4675751a10bee582bf639017f50a1e25e05b787a8c95bbd3656005c9bffb5ed5

Sharing

Copy URL Twitter E-mail

General

Target
Machine.Party-SteamRIP.com.rar
Size 492.4MB
Sample260806-cb476a1elb
SHA256 4675751a10bee582bf639017f50a1e25e05b787a8c95bbd3656005c9bffb5ed5
MD5 e04b5c85f1e1872d38dc1404fe10625f
SHA1 8bedc1b5459581c72cf66a3f103ba0c0a4693a29
SHA512 de6cc10eb5c9b8ea9ee6fc3b36b56418a6a9ddb75c0ff4b3a5fa020467a21b09ea3898fa670312c65285413c2d909f119e569634b8c548eeaff480e2c63baa0a
SSDEEP 12582912:jBfFDIsHzjziGQouCYR1ZlIJ4E4WR/sS0FUlY3EO2Yo0cF15:jBtHzj2NCYPZcV4G/sv0+8t
TLSH
T1583933A7534E39488E9223B1FB00F9F3724C11786B17CF44D49E5868BD4F7A84E68B69
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  Machine Party/Machine Party.exe
- Size 92.2MB
- SHA256 9acf6b8a57c82a46ae28c7840ae61edcfec0ca261b10cd818f55aa0e108fdeca
- MD5 5592e38a33d14a97860e3ebe2e99c6cd
- SHA1 19581cdfb272af6a5d45b04b848e413c445e0d33
- SHA512 483a274c54de7439491a2aa76af9e0ee02cd08fc7f6b7ef6b48a25e1d41172e39127c53360648db92d03ddb04f305bc45d7f9674282a7deecf678d3552cbe8e0
- SSDEEP 786432:+sXZHd3M0mrG9WTZ1xK1J5ZppGdWhuyb0L4C:TpHd3ZmrGAcXpNuyb0V
- TLSH
  T141284B07F2A370ECC46BF1309F7BA672BA71B85911386D6B5692CB302F61E10576DE18
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  Machine Party/OnlineFix.url
- Size 46B
- SHA256 3cb526cccccc54af4c006fff00d1f48f830d08cdd4a2f21213856065666ef38e
- MD5 59bf167dc52a52f6e45f418f8c73ffa1
- SHA1 fa006950a6a971e89d4a1c23070d458a30463999
- SHA512 00005820f0418d4a3b802de4a7055475c88d79c2ee3ebfa580b7ae66a12c6966e5b092a02dc0f40db0fd3b821ea28d4aec14d7d404ead4ea88dc54a1815ffe26
- MD5 SHA1 SHA512
Score

