7d299347477cd89198b0a6903fe48320d4b1ebbb4171f48016af1599ee3ccf8f

Sharing

Copy URL Twitter E-mail

General

Target
Data.Center.v1.0.49.1.ALL.DLC.zip
Size 722.2MB
Sample260804-xa3m6axfjb
SHA256 7d299347477cd89198b0a6903fe48320d4b1ebbb4171f48016af1599ee3ccf8f
MD5 062cc206821786c803cd9a2ca83bca2c
SHA1 191994192152c498be16558fbbfadfd4cb19b5ee
SHA512 d2d653c7c9fbb507e9c887fe374712a4604be894e658868bea52cc4faefac97fed78c9fb456d47ea0ccfd6b8419303ee2c411fb2299d20dad4501d1caabd282d
SSDEEP 12582912:bIhWR9fL/eM/oozFz0jvLQGabU2lcJ6iV927oWQfERNMMYRBwfpIngrpnKRbiEBH:Ky5H/NRGQG8uJ6iV9PNfEjNABoICnKRx
TLSH
T19A793347C2CD5A0FE8562034C8357D867B2AA434A7ED8DE3921ADDB81633BE1957EF01
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Data.Center.v1.0.49.1.ALL.DLC/Data.Center.v1.0.49.1.ALL.DLC/AMDUnityPlugin.dll
- Size 8.4MB
- SHA256 79806d54ac7090548f1da6be63b685b3b96eb195dd4cc06ee319796d8a08dfe5
- MD5 0c48263b435625e399b9caca757f4b0a
- SHA1 744740be0ce5152f8749d8ff8d077a4293606feb
- SHA512 74364d1961f095034580a086316dd2c1bcd78848d53f441bc9a368a4acb08808c12f7934786c0b2bc2d2606aa6efc1d14aceb716a89182056fb4d1b00e1b1479
- SSDEEP 24576:a9YGO5tRVBMrHCKUtGtnEq5J2GJ94zBoHgme2WQWKf6+zji8mx4qpHmmrYThq14Y:a6VBM+0tThJC+MIF4Lw/Dlt6SZGn0G
- TLSH
  T16396D61BE7619F36C46D427E88EB5760B336D0689FE30AD3115CB1383D923E959B21AC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2
- Target
  Data.Center.v1.0.49.1.ALL.DLC/Data.Center.v1.0.49.1.ALL.DLC/D3D12/D3D12Core.dll
- Size 4.5MB
- SHA256 625bd40005b1c3708695d5256ecf230d278e6b8edba5a88af70f3d91324f3052
- MD5 8bed03240b764906c937c0d6ccd560ac
- SHA1 2a38a4d7116b9d067e9d24d7da2646e2fc9f61c6
- SHA512 6fce3c735a101794634c53fd622be20e69e75c68ba216d0caa0fb48aadf97ed55ceb6ef205a4ea22f405bf5e663638add2f489df720c206739920093479863a7
- SSDEEP 49152:+h38HT1tnrx7KGN6McyBTwbreXHYTNeZQROL+qgGVO9EflU7slMWr+IGrh4TeeYo:IMBxrfwNFrfau5e/H
- TLSH
  T1B1266C07BBA840E8D4A6C079CA6B461FE7B278654370E7CB169087995F73BE1193F324
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3 behavioral4
- Target
  Data.Center.v1.0.49.1.ALL.DLC/Data.Center.v1.0.49.1.ALL.DLC/Data Center.exe
- Size 652KB
- SHA256 aa1e3a13877ab6a032bd4c289402e4c49e7842fe79895903111ae2f2f5a231e4
- MD5 4c9cc406a76ba3c3c920d3d07322d6df
- SHA1 2d57733088b7e7933afbd78ef3b1751942ad4d3e
- SHA512 584598ce07328995a3f9d7ffb751407e55541a72a4dc0bf18e835ab28e4db6f8025ca19c3fdf42533996c3e38682f5fb4409c3476ddfa99c8cf5f7654a35711e
