1e618ab0c9ba02d7c9336a
- SHA512 5462e177b59e6b532b7baaf3714ead5fe38550c9c068363c1730c5f19649e2a4dba936cb006495a288d5ef46b8f9734002c026b8185d176ab72bac1f56294e32
- SSDEEP 1536:tPdhbXapTK22y9fjyrZyq7VBG6SbJ8vmEbLJxKhnvR6eHYL4g:bQTK22y9fhoEbVULJxKVvR6eHYL4
- TLSH
  T1CCA3D8869A38C2D9C24E2F307CD8A990F671B72F49AFD7872CB460E52D62B432557C4D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral29 behavioral30
- Target
  Stumble Guys (v0.73)/MelonLoader/Dependencies/Il2CppAssemblyGenerator/Cpp2IL/cpp2il_out/Rewired.Windows.Functions.dll
- Size 2KB
- SHA256 a851bfaf5fcecd801cf1f42b9a3372fadc8505960cbd43cf64548120c9ecb55e
- MD5 be0a73dbccb54a4728dd898b2d7f83bf
- SHA1 f16841a9c1158c2853af94cb000d362befea640e
- SHA512 1f06f52890bca22b48af2f6a685b31c882f967c2988708dca2458b694eb999b6f6c76e68d4d5abbedf19db5b9c40521f717ae97fde6aa65f012181d211d0e680
- TLSH
  T1BB51943387695B7AC44803B84CE38740A370F4A905BBC7232D9894B9BC614B61653B90
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32