1^/10
behavioral3 behavioral4
- Target
  Machine Party/OnlineFix64.dll
- Size 12.8MB
- SHA256 ae23f76254fbcd88d36ff5d15f958708638cb63e6cebdc1d30247aa559c2340f
- MD5 0fe9abef0db903d05b11dca762fcd35b
- SHA1 41bafe6a9bac5b9baff6acbfb61093d075bc5248
- SHA512 a08c8b07a5c933ef162e37efc29728290a04c5b4ce94d453048a176b50b95eec5ffe72baeaa23d1d97aa415cfb72dc81d19526bfb7fe2e4ad71d2a20cbb3f7bf
- SSDEEP 196608:RBaZquxob+fHgdbRUf/kUiuJVZlTMWLgKjPId+LvApzm30aUJfc0FnglAw65P29b:R3ugRQx1hq5IAdLaEaUJQQMjq
- TLSH
  T159D6129569D497BCC4418578E24516FCF0D57C898CF9882AFFCB48213EB0C99C8B6BB6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  Machine Party/SteamOverlay64.dll
- Size 114KB
- SHA256 f784b4b85b627c7ea541bd2a90c9fc6e9736a0731707c31265aa86fe684dc2df
- MD5 0a5429b888c75f6525e1100e32dd2b69
- SHA1 8ae224580aa0838a7b1570c79d4d8f27a1b46d19
- SHA512 5f77ac9619ccb5baebabb2e406ce265148ad18c6e1162c7d4c3a5656f38abedf90f756a829da856312689a738a3258382f37a279843bf7db0c14ac953c6992ef
- SSDEEP 1536:h1iaPnCtV4+1/IGiaA7bSMhP3rOy843NxnpWJtRsWkd09dl38s6BtcBRXh4:h1iaPn5+uGi/7bpxaX43Ni3aMLJB1h
- TLSH
  T163B34A5B73E500BBE0768239C8A71A15D376B8110760DBEF03A0466A1F277E19D3EF62
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  Machine Party/libaudio_gate.windows.release.x86_64.dll
- Size 1.5MB
- SHA256 c3b3c25d89ff8681ed5e447a29733d4a1be203ba279e73a0339c51f1c8967c20
- MD5 d693ad2de99f3151223982e7cbde1366
- SHA1 8c12858f6ca63098b68331120995e0df007fd648
- SHA512 ce91dcb9cf7177cab16014a68ecb411a8337984efedee9b6dd86f7dbb745013139bfae1d29d51b981d0cbf78219a0adf914037c1303f55ec43540f652364b821
- SSDEEP 24576:vtk/vwxKU6hb355NbUAtCCqbHB241i8dhxXuvx4PQpqHnT:vuhxx6d2Gi8dhxXUqH
- TLSH
  T1B2654A1BE26358EDD97BC270C25B6673B970BC614A24E92E2F44DB352F31E60065EF24
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  Machine Party/libgodotsteam.windows.template_release.x86_64.dll
- Size 1.9MB
- SHA256 bcc918085496050d68610d4433f25460689cf110ab915b37f2a7d63a41b95c86
- MD5 15c4b1991b8818cd2811268d95c4f8ad
- SHA1 e2dd7877a3f6e0b110a35ba0c174eaa96f916c6c
- SHA512 f197ee9a1c30f03f6409c7611b326c80832ced908819ae10e0551c6996b415cbbe27b31d029e8cc00d39f382b4fb61e0fe52c24ab5e360d742424a75e753fa5c
- SSDEEP 24576:I4x4HWMInf4JtBidolBdcqznzJukgzH7CP+REFR2tyB7TVsIXrgob71itwjo:D4HWMIna9gzH77mb2sB/VsIbgSyc
- TLSH
  T17F950747631043A8D616D2FACE631216F6B0785CF339BAF78DA55D091F27BE0993AB04
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  Machine Party/steam-multiplayer-peer.windows.template_release.x86_64.dll
- Size 410KB
- SHA256 7e251c0bd48a4315bee373f589775008d7027fcdf6ae42089cc58c4baef55bdd
- MD5 7d35e0678c12c2ae2e1c8a358d730fd8
- SHA1 96c4334bb2c6994c3c5a5a9b5fe04e98949d1cc1
- SHA512 ab7742b1bbce6e55170d532010725b4113fdf232c3ff6ba6e6384c73346816e27c78e6b5a4ea266d5417b87a167e1b11c3149dc225efe1b2f196990b01a11651
- SSDEEP 6144:eGjJFZFHXFlxcLSotEjq/UOLgSFL5HtAmJHsv8IXEVJ+KhdRPP+wNNfbHBf:eKYtNLguHzJAFXE/+4RP9RR
- TLSH
  T1B4945B69FB005AB8D437E138C6830906E9F538C993B18AEF03A9455E4F63BE1573EB45
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  Machine Party/steam_api64.dll
- Size 294KB
- SHA256 9d6d2972c1571a2a058d79a8376e26a33d33813f29d93c3ca6e35adaddcd56de
- MD5 36f023155d9357e4c9c61af2e340abfe
- SHA1 48a9b3fd2670bb743e366da9203238a4fc69f903
- SHA512 6c13fa116eabbb6a1fbe9b5f8625910208a44c41103f9407a093328d00a682cb8a96d39356b76439b432b9b63f216288b044ecd1097ffc34c7f1bcd68f79e886
- SSDEEP 3072:M1mXZxtdMVhdbt9OFeX9qctF+nlD7Zh+iJba+RFSME5lhTbCCwGY2dbvIQEkyI+c:MMZTqJEK9TtF0hZI8Rsxvy4O2CH4SDKH
- TLSH
  T10154597AA2750CF4D076C13988565E0FF6B1745B23219EFF226053368E57AC21E3BBA1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  Machine Party/winmm.dll
- Size 490KB
- SHA256 063a8d5e57cd760a8eafb3573146cc97e18180412a5a0efc23614e23dc1a2568
- MD5 3fb1fae80a788ffd42b7f7047bc0903d
- SHA1 079be776a6618e43865bb4c033e119fcb7ae3306
- SHA512 08f994f0f4e8f268e77d29556eef805cb3405862fa9986c7e7dd15d5257e2d7366a4e77e07d6a4ba693fc2bc53be0f13eb36a5ee36b8e1dd2d05a8c394f14221
- SSDEEP 6144:zz01cAnrjsEtjiT5BZhK6H8jEY6tbNUvvJgVGs3YUlXULmyU1vwjmvy:vecAnrJjefK6c5vqVGGNXULmJvmk