- SSDEEP 6144:TaMjvuUwZp0UhLE+Y3Sx3YwYyMm3onUEWfg+xkvO3PxIuL:TtVwZpFhHYChYwYyM8pE3IhL
- TLSH
  T146E47B03FC886FE5DAF08D31C1F6A06A43746452EB4C478BEA640F66BDB54986F16B34
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral5 behavioral6
- Target
  Data.Center.v1.0.49.1.ALL.DLC/Data.Center.v1.0.49.1.ALL.DLC/Data Center_Data/Plugins/ARM64/AppUINativePlugin.dll
- Size 52KB
- SHA256 aa5481f1838e3392757a8661927fd61a90417491f17a9a24d753be0dfd62c9ad
- MD5 086ebdd2cda5ce7d7e3537168cfe1259
- SHA1 0f29c535d83619393c1be7a8cddb98080dbe324f
- SHA512 14057ea992004a6abf04182614e72c1133f4ddd265de495b9bd9a2ac4dbb8ff65b00851ffca9241042ddf22096c525151b107888f5bdc995035b1074c5a160f0
- SSDEEP 768:z/M3/Io9c3JM6/j560HdVhAuxiJexaEq4hQDSKsDTarhYiCGV5AL2:z/EH9f4dzVfEIaEBhQDSKsDch7L
- TLSH
  T163332BC17BC8AC46D5DBD33C9C968A68323BF6698961C1877327031DDE997E19BE00D2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral7 behavioral8
- Target
  Data.Center.v1.0.49.1.ALL.DLC/Data.Center.v1.0.49.1.ALL.DLC/Data Center_Data/Plugins/x86_64/AppUINativePlugin.dll
- Size 50KB
- SHA256 f2227af57d2c01cae8a2ec2d14bc5b32c4c2ff163b4be22db26e2397e22ebbf5
- MD5 8179058ae34c5128483c3f4c18c945c5
- SHA1 30d6b44aaf9906da3136d22d3386f50c69b02cd5
- SHA512 9ee3ef4791de79fa149d1c009a8f78dfdaa5b3896031ce7dafdf9be5c36703034a9051ca4051c7c4821d7b3d0145f04f58d041a2b761b3f3167ef6b4e9809852
- SSDEEP 768:iBxojjFEImNm3Ailz2AuG2+oRx40/qiN0X7O9CI6raYixKfX5AL:cxqdVXun+o40/XN0X7O9L6W7o
- TLSH
  T1AE336C42A6E146E8C866923CD8E79E18EE7174145BB183CF5330431E1FB27E15FBEA85
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral10 behavioral9
- Target
  Data.Center.v1.0.49.1.ALL.DLC/Data.Center.v1.0.49.1.ALL.DLC/Data Center_Data/Plugins/x86_64/lib_burst_generated.dll
- Size 2.5MB
- SHA256 a3043b86c1316a7c852557d0332bfb050a215d34efe2561b3f8d837856a789b7
- MD5 9b5f081c8a41d42d0838d18313a84e93
- SHA1 a1d16afe9b8d465c1668fe8fa7476ba6678579bd
- SHA512 4e58463772a5892c2f8dc6d045ef578b1ba93be3cbfddddcb9564ff60fd2e3027365affcf85ec4bcbe5bf18c76992e766160fbb24cb4f7cf773ca053daec6718
- SSDEEP 24576:TOzB1CjBRv/Q1tpgOHRDbRLMXwIDkMpLVbPVrAMstdwJD+6KxQL5PgYp+ECPM6Xa:Tz/Q5JIwINhbPp1s2Dnq2q+w
- TLSH
  T19BC56C3972A2A0BDC02EC0B4671EAA77E6233C4A1B605DF751E544B33EE1DD51E7C628
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  Data.Center.v1.0.49.1.ALL.DLC/Data.Center.v1.0.49.1.ALL.DLC/Data Center_Data/Plugins/x86_64/libonigwrap.dll
- Size 538KB
- SHA256 6d539f2ad6e1b58d3c8836b9c3a1d50c97cbd7a6ca0c5de25d994a7c4b1ecf42
