dd2ad783f245136d51fac42914678511524ab02f44701d13c3428e4fd7668bea

Sharing

Copy URL Twitter E-mail

General

Target
Mini-Metro-Steamrip.com.rar
Size 238.6MB
Sample260806-la724asvbx
SHA256 dd2ad783f245136d51fac42914678511524ab02f44701d13c3428e4fd7668bea
MD5 e4f6903bc3c494c690bb85feb248b3ab
SHA1 b605288a45820e478613715bdf6a46593390b590
SHA512 24979d2c04043c7d48b4e97713e8de6f4b15d45a192237fb30d1f08d0a9a4a1da1a8396ffe5321d46a438eef40890726e0c27cbeb48c5ea9748bba6f80e693e7
SSDEEP 3145728:L/nnk5iQtK62SHh8ZiQHdHhhMRBg5hcihqXXGfFDf9gpL3jAmc0EVYWqZqq2r0kx:CY6WZiQHdM45hDdDfeHcYYq2qK8iC72p
TLSH
T1D4C833C75AC340DBCED2FC330515039FBEF106A6AEA36567B83E27DA06B55D93209864
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Mini Metro/Galaxy.dll
- Size 4.1MB
- SHA256 f2a28e0b7856ea81f1901150e0b1f8d406906decbb856071f66df806c57afb85
- MD5 ee879a1a7b87125455ef49e1d9fb7ab0
- SHA1 a3121b94d2affbc19e711d805418cb202993c103
- SHA512 e6d257bbbff28412124d9095f1eb8b5515fc12ba2001d40c920834f1ce58206264d37247f73d51d2cadd74b3493d7fe3beb38a891cd294d5ce0d99a343999019
- SSDEEP 98304:Vjge6D7Agewe/0h89KGXRrd6sBoMZStoZdMXRgZ05:flRbLEtoZdMXRgZ05
- TLSH
  T14B168D21BF41C236EACE02BBD9FEAB6F4D2E8651072C46C7925C1E495E702D32E35587
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2
- Target
  Mini Metro/Launch Mini Metro.lnk
- Size 822B
- SHA256 fbf414831920ed97cd6b669a766955a715c82e3c8e039f72a5e8c3d5bb9bcb37
- MD5 ee279eddb3838bf61fcfed36bcfa8e1b
- SHA1 513f80eb1bb50f3d50b87ebfa7542332b229491f
- SHA512 d2a4a5785e9cb1daeea31840a3dbe9e18753a16c59666a95752697861de9f312fafc1a9961601b59096b84264c4422e86ccdabc29dc176a32a07cb6bfe2eb66f
- TLSH
  T167019E1047E21B0AF1E2D3BA53B26F119BA37B62D232472F24A812044D2520DDE2CF6F
- MD5 SHA1 SHA512 TLSH
Score

