297c323ed6e55e87ff5411437921bfac76c4305690e95ee6f5c0a500f323b228

Sharing

Copy URL Twitter E-mail

General

Target
angry-birds-king-pig.zip
Size 55.0MB
Sample260730-stjbeabe89
SHA256 297c323ed6e55e87ff5411437921bfac76c4305690e95ee6f5c0a500f323b228
MD5 8634800d7d68f806e066968c2daa67c5
SHA1 b621f74469fa2437ecb488cd330e0ba679177281
SHA512 e85ea7968ec949d5a450ac0e0890c211b4ecc7ab72adea9d127184a01d2360722264e81ae417a09d8794dfab47c714f469bbec7d44aed780a0af80ae46d354fc
SSDEEP 1572864:4QgVlW6MV6q/pQ+YV3rMzl+AZQegLhcmpYPO2:41pMV6uQPVPAKe4hcAW
TLSH
T1B9C7332EFD45B842CF5B757A63566E0CEC9B963C02203F09EB884397AE855C07BB0795
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Angry Birds King Pig/Angry Birds.exe
- Size 1.7MB
- SHA256 cc9fd5d9fa5090114ae7c203d77b7d8b1cf180b8b9cd665c6d6c9f386d34fde0
- MD5 27b4168773e2858a0eed703b0ce87c0b
- SHA1 ccf2bb141d0e480201f8017ccd3a737068b115f9
- SHA512 88a56126502fd7f1f1abc24b575e4eba77212df425e308e13912810e06bbf0b01c16fb80d6eb29134c15d42f38b73823c3ee6c9a77c27db50daf9f34bb01544a
- SSDEEP 24576:n3SZufOgjLAj5daSdW8tY2hZ71l9GdnOzE+v/2V+mjSvQp0W4EYOp/sNITbipSKs:CZg9Mj+whqj4hnITbfzCREB6Mw6
- TLSH
  T16085AF3AE9469131FEA305B18AA82FAEC42D171627541BC7F7991F4D1DA86E3343930F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral1
- Target
  Angry Birds King Pig/Angry Birds.gdf
- Size 163KB
- SHA256 57d98b7513337c51c7a693457e23a5da52203fb6088d3621598804a0be4e5f10
- MD5 2ec8debfae52c5995dababdda5914099
- SHA1 c5114a7056a6c9f12ff05f656f991b3511f98511
- SHA512 1799a02eb89d359a0788537ad0287e4c365aa76f5ae61a514296195c74f79e1b3ab520c355e9cb231cc77c9419c534323b689b4c392772ee86464326eff5cb25
- SSDEEP 3072:Yn6e6vPlzs1dUNc0ULjnIrzuPGwsaKLwcM045UWB:eivPl6UNNejnIOP1rJy45UWB
- TLSH
  T1EBF3F1C66781611AE4A90E3041EBC1B454397D519EA30A6F7CE82E0F7AB6F92270497F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral2
- Target
  Angry Birds King Pig/data/localization/angry.exe
- Size 153KB
- SHA256 b79c2fab952949ef8d1fe723fe14970af54675d4aefe010cebe8b2c6db593da7
- MD5 ea8e4a2d36b8c7e069c9750c8e472ce0
- SHA1 5ab459d3fcbec42091ac45b8e1a0b0e9e23d7e22
- SHA512 be351b569e14df26cc4936ca71a97041d21bafe057ab300f12d29f04785274926ba9e1c73492d6b14a952f0424810c7dd37251edd66dde32604257ddfdd707a4
- SSDEEP 3072:qa6y6XT4gf2/N6NlPJw2qiha9ZwiL0ayDCeAyPK+qyifqO:iy0sgeQ2TiharqJDCeDPFjif
- TLSH
  T198E3127FEA97C97BCD3126B81692463DCB26F816C68C4A53F608C1245DC432B1BA0EE5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware discovery persistence ransomware spyware upx
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral3
- Target
  Angry Birds King Pig/data/shaders/GL2/commons/attributes.sh
- Size 335B
- SHA256 54f1c7c4ffdde6c62862a248609a843672833309d00216296633037c8bfbba81
- MD5 ebb00a7455c90e803c5f630453320eff
- SHA1 a025a557b4e91d0291f53c2c51c618f4dd58fd2b
- SHA512 fea5d1beff66898869734780c77f03d94d91b9b409162adf882ed7eff6ff2aa6a68ff11584dc543868763a2bb0d5b5561347cd28559aaf8b61de8a63562ca543
- TLSH
  T180E0F63F9F036BF6AC30059794AC244980E9303CD8D8867E53C0D21718EC11847B019F
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware execution persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral4
- Target
  Angry Birds King Pig/data/shaders/GL2/commons/defines.sh
- Size 1KB
- SHA256 05545e394d82a9f7f3d4464c3bb9b0ba084b6b41d2056545f5de4b58ca922b1f
- MD5 31029a8cfe389f70eb4fb2acd6489ee2