- MD5 ab2bd6d029d63fcf779f2032af98a5f8
- SHA1 28b1fd59b714d81bcfb353d1f2ae5cd4a9190656
- SHA512 7ca95bf475dd49069c0accfee0f41783824bc2e521ac7238f7a20aa1c04896b629c82d9518715e9193597f7efeab46f27cf3b2cdb382817ea58752abf07ccc05
- SSDEEP 12288:cGDjNa62yL+/RrsXdgcTE33T8Hhvrol87WruRGS2:cGDj9ZeYdDEIrolQx2
- TLSH
  T1D7C4C503FEC3DBA9C1AE4970C896D3F52136EC605A108E572358BE37BD626205FD962D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  Data.Center.v1.0.49.1.ALL.DLC/Data.Center.v1.0.49.1.ALL.DLC/Data Center_Data/Plugins/x86_64/steam_api64.dll
- Size 960KB
- SHA256 78d775496337e6703604f390fed06f52827f17fd030bc7f69a2dc735ab1f8db1
- MD5 bd0070202c2204db83d7821af2ce25da
- SHA1 821e298d63d2b4a52c7d14bc722f6ea04f59323d
- SHA512 dc00a215ef9a26fa2562fd8d38a8d1fd468248893a43f831dd13c9408e7ba22d2cd59701ce1452b4b796424a938fa9f2bacffb0f8c90f46c65e7cdb075c81d1d
- SSDEEP 24576:JpbGG325KVB+kOj1FJYUjrw2/7k8/48Q1QNnrlcMyJfCp:uGwKVw5DYUXRgR1QZrlIfCp
- TLSH
  T11125127A602B1EF8D4B6C4719D563E0F7990018F31515CBE7A808932C6878876FB7ADB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  Data.Center.v1.0.49.1.ALL.DLC/Data.Center.v1.0.49.1.ALL.DLC/Data Center_Data/Plugins/x86_64/steam_api64.rne
- Size 288KB
- SHA256 4df999c0c8cb12589f0864d52be5d4c775577aeb27fee28b49b188f9ba083eea
- MD5 500475b20083ccdc64f12d238cab687a
- SHA1 b13f17561a9a0671befbebf0aae7b51bcc0072df
- SHA512 de926d38118c808cde4d3a8f6fde7b56b755ef7938b9adadf0efaac45c853f3d19f4cdd5906b02a7dcca7d2c38b8c01cbd401ce3a7f5e3f9221776f0ed49355b
- SSDEEP 3072:ujTqkh2mB9mkVi635gRaeaZqk4YJDf32uB+rJFC9R+5z65lhTbCz+hnv91vFAyNp:Gb9mZOB3Zx4YUuoaRRFAymC2CPzbN
- TLSH
  T13C545A7AA2710CF4D076C13A88565E0FF670744B23629EFF2A6053369E676C21E3B791
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  Data.Center.v1.0.49.1.ALL.DLC/Data.Center.v1.0.49.1.ALL.DLC/baselib.dll
- Size 233KB
- SHA256 df9a9af64cb5de377fd52c623fb4f150b3de514174a547d6c3f89f87771cdf0d
- MD5 ddb0e71f2fd3bc49174dd1a7919c80fa
- SHA1 0f47d731257517afc7711cacdd7cc74062a35abd
- SHA512 66738eba0f9cf27db882d835aaa7ee479f11245851c4a086627ac0b9eaba99da446d901d71e84e82a81f7d9a4a6886f6caba75f99cf39f8e3ea28e54365d12ee
- SSDEEP 3072:OA6C9vPJ6yHlMPuplt90vtE5NajsutMKlDNM6aFsxndw0skOYdNzh:OA6O3lMPi0vtQmxCkLB
- TLSH
  T17E347D4572A01DA6FDB741B4CD531A1AE67238034780CACF53A443A5EF6BBD06A3F762
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral19 behavioral20

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20