7^/10

discovery execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral3 behavioral4
- Target
  Mini Metro/Mini Metro.exe
- Size 626KB
- SHA256 b4ca1aa0430a826b1668b45448ff6ad2ca6b5245e50f0e0b82336dd128979d61
- MD5 2ab3c4cf754d152de8328cd0806c8995
- SHA1 5f632c468667c25bdc04f6e81364642cd15fd934
- SHA512 9b619b76279d1e53ce613c64dda14648d9b00f300f71090988e79b416fe01dc0919831804c65945a49274456bfebaf3c5c13d0b5425594140b0ae14f34693c78
- SSDEEP 12288:tqA3u5YZoK2Btttttttt31ttttqttt7DqVcs:tqwF2tODq6
- TLSH
  T172D48D8AB6A3674CDC558CF504BD8660C2675DF6E909C72D129E3ABEED029B3CE11313
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion discovery spyware trojan adware persistence
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral5 behavioral6
- Target
  Mini Metro/Mini Metro_Data/Managed/Assembly-CSharp.dll
- Size 2.1MB
- SHA256 a6cb2da28fa10fb25d856620149381e2cfbfad8a8a85331134e238bd82f7fcc4
- MD5 bec2ff08816569d51ff9deb5bd08d7b7
- SHA1 4a292b6f36b03d9eaae4e1a2f61db08208b81122
- SHA512 6dfb05ad29c2ea0c502dae7c53510277d2e890216fdfd54b6044ae8871fdfe2280994f0f13e35eacd51b93b96e9e12b3a05ba1c19070386051fb2da07ffd79d0
- SSDEEP 24576:JXDhFtNUK8AGOEzafRy1u97gmYFVYermycQf0KLWpCzmC9TQ:JXDhFtNrRyGXmmUswzmC9TQ
- TLSH
  T171A5498273F88D6AE1BF1B31A0B5952993F0F8C9D761D78E562079FD2E92B015C06363
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  Mini Metro/Mini Metro_Data/Managed/Mono.Posix.dll
- Size 207KB
- SHA256 a33abceffeaa6b6d5dbd2cf77210daddfe331ed40eeae4cea3c5efb0c0db2cc0
- MD5 72c9ea78101c493635c0f763d1795d7a
- SHA1 c04e331b6415bf566e1aa26550bf794651704c7c
- SHA512 4dcc9495000f0cb0d93381a466f8d0553c2f9ef9521ac71979371b5eded37a25224a861ccc101a24b0b2741d30efb71d81d03fa00ca476bf8339c1786d9c46f2
- SSDEEP 6144:9c9wE0Q11JQ1S+OWMYU7nUXxOwblnsAPe+Eg:9c9wE0Q11JQE+kY1SA1
- TLSH
  T18C245C5457B44609E29D6738F8732F098379F88E7E13A39D3799EB391877BC488016A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral10 behavioral9
- Target
  Mini Metro/Mini Metro_Data/Managed/Mono.Security.dll
- Size 302KB
- SHA256 2b7651b398dc63af0dbc0038758981c29238a495681a7ed487357a464ad4de15
- MD5 d1b792d07b0e08ef190eb6ef5361e6f3
- SHA1 36890188d80598132d63561ded707e641282f2a1
- SHA512 1229d49068401a078b81ee398524327ccdebcd2fb6134c980d643b76f075244f2670d0773aa35027aa8b8d40ad6c29f16a223b142f3a6595c3641c32c8c31215
- SSDEEP 6144:+JvWNTGENjTzSQfGFzPTzcyaksosrNn95tq:fmFz9mN
- TLSH
  T1C664492923E8632AE2EF9779D071441647F4F506BEA7EB4E5C8250FC2C437929811BB7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  Mini Metro/Mini Metro_Data/Managed/System.Configuration.dll
- Size 122KB
- SHA256 cd5793957604e1448443da0d703f29a31100d4a7030c140121c7ddf6b2027d94
- MD5 d0a550f30b09ac8e5f49ad6d7daab4c4
- SHA1 d502b45d880866d8608a5795033390ffde6df6a1
- SHA512 e24f1d15a5017ac034a52bb8e3466912199b45d75f0d3e4b03d3ed604bdf67f1109a75660ed22c1219973c5c6b3f33692777112fbdf14b5597ef967ecea395da