- TLSH
  T178B48F19A2A842B9E567E178C9430A07E7B1BC464761D7CF03E09BBB2F277E0563E351
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  STEAMRIP » Free Pre-installed Steam Games.url
- Size 219B
- SHA256 4572f3812daf7bcd347d1a36834c5a9fec1f530093adf688a6ecd9e6092cbf76
- MD5 bb3af69a2e7704bc210886920ff7681f
- SHA1 42fa4a09d62cce1c0d70a63e0816135fd6b410e3
- SHA512 4f86d06f06859ed87d5f5353de9971c118477c956a8e0e0019b275f6eb035b2841c7cb959c9f4823a599ca7e73f6a0ed320207d917e8f4ab2a9b20e732551839
- TLSH
  T119D0A9BA0B58900AD321C81AE030BC08E44E75568CDED0B932C4CA8A4D96481C8A6BA8
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  _CommonRedist/VisualCppRedist_AIO_x86_x64.exe
- Size 30.1MB
- SHA256 3c188e4651bcc07df2bdb06d69585158797b1bafb91557b09217621628cd5b23
- MD5 1a7523d92b573859df4cbe8e75509b9e
- SHA1 65b0ccf1fe1f23c4a0557b8a30251cc7e70a1f73
- SHA512 f7c684c00265402876a4159869774096090c7482358fa1882a50468c89483c9a30066667418d510dcc5b9780fbdfd1bcc6672f92ec53cb933c0b36292c6ec40b
- SSDEEP 786432:4JVdGL3z5NXeyQIwJtNYUJwif0nOJa9WEWRIOG5B7DVGLhYNBFv3cnZCa:gjOLXelIMjJwi0wMVW6n7ShYWCa
- TLSH
  T10E6733B51858C4B8E7E0B1F00807F5E1769AF9BCE9C5CC46B1F4BC99A19E4618FE612C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery execution persistence ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral21 behavioral22
- Target
  _CommonRedist/dotNetFx40_Full_setup.exe
- Size 868KB
- SHA256 fa1afff978325f8818ce3a559d67a58297d9154674de7fd8eb03656d93104425
- MD5 53406e9988306cbd4537677c5336aba4
- SHA1 06becadb92a5fcca2529c0b93687c2a0c6d0d610
- SHA512 4f89da81b5a3800aa16ff33cc4a42dbb17d4c698a5e2983b88c32738decb57e3088a1da444ad0ec0d745c3c6b6b8b9b86d3f19909142f9e51f513748c0274a99
- SSDEEP 24576:+tW4x8xAxCdUcyezFSjaBHFaNlsqK5/oh6iZf1LUXw/vxNI:d4x8xqCGexm8FCspg0iZf1LUXD
- TLSH
  T1F2151232ABA0C133D4DB28B48ADDB6B2657DE6610374C4C7B7440BEEAC307D1697964B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Executes dropped EXE
- Loads dropped DLL
behavioral23 behavioral24
- Target
  _CommonRedist/dxwebsetup.exe
- Size 288KB
- SHA256 2cf71d098c608c56e07f4655855a886c3102553f648df88458df616b26fd612f
- MD5 2cbd6ad183914a0c554f0739069e77d7
- SHA1 7bf35f2afca666078db35ca95130beb2e3782212
- SHA512 ff1af2d2a883865f2412dddcd68006d1907a719fe833319c833f897c93ee750bac494c0991170dc1cf726b3f0406707daa361d06568cd610eeb4ed1d9c0fbb10
- SSDEEP 6144:kWK8fc2liXmrLxcdRDLiH1vVRGVOhMp421/7YQV:VcvgLARDI1KIOzO0
- TLSH
  T19654F15197E4817BE4FA1B311DF2025327797DE86CB9E32E838658881D71780BE35B27
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery persistence
- Adds Run key to start application
  persistence
- Drops file in System32 directory
behavioral25 behavioral26
- Target
  _CommonRedist/oalinst.exe
- Size 790KB
- SHA256 b8f39714d41e009f75efb183c37100f2cbabb71784bbd243be881ac5b42d86fd
- MD5 694f54bd227916b89fc3eb1db53f0685
- SHA1 21fdc367291bbef14dac27925cae698d3928eead
- SHA512 55bc0de75a7f27f11eb8f4ee8c9934dfe1acd044d8b7b2151c506bdcbead3ab179df7023f699c9139c77541bbc4b1c0657e93c34a6bc4309b665c6cb7636a7e5
- SSDEEP 12288:0s1yfEcpPzdv+t4cRIy3ze3SUN0PXGTjiqRy2p3kwzjGHTkV:NwfLrvi4cRIyDe3SUNaXy+WypoGHgV
- TLSH
  T1E005F10020D5CC73E4EB32B3843586746EBA7E912F0A285B7FC476AEE673176DA71215
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops file in System32 directory
behavioral27 behavioral28
- Target
  _CommonRedist/xnafx40_redist.msi
- Size 6.7MB
- SHA256 47260420773a20443fb1e38a89b7f39c5237a80a842de598e6c8f7f90a3bbd6d
- MD5 ff1c0202ab7147c9dfd34b582f1da13f
- SHA1 5fc95a9ad87a38e71a953af116fd1f1cbe46a3e7
- SHA512 9a233fd33fa535d0783ac4a97108166b860d7647998ce184e6e5103200a6c8522a5e4d035b85e02280f5176c092e0d3e61a60f228d7ca17f09fcf2fc5cdf5253
- SSDEEP 98304:synfL329J1XswfXO6wiBB+4RZg6aENaCZAU5PMO0MntfERyJGH2YPq/:sYD3C1XXfzH+4cLHU5PM/Mnt+YGlq
- TLSH
  T1D06622A2751AFF41DDB406FCD970CA490925CF3B82274C686929356A7BF7E0202E9D4F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery persistence privilege_escalation ransomware
- Executes dropped EXE
- Loads dropped DLL
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral29 behavioral30