ee85b1e78c1bbbb6567f509525d0f55f3db725e72ad61c398b5848c2fb208970

Sharing

Copy URL Twitter E-mail

General

Target
Client_Game_TTDL.zip
Size 12.8MB
Sample260807-wtly3stxev
SHA256 ee85b1e78c1bbbb6567f509525d0f55f3db725e72ad61c398b5848c2fb208970
MD5 5a7b6d850dad13ebd509947165d1dcad
SHA1 3f016119d861fdb70b208518aaab02dd0eb2a0e1
SHA512 2eb4162e4af8241bb391b3dcf64fa68f07db886cad4d7a1bda4c6ed45b4baf05f15fd7b8513ca89bc06360b2abd758a55e27c187d769a5802972b991ae1d0f69
SSDEEP 196608:sunvImrRnlQKTPnnF1PMgmPwSDGaUFpABOr/7XJ81UVeu63X6p94kknASyyb+NM2:uy/TPpmYbaUfMk/7XvV/ecWAvyblAL
TLSH
T14DD633E67B4340FFDF4C6E72261AE28A770E42954799048F871EC4FED061AA1056EECD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Client_Game_TTDL/TruyenThuyetDoLong/LauncherClient/CAI_DAT.bat
- Size 16KB
- SHA256 d41d54ed544a80968d0e906ad4a2472719687cd056492320bd38c3d6d13fabb9
- MD5 4fed1aaf79239ee91bcbfd5dbbcd0002
- SHA1 e3e95bad21cd71dbb3eee48ab7be70ce52746f0c
- SHA512 d7e6e5a413c7163b1355fa27ffe910f31256d731b50a47fb5db4c725d32dbe27776b0eaea9eb3690d5fc96296620243fa09b610b3c914d74891a10ac72d60a52
- SSDEEP 384:QRqSGzQeF63qwOh4dMEf7tpCO6u630BNy0ICpIQ/xODvNI5hl5p3eVD9sCDJY861:Qyh1O1pnPZ46hhm6sHJQ
- TLSH
  T10F7293033E0146068D70E6E05F7A4166EB4A8187833791D9306FB2AAB35F34B97ED7C9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware defense_evasion discovery execution spyware
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Loads dropped DLL
- Drops file in System32 directory
behavioral1 behavioral2
- Target
  Client_Game_TTDL/TruyenThuyetDoLong/LauncherClient/Flash32_11_4_402_265.ocx
- Size 9.2MB
- SHA256 f5829c373011d9bcf88e26829dc900eb4faac99b1a07511dc974ffe9080bd1f6
- MD5 c7d41058eeb57f425fbd1585f9de71c4
- SHA1 88fdd76afdc2a1198103e8f4dd416d54c3ab89d0
- SHA512 0492c58a37357d575ee17ce1a63fb07b7bf0b7876aa5d19d6eb5f568f740c50cbbb5af4c1ab686d57116f79dca99c8b9a01aeba704a59d1f2e3495e79dbc5f48
- SSDEEP 196608:+0iIptsRKRkW3pti7pCtfmsAq/8iRhOe/zoxKmVGOts2AGeusYOV:+0HptoK/5ts4fmHiRhOeLgKmVGOts2AR
- TLSH
  T1DBA6CF23A7D1C0B6D09324F15137B76FA9FC6B21077499CBABC05865AA703D1963A38F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral3 behavioral4
- Target
  Client_Game_TTDL/TruyenThuyetDoLong/LauncherClient/GO_CAI_DAT.bat
- Size 2KB
- SHA256 cf029ee66a839dddacc721b98ab3b3039533e64c2c4dee6d1fc45db38b0c781e
- MD5 aa786af1754519c1bd2d4018f3b2b590
- SHA1 05067ea1a79710971c2243320a340db16880cb09
- SHA512 7bb8e8c31ff3b3d1444e2c7c72320ba452e851e3e7f136c5061f449abdc45859d020a7c10f362b06b4d14e6cb615fe867bf672425d02f55bd8cd6a8ea5acff41
- TLSH
  T11551530239225E068570B5C0D97A99637BAC429796337DC6B6D33635B88D3D933B87C8
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral5 behavioral6
- Target