- SHA1 697642dae0c6b0d6f7121505ce7e9b0b9d8b102e
- SHA512 bafdacf2b8ea3a610e559bc301067b06876064665329027906266c5709562070d1fc0077c11d8523fe22bb27f59721790a3f8fcc63879cd27052c8e327867fc8
- TLSH
  T131314116FEBA20D5023A1170516DA533A145EFFF0AA9CAFD5C04BCDC6D099943DF8868
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware execution persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral5
- Target
  Angry Birds King Pig/data/shaders/GL2/commons/functions.sh
- Size 2KB
- SHA256 5fe65bd6208ca42362b2d28edf64a8da49b48ae4a270332adbb647fc4a2d1196
- MD5 d2233b5b143906660908a96af8bf4a75
- SHA1 262ed793481188f67eceb027a11e06bbbb3fcf90
- SHA512 a6f95c5029c97f15c3f659a393cc69b8e952c04a0264b0349ca4e99e95db334f5da15d6d063a6f874b449e3787d7b689335cb674484ee11560d5982a236db579
- TLSH
  T1D7519B978E545326EB4B900FF1619B1A43F886D03D82CDC634DEAF712D9322BC6494CB
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware execution persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral6
- Target
  Angry Birds King Pig/data/shaders/GL2/commons/uniforms.sh
- Size 799B
- SHA256 f7851b7eace13cefe5607e67d376735bce9069cac3a082e70335bcd78388c526
- MD5 25ec03ceef74ab60d4b7044f981d48b6
- SHA1 44e6ce047883d7d9e2958eb451cac064a7d70a30
- SHA512 389d77f9bea6216d64365b464d53164e2f498c6825e77edb55e6b9ebfaeba77f9053ea7d4e69fe7d812b68cc9ad8c377db029fee73aa9bd6ffc227ec8d6d52a0
- TLSH
  T173011241D20B93AC4B8C386174D721181BA7C4ED45C7C35B2CC2722521D63D6F26A3DB
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral7
- Target
  Angry Birds King Pig/data/shaders/GL2/commons/varyings.sh
- Size 616B
- SHA256 41768c5422da4005ad0b3fcbe9ffda47d9213311127702791f9d30c735a37eeb
- MD5 3147e3a6a7cfabbc9d9ed93bac7ab9ed
- SHA1 1f60d4d875a77c95be5203a6323b138a9fa829da
- SHA512 29ea6257446a736671df3e1d9abd557f6b83eb7b046c55b79a5cba244dc7fe56f639e7d21ef84488195664ec5ff535fd35bdc2b06652ef43539c5ce6b67befc8
- TLSH
  T13CF03632403598EC354502F5F614652790DEA6C566BCB37E781FFFE93704D0506E982C
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral8
- Target
  Angry Birds King Pig/msvcp100.dll
- Size 411KB
- SHA256 b2ad109c15eaa92079582787b7772ba0a2f034f7d075907ff87028df0eaea671
- MD5 bc83108b18756547013ed443b8cdb31b
- SHA1 79bcaad3714433e01c7f153b05b781f8d7cb318d
- SHA512 6e72b2d40e47567b3e506be474dafa7cacd0b53cd2c2d160c3b5384f2f461fc91bb5fdb614a351f628d4e516b3bbdabc2cc6d4cb4710970146d2938a687dd011
- SSDEEP 12288:Seb8zxr1aWPaHX7dGP5frhUgiW6QR7t5qv3Ooc8UHkC2e7wx:Seb8Fpa6aHX7dGP5Gv3Ooc8UHkC2ekx
- TLSH
  T1559428237A4649F5E1D223F46289932143F9FCA40721B3C3A2EFE1A99F583D56A33951
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral9
- Target
  Angry Birds King Pig/msvcr100.dll
- Size 755KB
- SHA256 8793353461826fbd48f25ea8b835be204b758ce7510db2af631b28850355bd18
- MD5 0e37fbfa79d349d672456923ec5fbbe3
- SHA1 4e880fc7625ccf8d9ca799d5b94ce2b1e7597335
- SHA512 2bea9bd528513a3c6a54beac25096ee200a4e6ccfc2a308ae9cfd1ad8738e2e2defd477d59db527a048e5e9a4fe1fc1d771701de14ef82b4dbcdc90df0387630
- SSDEEP 12288:nMmCy3nAgPAxN9ueqix/HEmxsvGrif8ZSy+rdQw2QRAtd74/vmYK6H3BVoe3z:MmCy3KxW3ixPEmxsvGrm8Z6r+JQPzV7z
- TLSH
  T1D3F49D11B692C073C1B221300629D7B25D7BB8711035946BBBD59F3E1FB47C1EA277AA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

UPX packed file

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10