- SSDEEP 3072:JH3xt3GrHyTALVXzA4k8y3Kpn5WJzL0MIeZH4+:JH3DcSTSVDMJM
- TLSH
  T12EC3F82563EC876BE6EF277AF8B514100FF1FA0A6436D74C5D99B0ED1823B804662763
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral13 behavioral14
- Target
  Mini Metro/Mini Metro_Data/Managed/System.Core.dll
- Size 1021KB
- SHA256 d982f54622edc2ed4637fe547b70907f589a2ae4de4b6d604c54ee35f97dca03
- MD5 ee54cdd0260259a087442949da49f50a
- SHA1 49aafc2caeb908ccc8f8598414a317cc2cebf9c2
- SHA512 09af08ef2c72dea7ccf440e168a684e35bca1eba96d6276e8a3855be270ee8c91b92869b415622679f6dea95c29b096001b756d1ca7c58dff98a3b666a9e56d4
- SSDEEP 12288:GDQR1+Dy+BcB5Qud7DfVsL9KVI36owJKbYvB54wkHXdt:bn+BE5jVsEWIWYvB5
- TLSH
  T1DF253A5277D95A2BD5BF7BB7A038022057F2FC639FBAD70F124069690C62B40DE543A2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral15 behavioral16
- Target
  Mini Metro/Mini Metro_Data/Managed/System.Security.dll
- Size 180KB
- SHA256 c931417eb4690730438d7c93d1cf6e1864695d8d90a5833fe83298802a84ee58
- MD5 915fb88087c6ce36daa02bca9daff3dc
- SHA1 ce5bb0edb6e50c70b0cf188dd875c257da76e627
- SHA512 07c4a7d5a656bbef00deae0b814be51eba0348e678f562a78881a81b9850605838d9061341904e8d0ad13ebb47c09d2d7023de1607f8cd8f1d97b83b6260ce58
- SSDEEP 3072:Xr8JG/QlTReXnVzW72nDLR1RNdxz9nI/K6ZoedXHpnZQeU1GGeEebgUKFzODhSK0:Xr8JpeXnVzW72nDLhZz9J4oQJZQeBGeR
- TLSH
  T164040824B7E84319FAFE577DE0B411065AB1FD06BA7ADB5D0E9112ED0872F808812B77
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral17 behavioral18
- Target
  Mini Metro/Mini Metro_Data/Managed/System.Xml.dll
- Size 3.0MB
- SHA256 340ef89526404ea0a8161efcea85216efaae956f09fe28a01f565d40de38e683
- MD5 5fdd663f389f7f6e5daad28de3adfa7e
- SHA1 8005284d37619470874c99383202d0fb135c9f8d
- SHA512 e5cfd590bd1c95fee61d3c6ee0ab3685ea0812e1046022c163e3e5463af0d2f4187d208e3925ba90717e35fadf030a4d994a3fcfe5fb9ee2b50b576d3898b0ba
- SSDEEP 49152:G6V0g55GkLfaEam1yJ6hT+Lq4BpqgAq7LyPYas38PXNtH7U8Yn:z0g55e6l+Lq4Bpqgv
- TLSH
  T101E53840B7F88E26E6BF7779A434522547F2FC09FBB6E75E6540E1B928627008C513A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  Mini Metro/Mini Metro_Data/Managed/System.dll
- Size 2.6MB
- SHA256 3890f3a0b81e8f915b8e07ba89f4a9830f480574ac147b23c6d338ca2f1ecb81
- MD5 1517a46d24e4ee3caf8fceb42b515758
- SHA1 7b5fc013f86d0f769ded17b1e3d908236a2db2b5
- SHA512 762682b541b39737c682e0d9a9eaa46fd96624c350e0ba1620124fb662da379373d1eb397e7268154ed2c3eef5dfd076fb86abdcc6aa97e541d897aac99d1ec9
- SSDEEP 49152:Na2TMRPYcHGxrA5k41BIuGRR96B7pUuzsc:gFPYCSs5kOI
- TLSH
  T174D51801B3F85E29F1FB3BB5AC7411610AB5FD4DBB72E60E5A01912E1C62B418D623B7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral21 behavioral22
- Target
  Mini Metro/Mini Metro_Data/Managed/UnityEngine.AIModule.dll
- Size 44KB
- SHA256 732ce59d5d85df21d338cb3b31c04b2ac7bd698798e1ad787319028fb7807c33
- MD5 0a9344ba9921d0bc1ecc345708cb2c9a