  Client_Game_TTDL/TruyenThuyetDoLong/LauncherClient/Start_Launcher.bat
- Size 4KB
- SHA256 f083a3a925281fbf546dae1a2e45b802322db786e581f2573847d51a1362578e
- MD5 41ac38742785ae17fcf3a619840d65a3
- SHA1 da7160875028d050f56c195394a6395c4ba5cb12
- SHA512 35ac86679e6c1b48334e1935e81b274b2eef5c4bb343e36e3bf9bdd19a400e2477c11e8b895f036a6b4eb42da729acbbf8621a84470c21e1039eefef360300bf
- SSDEEP 96:X1yv6cwuY6dY6ZNLKI/pqc5d+rtuBAu9e7dupUkmhmKh5uVhJr0J9N:Fc6cwv6u63Lfqc5dM1raULAdDJr0J9N
- TLSH
  T15BA173827D04C9268C75F4D0A8390807E79B41C76753D6F6316339A6760D6CF02BE6C7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral7 behavioral8
- Target
  Client_Game_TTDL/TruyenThuyetDoLong/LauncherClient/TruyenThuyetDoLong.exe
- Size 137KB
- SHA256 c317e10ca09cb8e8153663a64b64b17a21f668fee81b3767aef9ddb1a06ed4f2
- MD5 e529eb6f0763921403ba7e10170d45ee
- SHA1 a44c5b83d5af6832da30fd23de4fbd33fa1b6a6d
- SHA512 3bf0c5f98cb63cc5fb4c5d213977ac4fe1b9c666400cbdd313fff8b9e5c64b337b6604e7fc4a82d21b6ace29df5ad843a15d327c6f8febb6c6f95dbb803a5fa7
- SSDEEP 3072:+RsXUpu6A+BwtefO1E15OuXOqhdnKzR6b0jk6PGYreDH+wSzd:ODAow4f5pXOqhtA0oY6PGhfS
- TLSH
  T1D7D3123C2BE84A36CA694F37F62426279770ED09D221D1A7680CE4BD9F53A210D177DD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  Client_Game_TTDL/TruyenThuyetDoLong/ProjectorClient/FlashPlayer.exe
- Size 15.2MB
- SHA256 a4b333ac1da12026989549015303d82231982838bccfb544ba5fd188746066f0
- MD5 08c13d0cc4ccdac79b38821e846a53b7
- SHA1 7736efc1c76e6a80132a22e1f9fc87a5884fa375
- SHA512 87e953e053e249a5c202ff4639aee6fa5915b0b86e69ad5eee76d9091545aa4d201a8477d1c2525db9d3ebb053476cfd9ef31a8c7b232a4dcf84c2dd86f35860
- SSDEEP 393216:nZl05YflfxgkTVfdBL/tEJ1+lFj99e2xXX+QU9DrFkpBK:nZl05Yt+kTVTL/xlFVaPP
- TLSH
  T12EF69D23A60144B1C182217DCC3AEEAD617DAE15873415C753A47C1BAA72FC3AA3DB5F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  Client_Game_TTDL/TruyenThuyetDoLong/ProjectorClient/StartGame.bat
- Size 878B
- SHA256 d37d9c48915b35b10b9aa8e297fdf229cf0bca108cf9fe14388aaba77e3660e7
- MD5 467941e971d5cabf4f4a64099ff548fe
- SHA1 15a0e044e2c1efa27a1a488c29bdc5ac23f6d2f2
- SHA512 177d1ec9a12c063d3bc616a6c18e97535f45eff1bb5caf6801a79f1b8480bbb1059604389c16bfc312b6a5014c87da2f35ed8158e26a65db4cd47e79fb07cf14
- TLSH
  T1691100A9A20E220CAB733E4160D1849BE38A67A2434191ADE002D7590D4C4B7F7E9B63
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery execution
behavioral13 behavioral14

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Badlisted process makes network request

Command and Scripting Interpreter: PowerShell

Command and Scripting Interpreter: PowerShell

Loads dropped DLL

Drops file in System32 directory

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14