- SHA1 3819d9b821309553f95a07011a24c27cbcb4774f
- SHA512 aa3c4229e1c5cc8d3d1300e61b5f66e8ff80ecdf342e45fd475d6dcda024b55c5b2e9488411c82b9b171d2bab928fcbcc6182c38319e13724b27ebddfdc9f530
- SSDEEP 768:zbc5nUbjYVOMBemKv2pEq3zQWR8Br2WYq/woOJCqIghjkjhU:3c5UbjYVlcWM7rngoOJCqIghjkjhU
- TLSH
  T13A23F7BA6794C52BCC5E177AF03897302B70C2019253F795135D6178387B3AEA932EE9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  Mini Metro/Mini Metro_Data/Managed/UnityEngine.ARModule.dll
- Size 10KB
- SHA256 42469cd16381d8c9e0dbd6b91b4081668a40a230d56690faf5b8d4cb21adcefe
- MD5 9ba8f6c67235fc3b7940171a865e5eda
- SHA1 7b38caaea80855aaba9e59c692427f966aa99205
- SHA512 5a3512b9bc492b5135e65a19233ec7651227a7d2918155ae4449066ce0fc80b6342fce08318afc672521df26b63cd032179bbe4135b002260d9b954587fa7921
- SSDEEP 192:e+Dvaksmg+LmO97CqQD0ZUz2hjkjcjOpVs:e+qmg+yOJCqQDZz2hjkjcjOL
- TLSH
  T17A2298F17A84259BEC491F33D07993813990C027CEF2E61D468E22A4B47D1EEBE217A5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  Mini Metro/Mini Metro_Data/Managed/UnityEngine.AccessibilityModule.dll
- Size 12KB
- SHA256 79aa29c106ef366f9034a19357ea548ac8a81f35307f88ca9c933107ff5d1990
- MD5 284b55fc84ee30307235fe1102fc59cd
- SHA1 8b9e7d321ef2472c65d291af43d8faf6a5b07619
- SHA512 84acbb1112492a5560fb4f08f2acdcb9b06894174a8f59860e238acab5f2c850ae8e2576b18a2df6b298e9cef3bdac757e4dea646c046258ab82e7e0ccfb6f47
- SSDEEP 384:fx8oDJjLyPdo0VbSzCSOJCqQDZz2hjkjcjOL:fx8eJjWK0hSzBOJCqIghjkjhL
- TLSH
  T1B6422FF17785365BEC5A2F37943983803DA0C027DE72E2558ACE21A6B13E0DD7D217A4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral27 behavioral28
- Target
  Mini Metro/Mini Metro_Data/Managed/UnityEngine.AndroidJNIModule.dll
- Size 59KB
- SHA256 cbf8430799e14daeb954c08a6f865b3309ce3297806c5a8401becac058768cd0
- MD5 3915973f7b8dca687b6256ef23b55ff5
- SHA1 4192ce34be3ae494e6a3131fd7ce5574e3b23cf4
- SHA512 c2b8ab8bbe0865e3cff0147b72e5fbd491501d04ebf047fd17433c4e890f2b230d74e3a7010b3cd6198a9e924ac5afc9d8ca0df950e1e7754dcb99a748fd3e63
- SSDEEP 1536:k/uYH1jrQghgx2QSD8nEsKDOUPjRmES3GQVOJCqIghjkjho:AH1jQvzU7RmES3GQVO8y
- TLSH
  T19853E7F57BD89E02D06E0ABE64E602119330E9674173D309A689307A7E763DF6D24FE4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  Mini Metro/Mini Metro_Data/Managed/UnityEngine.AnimationModule.dll
- Size 146KB
- SHA256 a95fa16045f13e3498fbbc61fdd8b37ff1859d28b15d95fa7656469c917cd391
- MD5 33ef4b122e5e8d37f633fe09ec413be8
- SHA1 43008867c8a32c3e070d3f2263c7168d57d2d660
- SHA512 fbca4b387054273a534d6ae5059409ccf3d838491d760f5322dada756ad0b74326fc54ca1a93aa058c1e923607f10c7fa19593e1d91c28321fc92ea4ce7c01d5
- SSDEEP 3072:aaZcWVKs1Etk28xo22mEWnL432S9pE1IeaO82:Bqsi1jJWnL432S9pEv8
- TLSH
  T106E32AB45BA8544ACDDF237EF0A990116F38D0695137D3991628E1B81CAB348EB33B77
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Checks computer location settings

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32